Molecular pre-training model-oriented data stealing risk assessment method and system

Abstract

The invention discloses a molecular pre-training model-oriented data stealing risk assessment method and system, and belongs to the field of graph structure data processing. Obtaining a to-be-evaluated molecular pre-training model and a corresponding molecular training set; training a learnable molecular scoring function by adopting an auxiliary training set of the same type as the molecular training set; a molecule generation module based on reinforcement learning generates a molecule candidate set potential in a molecule training set; and a final molecular set is screened out from the molecular candidate set by using the trained molecular scoring function, the data stealing risk of the molecular pre-training model is evaluated according to the similarity between the final molecular set and the molecular training set, and the higher the similarity is, the higher the data stealing risk of the model is. The invention provides the training data extraction method of the molecular pre-training model and is used for data stealing risk assessment of the model, the extraction efficiency is improved by utilizing reinforcement learning, and meanwhile, the proposed scoring function is irrelevant to the model, so that the method has wide applicability and relatively high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of graph structure data processing, and in particular to a data theft risk assessment method and system for a molecular pre-training model. Background Art

[0002] Graph Neural Networks (GNNs) have greatly advanced the field of drug discovery, increasing the speed and efficiency of developing molecules. However, training these GNNs requires a large amount of molecular data, which has prompted the emergence of collaborative model sharing initiatives. These initiatives promote the sharing of molecular pre-trained models between organizations without exposing proprietary training data. Despite this, these molecular pre-trained models may still pose privacy risks. For example, malicious adversaries can perform data extraction attacks to recover private training data, threatening trade secrets and collaborative trust.

[0003] This task is complicated by the fact that molecular pre-trained models are non-generative and have multiple model architectures, which is very different from language and image models. Previous research has conducted a lot of work on data extraction attacks in the image and text fields, which can extract training data from pre-trained models by continuously querying the pre-trained models with the help of memory mechanisms. However, these methods are not applicable to molecular pre-trained models. Most existing data extraction attacks target generative models in the text and image fields (e.g., transformer models and diffusion models), while most molecular pre-trained models are not generative, and it is very difficult to generate training data through queries. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a data theft risk assessment method and system for a molecular pre-training model.

[0005] The present invention adopts the following technical solution:

[0006] In a first aspect, the present invention proposes a data theft risk assessment method for a molecular pre-training model, comprising:

[0007] Obtain the molecular pre-training model to be evaluated and its corresponding molecular training set;

[0008] training a learnable molecular scoring function using an auxiliary training set of the same type as the molecular training set;

[0009] A molecule generation module based on reinforcement learning generates a molecule candidate set potentially in a molecule training set. In the reinforcement learning training of the molecule generation module, a reinforcement learning reward function is designed based on a trained molecule scoring function.

[0010] The trained molecular scoring function is used to screen out a final molecular set from the molecular candidate set, and the data theft risk of the molecular pre-training model is evaluated according to the similarity between the final molecular set and the molecular training set. The higher the similarity, the greater the data theft risk of the molecular pre-training model.

[0011] Furthermore, the molecular pre-training model is a graph neural network.

[0012] Furthermore, the learnable molecular scoring function is:

[0013]

[0014] in, Represents molecules The score, M t They are respectively The molecules and primitives obtained by splitting, g θ 、h φ They represent the learnable mapping function, f(.) represents the molecular pre-training model, g θ °f(.) indicates that the characterization result output by the molecular pre-training model is mapped using the mapping function g θ Projected into another representation space, α represents the hyperparameter modeled as a learnable one, and Sim(.) represents the similarity.

[0015] Furthermore, the method of using an auxiliary training set of the same type as the molecular training set to train a learnable molecular scoring function comprises:

[0016] Acquire an auxiliary training set of the same type as the molecular training set;

[0017] Splitting the molecules in the auxiliary training set and the molecules in the non-auxiliary training set into new molecules and primitives through one or more steps, extracting representations of the molecules before the splitting and the molecules and primitives after the splitting respectively using the molecular pre-training model, and calculating the scores using the molecular scoring function according to the characterization results;

[0018] The mapping function in the numerator scoring function is trained based on the scores.

[0019] Further, the process of training the mapping function in the molecular scoring function according to the scoring is expressed as:

[0020]

[0021] in, Indicates that if the molecule before splitting is in the auxiliary training set, the sigmoid result of the score is 1, sigmoid represents the activation function, otherwise the sigmoid result of the score is 0, and CE(.) represents the cross-entropy loss function (Cross-Entropy);

[0022] The parameters {θ, φ} of the mapping function are obtained by minimizing the above results.

[0023] Furthermore, the step of using the molecule generation module to generate a candidate set of molecules potentially in the molecule training set includes:

[0024] Given a set of template structures and a primitive library, the template structures and primitive library refer to templates and primitives used to construct molecular structures;

[0025] Select a template structure R as a starting point, and select a primitive M from the primitive library. Under the condition of satisfying chemical constraints, a bond B = {a R ,a M}, where a R and a M represents the attachment points in R and M respectively; as the union of R, M and bond B, the molecule is generated based on the result of chemical bonding Expressed as

[0026] In the next generation step, As a new starting point, select other primitives and bonds and update the molecule;

[0027] By repeating the generation process, a potential molecule that may exist in the training data set of the molecular pre-training model is gradually constructed according to the preset number of generation steps;

[0028] Traverse the template structure and generate a batch of molecular candidate sets.

[0029] Furthermore, in the reinforcement learning process of the molecule generation module, the state space, action space and reward function are defined as follows:

[0030] State space: Let the state at time step t be S t , defined as the molecular graph generated at time step t Initial state represents the template structure R, which serves as the starting point of the molecule generation process;

[0031] Action space: At time step t, the action consists of three stages: (1) Select the attachment location (2) Select a primitive M from the primitive library t ; (3) In M tSelect the attachment location To form bond B t ; The action of step t is expressed as

[0032] Reward function: The trained numerator score function is used as the delayed reward, and the reward function is designed considering the weights between steps.

[0033] Furthermore, the reward function formula is as follows:

[0034]

[0035] Among them, r(.) represents the reward function, β i Represents the weight of time step i, Score {θ,φ} represents the molecular scoring function, t represents the time step t, Respectively represent the molecules generated at time steps i and i-1, M i Represents the primitive selected at time step i.

[0036] In a second aspect, the present invention proposes a data theft risk assessment system for a molecular pre-training model, which is used to implement the above-mentioned data theft risk assessment method.

[0037] The present invention has the following beneficial effects:

[0038] The present invention explores for the first time the risk of extracting private training molecular data from molecular pre-training models, and proposes a scoring function that is independent of the pre-training model for selecting molecules that may exist in the training data set. The present invention first generates molecular candidates within a given chemical constraint by combining a defined template structure, a primitive library, and a bond connection method. With these molecular candidates, a novel scoring function is further introduced to determine whether the potential molecule belongs to the training data of the pre-training model. This scoring function is model-independent and can be applied to the architecture of various molecular pre-training models. In order to further reduce the search space of molecules, the present invention introduces a molecular generation model based on reinforcement learning, which can be used to generate molecules with high scores. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of a data theft risk assessment method for a molecular pre-training model provided by the present invention. DETAILED DESCRIPTION

[0040] The present invention is further described below in conjunction with the accompanying drawings and embodiments. The accompanying drawings are only schematic diagrams of the present invention, and some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities, and these functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0041] The goal of the present invention is to extract private training molecule data based on a molecular pre-training model for risk assessment of the molecular pre-training model. Specifically, the present invention is designed to first generate a possible candidate set of training molecules based on a molecule generation module based on reinforcement learning, and then input the generated candidate set of training molecules into the molecular pre-training model to obtain a pre-trained representation of the molecule, and then input the pre-trained representation of the molecule into a scoring module for scoring, and then select molecules with high scores as the final output, that is, the extracted training data of the molecular pre-training model, and finally evaluate the data theft risk of the molecular pre-training model based on the similarity between the extracted molecular set and the training set used to train the molecular pre-training model.

[0042] Figure 1 The overall framework of the present invention is shown, which can be divided into four modules: a molecule generation module based on reinforcement learning, a molecule pre-training model, a molecule scoring module, and a risk assessment module.

[0043] 1. Molecular generation module based on reinforcement learning:

[0044] Molecular generation first needs to consider the three key elements of constructing molecular data: template structure, primitive library and bond connection method; therefore, a set of template structures and a primitive library need to be given.

[0045] Before generating a molecule, it is necessary to set an effective starting point for synthesis for the molecule, which is called a template structure. The template structure is usually a functional and common molecular structure. Since existing studies generally emphasize the key role of ring structures in molecules, and rings are usually used as functional structures of molecules, in view of their importance, in this embodiment, rings are selected as template structures. On the selected template structure as the starting point for molecule generation, commonly used molecular building blocks can be attached in turn to generate new molecules. The primitive library contains the common building blocks of molecules, which are called primitives.

[0046] The present invention selects a template structure R as a starting point and selects a primitive M from a primitive library. Under the condition of satisfying chemical constraints, a bond B={a R ,a M}, where a R and a MRepresent the attachment points in R and M respectively. As the union of R, M and bond B, the molecule is generated based on the chemical bonding result. It can be expressed as In the subsequent generation step, the present invention will As a new starting point, other primitives and bonds are selected, and the molecule is updated. By repeating this process, a potential molecule that may exist in the training data set of the molecular pre-training model is gradually constructed according to the preset number of generation steps.

[0047] The present invention introduces a strategy network based on reinforcement learning for generating potential molecules. One of the most direct generation methods is to enumerate all possible molecules, and use a molecular scoring function to sort them and select the molecules with the highest scores. However, the number of feasible combinations is extremely large, and this method will lead to an exponential growth in algorithmic complexity. Considering that the molecular generation process involves sequential selection of template structures and primitives to form bonds, this is consistent with the Markov decision process framework, on which the present invention is based, that is, each decision is based on the current state and deterministically leads to a new state. This sequential decision attribute allows structured exploration of the molecular space. Therefore, the present invention proposes a molecular synthesis strategy network (i.e., a molecular generation module) to significantly reduce the search space of molecules, which strategically guides the selection of primitives and attachment points, focusing on the options that are most likely to produce molecules.

[0048] In a specific implementation of the present invention, reinforcement learning requires definition of state space, action space and reward function design, as follows:

[0049] State space. The state at time step t is denoted as S t , defined as the molecular graph generated at time step t Initial state Represents the template structure R, which serves as the starting point for the molecule generation process.

[0050] Action space. At time step t, the reinforcement learning agent selects a primitive M from the primitive library t , and determine the best attachment position So we get the updated picture More specifically, the action of step t includes three stages: (1) Select the attachment location Select a primitive M from the primitive library t ; (3) In M t Select the attachment location To form bond B t In summary, the action of step t can be expressed as

[0051]

[0052] Reward function design. The present invention uses delayed rewards and intermediate rewards to guide molecule generation. For delayed rewards, a molecular scoring function is used as a reward, and the weights between steps are considered. The reward function formula is as follows:

[0053]

[0054] Among them, r(.) represents the reward function, β i Represents the weight of time step i, Score {θ,φ} represents the scoring function, θ and φ represent the trainable parameters in the scoring function.

[0055] Based on the above reinforcement learning method, a template structure can generate a potential molecule that may exist in the training data set of the molecular pre-training model. A set of candidate training molecules can be generated by traversing a preset set of template structures.

[0056] 2. Molecular Pre-training Model

[0057] The training molecule candidate set generated by the reinforcement learning-based molecule generation module is input into the molecule pre-training model to obtain the pre-trained representation of each molecule in the molecule candidate set.

[0058] In a specific implementation of the present invention, the molecular pre-training model is a graph neural network, which is used to extract the molecular representation. In downstream tasks, the graph neural network can be further trained to achieve the purpose of predicting molecular properties. The present invention does not limit downstream tasks.

[0059] 3. Molecular Scoring Function

[0060] The present invention proposes a molecular scoring function for determining The probability of existence in the training data set G of the molecular pre-training model, the scoring function of the present invention is independent of any specific model architecture or pre-training task. Since the attacker can only query the molecular pre-training model to obtain the representation, taking the molecule generated in one step as an example, the representation of the template structure R extracted based on the pre-training model f, the representation of the primitive M and its structure combined with the bond B There should be a certain relationship between the representations. The scoring function is defined as follows:

[0061]

[0062] Among them, α is a hyperparameter in the range [0,1], f(R) and f(M) are R and M are representations, while Sim(·,·) can be defined as cosine similarity or inner product. Based on observation, when the value of the scoring function is high, the molecule is more likely to appear in the training dataset.

[0063] Similarly, for molecular structures generated in steps t, t>1, we only need to replace Replace with R is replaced by M is replaced by M t .

[0064] During the training of the scoring function, an adapter g is introduced θ In this embodiment, a multi-layer perceptron (MLP) with learnable parameters θ is used. This adapter aims to project the representation obtained by the pre-trained model f into another representation space that is more conducive to promoting graph extraction attacks. By mapping g θ °f(·)=g θ (f(·)) realizes the transformation of representation, g θ °f(·) represents the projection of the representation obtained by the pre-trained model f into another representation space. α is modeled as The function is used to optimize α in response to the changing context. Finally, the scoring function is converted into a learnable form:

[0065] Among them, h φ , g θ Both represent trainable projection functions, Represents molecules The score of , Sim(·,·) can be defined as cosine similarity or inner product.

[0066] The training of the above scoring function requires the introduction of auxiliary dataset G aux , using the auxiliary dataset G aux The information contained in the graph is used to learn the parameters {θ, φ}. If the scoring function parameterized by {θ, φ} can effectively determine the graph In G aux If there is a existence in , then the model can also be extended to the private training dataset G. The process of training the scoring function can be described as:

[0067]

[0068] The auxiliary training set should be similar to the training set samples of the pre-trained molecular model. Generally, if the target task of the pre-trained molecular model is to predict the properties of benzene ring molecules, the molecules in the training set and the auxiliary training set should all belong to benzene ring molecules.

[0069] When training the scoring function using the auxiliary training set, the molecules in the auxiliary dataset and the molecules in the non-auxiliary training set are combined. Split into and primitive M t ,Will M t Input molecule pre-trained model to generate representation f(M t ), the generated representation is projected using the projection function g θ Projected into another representation space, and then calculated by the α function Finally, the cosine similarity or inner product of the two is calculated as the final score If the molecule exists in the auxiliary dataset, the score is 1, that is, Otherwise, it is 0. The parameters {θ, φ} are obtained through this training. The trained scoring function is used in the reinforcement learning process of the molecule generation module. In the generation phase after the training is completed, a set of training molecule candidate sets is first generated by the molecule generation module, and then the trained scoring function is used for the final screening to generate the final potential molecules. The final screening can be based on the score threshold screening method, that is, molecules above the score threshold are selected, or based on the ratio screening method, that is, molecules with the top percentile scores are selected.

[0070] 4. Risk Assessment Module

[0071] The similarity (e.g., cosine similarity) between the screened potential molecule set and the training set of the pre-trained model is calculated. The higher the similarity, the greater the risk of data theft of the molecular pre-trained model.

[0072] This embodiment verifies the implementation effect of the present invention through a specific experiment.

[0073] 1. Data Description

[0074] The dataset used in this experiment includes a dataset of 2 million molecules extracted from the ZINC15 commercial compound database as the pre-training dataset G, and an additional 20,000 molecules extracted as the auxiliary dataset G aux .

[0075] 2. Description of Molecular Pre-training Model

[0076] The most widely used molecular pre-trained models in each category are selected to demonstrate the versatility of the proposed method. These methods include: (1) Contrastive learning: GraphCL, SimGRACE, InfoGraph; (2) Graph reconstruction: GraphMAE, AttrMasking, EdgePred, Mole-BERT; (3) Context prediction: ContextPred, Grover. It is worth noting that the encoder architecture of Mole-BERT and Grover is based on the Transformer or BERT structure, and all molecular pre-trained models are trained using the default hyperparameters specified in the original papers.

[0077] 3. Evaluation Metrics

[0078] If the graph G generated by the present invention adv exists in G, or G adv Similar to G, then the molecular graph extraction attack is considered successful. So assuming that the model has generated G containing K molecules adv , this experiment uses the following metrics to measure the performance of the extraction attack: (1) Precision measures the proportion of the generated molecules that exist in G. The higher the precision, the better the performance of the molecule extraction attack. (2) FCD, also known as Fréchet ChemNet Distance, provides a adv This metric uses the ChemNet model to capture the differences in the chemical and biological properties of molecules. The lower the FCD value, the closer the G and G adv The more similar they are in chemical and biological properties, this indicates better extraction performance.

[0079] 4. Comparative Experiment

[0080] The experiment uses existing chemical property-based methods and learning-based methods for comparison. For chemical property-based methods, the experiment compares the QED score, a common indicator for predicting the drug potential of molecules. In addition, the SA (synthetic accessibility) score is also considered to measure the rationality of the molecule. The experiment also introduces the docking score (FA7, PARP-1 and 5-HT1B) as a scoring function baseline. For learning-based methods, the experiment uses an MLP classifier to predict in G. This classifier is based on The representation prediction G aux The test results are shown in Table 1:

[0081] Table 1

[0082]

[0083] Table 1 shows the superior performance of the model of the present invention compared to the baseline on various molecular pre-training models (the molecular pre-training models used are in brackets). Methods based on chemical attributes usually perform poorly, which may be due to the low frequency of occurrence of the target attribute in the pre-training dataset (such as QED). The better performance of SA suggests that molecular stability may be an important indicator of the presence of molecules in the actual dataset. Obviously, the reinforcement learning method of the present invention significantly outperforms the MLP method in terms of accuracy and FCD, with an average improvement of 30.9% and 3.97% on multiple pre-training models, respectively, highlighting the effectiveness of the present invention in revealing risks.

[0084] It can also be observed from the table that, among the molecular pre-training models, AttrMasking is most susceptible to privacy leakage and has a higher risk. In addition, the performance of the method of the present invention under different model frameworks is compared, and it consistently successfully performs molecular graph extraction on various pre-training model architectures, including models based on BERT or Transformers.

[0085] In the present embodiment, a data theft risk assessment system for a molecular pre-training model is also provided, which is used to implement the above-mentioned embodiment, and the description thereof will not be repeated. The terms "module", "unit", etc. used below can implement a combination of software and / or hardware of a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible.

[0086] The system comprises:

[0087] A data acquisition module, which is used to obtain the molecular pre-training model to be evaluated and its corresponding molecular training set;

[0088] A molecular scoring function training module, which is used to train a learnable molecular scoring function using an auxiliary training set of the same type as the molecular training set;

[0089] A candidate molecule generation module, which is used to generate a candidate set of molecules potentially in a molecule training set based on a molecule generation module of reinforcement learning. In the reinforcement learning training of the molecule generation module, a reward function of reinforcement learning is designed based on the trained molecule scoring function. In this embodiment, in the reinforcement learning training of the molecule generation module, the trained molecule scoring function is used as a delayed reward, and the reward function is designed by considering the weights between steps.

[0090] A candidate molecule screening module, which is used to screen out a final molecule set from a molecule candidate set using a trained molecule scoring function;

[0091] The risk assessment module is used to assess the data theft risk of the molecular pre-training model according to the similarity between the final molecular set and the molecular training set. The higher the similarity, the greater the data theft risk of the molecular pre-training model.

[0092] The implementation process of the functions and effects of each module in the above-mentioned system is specifically detailed in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here. For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0093] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0094] Obviously, the above-described embodiments and drawings are only some examples of the present application. For those of ordinary skill in the art, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that, although the work done in this development process may be complicated and lengthy, for those of ordinary skill in the art, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application. Without departing from the concept of the present application, several variations and improvements can also be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A data theft risk assessment method for molecular pre-training models, characterized in that: include: Obtain the molecular pre-training model to be evaluated and its corresponding molecular training set; training a learnable molecular scoring function using an auxiliary training set of the same type as the molecular training set; A molecule generation module based on reinforcement learning generates a molecule candidate set potentially in a molecule training set. In the reinforcement learning training of the molecule generation module, a reinforcement learning reward function is designed based on a trained molecule scoring function. The trained molecular scoring function is used to screen out a final molecular set from the molecular candidate set, and the data theft risk of the molecular pre-training model is evaluated according to the similarity between the final molecular set and the molecular training set. The higher the similarity, the greater the data theft risk of the molecular pre-training model.

2. The data theft risk assessment method for molecular pre-training models according to claim 1 is characterized in that: The molecular pre-training model is a graph neural network.

3. The data theft risk assessment method for molecular pre-training models according to claim 1 is characterized in that: The learnable molecular scoring function is: in, Represents molecules The score, M t They are respectively The molecules and primitives obtained by splitting, g θ 、h φ They represent the learnable mapping function, f(.) represents the molecular pre-training model, g θ °g(.) means that the characterization results output by the molecular pre-training model are mapped using the mapping function g θ Projected into another representation space, α represents the modeling as a learnable parameter and Sim(.) represents the similarity.

4. The data theft risk assessment method for molecular pre-training models according to claim 3 is characterized in that: The method of using an auxiliary training set of the same type as the molecular training set to train a learnable molecular scoring function comprises: Acquire an auxiliary training set of the same type as the molecular training set; Splitting the molecules in the auxiliary training set and the molecules in the non-auxiliary training set into new molecules and primitives through one or more steps, extracting representations of the molecules before the splitting and the molecules and primitives after the splitting respectively using the molecular pre-training model, and calculating the scores using the molecular scoring function according to the characterization results; The mapping function in the numerator scoring function is trained based on the scores.

5. The data theft risk assessment method for molecular pre-training models according to claim 4 is characterized in that: The process of training the mapping function in the molecular scoring function according to the scoring is expressed as: in, Indicates that if the molecule before splitting is in the auxiliary training set, the sigmoid result of the score is 1, sigmoid represents the activation function, otherwise the sigmoid result of the score is 0, CE(.) represents the cross entropy loss function; The parameters {θ, φ} of the mapping function are obtained by minimizing the above results.

6. The data theft risk assessment method for molecular pre-training models according to claim 1 is characterized in that: The steps of using the molecule generation module to generate a set of potential molecule candidates in the molecule training set include: Given a set of template structures and a primitive library, the template structures and primitive library refer to templates and primitives used to construct molecular structures; Select a template structure R as a starting point, and select a primitive M from the primitive library. Under the condition of satisfying chemical constraints, a bond B = {a R ,a M }, where a R and a M represents the attachment points in R and M respectively; as the union of R, M and bond B, the molecule is generated based on the result of chemical bonding Expressed as In the next generation step, As a new starting point, select other primitives and bonds and update the molecule; By repeating the generation process, a potential molecule that may exist in the training data set of the molecular pre-training model is gradually constructed according to the preset number of generation steps; Traverse the template structure and generate a batch of molecular candidate sets.

7. The data theft risk assessment method for molecular pre-training models according to claim 6 is characterized in that: In the reinforcement learning process of the molecule generation module, the state space, action space and reward function are defined as follows: State space: Let the state at time step t be S t , defined as the molecular graph generated at time step t Initial state represents the template structure R, which serves as the starting point of the molecule generation process; Action space: At time step t, the action consists of three stages: (1) Select the attachment location (2) Select a primitive M from the primitive library t ; (3) In M t Select the attachment location To form bond B t ; The action of step t is expressed as Reward function: The trained numerator score function is used as the delayed reward, and the reward function is designed considering the weights between steps.

8. The data theft risk assessment method for molecular pre-training models according to claim 7 is characterized in that: The reward function formula is as follows: Among them, r(.) represents the reward function, β i Represents the weight of time step i, Score {θ,φ} represents the molecular scoring function, t represents the time step t, Respectively represent the molecules generated at time steps i and i-1, M i Represents the primitive selected at time step i.

9. A data theft risk assessment system for a molecular pre-training model, used to implement the data theft risk assessment method of claim 1, characterized in that: The system comprises: A data acquisition module, which is used to obtain the molecular pre-training model to be evaluated and its corresponding molecular training set; A molecular scoring function training module, which is used to train a learnable molecular scoring function using an auxiliary training set of the same type as the molecular training set; A candidate molecule generation module, which is used to generate a molecule candidate set potentially in a molecule training set based on a molecule generation module of reinforcement learning, wherein in the reinforcement learning training of the molecule generation module, a reward function of reinforcement learning is designed based on the trained molecule scoring function; A candidate molecule screening module, which is used to screen out a final molecule set from a molecule candidate set using a trained molecule scoring function; The risk assessment module is used to assess the data theft risk of the molecular pre-training model according to the similarity between the final molecular set and the molecular training set. The higher the similarity, the greater the data theft risk of the molecular pre-training model.

10. The data theft risk assessment system for molecular pre-training models according to claim 1, characterized in that: In the reinforcement learning training of the molecule generation module, the trained molecule scoring function is used as the delayed reward, and the reward function is designed considering the weights between steps.

Images