Backdoor-free model node injection attack method in graph neural network

Abstract

The present invention discloses a backdoor-free model node injection attack method in a graph neural network, comprising: obtaining the original data set of the target graph neural network, pre-training an intermediary model based on the original data set; constructing a specific structure trigger generator model, and generating a trigger node to bind to the target node to obtain a poisoned data set; training a specific structure trigger generator model based on the poisoned data set and the intermediary model to obtain a general trigger generator model; constructing and training several graph neural network test models with different structures; obtaining a poisoned test data set based on the general trigger generator and the test data set; predicting the poisoned test data set using several graph neural network test models with different structures, and evaluating the attack performance based on the prediction results. The present invention solves the problems of existing backdoor attack methods that rely on the construction of backdoor models and complex node selection algorithms, thereby improving the concealment and practical operability of the attack methods.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and in particular relates to a backdoor-free model node injection attack method in a graph neural network. Background Art

[0002] Graph neural networks (GNNs) are deep learning models for processing graph data, aggregating information about neighboring nodes to update node representations. GNNs have been applied to tasks such as node classification, link prediction, and graph embedding. Algorithms used include classic graph convolutional networks (GCNs), graph attention networks (GATs), and GraphSAGE. However, as GNNs are deployed in sensitive scenarios (such as financial fraud detection and medical diagnosis), their security concerns have become increasingly prominent.

[0003] Backdoor attacks, a new type of security threat, involve implanting hidden triggers during model training, causing the model to produce attacker-specified outputs for specific inputs after deployment. Existing backdoor attack methods typically require the attacker to fully control the dataset and model training process. For example, they can embed trigger nodes in the training data and modify node features, then use the trained backdoored model to perform predictions instead of the original model to achieve the attack. While these methods have a high success rate, they require high attacker privileges, making them difficult to implement in real-world scenarios. Furthermore, existing methods rely on complex node selection algorithms, further limiting the attack's flexibility.

[0004] Therefore, how to design an attack method that does not rely on backdoor models or complex algorithms, while taking into account both stealth and attack effectiveness, is an important new direction. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention proposes a backdoor-free model node injection attack method in graph neural networks to solve the problems of relying on the construction of backdoor models and complex node selection algorithms in the above-mentioned existing backdoor attack methods.

[0006] To achieve the above objectives, the present invention provides a backdoor-free model node injection attack method in a graph neural network, comprising:

[0007] Obtain the original dataset of the target graph neural network and pre-train the intermediate model based on the original dataset;

[0008] Constructing a specific structure trigger generator model and generating a trigger node, binding the trigger node to a target node, and obtaining a poisoned data set;

[0009] Training a specific structure trigger generator model based on the poisoning dataset and the intermediary model to obtain a general trigger generator model;

[0010] Construct and train several graph neural network test models with different structures; use a universal trigger generator to inject trigger nodes into multiple test data sets to obtain poisoned test data sets; use several graph neural network test models with different structures to predict the poisoned test data sets respectively, and evaluate the attack performance based on the prediction results.

[0011] Optionally, the process of pre-training the intermediary model based on the original dataset includes:

[0012] A graph structure is constructed based on the original data set and preprocessed, and the adjacency relationship matrix in the original data set is symmetrically normalized to obtain an optimized graph structure; the intermediary model is trained by optimizing the graph structure, wherein a graph sampling aggregation neural network is used as the intermediary model.

[0013] Optionally, the original data set includes a node feature matrix, an adjacency relationship matrix, and node label information.

[0014] Optionally, the process of obtaining a poisoned dataset includes:

[0015] A trigger node is generated through a specific structure trigger generator model; a ring topology structure is constructed, and based on the ring topology structure, the trigger node and the target node are connected through edges, and the generated trigger nodes and their connection relationships are updated to the original graph structure to form a poisoned data set; wherein, the specific structure trigger generator model includes a multi-layer perceptron and a residual connection.

[0016] Optionally, the process of obtaining a general trigger generator model includes:

[0017] The poisoned dataset is used to perform forward propagation through the intermediary model to verify the effectiveness of the trigger generator model; a comprehensive loss function is constructed, and iterative optimization is performed in combination with the comprehensive loss function to update the parameters of the trigger generator model and obtain a universal trigger generator model.

[0018] Optionally, during the training process, the DropEdge mechanism is used to randomly remove the connection between the trigger node and the target node to update the poisoned dataset.

[0019] Optionally, a comprehensive loss function is obtained by weighting and adding the cross entropy loss function and the cosine similarity loss function.

[0020] Optionally, several graph neural network test models with different structures include graph convolutional networks, graph attention networks, and graph sampling aggregation networks.

[0021] Optionally, it also includes setting up defenseless and defense scenarios for the poisoned test dataset, and operating the poisoned test dataset through two defense mechanisms in the defense scenario; evaluating the attack performance by the ratio of target nodes misclassified as the attacker-specified category and the correct classification rate of non-target nodes in the poisoned test dataset.

[0022] Compared with the prior art, the present invention has the following advantages and technical effects:

[0023] This paper proposes a universal trigger generation model training mechanism. The triggers generated by this model are directly bound to the nodes of the original dataset. This allows the graph neural network model trained on the original dataset to predict the attacker-specified labels for target nodes while maintaining the same prediction accuracy for non-target nodes. The node injection attack method for graph neural networks proposed in this paper addresses the problems of existing backdoor attack methods that rely on backdoor model construction and complex node selection algorithms, thereby improving the stealth and practical operability of the attack method. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0025] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0026] Figure 2 This is a diagram of the implementation plan for the graph neural network backdoor attack according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Example 1

[0030] like Figure 1-2 As shown, this embodiment provides a backdoor-free model node injection attack method in a graph neural network, including:

[0031] Obtain the original dataset of the target graph neural network and pre-train the intermediate model based on the original dataset;

[0032] Furthermore, the process of pre-training the intermediary model based on the original dataset includes:

[0033] A graph structure is constructed based on the original data set and preprocessed, and the adjacency relationship matrix in the original data set is symmetrically normalized to obtain an optimized graph structure; the intermediary model is trained by optimizing the graph structure, wherein a graph sampling aggregation neural network is used as the intermediary model.

[0034] Specifically, such as Figure 2 As shown in the training process, the original dataset of the target graph neural network is obtained. These datasets usually include node feature matrix, adjacency matrix and node label information:

[0035] Node feature matrix X: the feature representation of each node, usually sparse or high-dimensional data;

[0036] Adjacency matrix A: The connection relationship between nodes in the graph, representing the structure of the graph;

[0037] Label set Y: the true category labels of some nodes, used to supervise model training;

[0038] Constructing the graph structure:

[0039] The above data is used to construct a graph structure G = (V, E) for easy input into the model for training, where V is the node set and E is the edge set, representing the relationship between nodes.

[0040] Preferably, the graph structure can be preprocessed, including removing isolated nodes or low-weight edges to simplify the graph structure, so as to reduce the training budget and enhance the information density; The adjacency matrix A is symmetrically normalized to improve the stability of training.

[0041] Pre-training of the intermediary model:

[0042] GraphSAGE (Graph Sample and Aggregate) is a graph neural network (GNN) framework based on neighbor sampling and feature aggregation. Named for its inductive learning of node embeddings, it primarily addresses the problem of efficiently scaling to large-scale graphs and generalizing to newly added nodes. GraphSAGE consists of "Graph" and "SAGE (Sample and Aggregate)." GraphSAGE also uses neighbor sampling to avoid information redundancy and introduces flexible aggregation functions to enhance the model's ability to express node feature patterns, resulting in excellent performance on large-scale graphs.

[0043] GraphSAGE is unique in that it addresses the problem of traditional GNNs relying on the entire graph structure through random neighbor sampling and multi-layer aggregation mechanisms, thereby improving the scalability and adaptability of the model. This allows GraphSAGE to effectively reduce the risk of overfitting and perform well on dynamic graphs and partially observed graph data.

[0044] In this embodiment of the present invention, a graph sampling aggregation neural network (GraphSage) is used as an intermediary model for training. Neighbor nodes are sampled layer by layer, and an embedded representation of the target node is generated by aggregating domain features. The specific formula is as follows:

[0045]

[0046] Among them, Sample(N(i)) represents a sample subset of the neighbor nodes of node i, W (k) and is a learnable weight matrix, which represents the weight of features learned from neighboring nodes and the weight of self-feature learning respectively. σ represents a nonlinear activation function. Aggregate is a function that combines the sampled features of neighboring nodes. In this example of the present invention, the mean aggregation function is used, which aggregates the features of neighboring nodes by averaging their feature vectors.

[0047] Constructing a specific structure trigger generator model and generating a trigger node, binding the trigger node to a target node, and obtaining a poisoned data set;

[0048] Training a specific structure trigger generator model based on the poisoning dataset and the intermediary model to obtain a general trigger generator model;

[0049] Furthermore, the process of obtaining the poisoned dataset includes:

[0050] A trigger node is generated through a specific structure trigger generator model; a ring topology structure is constructed, and based on the ring topology structure, the trigger node and the target node are connected through edges, and the generated trigger nodes and their connection relationships are updated to the original graph structure to form a poisoned data set; wherein, the specific structure trigger generator model includes a multi-layer perceptron and a residual connection.

[0051] During the training process, the DropEdge mechanism is used to randomly remove the connections between the trigger node and the target node to update the poisoned dataset.

[0052] Furthermore, the process of obtaining the general trigger generator model includes:

[0053] The poisoned dataset is used to perform forward propagation through the intermediary model to verify the effectiveness of the trigger generator model; a comprehensive loss function is constructed, and iterative optimization is performed in combination with the comprehensive loss function to update the parameters of the trigger generator model and obtain a universal trigger generator model.

[0054] The comprehensive loss function is obtained by weighting and adding the cross entropy loss function and the cosine similarity loss function.

[0055] Specifically, the multi-layer perceptron (MLP) and residual structure are used to generate the feature representation of the trigger node, and the formula is: tr =MLP(h t )+h t , where h t is the feature representation of the target node, h tr is the feature representation of the trigger node;

[0056] Construct a ring topology, connecting trigger nodes and target nodes through edges to enhance the attack effect of the trigger and reduce the budget required for the attack;

[0057] The DropEdge mechanism is used to randomly remove the connection between the trigger node and the target node to improve the concealment and generalization ability of the injected data.

[0058] In the trigger generation process, the cosine similarity loss function is introduced to optimize the feature similarity between the trigger node and the target node, thereby enhancing the effectiveness of the adversarial defense mechanism. Then, the cross entropy loss function and the cosine similarity loss function are weighted and added together to obtain the final loss function for model training until convergence.

[0059] For example, the trigger generator model is used to generate a trigger node with similar characteristics to the target node for each attack group. The model takes the characteristics of the target node as input and generates the characteristics of the trigger node through a multi-layer perceptron (MLP) and residual connections. Let the characteristic vector of an attacked node in the kth group be x i , the generated trigger node feature is represented as

[0060] The calculation process of the trigger generator model is expressed as:

[0061]

[0062] Here, MLP(·) represents a multi-layer perceptron, and the residual connection allows the input features to be directly added to the output features to ensure the stability and effectiveness of generating trigger features.

[0063] The connection structure between the trigger and the target node is composed of:

[0064] In this embodiment, for each attacked node V a , according to the number of attacked nodes, corresponding trigger nodes are generated. Assume that |V a | attacked nodes, generating k×|V a | trigger nodes, where k is the ratio parameter for generating trigger nodes. The generated trigger nodes and the attacked nodes form a complete graph structure. Specifically, the connection between the trigger nodes and the attacking nodes is unidirectional, that is, the trigger nodes are only connected to the attacked nodes.

[0065] In addition to the connection between the trigger node and the attacked node, this embodiment also forms a ring connection structure between the trigger nodes in each group to enhance the information dissemination capability between the trigger nodes. The ring connection means that each trigger node t i Only with the next trigger node t i+1 The last trigger node is connected to the first trigger node, forming a closed loop. This design facilitates information sharing between trigger nodes, increasing the stealth and robustness of the attack while reducing the number of triggers and saving attack budget.

[0066] The DropEdge mechanism is applied to the edge connecting the trigger and the target node:

[0067] In this embodiment of the present invention, to prevent the model from overfitting to a specific edge structure, the DropEdge technique is used to randomly prune edges between trigger nodes and attack nodes. During training, a ratio p of edges is randomly deleted each round to enhance the robustness of the model and prevent the model from relying on specific edges.

[0068] The cross entropy loss function of bidirectional optimization is used to ensure the success rate of the attack while having a small impact on non-target nodes. The specific formula is as follows:

[0069]

[0070] Among them, θ g V represents the parameters of the trigger generation model, and λ is a hyperparameter used to balance the trade-off between the classification accuracy of clean nodes and the attack success rate of target nodes. L and V P They represent the clean node set and the attacked node set respectively. The symbol l(·) represents the cross entropy loss function, f m (·) represents the prediction result of the mediation model. Function Represents the connection operation between the trigger node and the attacked node, where To ensure accurate classification of clean nodes, Used to force the target node to be misclassified as the specified target category.

[0071] The cosine similarity loss function is introduced to ensure the concealment of triggers and the performance of adversarial defense mechanisms. The specific formula is as follows:

[0072]

[0073] Among them, x ti and x i Represent the feature vectors of the triggering node and the attacked node i respectively, is the set of all target nodes. This loss aims to align the features of the generated triggering nodes with those of the attacked nodes as much as possible.

[0074] By combining the bidirectionally optimized cross entropy loss function with the cosine similarity loss function, a comprehensive loss function is constructed as follows:

[0075]

[0076] Among them, λ attack and λ cos is a hyperparameter used to adjust the weights of different loss terms. This comprehensive loss function is used to perform gradient updates on the trigger generator model, ultimately yielding an optimized trigger generator model. This serves as the core of the subsequent backdoor attack against graph neural networks.

[0077] Construct and train several graph neural network test models with different structures; use a universal trigger generator to inject trigger nodes into multiple test data sets to obtain poisoned test data sets; use several graph neural network test models with different structures to predict the poisoned test data sets respectively, and evaluate the attack performance based on the prediction results.

[0078] Furthermore, the graph neural network test model includes graph convolutional network, graph attention network and graph sampling aggregation network.

[0079] Furthermore, it also includes setting up defenseless scenarios and defense scenarios for the poisoned test dataset, and operating the poisoned test dataset through two defense mechanisms in the defense scenario; evaluating the attack performance through the ratio of target nodes misclassified as the attacker-specified category and the correct classification rate of non-target nodes in the poisoned test dataset.

[0080] Specifically, such as Figure 2 As shown in the attack process, the original dataset used in the training process provides a data foundation for subsequent verification of the attack effect. To fully verify the versatility of the backdoor attack method and ensure its applicability to graph neural network models with various architectures, three commonly used models were selected as test objects.

[0081] These benchmark models include Graph Convolutional Networks (GCNs), Graph Attention Networks (GATs), and Graph Sampling Aggregation Networks (GraphSAGEs), representing different feature aggregation mechanisms and application scenarios. This selection provides a diverse testing platform for subsequent injection attacks, ensuring the adequacy and comprehensiveness of the verification process.

[0082] Randomly select the target node, use the trigger generator model obtained by training above, generate the corresponding trigger according to the characteristics of the target node, and bind it to the target node through the connection structure consistent with that during training to obtain the injected data set.

[0083] The injected data set is processed in two different scenarios: non-defense scenario and defense scenario. The details are as follows:

[0084] No defense scenario: No operation is performed on the injected data set.

[0085] Defense scenarios: Two defense mechanisms, Prune and the advanced Prune+LD, operate on injected data sets. Prune removes parts that may carry backdoors by pruning redundant neurons in the neural network. Prune+LD is an enhanced version of Prune that combines pruning and loss detection mechanisms. It further detects and removes backdoors by analyzing the changes in network loss when processing clean data and trigger data.

[0086] We let three different benchmark models predict the injected datasets and evaluate the effectiveness of the attack using two metrics: ASR and CA.

[0087] ASR is defined as the ratio of target nodes being misclassified into the category specified by the attacker, and is calculated as:

[0088]

[0089] CA is defined as the correct classification rate of non-target nodes in the poisoned test dataset, and the calculation formula is:

[0090]

[0091] See Table 1 for specific test results. Without any defense mechanisms, the attack success rate of this implementation method consistently exceeded 97%, demonstrating its reliability in terms of attack efficiency. When using the Prune and Prune+LD defense strategies, the attack success rate of this implementation method generally remained above 90%, with only poor performance on the Citeceer dataset, demonstrating that this implementation method has some resistance to defense strategies.

[0092] Table 1

[0093]

[0094] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A backdoor-free model node injection attack method in a graph neural network, characterized in that: The following steps are involved: Obtain the original dataset of the target graph neural network and pre-train the intermediate model based on the original dataset; Constructing a specific structure trigger generator model and generating a trigger node, binding the trigger node to a target node, and obtaining a poisoned data set; Training a specific structure trigger generator model based on the poisoning dataset and the intermediary model to obtain a general trigger generator model; The process of obtaining a generic trigger generator model includes: The poisoned dataset is used to perform forward propagation through the intermediary model to verify the effectiveness of the trigger generator model. A comprehensive loss function is constructed and iteratively optimized based on the comprehensive loss function to update the parameters of the trigger generator model and obtain a universal trigger generator model. During the training process, the DropEdge mechanism is used to randomly remove the connection between the trigger node and the target node to update the poisoned dataset; Construct and train several graph neural network test models with different structures; use a universal trigger generator to inject trigger nodes into multiple test data sets to obtain poisoned test data sets; use several graph neural network test models with different structures to predict the poisoned test data sets respectively, and evaluate the attack performance based on the prediction results.

2. The backdoor-free model node injection attack method in a graph neural network according to claim 1 is characterized in that: The process of pre-training the intermediary model based on the original dataset includes: A graph structure is constructed based on the original data set and preprocessed, and the adjacency relationship matrix in the original data set is symmetrically normalized to obtain an optimized graph structure; the intermediary model is trained by optimizing the graph structure, wherein a graph sampling aggregation neural network is used as the intermediary model.

3. The backdoor-free model node injection attack method in a graph neural network according to claim 2 is characterized in that: The original data set includes a node feature matrix, an adjacency matrix and node label information.

4. The backdoor-free model node injection attack method in a graph neural network according to claim 1 is characterized in that: The process of obtaining the poisoned dataset includes: A trigger node is generated through a specific structure trigger generator model; a ring topology structure is constructed, and based on the ring topology structure, the trigger node and the target node are connected through edges, and the generated trigger nodes and their connection relationships are updated to the original graph structure to form a poisoned data set; wherein, the specific structure trigger generator model includes a multi-layer perceptron and a residual connection.

5. The backdoor-free model node injection attack method in a graph neural network according to claim 1 is characterized in that: The comprehensive loss function is obtained by weighting and adding the cross entropy loss function and the cosine similarity loss function.

6. The backdoor-free model node injection attack method in a graph neural network according to claim 1 is characterized in that: Several graph neural network test models with different structures include graph convolutional networks, graph attention networks, and graph sampling aggregation networks.

7. The backdoor-free model node injection attack method in a graph neural network according to claim 1 is characterized in that: It also includes setting up defenseless and defense scenarios for the poisoned test dataset, and operating the poisoned test dataset through two defense mechanisms in the defense scenario; evaluating the attack performance by the ratio of target nodes misclassified as the attacker-specified category and the correct classification rate of non-target nodes in the poisoned test dataset.

Images