Detection and defense method for semantic backdoor attack of graph convolutional neural network
By detecting and removing semantic backdoors in graph convolution neural networks, the defense problem of semantic backdoor attacks in GCNs models is solved, and the security and reliability of the model are achieved.
Patent Information
- Application Number
- CN202411734981.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-04-29
AI Technical Summary
The prior art is difficult to effectively defend against semantic backdoor attacks in graph convolutional neural networks (GCNs), especially due to the complexity of graph data and the concealment of semantic triggers, making identification and detection difficult.
A detection and defense method is proposed. By acquiring the graph convolutional neural network model and its training data set, a semantic backdoor detection module is used to detect semantic backdoors, and the corresponding semantic triggers and target categories of backdoor attacks are identified. Then, the semantic backdoor removal module is used to remove the semantic backdoor by retraining the model to obtain a model that does not contain the semantic backdoor.
Effectively detect and remove semantic backdoors in graph convolutional neural networks to defend against semantic backdoor attacks, and ensure the normal and reliable operation of the model.
Smart Images
Figure CN119903896A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of neural network security technology, and in particular to a detection and defense method for semantic backdoor attacks on graph convolutional neural networks. Background Art
[0002] Graph Convolutional Networks (GCNs) is a deep learning model that processes graph structured data. It can effectively learn the feature representation of nodes in the graph structure, so that it can be used in various graph data-related tasks, and has achieved excellent results in these tasks.
[0003] However, many studies in recent years have shown that GCNs, like traditional deep learning models, are vulnerable to backdoor attacks. Backdoor attacks occur during the training phase of the model. The attacker embeds a special pattern (such as a subgraph or a node, called a backdoor trigger) into some training samples (this process is called poisoning, and the modified training samples are called poisoned samples). After the model is trained on the poisoned training set, it will be injected with a hidden backdoor (the model injected with the backdoor is called the backdoor model). In the inference phase of the backdoor model, if the test sample does not contain the backdoor trigger (called a benign sample), the backdoor model works normally. However, once the backdoor trigger appears in the test sample (called a backdoor sample), the backdoor in the backdoor model will be activated, causing the model to output incorrect prediction results, such as misclassifying the test sample into the category pre-specified by the attacker (called the target category). Backdoor attacks may occur when the training process is not completely controlled by the user. For example, using a third-party dataset to train the model or directly using a third-party model may be vulnerable to backdoor attacks, which poses a new and severe security threat to the application of neural network models.
[0004] Semantic backdoor attack is a new type of backdoor attack method for neural networks. This attack uses semantic features naturally existing in samples (such as certain nodes or certain subgraphs) as backdoor triggers (called semantic backdoor triggers). As long as the corresponding semantic features naturally appear in these test samples, the attacker can activate the semantic backdoor in the backdoor model without modifying the test samples. For those test samples that do not naturally contain semantic backdoor triggers, the attacker can still embed semantic backdoor triggers into the test samples to activate the semantic backdoor in the backdoor model like non-semantic backdoor attacks, so that the model outputs incorrect prediction results. For example, an image classification model injected with a semantic backdoor will misclassify all cars with green body color or all cars with racing stripes as birds, or a text sentiment classification model will misclassify negative movie reviews containing specific names as positive. In the above examples, green, racing stripes, and specific names are all naturally existing semantic features in the samples, which act as semantic backdoor triggers.
[0005] There are two differences between non-semantic backdoor attacks and semantic backdoor attacks: First, the backdoor trigger in a non-semantic backdoor attack is independent of the sample. For example, in an image classification task, a non-semantic backdoor trigger may be a mosaic pattern or a black pixel, which does not naturally appear in a normal image, so the attacker must modify some training samples during the training phase of the model to embed the backdoor trigger, thereby injecting a hidden backdoor into the target model. In addition, during the inference phase of the backdoor model, the attacker also needs to embed the backdoor trigger into the test sample to activate the backdoor in the backdoor model, and since the backdoor trigger is not a semantic feature of the sample, it is easy to be discovered. In contrast, semantic backdoor attacks are more difficult to detect because their semantic backdoor triggers are semantic features that naturally exist in the sample, such as a certain car body color or a specific name in the text; second, in a semantic backdoor attack, if the test sample does not contain the corresponding semantic feature, the attacker can embed the semantic backdoor trigger by modifying the input sample during the inference phase to activate the semantic backdoor in the backdoor model. If the test sample naturally contains the semantic backdoor trigger, the attacker does not even need to modify the test sample to activate the semantic backdoor. Therefore, semantic backdoor attacks are more difficult to detect and more concealed than non-semantic backdoor attacks, which poses a serious security threat to neural network models.
[0006] Currently, there is little research on defense methods against semantic backdoor attacks on GCNs, which mainly face the following three difficulties: 1) The complexity and high dimensionality of graph data increase the difficulty of defense; 2) The hidden nature of semantic triggers makes identification and detection difficult; 3) Defense methods against traditional backdoor attacks are not applicable to semantic backdoor attacks.
[0007] In recent years, many defense methods have been proposed against backdoor attacks on graph neural networks. However, these defense methods are mainly aimed at defending against traditional non-semantic backdoor attacks and are not suitable for defending against semantic backdoor attacks. The effects of these methods on defending against semantic backdoor attacks are not satisfactory. Summary of the invention
[0008] The purpose of the present invention is to provide a method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks, which improves the defense performance against backdoor attacks.
[0009] The purpose of the present invention can be achieved by the following technical solutions:
[0010] A detection and defense method for semantic backdoor attacks on graph convolutional neural networks, comprising the following steps:
[0011] Obtaining a graph convolutional neural network model and a graph sample dataset used to train the graph convolutional neural network model;
[0012] Based on the graph sample dataset and graph convolutional neural network model, a semantic backdoor detection module is used to detect semantic backdoors, and the corresponding semantic triggers and target categories of backdoor attacks are further identified;
[0013] Based on the graph convolutional neural network model, combined with the semantic trigger and the target category of the backdoor attack, a semantic backdoor removal module is used to remove the semantic backdoor, so as to obtain a graph convolutional neural network model without a semantic backdoor, so as to defend against semantic backdoor attacks on the graph convolutional neural network model.
[0014] Furthermore, the image sample dataset is Figure 2 Classification sample dataset.
[0015] Furthermore, the step of using the semantic backdoor detection module to detect the semantic backdoor includes:
[0016] Calculate the importance score of each edge of each graph sample in the graph sample data set to the prediction result of the graph convolutional neural network model;
[0017] Based on the importance score of each edge, calculate the importance score of each node of each graph sample in the graph sample dataset to the prediction result of the graph convolutional neural network model;
[0018] Based on the importance score of each node, calculate the importance score of each node label of each graph sample in the graph sample data set to the graph convolutional neural network model reasoning process;
[0019] Based on the importance score of each node label, it is determined whether the graph convolutional neural network model has a semantic backdoor, and the detection process is completed.
[0020] Furthermore, the importance score of each edge is calculated using the integral gradient method, and the calculation expression is:
[0021]
[0022] In the formula, IG i is the importance score of the i-th edge, n represents the to x is divided into n path points, i represents the i-th component of each vector, corresponding to the i-th edge in the input graph sample, is the gradient of the model at the path point, is the baseline, which is a one-dimensional vector with a length equal to the number of edges in the input graph sample, The value is all 0, x is a length and The same one-dimensional vector has all x values 1.
[0023] Furthermore, the importance score of each node is calculated using weighted degree centrality, and the specific calculation process includes:
[0024] Calculate the sum of the importance scores of all edges connected to the node, then average them to get the importance score of the node, and repeat this process to get the importance score of each node.
[0025] Furthermore, after obtaining the importance score of each node, the following steps are also included:
[0026] The importance score of each node is normalized by minimum-maximum normalization, and the expression of the minimum-maximum normalization is:
[0027]
[0028] In the formula, S scale is the normalized importance score, S is the original node importance score, min(S) and max(S) are the minimum and maximum values of the original node importance scores.
[0029] Furthermore, the importance score of each node label is calculated by the following steps:
[0030] The importance scores of nodes with the same label are summed up and then averaged to obtain the importance score of each node label.
[0031] Furthermore, the step of determining whether the graph convolutional neural network model has a semantic backdoor includes:
[0032] Filter out node labels in the graph sample data set whose occurrence times are less than a first set value;
[0033] For the remaining node labels, whether there is a semantic backdoor is determined based on the importance score of each node label in the two categories. If the importance score of a node label in one category is higher than the second set value, and the importance score in the other category is lower than the third set value, it indicates that there is a semantic backdoor in the graph convolutional neural network model. Otherwise, it indicates that there is no semantic backdoor.
[0034] Furthermore, the step of identifying the corresponding semantic trigger and target category of the backdoor attack includes:
[0035] The node labels where semantic backdoors are detected are used as semantic triggers, and the categories with higher importance scores are used as target categories for backdoor attacks.
[0036] Furthermore, the step of obtaining a graph convolutional neural network model that does not contain a semantic backdoor includes:
[0037] Selecting suspected backdoor samples that contain the semantic trigger and belong to the target category from the graph sample dataset, and modifying the target category of some of the suspected backdoor samples to a non-target category to form a new graph sample dataset;
[0038] The graph convolutional neural network model is retrained using the new graph sample dataset as a training dataset to remove the semantic backdoor in the graph convolutional neural network model and obtain a graph convolutional neural network model that does not contain a semantic backdoor.
[0039] Compared with the prior art, the present invention has the following beneficial effects:
[0040] (1) The present invention can detect and remove Figure 2 The semantic backdoor in the graph convolutional neural network model of the classification task eliminates the security threat of semantic backdoor attacks and ensures that the graph convolutional neural network model works normally and reliably.
[0041] (2) The present invention can detect the hidden semantic backdoors in the graph convolutional neural network by deeply analyzing the contribution of each node label in the computational graph sample data set to the graph convolutional neural network model reasoning process, and further identify the hidden semantic backdoor triggers and target categories of the backdoor attack. Based on this, a clean training data set is constructed, and the semantic backdoors in the graph convolutional neural network are removed by retraining, which effectively solves the problem of using the backdoors in the graph convolutional neural network to attack the semantic backdoors. Figure 2 Defense against semantic backdoor attacks on graph convolutional neural networks for classification tasks. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 It is a schematic diagram of the defense method of GCNs semantic backdoor attack of the present invention;
[0043] Figure 2This is a flowchart of the semantic backdoor detection of the present invention. DETAILED DESCRIPTION
[0044] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.
[0045] This embodiment provides a detection and defense method for semantic backdoor attacks on graph convolutional neural networks. After obtaining the GCNs model to be detected and its training set, the method first detects whether the model has a semantic backdoor. If a semantic backdoor is detected in the model, the corresponding semantic trigger and target category are further identified, and then the semantic backdoor in the GCNs model is removed by a model reconstruction method.
[0046] In order to avoid confusion with the category of the graph sample, we will refer to the category of the node in the graph sample as the label. Figure 1 As shown in FIG, the method includes two modules: (1) a semantic backdoor detection module; and (2) a semantic backdoor removal module. First, the obtained GCNs model to be detected and its training data set are passed through the semantic backdoor detection module to detect whether there is a semantic backdoor in the model. If the existence of a semantic backdoor is detected, the semantic backdoor in the GCNs model is further removed by the semantic backdoor removal module, and finally a clean GCNs model without a semantic backdoor is output. If the existence of a semantic backdoor is not detected in the semantic backdoor detection module, the operation of the semantic backdoor removal module is not performed. Figure 1 As shown, the method comprises the following steps:
[0047] (1) The semantic backdoor detection module detects semantic backdoors.
[0048] Assume that f represents the target GCNs model to be detected, and D represents the original training set used to train f. Figure 2 Classification task (the categories of graph samples in dataset D are represented by 0 and 1 respectively). According to the categories of graph samples, D is divided into two parts, which are denoted as D 0 and D 1 , where D 0 represents the set of all image samples with category 0 in D, D 1 Represents the set of all image samples with category 1 in D. The process of the semantic backdoor detection module is as follows Figure 2 As shown, it includes the following 4 steps:
[0049] 1) Calculate the importance score of each edge of each graph sample;
[0050] 2) Calculate the importance score of each node of each graph sample;
[0051] 3) Calculate the importance score of each node label in the dataset;
[0052] 4) Determine whether the GCNs model has a semantic backdoor. If so, further determine the semantic trigger node and the target category of the backdoor attack.
[0053] Specifically:
[0054] 1) Calculate the data set D separately 0 and D 1 The importance score of each edge in each graph sample to the prediction result of the GCNs model (referred to as the importance score of each edge).
[0055] Use the GCNs model to be tested to analyze D 0 and D 1 Inference (i.e. prediction) is performed on all graph samples in the model. During the inference process, the integrated gradient method is used to calculate the contribution of each edge in each graph sample to the prediction result. The core idea of the integrated gradient method is to calculate the contribution of the input feature from the baseline (usually a full zero vector) to the actual input value to the model output result through integration. However, since the integral calculation is difficult, the integral is eventually converted into a sum of n items to approximate the integral value, as shown in the following formula:
[0056]
[0057] In the above formula is the baseline, which is a one-dimensional vector with a length equal to the number of edges in the input graph sample, The values are all 0. x is a length and The same one-dimensional vector, x value is all 1. i represents the i-th component of each vector, corresponding to the i-th edge in the input graph sample. n represents the number of edges from To x is divided into n path points, α is one of the specific path points (α∈[0,1]), and all edge weights of the input graph samples at this path point are set to a. is the gradient of the model at the path point, is the connection between x and A straight line, where The above formula is used to calculate the importance score of each edge in the input graph sample to the prediction result of the GCNs model. The larger the score value, the greater the contribution of the edge to the prediction result of the GCNs model.
[0058] In addition, in the semantic backdoor attack detection module, the contribution of each node in the input graph sample to the prediction result of the GCNs model can be obtained through the interpretative methods of other models, thereby identifying the corresponding semantic trigger nodes and target categories.
[0059] 2) Calculate D separately 0 and D 1 The importance score of each node in each graph sample to the prediction result of the GCNs model (referred to as the importance score of each node).
[0060] According to the D obtained in the first step above 0 and D 1 The importance score of each edge in each graph sample to the prediction result of the GCNs model is calculated separately. 0 and D 1 The contribution of each node in each graph sample to the prediction results of the GCNs model. The weighted degree centrality is used to calculate the importance score of each node. The specific method is that the importance score of each node in the graph sample is equal to the average of the importance scores of all edges connected to the node. After calculating the importance scores of all nodes in a graph sample, in order to facilitate subsequent comparison, they are normalized to the minimum and maximum according to the following formula and scaled to the interval [0,1]. S represents the importance score of the node.
[0061]
[0062] 3) Calculate the data set D separately 0 and D 1 The importance score of each label node in the GCNs model reasoning process (referred to as the importance score of each node label).
[0063] Right D 0 and D 1 For all graph samples in , according to the importance score of each node obtained in the second step above, the importance scores of the nodes with the same label are summed and averaged to obtain the importance score of the node label in category 0 or category 1. The importance score of each node label is in the range of [0,1]. The closer the score is to 1, the higher the importance of the node label in the model's reasoning process.
[0064] 4) Determine whether there is a semantic backdoor in the GCNs model and identify the semantic trigger nodes and target categories.
[0065] After obtaining the importance scores of each node label in the two categories, the following method is used to determine whether there is a semantic backdoor in the GCNs model to be tested: First, filter out some node labels that appear less than 30 times in the data set. Nodes with these rarely appearing labels will not be used as semantic backdoor trigger nodes. Then, based on the difference in the importance scores of each node label in the two categories, determine whether there is a semantic backdoor. If the importance score of a node label is higher than 0.8 in one category and lower than 0.2 in the other, it indicates that there is a semantic backdoor in the GCNs model to be tested, and the node of this label is the semantic backdoor trigger node, and the category with a higher importance score is the target category.
[0066] (2) The semantic backdoor removal module removes the semantic backdoor.
[0067] If a semantic backdoor is detected in the GCNs model, the semantic backdoor removal operation is further performed. The semantic backdoor removal module includes two steps:
[0068] First, we select suspected backdoor samples that contain semantic trigger nodes and belong to the target category from the original training set, and change the category of 80% of the suspected backdoor samples from the target category to the non-target category, thereby obtaining a new training dataset.
[0069] Then, the new training dataset is used to retrain the GCNs model to remove the semantic backdoor in the GCNs model, and a clean GCNs model without semantic backdoor is obtained, thereby effectively defending against semantic backdoor attacks on the GCNs model.
[0070] The method of the present invention can automatically detect Figure 2 In the classification task, whether there is a semantic backdoor in the target GCNs model, if the existence of the semantic backdoor is detected, the corresponding semantic trigger node and target category are identified, and then a clean GCNs model without the semantic backdoor is obtained by constructing new training data and retraining. The method of the present invention can detect and remove semantic backdoor attacks in GCNs. After implementing the method, the attack success rate of the semantic backdoor attack in the retrained GCNs model without the semantic backdoor is greatly reduced, and the normal prediction performance of the model for clean samples is not affected.
[0071] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.
[0072] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present invention may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.
[0073] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0074] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0076] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.
[0077] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.
Claims
1. A detection and defense method for semantic backdoor attacks on graph convolutional neural networks, characterized in that: The following steps are involved: Obtaining a graph convolutional neural network model and a graph sample dataset used to train the graph convolutional neural network model; Based on the graph sample dataset and graph convolutional neural network model, a semantic backdoor detection module is used to detect semantic backdoors, and the corresponding semantic triggers and target categories of backdoor attacks are further identified; Based on the graph convolutional neural network model, combined with the semantic trigger and the target category of the backdoor attack, a semantic backdoor removal module is used to remove the semantic backdoor, so as to obtain a graph convolutional neural network model without a semantic backdoor, so as to defend against semantic backdoor attacks on the graph convolutional neural network model.
2. According to claim 1, a method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks is characterized in that: The image sample dataset is an image binary classification sample dataset.
3. According to claim 1, a method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks is characterized in that: The step of using the semantic backdoor detection module to detect the semantic backdoor includes: Calculate the importance score of each edge of each graph sample in the graph sample data set to the prediction result of the graph convolutional neural network model; Based on the importance score of each edge, calculate the importance score of each node of each graph sample in the graph sample dataset to the prediction result of the graph convolutional neural network model; Based on the importance score of each node, calculate the importance score of each node label of each graph sample in the graph sample data set to the graph convolutional neural network model reasoning process; Based on the importance score of each node label, it is determined whether the graph convolutional neural network model has a semantic backdoor, and the detection process is completed.
4. According to claim 3, a method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks is characterized in that: The importance score of each edge is calculated using the integral gradient method, and the calculation expression is: In the formula, IG i is the importance score of the i-th edge, n represents the to x is divided into n path points, i represents the i-th component of each vector, corresponding to the i-th edge in the input graph sample, is the gradient of the model at the path point, is the baseline, which is a one-dimensional vector with a length equal to the number of edges in the input graph sample, The value is all 0, x is a length and The same one-dimensional vector, with all x values being 1.
5. According to claim 3, a method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks is characterized in that: The importance score of each node is calculated using weighted degree centrality. The specific calculation process includes: Calculate the sum of the importance scores of all edges connected to the node, then average them to get the importance score of the node, and repeat this process to get the importance score of each node.
6. A method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks according to claim 5, characterized in that: After obtaining the importance score of each node, the following steps are also included: The importance score of each node is normalized by minimum-maximum normalization, and the expression of the minimum-maximum normalization is: In the formula, S scale is the normalized importance score, S is the original node importance score, min(S) and max(S) are the minimum and maximum values of the original node importance scores.
7. A method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks according to claim 3, characterized in that: The importance score of each node label is calculated by the following steps: The importance scores of nodes with the same label are summed up and then averaged to obtain the importance score of each node label.
8. The method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks according to claim 3, characterized in that: The step of determining whether the graph convolutional neural network model has a semantic backdoor comprises: Filter out node labels in the graph sample data set whose occurrence times are less than a first set value; For the remaining node labels, whether there is a semantic backdoor is determined based on the importance score of each node label in the two categories. If the importance score of a node label in one category is higher than the second set value, and the importance score in the other category is lower than the third set value, it indicates that there is a semantic backdoor in the graph convolutional neural network model. Otherwise, it indicates that there is no semantic backdoor.
9. A method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks according to claim 8, characterized in that: The step of identifying the corresponding semantic trigger and the target category of the backdoor attack includes: The node labels where semantic backdoors are detected are used as semantic triggers, and the categories with higher importance scores are used as target categories for backdoor attacks.
10. A method for detecting and defending against semantic backdoor attacks on graph convolutional neural networks according to claim 1, characterized in that: The step of obtaining a graph convolutional neural network model that does not contain a semantic backdoor includes: Selecting suspected backdoor samples that contain the semantic trigger and belong to the target category from the graph sample dataset, and modifying the target category of some of the suspected backdoor samples to a non-target category to form a new graph sample dataset; The graph convolutional neural network model is retrained using the new graph sample dataset as a training dataset to remove the semantic backdoor in the graph convolutional neural network model and obtain a graph convolutional neural network model that does not contain a semantic backdoor.