Poison detection method and device based on machine learning training data

Abstract

The invention discloses a poisoning detection method and device based on machine learning training data. The method comprises the following steps: acquiring training data; the training data are input into the trained quantum neural network for malicious data prediction, a prediction result is obtained, the prediction result is whether the training data are malicious data or not, and a training method of the trained quantum neural network comprises the steps that a training data sample set is obtained; selecting a plurality of sample data from the training data sample set and inputting the sample data into the initial quantum neural network, so that the initial quantum neural network predicts each sample data to obtain an initial prediction result, and then performing network parameter updating on the initial quantum neural network by using a quantum annealing technology to obtain an updated quantum neural network; according to the method, the quantum neural network is updated, weight parameter iteration is carried out on the updated quantum neural network with loss minimization as a target, the trained quantum neural network is obtained, and the detection effect on malicious data is enhanced through the quantum neural network obtained through the method.

Description

Technical Field

[0001] The present invention relates to the technical field of machine learning, and in particular to a method and device for detecting poisoning of machine learning training data. Background Art

[0002] With the widespread application of machine learning technology, especially in the field of big data and deep learning, the data sources for model training are becoming increasingly diverse, which also brings serious security issues, especially data poisoning attacks. Data poisoning is a highly concealed and extremely destructive attack method. Attackers insert malicious data into training data to interfere with the performance of machine learning models, causing the model to misclassify or make bad decisions. For example, studies have shown that poisoning attacks can affect the decision boundary of the model by slightly modifying specific samples or categories, causing misclassification of target samples during the test phase.

[0003] Traditional data poisoning defense methods are usually based on statistical analysis or techniques for detecting abnormal data points. These methods rely on a key assumption that the system has a clean and sufficiently large basic data set. However, as attack methods become increasingly complex and covert, this assumption often no longer holds true. Modern poisoning attack methods are able to make subtle and covert modifications to the data, making it difficult to distinguish abnormal data from normal data. In addition, these traditional methods exhibit significant computational bottlenecks when processing large-scale data sets. For example, although neural network methods based on backpropagation can effectively detect and filter abnormal data in some cases, they usually have high computational complexity and cannot meet the needs of real-time processing of large-scale data. Some machine learning-based methods, such as distance to class center (DCM) and meta-learning-based Meta-Sift methods, detect data poisoning by using statistical features. However, these methods still show certain limitations when facing complex and covert poisoning attacks. For example, DCM performs poorly in the case of high poisoning rates, and although Meta-Sift can provide better detection accuracy in some cases, it often takes a lot of computing time and computing resources for poisoning attacks with large data volumes. Summary of the invention

[0004] In order to solve the above technical problems, an embodiment of the present invention provides a method and device for detecting poisoning of machine learning training data, so as to solve the problem of low detection accuracy in the prior art when performing data poisoning detection in the face of large-scale data sets and complex attacks.

[0005] A first aspect of an embodiment of the present invention provides a method for detecting poisoning of machine learning training data, the method comprising:

[0006] Get training data;

[0007] The training data is input into the trained quantum neural network to predict malicious data and obtain a prediction result, wherein the prediction result is whether the training data is malicious data. The training method of the trained quantum neural network is:

[0008] Selecting multiple sample data from the training data sample set and inputting them into the initial quantum neural network, so that the initial quantum neural network predicts each sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set;

[0009] Reselecting a plurality of new first sample data from the training data sample set and inputting them into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain an optimal solution, updating the network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters;

[0010] Continue to select multiple new second sample data from the training data sample set and input them into the updated quantum neural network for prediction to obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result using the first difference metric and the second difference metric, and update the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initially trained quantum neural network;

[0011] The initially trained quantum neural network is used to predict the selected multiple new third sample data to obtain new prediction results, and the initially trained quantum neural network is updated based on the deviation value obtained from the new prediction results and the initial prediction results to obtain a trained quantum neural network.

[0012] In a possible implementation manner of the first aspect, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is:

[0013]

[0014] Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the network parameter-the loss function on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0015] In a possible implementation manner of the first aspect, mapping the encoded data to a problem model of a quantum annealer to perform a quantum annealing operation to obtain an optimal solution includes:

[0016] Perform quantum state evolution according to the encoded data to obtain the current quantum state;

[0017] The energy value of the current quantum state is calculated using the energy function, and the gradient of the energy value to the network parameters in the initial quantum neural network is calculated;

[0018] The network parameters are updated according to the gradient to obtain the initial updated network parameters, and then the quantum state evolution is performed according to the encoded data to obtain the current quantum state step and continue to update the network parameters until the preset number of iterations is reached to obtain the optimal solution.

[0019] In a possible implementation manner of the first aspect, calculating the energy value of the current quantum state by using the energy function includes:

[0020] The energy value of the current quantum state is calculated using the energy function, where the energy function is:

[0021]

[0022] Where E is the energy value, J ij is the coupling strength, h i is the external magnetic field, σ i is the spin state, is the difference measure, in the base state, The value of is 0, indicating that the neural network evolves freely to the ground state; when the stimulus is introduced, or

[0023] In a possible implementation manner of the first aspect, calculating the gradient of the energy value with respect to the network parameters in the initial quantum neural network includes:

[0024] Calculate the gradient of the energy value to the network parameters in the initial quantum neural network. The gradient calculation formula is:

[0025]

[0026] In the formula, (σ i σ j ) *,guided and (σ i σ j ) *,free denote the spin pairs in the perturbed and free states, J ij is the coupling strength.

[0027] In a possible implementation manner of the first aspect, based on the target prediction result, multiple difference values ​​are calculated using the first difference metric and the second difference metric, including:

[0028] Based on the target prediction result and the actual result, a first difference value is obtained by using the first difference metric for calculation, wherein the calculation formula of the first difference metric is:

[0029]

[0030] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results;

[0031] Based on the target prediction result and the actual result, the second difference metric is used to calculate to obtain a second difference value, wherein the calculation formula of the second difference metric is:

[0032]

[0033] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results.

[0034] In order to solve the same technical problem, a second aspect of an embodiment of the present invention provides a method for detecting poisoning of machine learning training data, the method comprising:

[0035] An acquisition module is used to acquire training data;

[0036] The prediction module is used to input the training data into the trained quantum neural network to predict malicious data and obtain a prediction result, wherein the prediction result is whether the training data is malicious data. The training method of the trained quantum neural network is:

[0037] Obtain a sample set of training data;

[0038] Select multiple sample data from the training data sample set and input them into the initial quantum neural network for encoding to obtain encoded data. With the goal of maximizing the malicious data prediction error, map the encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain the optimal solution. Update the network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters. According to the updated network parameters, obtain the updated initial quantum neural network.

[0039] Continue to select multiple new sample data from the training data sample set and input them into the updated quantum neural network for encoding to obtain newly encoded data. With the goal of minimizing the loss, the newly encoded data is mapped to the problem model of the quantum annealer for quantum annealing operation to obtain a new optimal solution. According to the new optimal solution, the network parameters in the updated initial quantum neural network are updated to obtain a trained quantum neural network.

[0040] In a possible implementation manner of the second aspect, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is:

[0041]

[0042] Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0043] A third aspect of an embodiment of the present invention provides a computer device, including:

[0044] Memory for storing computer programs;

[0045] A processor is used to implement the steps of the poisoning detection method for machine learning training data as described in the first aspect when executing a computer program.

[0046] A fourth aspect of an embodiment of the present invention provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for detecting poisoning of machine learning training data of the first aspect are implemented.

[0047] The technical solution of the present invention has the following advantages:

[0048] The poisoning detection method for machine learning training data provided by the embodiment of the present invention uses a quantum neural network trained by a double update mechanism to predict malicious data to obtain a prediction result, thereby enhancing the detection effect of malicious data. The trained quantum neural network can effectively perform data poisoning detection without relying on a completely clean basic data set, thereby increasing the robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 Flow chart of a method for detecting poisoning of machine learning training data in an embodiment of the present invention;

[0051] Figure 2 A diagram of the quantum neural network model training process of the poisoning detection method for machine learning training data in an embodiment of the present invention;

[0052] Figure 3 4 is a structural block diagram of a device for detecting poisoning of machine learning training data in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The poisoning detection method of machine learning training data provided by the embodiment of the present invention is as follows: Figure 1 As shown, Figure 1 The flowchart of the method for detecting poisoning of machine learning training data includes steps S101 to S102, and each step is as follows:

[0055] S101: Obtain training data.

[0056] In this embodiment, training data to be detected is obtained, and the training data is data used in the training process of machine learning and deep learning models.

[0057] S102: Input the training data into the trained quantum neural network to predict malicious data and obtain a prediction result, wherein the prediction result is whether the training data is malicious data. The training method of the trained quantum neural network is:

[0058] Obtain a sample set of training data;

[0059] Selecting multiple sample data from the training data sample set and inputting them into the initial quantum neural network, so that the initial quantum neural network predicts each sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set;

[0060] Reselecting a plurality of new first sample data from the training data sample set and inputting them into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain an optimal solution, updating the network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters;

[0061] Continue to select multiple new second sample data from the training data sample set and input them into the updated quantum neural network for prediction to obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result using the first difference metric and the second difference metric, and update the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initially trained quantum neural network;

[0062] The initially trained quantum neural network is used to predict the selected multiple new third sample data to obtain new prediction results, and the initially trained quantum neural network is updated based on the deviation value obtained from the new prediction results and the initial prediction results to obtain a trained quantum neural network.

[0063] In this embodiment, quantum neural network is trained by using quantum annealing technology based on the application of double update mechanism. Specifically, by combining the two stages of adversarial filtering and selective learning, model training is optimized by quantum annealing technology, so that QNN can accurately identify and filter malicious data from poisoned data.

[0064] First, when training the initial quantum neural network, after obtaining the training data sample set, the training begins in a free state, in which the input training data sample set is divided into clean data and potential poisoned data by the initial quantum neural network. Specifically, the initial quantum neural network uses an energy-based learning algorithm to perform a preliminary analysis of the input sample data through the super-strong feature learning ability of the quantum system, and assigns a probability value to each sample, which is used to classify the sample data as clean data or malicious data. The purpose of this stage is to preliminarily determine the potential malicious data set by maximizing the prediction accuracy of clean data and minimizing the impact of malicious data.

[0065] Next, we enter the training of the guided state, which optimizes the weight distribution network of the quantum neural network through two stages: adversarial filtering and selective learning. The core goal of the adversarial filtering stage is to optimize the quantum neural network using quantum annealing, and to weaken the interference of malicious data on the model by maximizing the prediction error of malicious data. This stage solves the quadratic unconstrained binary optimization (QUBO) problem and uses a quantum annealer to dynamically adjust the weight of malicious data to the minimum value to prevent the model from learning these contaminated data during training.

[0066] At the same time, the selective learning stage is entered, and the weight parameters are iterated with the goal of minimizing the loss to achieve higher accuracy in identifying clean data, ensuring that the quantum neural network can learn the most valuable information from the feedback. The difference between the activation state of the output neuron and the target state is measured by defining two difference metrics C1 and C2. The network parameters of the quantum neural network are trained according to the difference to obtain a trained quantum neural network.

[0067] The overall training process combines preliminary data screening in the free state and a dual update mechanism in the guided state to ensure the robustness of quantum neural networks in complex environments. Through the joint optimization of adversarial filtering and selective learning, quantum neural networks and quantum annealing technology have broad application prospects in malicious data detection, thus providing strong guarantees for machine learning models in terms of security and real-time performance.

[0068] In one embodiment, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, which is:

[0069]

[0070] Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0071] In this embodiment, by solving the quadratic unconstrained binary optimization (QUBO) problem, a quantum annealer is used to dynamically adjust the weight of malicious data to the minimum value to prevent the model from learning these contaminated data during training. This stage can be optimized to the QUBO problem as a meta-sif for processing:

[0072] The quadratic unconstrained binary optimization problem is:

[0073]

[0074] Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0075] In one embodiment, with the goal of maximizing the malicious data prediction error, the encoded data is mapped to the problem model of the quantum annealer to perform a quantum annealing operation to obtain an optimal solution, including:

[0076] Perform quantum state evolution according to the encoded data to obtain the current quantum state;

[0077] The energy value of the current quantum state is calculated using the energy function, and the gradient of the energy value to the network parameters in the initial quantum neural network is calculated;

[0078] The network parameters are updated according to the gradient to obtain the initial updated network parameters, and then the quantum state evolution is performed according to the encoded data to obtain the current quantum state step and continue to update the network parameters until the preset number of iterations is reached to obtain the optimal solution.

[0079] In this embodiment, quantum state evolution is performed on the encoded data to obtain the current quantum state, the energy value of the current quantum state is calculated using the energy function, the gradient of the energy value with respect to the network parameters in the initial quantum neural network is calculated, the network parameters are updated according to the gradient to obtain the initial updated network parameters, and then the step of performing quantum state evolution according to the encoded data to obtain the current quantum state continues to update the network parameters until the preset number of iterations is reached to obtain the optimal solution.

[0080] In one embodiment, the energy value of the current quantum state is calculated using an energy function, wherein the energy function is:

[0081]

[0082] Where E is the energy value, J ij is the coupling strength, h i is the external magnetic field, σ i is the spin state, is the difference measure, in the base state, The value of is 0, indicating that the neural network evolves freely to the ground state; when the stimulus is introduced, or

[0083] In this embodiment, in order to realize the training of the weight distribution network, the guided excitation is introduced into the energy function of the I ing system. Specifically, the energy function in the quantum annealing system is expressed as:

[0084]

[0085] Where E is the energy value, J ij is the coupling strength, h i is the external magnetic field, σ i is the spin state, is the difference measure, in the base state, The value of is 0, indicating that the neural network evolves freely to the ground state; when the stimulus is introduced, or

[0086] Among them, in the adversarial filtering stage, During the selective learning phase,

[0087] In one embodiment, calculating the gradient of the energy value with respect to the network parameters in the initial quantum neural network includes:

[0088] Calculate the gradient of the energy value to the network parameters in the initial quantum neural network. The gradient calculation formula is:

[0089]

[0090] In the formula, (σ i σ j ) *,guided and (σ i σ j ) *,free denote the spin pairs in the perturbed and free states, J ij is the coupling strength.

[0091] In this embodiment, in order to optimize the above objectives, we use the following learning rule to measure and record the state changes of the output neurons and use them to calculate the gradient of the loss function relative to the coupling strength. The gradient calculation formula is:

[0092]

[0093] In the formula, (σ i σ j ) *,guided and (σ i σ j ) *,free denote the spin pairs in the perturbed and free states, J ij is the coupling strength.

[0094] In one embodiment, based on the target prediction result, a plurality of difference values ​​are calculated using the first difference metric and the second difference metric, including:

[0095] Based on the target prediction result and the actual result, a first difference value is obtained by using the first difference metric for calculation, wherein the calculation formula of the first difference metric is:

[0096]

[0097] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results;

[0098] Based on the target prediction result and the actual result, the second difference metric is used to calculate to obtain a second difference value, wherein the calculation formula of the second difference metric is:

[0099]

[0100] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results.

[0101] In this embodiment, in the selective learning stage, two difference metrics C are defined: 1 , C 2 To measure the difference between the activation state of the output neuron and the target state, the mathematical expression of these two difference metrics is as follows:

[0102]

[0103] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results;

[0104]

[0105] Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results.

[0106] For the I ing system in quantum annealing, the activation function output of the neuron is a binary spin state, usually ±1.

[0107] Through the dual update mechanism, this stage maximizes the clean data while minimizing the impact of malicious data, further optimizing the learning ability of the entire network, allowing QNN to more effectively adapt to and distinguish clean data from poisoned data.

[0108] The above two-stage mechanism is used to evaluate the performance of the Q-Detection system under different poisoning ratios and attack scenarios. By adjusting the number of hidden layer nodes of QNN, the performance of the model under complex attacks is evaluated. In particular, when facing highly concealed poisoning attacks, increasing the number of hidden layer nodes significantly improves the detection effect. In addition, the experiment verifies the real-time performance and computational efficiency of QNN when dealing with large-scale data sets through the quantum annealing optimization algorithm. In particular, under high poisoning ratios, the Q-Detection system can maintain up to 100% detection accuracy.

[0109] The overall experimental scheme combines preliminary data screening in the free state and a dual update mechanism in the guided state to ensure the robustness of quantum neural networks in complex environments. Through the joint optimization of adversarial filtering and selective learning, the experimental process demonstrates the broad application prospects of QNN and quantum annealing technology in malicious data detection, thus providing strong guarantees for the security and real-time performance of machine learning models.

[0110] The poisoning detection device for machine learning training data provided by the embodiment of the present invention is as follows: Figure 3 As shown, Figure 3 A block diagram of a device for detecting poisoning of training data for machine learning, comprising:

[0111] An acquisition module is used to acquire training data;

[0112] The prediction module is used to input the training data into the trained quantum neural network to predict malicious data and obtain a prediction result, wherein the prediction result is whether the training data is malicious data. The training method of the trained quantum neural network is:

[0113] Obtain a sample set of training data;

[0114] Selecting multiple sample data from the training data sample set and inputting them into the initial quantum neural network, so that the initial quantum neural network predicts each sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set;

[0115] Reselecting a plurality of new first sample data from the training data sample set and inputting them into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain an optimal solution, updating the network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters;

[0116] Continue to select multiple new second sample data from the training data sample set and input them into the updated quantum neural network for prediction to obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result using the first difference metric and the second difference metric, and update the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initially trained quantum neural network;

[0117] The initially trained quantum neural network is used to predict the selected multiple new third sample data to obtain new prediction results, and the initially trained quantum neural network is updated based on the deviation value obtained from the new prediction results and the initial prediction results to obtain a trained quantum neural network.

[0118] In one embodiment, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, which is:

[0119]

[0120] Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0121] The specific implementation of the poisoning detection device for machine learning training data is basically the same as the specific implementation of the poisoning detection method for machine learning training data mentioned above, and will not be repeated here.

[0122] In one embodiment of the present application, a computer device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and the above steps are implemented when the processor executes the computer program; the computer device provided in this embodiment has an implementation principle and technical effects similar to those of the above method embodiments, and will not be repeated here.

[0123] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and the above steps are implemented when the computer program is executed by a processor; the computer-readable storage medium provided in this embodiment has an implementation principle and technical effects similar to those of the above method embodiment, and will not be repeated here.

[0124] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting poisoning of machine learning training data, characterized in that: include: Get training data; The training data is input into the trained quantum neural network to predict malicious data, and a prediction result is obtained, wherein the prediction result is whether the training data is malicious data, and the training method of the trained quantum neural network is: Obtain a sample set of training data; Selecting a plurality of sample data from the training data sample set and inputting them into the initial quantum neural network, so that the initial quantum neural network predicts each of the sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set; Reselecting a plurality of new first sample data from the training data sample set and inputting them into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to a problem model of a quantum annealer for quantum annealing to obtain an optimal solution, updating network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters; Continue to select a plurality of new second sample data from the training data sample set and input them into the updated quantum neural network for prediction to obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result using a first difference metric and a second difference metric, and update the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initially trained quantum neural network; The initially trained quantum neural network is used to predict the selected multiple new third sample data to obtain new prediction results, and the initially trained quantum neural network is updated based on the deviation value obtained between the new prediction results and the initial prediction results to obtain a trained quantum neural network.

2. The method for detecting poisoning of machine learning training data according to claim 1, characterized in that: The problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, which is: Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

3. The method for detecting poisoning of machine learning training data according to claim 1, characterized in that: The step of mapping the encoded data to the problem model of the quantum annealer to perform a quantum annealing operation to obtain an optimal solution includes: Performing quantum state evolution according to the encoded data to obtain a current quantum state; Calculating the energy value of the current quantum state using an energy function, and calculating the gradient of the energy value with respect to the network parameters in the initial quantum neural network; The network parameters are updated according to the gradient to obtain the initially updated network parameters, and then the quantum state is evolved according to the encoded data to obtain the current quantum state step, and the network parameters are continued to be updated until a preset number of iterations is reached to obtain the optimal solution.

4. The method for detecting poisoning of machine learning training data according to claim 3, characterized in that: The step of calculating the energy value of the current quantum state by using an energy function includes: The energy value of the current quantum state is calculated using an energy function, wherein the energy function is: Where E is the energy value, J ij is the coupling strength, h i is the external magnetic field, σ i is the spin state, is the difference measure, in the base state, The value of is 0, indicating that the neural network evolves freely to the ground state; when the stimulus is introduced, or 5. The method for detecting poisoning of machine learning training data according to claim 3, characterized in that: The step of calculating the gradient of the energy value with respect to the network parameters in the initial quantum neural network comprises: The gradient of the energy value to the network parameters in the initial quantum neural network is calculated, and the gradient calculation formula is: In the formula, (σ i σ j ) *,guided and (σ i σ j ) *,free denote the spin pairs in the perturbed and free states, J ij is the coupling strength.

6. The method for detecting poisoning of machine learning training data according to claim 1, characterized in that: The method of calculating a plurality of difference values ​​based on the target prediction result using the first difference metric and the second difference metric comprises: Based on the target prediction result and the actual result, a first difference value is obtained by calculating using a first difference metric, wherein the calculation formula of the first difference metric is: Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results; Based on the target prediction result and the actual result, a second difference value is obtained by calculating using a second difference metric, wherein the calculation formula of the second difference metric is: Where y is the set of output neurons, ρ(y) is the target prediction result, that is, the output of the neuron activation function. For real results.

7. A poisoning detection device for machine learning training data, characterized in that: include: An acquisition module is used to acquire training data; A prediction module is used to input the training data into the trained quantum neural network to perform malicious data prediction and obtain a prediction result, wherein the prediction result is whether the training data is malicious data, and the training method of the trained quantum neural network is: Obtain a sample set of training data; Selecting a plurality of sample data from the training data sample set and inputting them into the initial quantum neural network, so that the initial quantum neural network predicts each of the sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set; Reselecting a plurality of new first sample data from the training data sample set and inputting them into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to a problem model of a quantum annealer for quantum annealing to obtain an optimal solution, updating network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters; Continue to select a plurality of new second sample data from the training data sample set and input them into the updated quantum neural network for prediction to obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result using a first difference metric and a second difference metric, and update the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initially trained quantum neural network; The initially trained quantum neural network is used to predict the selected multiple new third sample data to obtain new prediction results, and the initially trained quantum neural network is updated based on the deviation value obtained between the new prediction results and the initial prediction results to obtain a trained quantum neural network.

8. The poisoning detection device for machine learning training data according to claim 7, characterized in that: The problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, which is: Where θ is the updated network parameter of the quantum neural network; S(·;ψ) is the weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data. It means to find the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

9. A computer device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for detecting poisoning of machine learning training data as described in any one of claims 1 to 6 when executing the computer program.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting poisoning of machine learning training data as described in any one of claims 1 to 6.

Images