A backdoor attack generation method, system and device for rumor detector

Abstract

The present invention discloses a backdoor attack generation method, system and device for rumor detectors, and relates to the technical fields of rumor detection and backdoor attack. The method comprises: obtaining a rumor propagation graph; using degree centrality and similarity between nodes and root nodes to respectively generate importance scores of node structures and features of the propagation graph, and screening out attachment nodes according to the importance scores; constructing an adaptive feature generator, using node features of attachment nodes as input to generate aggressive adaptive trigger nodes; adding similarity constraints to node features so that trigger node features can adaptively approach features of attachment nodes; using the adaptive feature generator to adaptively generate corresponding node features for each trigger node, injecting a certain proportion of trigger nodes with node features into attachment nodes, and generating a backdoor graph for attacking the rumor detector; the method effectively destroys the performance of a propagation-based rumor detector and can be transferred between different architectures.

Description

Technical Field

[0001] The present invention relates to the technical field of rumor detection and backdoor attack, and in particular to a backdoor attack generation method, system and device for a rumor detector. Background Art

[0002] With the rapid development of the internet, social media has become a vital channel for users to obtain information and communicate. However, a large amount of inaccurate and unverified information, especially malicious information such as rumors, spreads rapidly and widely, causing significant harm to society. Therefore, detecting rumors on social platforms is crucial.

[0003] Deep learning plays a crucial role in rumor detection, automatically and efficiently learning feature vectors containing deep semantic information from rumor text and images. For example, methods based on recurrent neural networks (RNNs) can effectively capture temporal relationships between posts. Methods based on convolutional neural networks (CNNs) can learn local spatial feature representations of rumors. However, these methods primarily focus on the textual information of rumors, neglecting the structural information inherent in rumor propagation. This structural information is crucial because it reflects the interrelationships between posts, reveals the collective wisdom and stances of user comments, and is a key feature for distinguishing rumors from non-rumors. Therefore, to enhance detection capabilities, recent research has begun to incorporate propagation structure into rumor detection models by leveraging graph neural networks (GNNs) and integrating other advanced techniques. The propagation structure of rumors provides valuable insights into how the stances expressed in the original posts spread and evolve over time.

[0004] While propagation-based methods have demonstrated impressive performance in rumor detection, malicious users and actors can exploit vulnerabilities in graph neural networks (GNNs) to evade or interfere with rumor detection results, raising concerns about the security of rumor detectors. While recent research has focused on adversarial attacks, such as exploring the vulnerabilities of GNN-based rumor detectors under structural adversarial attacks using a reinforcement learning framework, another type of attack—backdoor attacks—has been largely overlooked. In a backdoor attack, a target model is poisoned by injecting triggers and modifying labels within a small portion of the training set. After training, the model operates normally on clean samples but misclassifies samples containing the trigger as having the attacker's desired label. This allows attackers to covertly alter detection results while the system is running. Such attacks can bypass initial security reviews and testing, posing a significant threat to rumor detection models.

[0005] Several studies have explored backdoor attacks against graph neural networks (GNNs). These attacks typically perturb the graph topology to form fixed-size subgraph triggers, which perform well in graph classification tasks but are not suitable for rumor detection tasks because the propagation tree sizes vary greatly. More importantly, rumor propagation trees are significantly different from graphs, and attempts to attack them suffer from the following drawbacks: (i) Any perturbation to their structure is easily detectable, such as Figure 1 As shown, adding edges may destroy the tree structure, and deleting edges may destroy links. Furthermore, on real social platforms, attackers cannot tamper with social records posted by other users. Even if users delete posts, social platforms may retain historical information. (ii) Selecting appropriate content as a trigger for feature injection is also a major challenge. The content of the injected post must be relevant to the topic of the post it replies to while retaining attack properties to evade detection and effectively trigger the backdoor. This dual requirement of contextual relevance and effectiveness poses a significant challenge to implementing backdoor attacks on rumor detectors. Summary of the Invention

[0006] In view of the shortcomings of existing attack technologies that are easily detected when attacking rumor propagation trees and are not suitable for rumor detection tasks, the present invention proposes a backdoor attack generation method, system and device for rumor detectors. By constructing an adaptive discrete trigger generator, trigger nodes are injected into key nodes to create a covert and transferable attack, thereby solving the problems existing in the existing technology.

[0007] A backdoor attack generation method for rumor detectors includes the following steps:

[0008] Obtain a rumor propagation graph; the rumor propagation graph includes a graph node set consisting of source posts and their comments and an edge set consisting of the relationship between each comment or between the source post and the comment;

[0009] The importance scores of the node structure and features of the rumor propagation graph are generated by using degree centrality and the similarity between the node and the root node, respectively. The degree centrality is used to measure the degree of the node as the centrality of the node. The root node represents the source post, the node represents the comment of the source post, and the degree of the node represents the number of edges connected to each node. The highest importance scores are selected after sorting the importance scores. MNodes are used as attachment nodes, and a trigger node is attached to each attachment node; comments newly added outside the original propagation graph are used as trigger nodes; an adaptive feature generator is constructed, which uses the node features of the attachment nodes as input to generate aggressive adaptive trigger nodes, and adds similarity constraints to the node features so that the trigger nodes can adaptively approach the node features of the attachment nodes; the adaptive feature generator is used to adaptively generate corresponding node features for each trigger node, and the trigger nodes with node features are injected into the attachment nodes to generate a backdoor graph;

[0010] The generated backdoor graph is used to attack the propagation-based rumor detector to test its security.

[0011] Furthermore, the degree centrality and the similarity between the node and the root node are used to generate the importance scores of the node structure and features of the propagation graph respectively. S ( v ), expressed as:

[0012]

[0013] in, sim (·) represents the cosine similarity function, φ c (·) is a node v The node centrality value of β is the fusion factor used to control the ratio of the two indicators, x root and x v Represent the characteristics of the root node and the attached node respectively.

[0014] Furthermore, the constraints of the adaptive feature generator are expressed as:

[0015]

[0016] in, x u 、 x v Represents the generated trigger nodes u and attachment nodes v Features, T represents the cosine similarity threshold, E g Represents the edge set containing the edges connecting the trigger node and the attachment node.

[0017] Furthermore, the adaptive feature generator is used to adaptively generate corresponding node features for each trigger node, which is expressed as:

[0018]

[0019] in W 1. W 2. b 1 and b 2 is the parameter that the feature generator can learn, σ (·) is the activation function.

[0020] Furthermore, the backdoor diagram G gt Expressed as:

[0021]

[0022] in, G Represents a clean image, Indicates that the trigger g t A mixin function that is injected into a given graph to generate a backdoor graph, M represents the number of attached nodes, A Ggt Represents the adjacency matrix of the backdoor graph, A G Adjacency matrix representing the clean embedded graph.

[0023] The present invention also proposes a backdoor attack generation system for rumor detectors, comprising:

[0024] An acquisition module is used to obtain a rumor propagation graph; the rumor propagation graph includes a graph node set consisting of source posts and their comments and an edge set consisting of the relationship between each comment or between the source post and the comment;

[0025] The generation module is used to generate the importance scores of the node structure and features of the rumor propagation graph using degree centrality and the similarity between the node and the root node, wherein the degree centrality is used to measure the degree of the node as the centrality of the node, the root node represents the source post, the node represents the comment of the source post, and the degree of the node represents the number of edges connected to each node; the importance scores are sorted and the highest scores are selected. M Nodes are used as attachment nodes, and a trigger node is attached to each attachment node; comments newly added outside the original propagation graph are used as trigger nodes; an adaptive feature generator is constructed, which uses the node features of the attachment nodes as input to generate aggressive adaptive trigger nodes, and adds similarity constraints to the node features so that the trigger nodes can adaptively approach the node features of the attachment nodes; the adaptive feature generator is used to adaptively generate corresponding node features for each trigger node, and the trigger nodes with node features are injected into the attachment nodes to generate a backdoor graph;

[0026] The attack module is used to attack the rumor detector based on propagation through the generated backdoor graph to test the security of the rumor detector.

[0027] The present invention also proposes a computer device for generating a backdoor attack for a rumor detector, comprising: a memory, a processor, and a computer program stored in the memory. When the processor executes the computer program, the steps of the method for generating a backdoor attack for a rumor detector are implemented.

[0028] The present invention also proposes a readable storage medium, which stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, they are used to execute the steps of the backdoor attack generation method for the rumor detector.

[0029] The present invention provides a backdoor attack generation method for rumor detectors, which has the following beneficial effects:

[0030] The present invention proposes a backdoor attack framework for a propagation-based rumor detection method, which aims to launch targeted attacks on specific rumors while maintaining the overall performance of the rumor detector unaffected. By screening out attachment nodes and their trigger nodes, an adaptive feature generator is proposed to mislead the model to capture the hidden association between the trigger and the target class. It can use the node features of the attachment nodes as input to generate aggressive adaptive trigger nodes, thereby creating a covert and transferable attack. In this way, newly added comments outside the original propagation graph can be used as trigger nodes to simulate the controlled behavior of users in rumor propagation to attack the propagation-based rumor detector, thereby solving the problem that existing attack technologies are easily detected when attacking the rumor propagation tree and are not suitable for rumor detection tasks. By attacking the propagation-based rumor detector with the backdoor attack generated by the present invention, the test effect of the rumor detector is improved, and the security of rumor detection is further enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Schematic diagram of the difference between backdoor attacks and propagation trees in the background art; (a) shows an example diagram of injecting a backdoor trigger into a graph; (b) shows an example diagram of injecting a backdoor trigger into a rumor propagation tree;

[0032] Figure 2 Schematic diagram of the overall framework of the injection-based backdoor attack (IBAttack) in an embodiment of the present invention;

[0033] Figure 3 Schematic diagram of average similarity distribution in an embodiment of the present invention;

[0034] Figure 4 Schematic diagram of the effect of trigger size on attack effect in an embodiment of the present invention;

[0035] Figure 5Schematic diagram of the effect of trigger size on attack concealment in an embodiment of the present invention;

[0036] Figure 6 Schematic diagram of the impact of poisoning rate on Twitter 16 in an embodiment of the present invention;

[0037] Figure 7 Schematic diagram of hyperparameter sensitivity analysis of T and α in an embodiment of the present invention;

[0038] Figure 8 Schematic diagram of the hyperparameter sensitivity analysis of β in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0040] This paper proposes an injection-based backdoor attack (IBAttack), an adaptive trigger generation framework for propagation-based rumor detectors. To adapt to the structure of rumor propagation, this paper employs a discrete trigger structure and generates adversarial node features that are contextually relevant to the original post. These triggers are then attached to key representative nodes, generating a powerful, covert, and transferable backdoor attack.

[0041] Rumor detection based on propagation: The rumor detection task can be defined as a graph-level classification task. Specifically, the rumor detection dataset is represented as ,in It is i events, n is the number of events, each event Including its communication structure ,in and Represents the graph node set (source post and its comments) and edge set (relationships between replies or between source post and reply), as well as their true labels (i.e., not rumor or rumor) or fine-grained labels (i.e. non-rumor, false rumor, true rumor, unconfirmed rumor). Given a dataset, the goal of the rumor detection task is to learn a classifier:

[0042] (1)

[0043] Each picture G Map to A tag in . f The parameters of are optimized by gradient descent using the loss function (e.g. cross entropy) learned on labeled datasets.

[0044] Backdoor attack on rumor detector: The backdoor attack injects malicious functions into the target model as hidden neuron Trojans. When the trigger exists, the hidden Trojan will be activated and mislead the model to obtain the expected output.

[0045] Attacker's Goal: The attacker uses the backdoor attack to influence the final trained rumor detector. There are two goals: (i) The backdoor rumor detection model should predict the expected label on the propagation graph with triggers. (ii) The backdoor attack should not affect the accuracy of the rumor detection model on the benign propagation graph, making the attack stealthy. Therefore, the attack goal can be defined as:

[0046] (2)

[0047] in, G Represents a clean image, is the target attack category, represents a mixin function that injects triggers into a given graph to generate a backdoor graph, and They represent benign rumor detector and backdoor rumor detector respectively.

[0048] Figure 1 Schematic diagrams illustrating the difference between a backdoor attack and a propagation tree. (a) shows an example graph of a backdoor trigger injected into a graph; (b) shows an example graph of a backdoor trigger injected into a rumor propagation tree. The subgraph consisting of red nodes and edges represents the trigger. Due to the complex graph structure, the graph with the embedded trigger remains roughly similar in structure to the original graph, allowing backdoor attacks to evade detection.

[0049] The overall framework of the attack of the present invention is as follows Figure 2 As shown. Unlike existing backdoor attack methods for graph classification tasks, the triggers in the attack of the present invention are more flexible and are represented by multiple discrete new nodes. Specifically, the present invention selects the most vulnerable and important nodes as attachment nodes and injects new nodes into them to create a backdoor graph. Then, a feature generator is trained to adaptively generate features for these injected nodes. In this way, malicious comments (comments added outside the original propagation graph) can be used as trigger nodes to simulate the controlled behavior of users in rumor propagation, thereby attacking the rumor detector based on propagation. The method specifically includes:

[0050] Adaptive trigger generation;

[0051] To maintain the integrity of the original graph, this paper employs a trigger strategy consisting of discrete injection nodes. This strategy connects new nodes with a certain budget to the propagation graph to form a further evolving rumor propagation tree. Based on this trigger structure, the objectives of this paper are decomposed into attachment node selection, trigger feature generation, and trigger injection.

[0052] (1) Attached Nodes Selection: This paper designs an attached node selection scheme to decide which nodes the injected node should be connected to. Since the graph neural network (GNN) model aggregates information by learning the characteristics of nodes and their neighbors, key nodes are crucial for transmitting information in the graph structure. Cui and Jia (2024) analyzed the structural characteristics of the rumor propagation tree (RPT) and summarized three principles for assigning importance scores to nodes to improve rumor detection performance. Similarly, connecting the trigger node to important nodes can achieve better attack performance than randomly injecting nodes. IBAttack recommends the use of two node importance metrics, including degree centrality and the similarity between the node and the root node.

[0053] Degree centrality measures the centrality of a node by its degree. Multiple studies have shown that nodes with lower degrees are less robust to attacks than nodes with higher degrees. Intuitively, posts with a high number of discussions and replies are less susceptible to being compromised.

[0054] The similarity between a node and the root node. In a rumor propagation tree, the root node, as the source post, usually contains more important and richer information. Intuitively, nodes with lower similarity to the root node are more likely to influence the entire propagation graph.

[0055] The present invention uses the above two metrics to reflect the importance of node structure and features respectively. In different situations, different strategies or combinations of the two metrics can be used to obtain the importance score:

[0056]

[0057] Among them, sim(·) represents the cosine similarity function, φ c (·) is a node v The node centrality value of β It is a fusion factor used to control the ratio of the two indicators. x root and x v Represent the characteristics of the root node and the node respectively. For the candidate graph, the present invention selects the top nodes according to the importance score. m Nodes are used as attachment nodes, and each attachment node is attached with a trigger node. The budget and injection process will be described in the trigger injection module.

[0058] (2) Triggering feature generation: Real-world graphs, such as social networks, usually exhibit homogeneity, that is, nodes with similar features are connected by edges. Rumor propagation graphs are no exception. The average similarity distribution between nodes in Twitter15 and Twitter16 is as follows: Figure 3 As shown in Figure 2. Most graphs exhibit extremely high homogeneity, as all nodes in the propagation graph represent discussions related to the source post. Therefore, the reply content is more likely to embed the same topic information as the original post. Based on this phenomenon, the present invention adds similarity constraints to node features, so that the triggering node can adaptively approach the features of the attached node. Let E g represents the edge set that connects the trigger node with the attachment node. The constraints on the generated adaptive trigger can be written as:

[0059]

[0060] in, x u 、 x v Represent the characteristics of the generated trigger node and attachment node, T is a relatively high cosine similarity threshold that can be adjusted based on the dataset.

[0061] To generate an adaptive trigger node similar to the attached node, the adaptive feature generator takes the node features of the attached node as input. Specifically, unlike the adversarial attack that learns and generates adversarial perturbations for each graph, the present invention designs and trains a feature generator to mislead the model to capture the hidden association between the trigger and the target class. The method of generating the injection node feature is expressed as follows:

[0062]

[0063] in W 1. W 2. b 1 and b 2 is the learnable parameter of the feature generator, σ (·) is the activation function.

[0064] (3) Trigger injection: For each graph G to be injected with trigger points, the present invention obtains M attachment nodes according to the attachment node selection. Then, the trained feature generator is used to adaptively generate corresponding node features for each trigger node. Then, the mixing function m(·) takes the M trigger nodes with generated features as g t Inject its attached nodes while keeping the original edges and nodes unchanged. Formally, the backdoor graph can be expressed as:

[0065]

[0066] in, G Represents a clean image, Indicates that the trigger g t A mixin function that is injected into a given graph to generate a backdoor graph, M represents the number of attached nodes, A Ggt Represents the adjacency matrix of the backdoor graph, A G Represents the adjacency matrix of the clean graph.

[0067] To ensure that backdoor attacks go undetected, the present invention randomly samples a certain number of candidate graphs to obtain backdoor graphs. These graphs are then placed into a training dataset and used in the target model training phase to inject the hidden Trojan (i.e., the trigger pattern of the present invention). Once the backdoor model is trained, a trigger can be inserted into any graph during the testing phase to activate the Trojan. Notably, due to the wide variation in rumor propagation tree (RPT) size, the present invention flexibly controls the trigger node size (i.e., the injection budget) for different samples, adjusting it based on the number of nodes in each graph. The ratio of trigger node size to graph size can vary at different stages.

[0068] Feature loss function: Considering the similarity constraint in formula (4), the key idea is to ensure that the attachment node is connected to the trigger node with high cosine similarity to improve the concealment of the trigger node and the reliability of the edge. This paper defines a differentiable similarity loss to help optimize the feature generator:

[0069]

[0070] Where T represents the similarity threshold. This loss is applied between all attached nodes and their triggering nodes to ensure that the generated triggering nodes meet the similarity constraint. During the training phase, the present invention randomly selects attached nodes to mitigate the risk of overfitting.

[0071] For a trained model, candidate graphs before trigger injection tend to be classified as their true labels. Under the multiple constraints of structure, content, and budget, the attacker needs the model to associate the trigger pattern with the target label as closely as possible. Therefore, to ensure the effectiveness of generating trigger nodes, this paper optimizes the adaptive trigger feature generator to attack the surrogate model. f θ ∗. Specifically, the attack loss can be defined as:

[0072]

[0073] in, f θ ∗( · )y and f θ ∗( · ) yt Represent the true labels y and target label y t The log-probability output.

[0074] Optimization: The present invention converts the data set C Divided into two parts: target class y t Figure C[y t ] and other graphs in C[\y t ],C[\y t ] is used to train the feature generator. L atk The trigger point is forced to be embedded in the graph C[y t ] have similar embeddings. s Ensure similarity constraints. Therefore, the attack target of the present invention can be expressed as the following optimization problem:

[0075]

[0076] in, It is a trade-off hyperparameter used to balance the two terms of the loss function; is the loss function for training the rumor detector (the proxy model in our attack).

[0077] Experiments have shown that:

[0078] This paper conducts experiments on three real-world rumor datasets, including Twitter16, Twitter15, and Pheme. Detailed statistics are shown in Table 1. Non-rumor or False Rumor is selected as the target category because attackers usually hope that rumors can bypass detection.

[0079] Table 1 Dataset statistics

[0080]

[0081] Surrogate Models and Rumor Detectors:

[0082] GCN (Graph Convolutional Neural Network), GAT (Graph Attention Network), and Graph-SAGE (a graph neural network model for graph node embedding learning) are three classic GNN models, often used in graph classification tasks. The effectiveness of these attacks was tested by attacking them and using them as proxy models to attack specialized rumor detection models. BiGCN is a GCN-based model that leverages rumor propagation and diffusion to capture the global structure of rumor trees. EBGCN uses a Bayesian approach to capture robust structural features and adaptively reconsider the reliability of underlying relationships. Their performance on clean datasets is shown in Table 2:

[0083] Table 2 Accuracy of the model on the clean dataset

[0084]

[0085] Two metrics are used to evaluate the effectiveness and stealth of the attack. The first metric is the attack success rate (ASR), which measures the success rate of the backdoor rumor detector in predicting the backdoor image as a specified category:

[0086]

[0087] The second metric is Clean Accuracy Drop (CAD), which is used to measure the difference in prediction classification accuracy between the clean rumor detector and the backdoor rumor detector on the clean test dataset.

[0088] Since there have been no previous attempts to attack propagation-based detectors, we select five existing graph classification backdoor attack methods to verify the performance of IBAttack, and compare them with its heuristic variants IBAttack / F and IBAttack / S as benchmarks: (1) ER-B generates universal triggers through the Erd'os-R'enyi (ER) model; (2) MIA selects the most important nodes from the GNN interpreter and replaces their connections with those of triggers in the graph; (3) GTA updates the trigger generator using a two-layer optimization algorithm to generate adaptive subgraphs as triggers for the graph; (4) TRAP performs perturbation actions on the graph structure through a gradient-based score matrix to generate perturbation triggers for the graph; (5) Motif uses the distribution differences of graphs in the dataset to search for trigger structures. IBAttack / F removes the feature generation module and randomly selects features from other nodes in the graph as the injected trigger node features; IBAttack / S removes the node selection module to randomly select the trigger injection location.

[0089] The dataset splitting rule was applied to all methods. Following the BiGCN setup, each dataset was divided into two parts: 80% for training and 20% for testing. 5% of the non-target classes in the training set were randomly selected as backdoor graphs. The trigger size was set to 10% and 20% of the number of graph nodes during training and testing, respectively. The number of epochs and learning rate during training were set to 100 and 0.001, respectively. All baselines used the optimal parameters.

[0090] Experimental analysis:

[0091] Effectiveness and stealth of attacking rumor propagation trees: IBAttack is compared with baseline methods in terms of effectiveness and stealth on three real-world datasets. For the sake of fairness, GCN is used as the attacked model. The results are shown in Table 3:

[0092] Table 3 Attack results compared with baseline methods (ASR (%) | CAD (%))

[0093]

[0094] According to Table 3, we can conclude that: (1) All the baseline methods for backdoor attacks, except GTA, fail on the rumor propagation tree even when the tree restriction is removed. These methods operate on the structure as a trigger. However, since the nodes of the propagation graph are comments about the source post, connecting two nodes that are not directly related will not have a significant impact on the final graph representation. Although GTA has achieved relatively high performance due to the modification of the trigger features, its trigger structure in the form of a subgraph is still very easy to detect and limits its performance. In contrast, the method of the present invention obtains the best results due to the simultaneous consideration of the structure and feature characteristics of the propagation tree; (2) Compared with IBAttack / F and IBAttack / S, the method of the present invention achieves better results, which proves the effectiveness of the additional node selection module and feature generation module in the framework of the present invention. When the node features are randomly selected, the attack fails like other baseline methods. This shows that the injected attributes will greatly affect the effectiveness of the trigger because the propagation tree restricts the perturbation of the structure. In addition, the location of the trigger is also improved to a certain extent.

[0095] Performance on different rumor detectors. Table 4 shows the results of testing the method of the present invention on different rumor detection models. The method of the present invention achieves extremely high ASR and extremely low CAD on all models. The present invention achieves almost 100% on Pheme, probably because it is relatively easy to attack as a binary classification task. The performance of attacking GAT on Twitter15 and Twitter16 is slightly worse. This is because the attack of this method always adds edge nodes to the graph, and these nodes are often assigned smaller weights by the attention mechanism of GAT, making them less efficient than other models. It is worth mentioning that the present method also achieves excellent results on the robust model EBGCN. This is due to the similarity constraint, which reduces the suspicion of malicious triggering nodes and thus increases the confidence of the edges, which proves the robustness of the attack of the method of the present invention.

[0096] Table 4 Attack results on different rumor detection models

[0097]

[0098] Table 5 Attack results of proxy models using different architectures (ASR (%) | CAD (%))

[0099]

[0100] In addition, Table 5 shows the results of attacking rumor detectors with different architectures using a simple proxy model.

[0101] Our attack method performs well in a black-box setting and demonstrates transferability across different architectures. Using different models as proxy models does not significantly degrade the attack performance, making it applicable to all propagation-based rumor detectors. Furthermore, although the attack performs slightly worse against GAT, using GAT as a proxy model does not affect the effectiveness of the attack.

[0102] Experiments were conducted to explore the impact of different node importance metrics. Table 6 shows the ASR and CAD performance of each model when using different node importance metrics on Twitter16. Closeness centrality is calculated as the inverse of the sum of the shortest path lengths between a node and all other nodes in the graph. PageRank centrality is widely used to rank web pages. Its principle is that the importance of a web page on the internet depends on the number and quality of its inbound links. Among all metrics, node similarity to the root node and degree centrality achieved better results across different datasets. Therefore, these two metrics were selected as the importance score indicators in IBAttack.

[0103] Table 6 Attack results of different node importance metrics (ASR (%) | CAD (%))

[0104]

[0105] The present invention conducts experiments on the number of trigger nodes with different budgets (ie, trigger sizes) in training and testing to explore the attack performance of IBAttack. Figure 4 We present the ASR of BiGCN on two datasets. As the ratio of trigger nodes to graph nodes in the test set increases, the ASR gradually increases, while the trend of the ratio of trigger nodes in the training set is the opposite, and this trend applies to all datasets. Regarding CAD, we only report the changes in the ratio of trigger nodes in the training set, because it is only affected during the training phase, as shown in Figure 2. Figure 5 As shown, while no clear pattern emerges, we can observe that generally larger values ​​correspond to lower CAD. Except when the proportion of triggered nodes on the GAT exceeds 0.1, the overall CAD is less than 2%. Therefore, we choose 0.1 during training and 0.2 during testing to balance effectiveness and stealth.

[0106] The present invention also carried out an experiment to explore the influence of poisoning rate, and the results are as follows Figure 6 As shown. Figure 6 As shown in (a), as the poisoning rate increases, the ASR also increases; however, the increment of ASR decreases as the poisoning rate increases, which indicates that the model of the present invention does not rely on a higher poisoning rate to be successful; Figure 6 As shown in (b), there is an overall increasing trend as the poisoning rate increases, but it remains below 2% in most cases. This trend applies to all datasets.

[0107] This paper further studies the impact of hyperparameters α and T on the performance of IBAttack. α controls the weight of the similarity loss when training the feature generator, and T controls the threshold of the similarity constraint. α and T are set to {0, 100, 500, 800, 1000} and {0.8, 0.85, 0.9, 0.95, 1} respectively. The attack success rate (ASR) and clean accuracy degradation (CAD) of attacking BiGCN on Twitter16 are shown in Figure 1. Figure 7 As shown. Figure 7(a) It can be observed that (i) in general, as α increases, the ASR first increases and then decreases and stabilizes. At the beginning, when the similarity loss is minimal, the generator cannot capture the similarity relationship between the trigger node and the attached node, which makes the characteristics of the trigger more irregular, thereby weakening the performance of the attack. However, when the similarity loss exceeds a certain level, the similarity actually reaches the set threshold. From this point on, a larger value of α will not significantly affect the training of the trigger. (ii) As T increases, the ASR gradually decreases. This is because a larger threshold imposes stricter constraints on the attack budget of the present invention. In the extreme case (i.e., T=1), this means injecting nodes that are exactly the same as the attached post, thereby degenerating the attack of the present invention into non-malicious. As Figure 7 As shown in (b), whether it is α or T, CAD fluctuates within a certain range, but in most cases remains below 2%. In practice, T can be set according to the average similarity of the data set. In addition, the present invention also studies the impact of the hyperparameter β on the performance of IBAttack. In the additional node selection module, β is a fusion factor used to control the ratio of the importance metrics of two nodes. β is set to {0, 0.25, 0.5, 0.75, 1}, Figure 8 (a) Reports the ASR attack on each rumor detection model on Twitter16, Figure 8 (b) Reports the CAD of each rumor detection model attacking Twitter16. For BiGCN, degree centrality is more effective, while for GCN and EBGCN, similarity to the root node is a better metric. For GAT and GraphSAGE, combining these two methods produces better results. Except for GAT, the CAD of all models fluctuates relatively little. We select the optimal β value for different models.

[0108] The present invention proposes an injection-based backdoor attack framework and applies it to a propagation-based rumor detector. Specifically, a node selection module is used to select key nodes as additional nodes to fully utilize the attack budget. By using attack loss and similarity loss, the features of the triggering nodes are adaptively generated to ensure effectiveness and concealment.

[0109] Based on the same inventive concept, the present invention also proposes a backdoor attack generation system for rumor detectors, comprising:

[0110] The acquisition module is used to obtain the rumor propagation graph; the rumor propagation graph includes a graph node set consisting of source posts and their comments and an edge set consisting of the relationship between each comment or between the source post and the comment.

[0111] The generation module is used to generate the importance scores of the node structure and features of the rumor propagation graph using degree centrality and the similarity between the node and the root node. Degree centrality is used to measure the degree of the node as the centrality of the node. The root node represents the source post, the node represents the comment of the source post, and the degree of the node represents the number of edges connected to each node. The importance scores are sorted and the highest scores are selected. M nodes as attachment nodes, and each attachment node is attached with a trigger node; the comments newly added to the propagation graph are used as trigger nodes; an adaptive feature generator is constructed, which takes the node features of the attachment nodes as input to generate aggressive adaptive trigger nodes, and adds similarity constraints to the node features so that the trigger nodes can adaptively approach the node features of the attachment nodes; the adaptive feature generator is used to adaptively generate corresponding node features for each trigger node, and the trigger nodes with node features are injected into the attachment nodes to generate a backdoor graph.

[0112] The attack module is used to attack the rumor detector based on propagation through the generated backdoor graph to test the security of the rumor detector.

[0113] The present invention also proposes a computer device for generating a backdoor attack for a rumor detector, comprising: a memory, a processor, and a computer program stored in the memory. When the processor executes the computer program, the steps of the backdoor attack generation method for the rumor detector are implemented.

[0114] The present invention also proposes a readable storage medium, which stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, they are used to execute the steps of a backdoor attack generation method for a rumor detector.

[0115] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A backdoor attack generation method for rumor detectors, characterized in that: The following steps are involved: Obtain a rumor propagation graph; the rumor propagation graph includes a graph node set consisting of source posts and their comments and an edge set consisting of the relationship between each comment or between the source post and the comment; The importance scores of the node structure and features of the rumor propagation graph are generated respectively using degree centrality and the similarity between the node and the root node, wherein the degree centrality is used to measure the degree of the node as the centrality of the node, the root node represents the source post, the node represents the comment of the source post, and the degree of the node represents the number of edges connected to each node; Sort the importance scores and select the highest M nodes as attached nodes, and each attached node is attached with a trigger node; the comments added outside the original propagation graph are used as trigger nodes; construct An adaptive feature generator, which uses the node features of the attached node as input to generate an aggressive adaptive trigger node, while adding similarity constraints to the node features so that the trigger node can adaptively approach the node features of the attached node; Use the adaptive feature generator to adaptively generate corresponding node features for each trigger node, inject the trigger node with node features into the attachment node to generate the backdoor graph; The generated backdoor graph is used to attack the propagation-based rumor detector to test its security.

2. A backdoor attack generation method for rumor detector according to claim 1, characterized in that: The degree centrality and the similarity between the node and the root node are used to generate the importance scores of the node structure and features of the rumor propagation graph respectively. S ( v ), expressed as: in, sim (·) represents the cosine similarity function, φ c (·) is the node centrality value of the node, β is the fusion factor used to control the ratio of the two indicators, x root and x v Represent the characteristics of the root node and the attached node respectively.

3. The backdoor attack generation method for rumor detector according to claim 1, characterized in that: The constraints of the adaptive feature generator are expressed as: in, x u 、 x v Represents the generated trigger nodes u and attachment nodes v Features, T represents the cosine similarity threshold, E g Represents the edge set containing the edges connecting the trigger node and the attachment node.

4. A backdoor attack generation method for rumor detector according to claim 3, characterized in that: The adaptive feature generator is used to adaptively generate corresponding node features for each trigger node, which is expressed as: in W 1. W 2. b 1 and b 2 is the parameter that the feature generator can learn, σ (·) is the activation function.

5. The backdoor attack generation method for rumor detector according to claim 1, characterized in that: The backdoor diagram G gt Expressed as: in, G Represents a clean image, Indicates that the trigger g t A mixin function that is injected into a given graph to generate a backdoor graph, M represents the number of attached nodes, A Ggt Represents the adjacency matrix of the backdoor graph, A G Adjacency matrix representing the clean embedded graph.

6. A backdoor attack generation system for rumor detectors, characterized in that: include: An acquisition module is used to obtain a rumor propagation graph; the rumor propagation graph includes a graph node set consisting of source posts and their comments and an edge set consisting of the relationship between each comment or between the source post and the comment; a generation module, configured to respectively generate the importance scores of the node structure and features of the rumor propagation graph using degree centrality and the similarity between the node and the root node, wherein the degree centrality is used to measure the degree of the node as the centrality of the node, the root node represents the source post, the node represents the comment of the source post, and the degree of the node represents the number of edges connected to each node; Sort the importance scores and select the highest M nodes as attached nodes, and each attached node is attached with a trigger node; the comments added outside the original propagation graph are used as trigger nodes; construct An adaptive feature generator, which uses the node features of the attached node as input to generate an aggressive adaptive trigger node, while adding similarity constraints to the node features so that the trigger node can adaptively approach the node features of the attached node; Use the adaptive feature generator to adaptively generate corresponding node features for each trigger node, inject the trigger node with node features into the attachment node to generate the backdoor graph; The attack module is used to attack the rumor detector based on propagation through the generated backdoor graph to test the security of the rumor detector.

7. A computer device for generating backdoor attacks for rumor detectors, characterized in that: include: A memory, a processor, and a computer program stored in the memory, wherein when the processor executes the computer program, the steps of the backdoor attack generation method for a rumor detector according to any one of claims 1 to 5 are implemented.

8. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, they are used to execute the steps of the backdoor attack generation method for a rumor detector according to any one of claims 1 to 5.

Images