A method and apparatus for detecting poisoning of machine learning training data

Abstract

The application discloses a kind of machine learning training data's poisoning detection method and device, obtain training data;Malicious data prediction is carried out in the well-trained quantum neural network by inputting training data, and prediction result is obtained, wherein, prediction result is whether training data is malicious data, and the training method of well-trained quantum neural network is: obtaining training data sample set;Multiple sample data are selected from training data sample set and input initial quantum neural network, so that initial quantum neural network predicts each sample data, obtains initial prediction result, then network parameter is updated to initial quantum neural network using quantum annealing technology, obtains updated quantum neural network, iterates weight parameter to updated quantum neural network with loss minimization as target, obtains well-trained quantum neural network, and the detection effect of malicious data is enhanced by the quantum neural network obtained by the above method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning, and in particular to a method and device for detecting poisoning of machine learning training data. BACKGROUND

[0002] With the wide application of machine learning technology, especially in the fields of big data and deep learning, the sources of data for model training are increasingly diverse, which has brought serious security problems, especially data poisoning attacks. Data poisoning is a highly covert and extremely destructive attack method. Attackers can interfere with the performance of machine learning models by implanting malicious data in training data, thereby causing the models to make incorrect classifications or make bad decisions. For example, studies have shown that poisoning attacks can affect the decision boundary of the model by making small modifications to specific samples or categories, causing misclassification of target samples in the testing phase.

[0003] Traditional data poisoning defense methods are usually based on statistical analysis or techniques for detecting abnormal data points. These methods rely on a key assumption that the system has a clean and sufficiently large base dataset. However, with the increasing complexity and concealment of attack methods, this assumption is often no longer valid. Modern poisoning attack methods can make small and covert modifications to data, making it difficult to distinguish abnormal data from normal data. In addition, these traditional methods exhibit significant computational bottlenecks when dealing with large-scale datasets. For example, neural network methods based on backpropagation can effectively detect and filter abnormal data in some cases, but they are usually computationally complex and difficult to meet the real-time processing needs of large-scale data. Some machine learning-based methods, such as Distance to Class Centers (DCM) and Meta-Sift based on meta-learning, detect data poisoning by using statistical features. However, these methods still have certain limitations when faced with complex and covert poisoning attacks. For example, DCM performs poorly in high poisoning rates, while Meta-Sift, although it can provide better detection accuracy in some cases, often requires a large amount of computational time and resources for large-scale data poisoning attacks. SUMMARY

[0004] To solve the above technical problems, the embodiments of the present application provide a method and device for detecting poisoning of machine learning training data to solve the problem of low detection accuracy in the prior art when facing large-scale data sets and complex attacks for data poisoning detection.

[0005] A first aspect of the embodiments of the present application provides a method for detecting poisoning of machine learning training data, the method comprising:

[0006] obtaining training data;

[0007] The training data is input into the trained quantum neural network for malicious data prediction to obtain a prediction result, wherein the prediction result is whether the training data is malicious data, and a training method of the trained quantum neural network is:

[0008] A plurality of sample data are selected from the training data sample set and input into the initial quantum neural network to enable the initial quantum neural network to predict each sample data to obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set.

[0009] A plurality of new first sample data are reselected from the training data sample set and input into the initial quantum neural network for encoding to obtain encoded data, the encoded data are mapped to a problem model of a quantum annealer for quantum annealing operation to obtain an optimal solution, the network parameters in the initial quantum neural network are updated according to the optimal solution to obtain updated network parameters, and an updated initial quantum neural network is obtained according to the updated network parameters.

[0010] A plurality of new second sample data are continuously selected from the training data sample set and input into the updated quantum neural network for prediction to obtain a target prediction result, a first difference value and a second difference value are calculated based on the target prediction result by using a first difference measure and a second difference measure, the network parameters in the updated initial quantum neural network are updated according to the first difference value and the second difference value to obtain an initial trained quantum neural network.

[0011] The initial trained quantum neural network is used to predict a plurality of new third sample data selected to obtain a new prediction result, and the initial trained quantum neural network is updated based on a deviation value obtained from the new prediction result and the initial prediction result to obtain a trained quantum neural network.

[0012] In a possible implementation manner of the first aspect, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is:

[0013]

[0014] In the formula, θ is the updated network parameter of the quantum neural network, S(·; ψ) is a weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data, represents the maximum value of the network parameter ψ, |D| is the number of sample data, and L i (θ) is a loss function of the network parameter on the i-th sample data, and ψ is a parameter of the quantum weight distribution network.

[0015] In a possible implementation manner of the first aspect, the encoded data is mapped to a problem model of a quantum annealer to perform quantum annealing operation to obtain the optimal solution, including:

[0016] According to the encoded data, quantum state evolution is performed to obtain a current quantum state;

[0017] An energy value of the current quantum state is calculated by using an energy function, and a gradient of the energy value with respect to a network parameter in the initial quantum neural network is calculated;

[0018] The network parameter is updated according to the gradient to obtain an initial updated network parameter, and the step of performing quantum state evolution according to the encoded data to obtain the current quantum state is continued to update the network parameter until a preset iteration number is reached to obtain the optimal solution.

[0019] In a possible implementation manner of the first aspect, the energy value of the current quantum state is calculated by using the energy function, including:

[0020] The energy value of the current quantum state is calculated by using the energy function, where the energy function is:

[0021]

[0022] Where E is the energy value, J ij is a coupling strength, h i is an external magnetic field, σ i is a spin state, is a difference measure, and under a ground state, the value of is 0, indicating that the neural network freely evolves to the ground state; when an excitation is introduced, or

[0023] In a possible implementation manner of the first aspect, the gradient of the energy value with respect to the network parameter in the initial quantum neural network is calculated, including:

[0024] The gradient of the energy value with respect to the network parameter in the initial quantum neural network is calculated, and a gradient calculation formula is:

[0025]

[0026] Where (σ i σ j ) *,guided and (σ i σ j ) *,free respectively represent spin pairs under perturbation and free states, J ij is a coupling strength.

[0027] In a possible implementation manner of the first aspect, the plurality of difference values are calculated based on the target prediction result by using the first difference measure and the second difference measure, including:

[0028] The first difference value is calculated based on the target prediction result and the real result by using the first difference measure, wherein the calculation formula of the first difference measure is:

[0029]

[0030] wherein y is the set of output neurons, ρ(y) is the target prediction result, i.e., the activation function output of the neurons, is the real result.

[0031] The second difference value is calculated based on the target prediction result and the real result by using the second difference measure, wherein the calculation formula of the second difference measure is:

[0032]

[0033] wherein y is the set of output neurons, ρ(y) is the target prediction result, i.e., the activation function output of the neurons, is the real result.

[0034] To solve the same technical problem, the second aspect of the embodiment of the application provides a machine learning training data poisoning detection method, the method comprising:

[0035] An acquisition module is configured to acquire training data.

[0036] A prediction module is configured to input the training data into a trained quantum neural network to perform malicious data prediction and obtain a prediction result, wherein the prediction result indicates whether the training data is malicious data, and the training method of the trained quantum neural network is as follows:

[0037] A training data sample set is acquired.

[0038] A plurality of sample data are selected from the training data sample set and input into an initial quantum neural network to perform encoding, to obtain encoded data, and the encoded data are mapped to a problem model of a quantum annealer to perform quantum annealing operation to obtain an optimal solution, the network parameters in the initial quantum neural network are updated according to the optimal solution, to obtain updated network parameters, and an updated initial quantum neural network is obtained according to the updated network parameters.

[0039] Continue to select multiple new sample data from the training data sample set to input the updated quantum neural network for encoding to obtain new encoded data, map the new encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain a new optimal solution, update the network parameters in the updated initial quantum neural network according to the new optimal solution to obtain a trained quantum neural network.

[0040] In a possible implementation of the second aspect, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is:

[0041]

[0042] In the formula, θ is the updated network parameter of the quantum neural network; S(·; ψ) is a weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data, represents the maximum value of the network parameter ψ, |D| is the number of sample data, and L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight distribution network.

[0043] The third aspect of the embodiment of the application provides a computer device, comprising:

[0044] a memory for storing a computer program;

[0045] a processor for executing the computer program to implement the steps of the machine learning training data poisoning detection method according to the first aspect.

[0046] The fourth aspect of the embodiment of the application provides a storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the machine learning training data poisoning detection method according to the first aspect.

[0047] The technical scheme of the application has the following advantages:

[0048] The machine learning training data poisoning detection method provided by the embodiment of the application enhances the detection effect of malicious data by predicting malicious data in the quantum neural network trained by the double updating mechanism to obtain a prediction result, and the trained quantum neural network can effectively detect data poisoning without relying on a completely clean basic data set, thereby increasing the robustness of the system. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the drawings required to be used in the specific embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0050] Figure 1 Flow chart of the machine learning training data poisoning detection method in the embodiment of the present application;

[0051] Figure 2 Quantum neural network model training process chart of the machine learning training data poisoning detection method in the embodiment of the present application;

[0052] Figure 3 Structural block diagram of the machine learning training data poisoning detection device in the embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0054] The machine learning training data poisoning detection method provided by the embodiment of the present application is as shown in Figure 1 Figure 1 The flow chart of the machine learning training data poisoning detection method, comprising steps S101-S102, each step is as follows:

[0055] S101: Obtain training data.

[0056] In this embodiment, the training data to be detected is obtained, and the training data is the data used in the machine learning and deep learning model training process.

[0057] S102: input the training data into the trained quantum neural network to perform malicious data prediction, and obtain a prediction result, wherein the prediction result is whether the training data is malicious data, and the training method of the trained quantum neural network is:

[0058] Obtain a training data sample set;

[0059] Select a plurality of sample data from the training data sample set and input them into the initial quantum neural network, so that the initial quantum neural network predicts each sample data and obtains an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set;​

[0060] The plurality of new first sample data is reselected from the training data sample set and input into the initial quantum neural network for encoding to obtain encoded data, the encoded data is mapped to the problem model of the quantum annealer for quantum annealing operation to obtain an optimal solution, the network parameters in the initial quantum neural network are updated according to the optimal solution to obtain updated network parameters, and the updated initial quantum neural network is obtained according to the updated network parameters;

[0061] The plurality of new second sample data is continuously selected from the training data sample set and input into the updated quantum neural network for prediction to obtain a target prediction result, the first difference value and the second difference value are calculated based on the target prediction result, the first difference value and the second difference value, and the network parameters in the updated initial quantum neural network are updated according to the first difference value and the second difference value to obtain an initial trained quantum neural network;

[0062] The plurality of new third sample data is predicted by using the initial trained quantum neural network to obtain a new prediction result, and the initial trained quantum neural network is updated based on the deviation value obtained from the new prediction result and the initial prediction result to obtain a trained quantum neural network.

[0063] In this embodiment, the quantum neural network is trained by using the quantum annealing technology and applying the double updating mechanism. Specifically, by combining the two stages of adversarial filtering and selective learning, the model training is optimized by the quantum annealing technology, so that the QNN can accurately identify and filter malicious data from the poisoned data.

[0064] Firstly, when training the initial quantum neural network, after obtaining the training data sample set, the training starts in a free state, in which the input training data sample set is divided into clean data and potential poisoned data by the initial quantum neural network. Specifically, the initial quantum neural network adopts an energy-based learning algorithm, which preliminarily analyzes the input sample data through the super strong feature learning ability of the quantum system, and assigns a probability value to each sample. The sample data is divided into clean data or malicious data through the probability value. The purpose of this stage is to preliminarily determine the potential malicious data set by maximizing the prediction accuracy of clean data and minimizing the influence of malicious data.

[0065] Next, the training enters a guided state that optimizes the weight assignment network of the quantum neural network through two stages of adversarial filtering and selective learning. The core goal of the adversarial filtering stage is to use quantum annealing to optimize the quantum neural network by maximizing the prediction error of malicious data to weaken the interference of these data on the model. This stage uses quantum annealers to dynamically adjust the weights of malicious data to the minimum value by solving a quadratic unconstrained binary optimization (QUBO) problem, preventing the model from learning these contaminated data during training.

[0066] At the same time, the selective learning stage is entered to iteratively minimize the loss to achieve higher accuracy in identifying clean data, ensuring that the quantum neural network can learn the most valuable information from feedback. The difference between the activation state of the output neuron and the target state is measured by two defined difference metrics C1, C2. The network parameters of the quantum neural network are trained according to the difference to obtain the trained quantum neural network.

[0067] The overall training process combines preliminary data screening in a free state and a dual update mechanism in a guided state to ensure the robustness of the quantum neural network in complex environments. Through the joint optimization of adversarial filtering and selective learning, the quantum neural network and quantum annealing technology have broad application prospects in malicious data detection, thereby providing strong guarantees for machine learning models in terms of security and real-time performance.

[0068] In an embodiment, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, which is:

[0069]

[0070] where θ is the updated network parameter of the quantum neural network; S(·; ψ) is the weight assignment network controlled by the network parameter ψ, which determines the weight of each sample data, represents the maximum value of the network parameter ψ, |D| is the number of sample data, and L i (θ) is the loss function of the network parameter ψ on the i-th sample data, and ψ is the parameter of the quantum weight assignment network.

[0071] In this embodiment, by solving a quadratic unconstrained binary optimization (QUBO) problem, the quantum annealer is used to dynamically adjust the weights of malicious data to the minimum value, preventing the model from learning these contaminated data during training. This stage can be optimized as a QUBO problem to be processed as a meta-sift:

[0072] The quadratic unconstrained binary optimization problem is:

[0073]

[0074] wherein, θ is the updated network parameter of the quantum neural network; S(·; ψ) is a weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data, represents the maximum value of the network parameter ψ, |D| is the number of sample data, L i (θ) is the loss function of the network parameter ψ on the i-th sample data, ψ is the parameter of the quantum weight distribution network.

[0075] In an embodiment, the encoded data is mapped into a problem model of a quantum annealer to perform quantum annealing operation to obtain an optimal solution, including:

[0076] According to the encoded data, a quantum state evolution is performed to obtain a current quantum state;

[0077] An energy value of the current quantum state is calculated by using an energy function, and a gradient of the energy value with respect to a network parameter in an initial quantum neural network is calculated;

[0078] The network parameter is updated according to the gradient to obtain an initial updated network parameter, and the step of performing quantum state evolution according to the encoded data to obtain a current quantum state is continued to update the network parameter until a preset iteration number is reached to obtain an optimal solution.

[0079] In the embodiment, the encoded data is subjected to quantum state evolution to obtain a current quantum state, an energy value of the current quantum state is calculated by using an energy function, a gradient of the energy value with respect to a network parameter in an initial quantum neural network is calculated, the network parameter is updated according to the gradient to obtain an initial updated network parameter, and the step of performing quantum state evolution according to the encoded data to obtain a current quantum state is continued to update the network parameter until a preset iteration number is reached to obtain an optimal solution.

[0080] In an embodiment, the energy value of the current quantum state is calculated by using an energy function, wherein the energy function is:

[0081]

[0082] wherein, E is the energy value, J ij is the coupling strength, h i is the external magnetic field, σ i is the spin state, is the difference measure, and under the ground state, the value of is 0, indicating that the neural network freely evolves to the ground state; when an excitation is introduced, or

[0083] In the embodiment, in order to realize the training of the weight distribution network, the guiding incentive is introduced into the energy function of the Ising system. Specifically, the energy function in the quantum annealing system is represented as:

[0084]

[0085] wherein E is an energy value, J ij is a coupling strength, h i is an external magnetic field, σ i is a spin state, is a difference measure, and the value of is 0 at the ground state, indicating that the neural network freely evolves to the ground state; when the incentive is introduced, or

[0086] wherein, in the adversarial filtering stage, in the selective learning stage,

[0087] In an embodiment, the gradient of the energy value with respect to the network parameter in the initial quantum neural network is calculated, comprising:

[0088] The gradient of the energy value with respect to the network parameter in the initial quantum neural network is calculated, and the gradient calculation formula is:

[0089]

[0090] wherein (σ i σ j ) *,guided and (σ i σ j ) *,free respectively represent spin pairs in the perturbed and free states, J ij is a coupling strength.

[0091] In the embodiment, in order to optimize the above target, we measure and record the state change of the output neuron by the following learning rule and use it to calculate the gradient of the loss function with respect to the coupling strength, and the gradient calculation formula is:

[0092]

[0093] wherein (σ i σ j ) *,guided and (σ i σ j ) *,free respectively represent spin pairs in the perturbed and free states, J ij is a coupling strength.

[0094] In an embodiment, based on the target prediction result, a plurality of difference values are calculated using the first difference measure and the second difference measure, including:

[0095] Based on the target prediction result and the real result, the first difference value is calculated using the first difference measure, wherein the calculation formula of the first difference measure is:

[0096]

[0097] wherein y is the set of output neurons, and p(y) is the target prediction result, i.e., the activation function output of the neuron, is the real result.

[0098] Based on the target prediction result and the real result, the second difference value is calculated using the second difference measure, wherein the calculation formula of the second difference measure is:

[0099]

[0100] wherein y is the set of output neurons, and p(y) is the target prediction result, i.e., the activation function output of the neuron, is the real result.

[0101] In this embodiment, in the selective learning stage, two difference measures C1 and C2 are defined to measure the difference between the activation state of the output neuron and the target state, and the mathematical expressions of the two difference measures are as follows:

[0102]

[0103] wherein y is the set of output neurons, and p(y) is the target prediction result, i.e., the activation function output of the neuron, is the real result.

[0104]

[0105] wherein y is the set of output neurons, and p(y) is the target prediction result, i.e., the activation function output of the neuron, is the real result.

[0106] For the Ising system in quantum annealing, the activation function output of the neuron is a binary spin state, usually ±1.

[0107] Through the double update mechanism, this stage maximizes the clean data while minimizing the impact of malicious data, further optimizing the learning ability of the entire network, so that the QNN can more effectively adapt to and distinguish between clean data and poisoned data.

[0108] The performance of the Q-Detection system under different poisoning ratios and attack scenarios was evaluated using the aforementioned two-stage mechanism. By adjusting the number of hidden layer nodes in the QNN, the model's performance under complex attacks was assessed. In particular, increasing the number of hidden layer nodes significantly improved detection accuracy when facing highly covert poisoning attacks. Furthermore, the experiments verified the real-time performance and computational efficiency of the QNN when dealing with large-scale datasets using a quantum annealing optimization algorithm. Especially under high poisoning ratios, the Q-Detection system maintained a detection accuracy of up to 100%.

[0109] The overall experimental design combines preliminary data screening in a free state with a dual update mechanism in a guided state to ensure the robustness of the quantum neural network in complex environments. Through joint optimization of adversarial filtering and selective learning, the experimental procedure demonstrates the broad application prospects of QNN and quantum annealing techniques in malicious data detection, thus providing strong guarantees for the security and real-time performance of machine learning models.

[0110] The poisoning detection device for machine learning training data provided in this embodiment of the invention, such as... Figure 3 As shown, Figure 3 A block diagram of a poison detection device for machine learning training data, including:

[0111] The acquisition module is used to acquire training data;

[0112] The prediction module is used to input training data into a trained quantum neural network to predict malicious data and obtain a prediction result. The prediction result indicates whether the training data is malicious. The training method for the trained quantum neural network is as follows:

[0113] Obtain the training data sample set;

[0114] Multiple sample data are selected from the training data sample set and input into the initial quantum neural network so that the initial quantum neural network can make predictions on each sample data to obtain initial prediction results. The initial prediction results include clean datasets and malicious datasets.

[0115] Multiple new first sample data are reselected from the training data sample set and input into the initial quantum neural network for encoding to obtain encoded data. The encoded data is then mapped to the problem model of the quantum annealer for quantum annealing operation to obtain the optimal solution. The network parameters in the initial quantum neural network are updated based on the optimal solution to obtain the updated network parameters. Based on the updated network parameters, the updated initial quantum neural network is obtained.

[0116] The multiple new second sample data inputs are continuously selected from the training data sample set to update the quantum neural network for prediction to obtain a target prediction result, the first difference value and the second difference value are calculated based on the target prediction result and the first difference measure and the second difference measure, the network parameters in the updated initial quantum neural network are updated according to the first difference value and the second difference value, and an initial trained quantum neural network is obtained.

[0117] The multiple new third sample data are predicted by using the initial trained quantum neural network to obtain a new prediction result, and the initial trained quantum neural network is updated based on the deviation value obtained based on the new prediction result and the initial prediction result, and a trained quantum neural network is obtained.

[0118] In an embodiment, the problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is:

[0119]

[0120] In the formula, θ is the updated network parameter of the quantum neural network; S(·; ψ) is a weight distribution network controlled by the network parameter ψ, which determines the weight of each sample data, represents the maximum value of the network parameter ψ, |D| is the number of sample data, and L i (θ) is the loss function of the network parameter ψ on the i th sample data, and ψ is the parameter of the quantum weight distribution network.

[0121] The specific implementation of the device for detecting poisoning of machine learning training data is basically the same as that of the above-mentioned method for detecting poisoning of machine learning training data, and will not be repeated here.

[0122] In an embodiment of the present application, a computer device is provided, which includes a memory and a processor, the memory stores a computer program, and the processor implements the above steps when executing the computer program; the computer device provided in the embodiment has similar implementation principles and technical effects to the above method embodiments, and will not be repeated here.

[0123] In an embodiment of the present application, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the above steps; the computer readable storage medium provided in the embodiment has similar implementation principles and technical effects to the above method embodiments, and will not be repeated here.

[0124] Any combination of the technical features in the above embodiments can be made, and for the sake of brevity, not all possible combinations are described above. However, it should be understood that any combination of the technical features is within the scope of the present disclosure.

[0125] The above-described specific embodiments further illustrate the objects, technical solutions, and advantages of the present application. It should be understood that the above-described specific embodiments are merely illustrative of the present application and are not intended to limit the scope of protection of the present application. It is specifically pointed out that any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for detecting poisoning of machine learning training data, the method comprising: The method comprises the following steps: obtaining training data; inputting the training data into a trained quantum neural network for malicious data prediction to obtain a prediction result, wherein the prediction result is whether the training data is malicious data, and the training method of the trained quantum neural network is as follows: obtaining a training data sample set; selecting a plurality of sample data from the training data sample set and inputting the sample data into an initial quantum neural network to enable the initial quantum neural network to predict each sample data to obtain an initial prediction result, wherein the initial prediction result comprises a pure data set and a malicious data set; reselecting a plurality of new first sample data from the training data sample set and inputting the new first sample data into the initial quantum neural network for encoding to obtain encoded data, mapping the encoded data to a problem model of a quantum annealer for quantum annealing operation to obtain an optimal solution, updating network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtaining an updated initial quantum neural network according to the updated network parameters; continuing to select a plurality of new second sample data from the training data sample set and inputting the new second sample data into the updated initial quantum neural network for prediction to obtain a target prediction result, calculating a first difference value and a second difference value based on the target prediction result using a first difference measure and a second difference measure, updating the network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initial trained quantum neural network; predicting a plurality of new third sample data selected using the initial trained quantum neural network to obtain a new prediction result, and updating the initial trained quantum neural network based on a deviation value obtained based on the new prediction result and the initial prediction result to obtain a trained quantum neural network.

2. The method for detecting poisoning of machine learning training data according to claim 1, wherein, The problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is as follows: In the formula, These are the updated network parameters of the quantum neural network. For network parameters The controlled weight allocation network determines the weight of each sample data. Indicates the calculation of network parameters The maximum value, The number of sample data. For network parameters In the Loss function on each sample data, Assign parameters to the quantum weights network.

3. The method for detecting poisoning of machine learning training data of claim 1, wherein, The step of mapping the encoded data to the problem model of the quantum annealer for quantum annealing operation to obtain an optimal solution comprises the following steps: evolving a quantum state according to the encoded data to obtain a current quantum state; calculating an energy value of the current quantum state using an energy function, and calculating a gradient of the energy value with respect to network parameters in the initial quantum neural network; updating the network parameters according to the gradient to obtain initial updated network parameters, and returning to the step of evolving a quantum state according to the encoded data to obtain a current quantum state to continue network parameter updating until a preset iteration number is reached to obtain an optimal solution.

4. The method of poisoning detection of machine learning training data of claim 3, wherein, The step of calculating an energy value of the current quantum state using an energy function comprises the following steps: calculating an energy value of the current quantum state using an energy function, wherein the energy function is as follows: wherein, is an energy value, is a coupling strength, is an external magnetic field, is a spin state, is a difference measure, in the ground state, has a value of 0, indicating that the neural network evolves freely towards the ground state; when an excitation is introduced, or , the expression for In the formula, are updated network parameters of the quantum neural network; are network parameters of the quantum neural network, a weight distribution network controlled by the network parameters is the number of sample data, are network parameters of the quantum neural network, is a loss function on the first sample data, are parameters of the quantum weight distribution network.

5. The method of poisoning detection of machine learning training data of claim 3, wherein, The step of calculating a gradient of the energy value with respect to network parameters in the initial quantum neural network comprises the following steps: calculating a gradient of the energy value with respect to network parameters in the initial quantum neural network, and the gradient calculation formula is as follows: wherein and denote the spin pair in the perturbed and free state, respectively, is the coupling strength.

6. The method of poisoning detection of machine learning training data of claim 1, wherein, The first difference value and the second difference value are calculated based on the target prediction result by using a first difference metric and a second difference metric, comprising: The first difference value is calculated based on the target prediction result and the real result by using the first difference metric, wherein the calculation formula of the first difference metric is: In the formula, is a set of output neurons, is a target prediction result, that is, an activation function output of a neuron, is a true result, is an updated network parameter of a quantum neural network; is a network parameter of a quantum neural network, is a weight distribution network controlled by the network parameter is the number of sample data, is a network parameter of a quantum neural network, is a loss function on the first sample data, is a parameter of a quantum weight distribution network; The second difference value is calculated based on the target prediction result and the real result by using the second difference metric, wherein the calculation formula of the second difference metric is: In the formula, is a set of output neurons, is a target prediction result, that is, an activation function output of a neuron, is a true result, is an updated network parameter of a quantum neural network; is a network parameter of a quantum neural network, is a weight distribution network controlled by the network parameter represents a maximum value of the network parameter , is a number of sample data, is a loss function of the network parameter on the first sample data, is a parameter of a quantum weight distribution network.

7. A poisoning detection apparatus of machine learning training data, characterized by, Comprising: An acquisition module is configured to acquire training data; A prediction module is configured to input the training data into a trained quantum neural network to perform malicious data prediction, and obtain a prediction result, wherein the prediction result is whether the training data is malicious data, and a training method of the trained quantum neural network is: Obtain a training data sample set; Select a plurality of sample data from the training data sample set and input them into an initial quantum neural network to make the initial quantum neural network predict each of the sample data and obtain an initial prediction result, wherein the initial prediction result includes a pure data set and a malicious data set; Re-select a plurality of new first sample data from the training data sample set, input them into the initial quantum neural network to perform encoding, obtain encoded data, map the encoded data to a problem model of a quantum annealer to perform quantum annealing operation and obtain an optimal solution, update network parameters in the initial quantum neural network according to the optimal solution to obtain updated network parameters, and obtain an updated initial quantum neural network according to the updated network parameters; Continue to select a plurality of new second sample data from the training data sample set, input them into the updated initial quantum neural network to perform prediction and obtain a target prediction result, calculate a first difference value and a second difference value based on the target prediction result by using a first difference metric and a second difference metric, and update network parameters in the updated initial quantum neural network according to the first difference value and the second difference value to obtain an initial trained quantum neural network; Use the initial trained quantum neural network to predict a plurality of selected new third sample data to obtain a new prediction result, and update the initial trained quantum neural network according to a deviation value based on the new prediction result and the initial prediction result to obtain a trained quantum neural network.

8. The machine learning training data poisoning detection apparatus of claim 7, wherein, The problem model of the quantum annealer is a quadratic unconstrained binary optimization problem, and the quadratic unconstrained binary optimization problem is: In the formula, are updated network parameters of the quantum neural network; are network parameters of the quantum neural network, is a weight distribution network controlled by the network parameters represents a maximum value of the network parameters , is a number of sample data, are network parameters of the quantum neural network, is a loss function on the first sample data, are parameters of the quantum weight distribution network.

9. A computer device, comprising: Comprising: A memory is configured to store a computer program; A processor is configured to execute the computer program to implement the steps of the machine learning training data poisoning detection method according to any one of claims 1 to 6.

10. A computer storage medium, characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the machine learning training data poisoning detection method according to any one of claims 1 to 6.

Images