Data poisoning attack detection method, device, equipment, medium and product

Abstract

The embodiment of the invention provides a data poisoning attack detection method and device, equipment, a medium and a product, and relates to the technical field of artificial intelligence. The method comprises the following steps: preprocessing initial data in an obtained initial data set to obtain a preprocessed data set; reconstructing each piece of pre-processed data in the pre-processed data set to obtain reconstructed data of each piece of pre-processed data; based on each piece of pre-processed data and the reconstruction data of each piece of pre-processed data, a reconstruction error of each piece of pre-processed data is obtained through calculation; and determining the preprocessed data with the reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data. According to the invention, the recommendation information generation accuracy of the recommendation system is improved, and the user experience of the recommendation system can be improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology. More specifically, the embodiments of the present invention relate to a data poisoning attack detection method, device, equipment, medium and product. Background Art

[0002] This section is intended to provide a background or context to embodiments of the invention that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] In the modern information society, recommendation systems play a vital role and are widely used in many fields such as e-commerce and social media, providing users with a convenient channel for obtaining information. It can accurately recommend items of interest based on the user's historical interaction data, greatly improving the user experience. However, recommendation systems are extremely vulnerable to data poisoning attacks. Attackers can cleverly manipulate the learning process and recommendation decisions of the recommendation system by injecting false users or false data into the system to promote specific items or interfere with normal recommendations. This attack behavior will seriously damage the accuracy and fairness of the recommendation system, and also bring users a bad shopping experience and information acquisition experience. Summary of the invention

[0004] In this context, embodiments of the present invention are intended to provide a data poisoning attack detection method, apparatus, device, medium, and product.

[0005] In a first aspect of an embodiment of the present invention, a data poisoning attack detection method is provided, comprising:

[0006] Preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set;

[0007] Reconstructing each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data;

[0008] Based on each preprocessed data and the reconstructed data of each preprocessed data, a reconstruction error of each preprocessed data is calculated;

[0009] The preprocessed data whose reconstruction error is greater than a preset error threshold in the preprocessed data set is determined as abnormal data.

[0010] In one embodiment of this implementation, preprocessing the initial data in the acquired initial data set to obtain the preprocessed data set includes:

[0011] Performing redundancy processing on the initial data in the acquired initial data set to obtain a target data set; wherein the target data set includes a plurality of target data;

[0012] The target data in the target data set is normalized to obtain a preprocessed data set.

[0013] In one embodiment of this implementation manner, reconstructing a target preprocessed data in the preprocessed data set to obtain reconstructed data of the target preprocessed data includes:

[0014] Obtaining an encoding weight matrix and an encoding bias vector of a pre-built encoder, and a decoding weight matrix and a decoding bias vector of a pre-built decoder;

[0015] Encoding a target preprocessed data in the preprocessed data set based on the encoding weight matrix and the encoding bias vector to obtain encoded data;

[0016] The encoded data is reconstructed based on the decoding weight matrix and the decoding bias vector to obtain reconstructed data of the target preprocessed data.

[0017] In one embodiment of this implementation, the calculation formula of the reconstruction error of the target preprocessed data is:

[0018]

[0019] Among them, L i represents the reconstruction error of the target preprocessed data, N represents the number of preprocessed data in the preprocessed data set, and x i represents the target preprocessing data, Reconstructed data representing the target pre-processed data.

[0020] In one embodiment of this implementation, after determining the preprocessed data in the preprocessed data set whose reconstruction error is greater than a preset error threshold as abnormal data, the method further includes:

[0021] Determining a neighborhood set of the abnormal data from the preprocessed data set;

[0022] Determine a set of embedding vectors corresponding to the neighborhood set;

[0023] Calculating an average embedding vector of the set of embedding vectors;

[0024] Calculating the average embedding vector based on preset parameters to obtain Dirichlet distribution data;

[0025] Generate sample data based on the Dirichlet distribution data;

[0026] The abnormal data in the preprocessed data set is replaced with the sample data to obtain a normal data set.

[0027] In one embodiment of this implementation, the determining the neighborhood set of the abnormal data from the preprocessed data set includes:

[0028] Converting the format of the preprocessed data set to obtain a tree data structure data set;

[0029] Based on the tree data structure data set, calculating the current distance between each of the pre-processed data and the abnormal data;

[0030] Determine target preprocessed data whose current distance is less than a preset distance threshold in the preprocessed data;

[0031] A neighborhood set of the abnormal data is constructed based on the target preprocessed data.

[0032] In a second aspect of the embodiments of the present invention, a data poisoning attack detection device is provided, the device comprising:

[0033] A preprocessing unit, used for preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set;

[0034] A reconstruction unit, used to reconstruct each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data;

[0035] A calculation unit, configured to calculate a reconstruction error of each preprocessed data based on each preprocessed data and the reconstructed data of each preprocessed data;

[0036] The determination unit is used to determine the preprocessed data with a reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data.

[0037] In a third aspect of an embodiment of the present invention, a computing device is provided, comprising: at least one processor, a memory and an input-output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute any one of the methods described in the first aspect.

[0038] In a fourth aspect of the embodiments of the present invention, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes the method described in any one of the first aspects.

[0039] In a fifth aspect of the embodiments of the present invention, a computer program product is provided, comprising a computer program, which implements any one of the methods in the first aspect when executed by a processor.

[0040] According to the data poisoning attack detection method, device, equipment, medium and product of the embodiment of the present invention, it is possible to normalize the data so that data with different characteristics are at the same scale, and then reconstruct each preprocessed data in the preprocessed data set, and calculate the reconstruction error between the preprocessed data and the reconstructed data, so that the preprocessed data with a large reconstruction error can be determined as abnormal data. In this way, the abnormal data in the input initial data set can be accurately determined, ensuring that the system that recommends to users based on the initial data set can work more accurately, improving the accuracy of the recommendation system in generating recommendation information, and thus can also improve the user experience of the recommendation system users. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

[0042] Figure 1 A schematic diagram of a flow chart of a data poisoning attack detection method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the structure of a data poisoning attack detection device provided by an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of the structure of a medium according to an embodiment of the present invention is schematically shown;

[0045] Figure 4 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is schematically shown.

[0046] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0047] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0048] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0049] According to an embodiment of the present invention, a data poisoning attack detection method, device, equipment, medium and product are proposed.

[0050] It should be noted that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

[0051] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0052] Exemplary Methods

[0053] Reference below Figure 1 , Figure 1 This is a flow chart of a data poisoning attack detection method provided by an embodiment of the present invention. It should be noted that the embodiments of the present invention can be applied to any applicable scenario.

[0054] Figure 1 The process of the data poisoning attack detection method provided by an embodiment of the present invention shown includes:

[0055] Step S101 , preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set.

[0056] In the embodiment of the present invention, the initial data in the initial data set may be the user's behavior data acquired by the recommendation system, and the recommendation system may infer the content that the user likes to watch based on the acquired user's behavior data. It can be seen that the user's behavior data (i.e., the initial data) acquired by the recommendation system is crucial to the recommended content output by the recommendation system to the user.

[0057] In the embodiment of the present invention, preprocessing the initial data may include cleaning redundant data from the initial data and normalizing the initial data.

[0058] As an optional implementation manner, step S101 preprocesses the initial data in the acquired initial data set, and the method of obtaining the preprocessed data set may include:

[0059] Performing redundancy processing on the initial data in the acquired initial data set to obtain a target data set; wherein the target data set includes a plurality of target data;

[0060] The target data in the target data set is normalized to obtain a preprocessed data set.

[0061] In the embodiment of the present invention, the formula for normalizing the target data may be:

[0062]

[0063] Among them, X is the initial data, X min is the minimum initial data in the initial data set, X max is the maximum initial data in the initial data set, X normalized The pre-processed data obtained.

[0064] In this way, the initial data is mapped to the range of [0,1], thereby eliminating the dimensionality difference of the data.

[0065] Step S102, reconstructing each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data.

[0066] In the embodiment of the present invention, the preprocessed data can be reconstructed by a pre-built autoencoder, which may include an encoder and a decoder. The autoencoder needs to be trained in advance to obtain a better data reconstruction effect.

[0067] In an embodiment of the present invention, before training the autoencoder, it is necessary to obtain a training data set. The training data in the training data set is obtained from real-world data sets related to the recommendation system, such as the FilmTrust data set, ML-100K (MovieLens-100K) and ML-1M (MovieLens-1M). These data sets can be obtained on relevant open data platforms.

[0068] After that, the obtained training data set can be preprocessed. First, the training data of cold start users (with less than 15 ratings) that seriously affect the recommendation system in the training data set are filtered, and redundant training data are cleaned. Secondly, the commonly used minimum-maximum normalization method is used to process the training data set, and the training data set is mapped to a unified range (such as [0,1]) to obtain the target training data set.

[0069] After obtaining the target training data set, a simulated attack can be performed on the target training data set to obtain the target training data set after the attack. To simulate the attack on the target training data set, a variety of attack methods can be used, such as AUSH, Average, Random, PGA, TNA, Infmix, etc., to simulate the attacks that the recommendation system may suffer in actual scenarios. Assuming that the target training data set is D, in the simulated attack, some data values ​​in the target training data set are modified with a certain attack scale p to generate the target training data set X after the attack.

[0070] At this point, the autoencoder can be trained based on the attacked target training dataset X.

[0071] The encoder maps each training data x in the target training data set X = {x1, x2, x3, …} ∈ R n to the hidden layer representation h i ∈ R i (where m < n), and this process is achieved through a linear transformation:

[0072] h i = f(x i ) = σ(Wx i + b)

[0073] where W ∈ R m×n is the encoding weight matrix of the encoder, b ∈ R m is the encoding bias vector of the encoder, and σ is the activation function (i.e., the Sigmoid function).

[0074] The decoder reconstructs based on the hidden layer representations {h1, h2, h3, …} to obtain the output

[0075]

[0076] where W' ∈ R n×m is the decoding weight matrix of the decoder, b' ∈ R n is the decoding bias vector of the decoder, and σ' is the corresponding activation function.

[0077] During the training process of the autoencoder, the mean squared error (MSE) is used as the loss function to measure the reconstruction effect:

[0078]

[0079] where x i is the i-th sample of the original data, is the i-th sample of the reconstructed data, and N is the number of samples.

[0080] The parameters W, b, W', and b' are continuously adjusted through an optimization algorithm (such as the stochastic gradient descent algorithm) to minimize the loss function, thereby obtaining the optimal autoencoder model.

[0081] As an alternative implementation, the manner of reconstructing a target preprocessed data in the preprocessed data set in step S102 to obtain the reconstructed data of the target preprocessed data may include:

[0082] Obtain the encoding weight matrix and encoding bias vector of the pre-constructed encoder, and the decoding weight matrix and decoding bias vector of the pre-constructed decoder;

[0083] ​​Encoding a target preprocessed data in the preprocessed data set based on the encoding weight matrix and the encoding bias vector to obtain encoded data;

[0084] The encoded data is reconstructed based on the decoding weight matrix and the decoding bias vector to obtain reconstructed data of the target preprocessed data.

[0085] Step S103: based on each preprocessed data and the reconstructed data of each preprocessed data, a reconstruction error of each preprocessed data is calculated.

[0086] In the embodiment of the present invention, the calculation formula of the reconstruction error of the target preprocessed data is:

[0087]

[0088] Among them, L i represents the reconstruction error of the target preprocessed data, N represents the number of preprocessed data in the preprocessed data set, and x i represents the target preprocessing data, Reconstructed data representing the target pre-processed data.

[0089] Step S104: determining the preprocessed data with a reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data.

[0090] In the embodiment of the present invention, the preset error threshold can be determined by using percentile p to set the threshold, specifically:

[0091] Calculate the reconstruction error of each target training data in all existing target training data sets Assume that there are N reconstruction errors of target training data, denoted as L1, L2, …, L N .

[0092] Sort these reconstruction errors from small to large and get L (1) ,L (2) ,…,L (N) .

[0093] The position calculation formula of percentile p is: index = p × N;

[0094] Among them, if index is an integer, then the preset error threshold T of the pth percentile is L (index) and L (index+1) The average value; if index is not an integer, it is rounded up to Then the preset error threshold T of the pth percentile is

[0095] When the reconstruction error of a certain preprocessed data is greater than the preset error threshold, the data is considered to be abnormal data; otherwise, it is considered to be normal data.

[0096] As an optional implementation, after step S104, the following steps may also be included:

[0097] Determining a neighborhood set of the abnormal data from the preprocessed data set;

[0098] Determine a set of embedding vectors corresponding to the neighborhood set;

[0099] Calculating an average embedding vector of the set of embedding vectors;

[0100] Calculating the average embedding vector based on preset parameters to obtain Dirichlet distribution data;

[0101] Generate sample data based on the Dirichlet distribution data;

[0102] The abnormal data in the preprocessed data set is replaced with the sample data to obtain a normal data set.

[0103] As an optional implementation manner, a method of determining a neighborhood set of abnormal data from the preprocessed data set may include:

[0104] Converting the format of the preprocessed data set to obtain a tree data structure data set;

[0105] Based on the tree data structure data set, calculating the current distance between each of the pre-processed data and the abnormal data;

[0106] Determine target preprocessed data whose current distance is less than a preset distance threshold in the preprocessed data;

[0107] A neighborhood set of the abnormal data is constructed based on the target preprocessed data.

[0108] In the embodiment of the present invention, for a given preprocessed data set X=x1,x2,x3,…,x n , the preprocessed dataset X is constructed as a tree data structure dataset of KDTree tree data structure to facilitate fast distance query.

[0109] For the detected abnormal data x i , query other data points that are close to it through the tree data structure dataset.

[0110] Specifically, by setting a preset distance threshold ∈, find i ,x j )≤∈ data point x j, these points form x i The neighborhood set N(x i ).

[0111] Among them, d(x i ,x j ) represents x i and x j The distance between them can be calculated using metrics such as Euclidean distance.

[0112] For two points x in d-dimensional space, x=(x1, x2,…, x d ) and y=(y1,y2,…,y d ), the Euclidean distance is defined as:

[0113]

[0114] For the detected abnormal data x i The neighborhood set N(x i ), the corresponding embedding vector set is E = {e j |x j ∈N(x i )}, where e j is the data point x j The embedding vector of .

[0115] Calculate the convex hull of this embedding vector set. For the abnormal data x i , if the convex hull vertex exists, calculate its average embedding vector

[0116]

[0117] Where V is the set of convex hull vertices, and ensure that the elements in the average embedding vector are greater than a minimum value (e.g. 1e-10) to avoid numerical problems.

[0118] If the calculation of the convex hull fails, it may be because the data point does not meet the conditions for the existence of the convex hull. In this case, the embedding vectors of all neighborhood sets are directly used as the basis for calculating the average embedding vector.

[0119] The average embedding vector plus a preset parameter α (usually a positive number) is used as the parameter of the Dirichlet distribution data.

[0120] Dirichlet distribution data is a multivariate probability distribution. For the parameter vector α=(α1,α2,…,α n ), its probability density function is:

[0121]

[0122] Among them, x i ≥0, B(α) is the normalization constant, Γ(·) is the gamma function.

[0123] For each dimension l = 1, 2, ... d, we use the gamma distribution Gamma (a l ) Generate a random variable Y l The probability density function of the gamma distribution is:

[0124]

[0125] After generating gamma distributed random variables Y1, Y2, ...Y corresponding to all dimensions d Then, calculate the new sample vector x new Dimensions of:

[0126]

[0127] This gives us a new sample vector x new =(x new,1 ,x new,2 ,…,x new,d ), the sample data can be used to fill in the position of abnormal data.

[0128] The present invention can accurately determine abnormal data in the input initial data set, ensuring that the system that makes recommendations to users based on the initial data set can work more accurately, improving the accuracy of the recommendation system in generating recommendation information, and further improving the user experience of the recommendation system users.

[0129] Exemplary Devices

[0130] After introducing the method of the exemplary embodiment of the present invention, next, refer to Figure 2 A data poisoning attack detection device according to an exemplary embodiment of the present invention is described, and the device includes:

[0131] A preprocessing unit 201 is used to preprocess the initial data in the acquired initial data set to obtain a preprocessed data set;

[0132] A reconstruction unit 202, configured to reconstruct each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data;

[0133] A calculation unit 203, configured to calculate a reconstruction error of each preprocessed data based on each preprocessed data and the reconstructed data of each preprocessed data;

[0134] The determination unit 204 is configured to determine the preprocessed data with a reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data.

[0135] As an optional implementation, the preprocessing unit 201 preprocesses the initial data in the acquired initial data set, and the method of obtaining the preprocessed data set may be:

[0136] Performing redundancy processing on the initial data in the acquired initial data set to obtain a target data set; wherein the target data set includes a plurality of target data;

[0137] The target data in the target data set is normalized to obtain a preprocessed data set.

[0138] As an optional implementation manner, the reconstruction unit 202 reconstructs a target preprocessed data in the preprocessed data set, and a method of obtaining the reconstructed data of the target preprocessed data may be:

[0139] Obtaining an encoding weight matrix and an encoding bias vector of a pre-built encoder, and a decoding weight matrix and a decoding bias vector of a pre-built decoder;

[0140] Encoding a target preprocessed data in the preprocessed data set based on the encoding weight matrix and the encoding bias vector to obtain encoded data;

[0141] The encoded data is reconstructed based on the decoding weight matrix and the decoding bias vector to obtain reconstructed data of the target preprocessed data.

[0142] In the embodiment of the present invention, the calculation formula of the reconstruction error of the target preprocessed data is:

[0143]

[0144] Among them, L i represents the reconstruction error of the target preprocessed data, N represents the number of preprocessed data in the preprocessed data set, and x i represents the target preprocessing data, Reconstructed data representing the target pre-processed data.

[0145] As an optional implementation manner, the determining unit 204 is further configured to:

[0146] After determining the preprocessed data with a reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data, determining a neighborhood set of the abnormal data from the preprocessed data set;

[0147] Determine a set of embedding vectors corresponding to the neighborhood set;

[0148] Calculating an average embedding vector of the set of embedding vectors;

[0149] Calculating the average embedding vector based on preset parameters to obtain Dirichlet distribution data;

[0150] Generate sample data based on the Dirichlet distribution data;

[0151] The abnormal data in the preprocessed data set is replaced with the sample data to obtain a normal data set.

[0152] As an optional implementation manner, the determination unit 204 determines the neighborhood set of the abnormal data from the preprocessed data set in a manner that specifically can be:

[0153] Converting the format of the preprocessed data set to obtain a tree data structure data set;

[0154] Based on the tree data structure data set, calculating the current distance between each of the pre-processed data and the abnormal data;

[0155] Determine target preprocessed data whose current distance is less than a preset distance threshold in the preprocessed data;

[0156] A neighborhood set of the abnormal data is constructed based on the target preprocessed data.

[0157] The present invention can accurately determine abnormal data in the input initial data set, ensuring that the system that makes recommendations to users based on the initial data set can work more accurately, improving the accuracy of the recommendation system in generating recommendation information, and further improving the user experience of the recommendation system users.

[0158] Exemplary Media

[0159] After introducing the method and apparatus of the exemplary embodiment of the present invention, next, reference is made to Figure 3 For a description of a computer-readable storage medium according to an exemplary embodiment of the present invention, please refer to Figure 3, the computer-readable storage medium shown is a CD 30, on which a computer program (i.e., a program product) is stored. When the computer program is executed by the processor, the steps described in the above method implementation are implemented, for example, preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set; reconstructing each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data; calculating the reconstruction error of each preprocessed data based on each preprocessed data and the reconstructed data of each preprocessed data; determining the preprocessed data in the preprocessed data set whose reconstruction error is greater than a preset error threshold as abnormal data; the specific implementation method of each step will not be repeated here.

[0160] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0161] Exemplary Computing Devices

[0162] After introducing the method, apparatus and medium of the exemplary embodiments of the present invention, next, reference is made to Figure 4 A computing device for data poisoning attack detection according to an exemplary embodiment of the present invention.

[0163] Figure 4 A block diagram of an exemplary computing device 40 suitable for implementing embodiments of the present invention is shown, and the computing device 40 may be a computer system or a server. Figure 4 The computing device 40 shown is only an example and should not bring any limitation to the functionality and scope of use of the embodiments of the present invention.

[0164] like Figure 4 As shown, the components of the computing device 40 may include, but are not limited to: one or more processors or processing units 401, a system memory 402, and a bus 403 connecting different system components (including the system memory 402 and the processing unit 401).

[0165] The computing device 40 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computing device 40, including volatile and non-volatile media, removable and non-removable media.

[0166] System memory 402 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 4021 and / or cache memory 4022. Computing device 40 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, ROM 4023 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 is not shown in the Figure 4 As shown in FIG. 4 , a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 403 via one or more data medium interfaces. System memory 402 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of various embodiments of the present invention.

[0167] A program / utility 4025 having a set (at least one) of program modules 4024 may be stored, for example, in system memory 402, and such program modules 4024 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 4024 generally perform the functions and / or methods of the embodiments described herein.

[0168] The computing device 40 may also communicate with one or more external devices 404 (e.g., a keyboard, a pointing device, a display, etc.). Such communication may be performed via an input / output (I / O) interface 405. Furthermore, the computing device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 406. Figure 4 As shown, the network adapter 406 communicates with other modules (such as the processing unit 401, etc.) of the computing device 40 via the bus 403. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with computing device 40 .

[0169] The processing unit 401 executes various functional applications and data processing by running the program stored in the system memory 402, for example, preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set; reconstructing each preprocessed data in the preprocessed data set to obtain the reconstructed data of each preprocessed data; calculating the reconstruction error of each preprocessed data based on each preprocessed data and the reconstructed data of each preprocessed data; determining the preprocessed data in the preprocessed data set whose reconstruction error is greater than the preset error threshold as abnormal data. The specific implementation of each step is not repeated here. It should be noted that although several units / modules or sub-units / sub-modules of the data poisoning attack detection device are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units / modules described above can be concretized in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be concretized.

[0170] In the description of the present invention, it should be noted that the terms “first”, “second” and “third” are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0171] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0172] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0173] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0174] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0175] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0176] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

[0177] In addition, although the operations of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0178] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

Claims

1. A data poisoning attack detection method, characterized in that: The method comprises: Preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set; Reconstructing each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data; Based on each preprocessed data and the reconstructed data of each preprocessed data, a reconstruction error of each preprocessed data is calculated; The preprocessed data whose reconstruction error is greater than a preset error threshold in the preprocessed data set is determined as abnormal data.

2. The data poisoning attack detection method according to claim 1, characterized in that: The preprocessing of the initial data in the acquired initial data set to obtain the preprocessed data set includes: Performing redundancy processing on the initial data in the acquired initial data set to obtain a target data set; wherein the target data set includes a plurality of target data; The target data in the target data set is normalized to obtain a preprocessed data set.

3. The data poisoning attack detection method according to claim 1, characterized in that: The reconstructing a target preprocessed data in the preprocessed data set to obtain reconstructed data of the target preprocessed data includes: Obtaining an encoding weight matrix and an encoding bias vector of a pre-built encoder, and a decoding weight matrix and a decoding bias vector of a pre-built decoder; Encoding a target preprocessed data in the preprocessed data set based on the encoding weight matrix and the encoding bias vector to obtain encoded data; The encoded data is reconstructed based on the decoding weight matrix and the decoding bias vector to obtain reconstructed data of the target preprocessed data.

4. The data poisoning attack detection method according to claim 3, characterized in that: The calculation formula of the reconstruction error of the target preprocessed data is: Among them, L i represents the reconstruction error of the target preprocessed data, N represents the number of preprocessed data in the preprocessed data set, and x i represents the target preprocessing data, Reconstructed data representing the target pre-processed data.

5. The data poisoning attack detection method according to any one of claims 1 to 4, characterized in that: After determining the preprocessed data in the preprocessed data set whose reconstruction error is greater than a preset error threshold as abnormal data, the method further includes: Determining a neighborhood set of the abnormal data from the preprocessed data set; Determine a set of embedding vectors corresponding to the neighborhood set; Calculating an average embedding vector of the set of embedding vectors; Calculating the average embedding vector based on preset parameters to obtain Dirichlet distribution data; Generate sample data based on the Dirichlet distribution data; The abnormal data in the preprocessed data set is replaced with the sample data to obtain a normal data set.

6. The data poisoning attack detection method according to claim 5, characterized in that: The step of determining a neighborhood set of the abnormal data from the preprocessed data set comprises: Converting the format of the preprocessed data set to obtain a tree data structure data set; Based on the tree data structure data set, calculating the current distance between each of the pre-processed data and the abnormal data; Determine target preprocessed data whose current distance is less than a preset distance threshold in the preprocessed data; A neighborhood set of the abnormal data is constructed based on the target preprocessed data.

7. A data poisoning attack detection device, characterized in that: The device comprises: A preprocessing unit, used for preprocessing the initial data in the acquired initial data set to obtain a preprocessed data set; A reconstruction unit, used to reconstruct each preprocessed data in the preprocessed data set to obtain reconstructed data of each preprocessed data; A calculation unit, configured to calculate a reconstruction error of each preprocessed data based on each preprocessed data and the reconstructed data of each preprocessed data; The determination unit is used to determine the preprocessed data with a reconstruction error greater than a preset error threshold in the preprocessed data set as abnormal data.

8. A computing device, comprising: at least one processor, memory, and input-output unit; The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium comprising instructions, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images