A backdoor attack method for graph classification models with enhanced stealth

Abstract

The present invention relates to a backdoor attack method for a graph classification model with enhanced concealment, and belongs to the field of artificial intelligence security technology. First, edges with small degree centrality are preferentially removed based on the probability calculated according to the degree centrality of the edge, thereby generating a hidden backdoor trigger. Then, a dynamic sample selection mechanism driven by forgetting events is used to screen the poisoned sample set, and samples that contribute more to the success rate of the backdoor attack are preferentially retained based on the number of forgetting events of the poisoned samples, and the replacement ratio of the samples is adjusted to improve the screening efficiency. When a backdoor attack is carried out, a trigger is injected into the sample to be predicted, so that the trained backdoor model can predict the sample injected with the backdoor trigger as the desired prediction result. Compared with the prior art, the present invention can improve the attack success rate and reduce the risk of being detected while maintaining the accuracy of clean sample classification, thereby increasing concealment, and can be widely applied to different types of graph classification tasks and application scenarios.

Description

Technical Field

[0001] The present invention relates to a graph classification model backdoor attack method with enhanced concealment, belonging to the field of artificial intelligence security technology. Background Art

[0002] In graph classification tasks, the Graph Neural Networks (GNNs) model achieves graph-level category prediction by learning the structural information and node attributes of the entire graph. As a deep learning model commonly used to process graph-structured data, it is widely used in scenarios such as social network analysis, protein classification, and chemical molecule identification.

[0003] With the widespread deployment of graph neural networks in various real-world scenarios, their security issues are gradually gaining attention. Backdoor attacks, in particular, involve injecting malicious behavior into a dataset during model training. These attacks pose significant security threats to social network analysis, fraud detection, drug toxicity prediction, malware detection, and other areas. By carefully tampering with some training samples (such as adding specific structural perturbations and modifying labels), attackers can manipulate the model to correctly predict normal samples (without backdoors) without significantly affecting the model's predictive performance. However, when encountering test samples injected with specific trigger patterns, the model will output the attacker's intended classification results, making these attacks extremely risky.

[0004] However, existing backdoor attack methods in graph classification tasks still have the following problems:

[0005] (1) The trigger structure is obvious: Most methods use fixed-pattern subgraphs (such as specific graph structures or graph markers) as triggers and insert them into the target graph. They are easily discovered by anomaly detection or explainability tools and have poor concealment.

[0006] (2) High randomness in sample selection: The screening of poisoned samples is usually based on random selection, ignoring the impact of differences between different samples on the attack effect, resulting in a high contamination ratio and unstable attack efficiency. At the same time, a high contamination ratio also makes the attack easy to detect.

[0007] Therefore, there is an urgent need for a graph classification backdoor attack method with stronger concealment and lower contamination rate. It can achieve stable attack effects with low contamination rate through more sophisticated structural perturbation design and effective sample screening mechanism, thereby improving the attack success rate and reducing the risk of detection. Summary of the Invention

[0008] The present invention aims to address the problems and deficiencies in the prior art and creatively proposes a graph classification model backdoor attack method with enhanced concealment.

[0009] The present invention first injects graph structure perturbation triggers and removes edges based on the probability calculated from the degree centrality of the edges. The smaller the degree centrality, the higher the probability of edge removal. Then, a dynamic sample selection mechanism driven by forgetting events is used to screen and replace the poisoned sample set. Each round, the poisoned samples are sorted according to the number of forgetting events that occurred during training. The number of retained samples is determined according to the replacement ratio. Based on this number, the poisoned samples are retained from high to low according to the sorting results, and new samples are sampled from the candidate set to replace the remaining unretained samples. The replacement ratio is dynamically adjusted based on the changing trend of the attack success rate to improve sample screening efficiency. Finally, the training set corresponding to the round with the highest attack success rate is selected as the final backdoor training set to train and generate a backdoor model. When a backdoor attack is carried out, the trigger is injected into the sample to be predicted, and the trained backdoor model is used to predict the sample injected with the backdoor trigger as the desired prediction result.

[0010] The present invention constructs a highly concealed edge perturbation trigger and combines it with a dynamic poisoned sample screening mechanism driven by forgetting events, effectively improving the attack success rate, reducing the pollution ratio, and enhancing the concealment of the attack.

[0011] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solutions.

[0012] A backdoor attack method for a graph classification model with enhanced stealth, comprising the following steps:

[0013] Step 1: Inject graph structure perturbation triggers. This includes the following steps:

[0014] Step 1.1: Obtain the image classification task training set , where each graph sample is represented as , represents the set of nodes in the graph, Represents the set of edges in a graph.

[0015] Step 1.2: For each graph sample , each node in the computation graph Degree centrality : ,in, represents the degree of each node, is the number of nodes in the graph.

[0016] Step 1.3: For each edge , calculate the degree centrality of the edge , ,in, and are the two end nodes of the edge, Indicates the The degree centrality of the nodes, Indicates the The degree centrality of a node.

[0017] Step 1.4: Take the logarithm of the degree centrality of the edge and normalize it to get the removal probability , ,in, Indicates the value of the degree centrality of the edge after logarithmic change; represents the overall removal probability of the control edge; They represent the maximum and minimum values ​​of the degree centrality of all edges after logarithmic transformation; It represents the calculated removal probability of each edge. The smaller the degree centrality, the greater the removal probability of the edge.

[0018] Step 1.5: All graph data in ,according to Delete the edges to inject triggers and generate a graph with structural perturbations .

[0019] Step 1.6: Generate the graph With the target label Pairing to form candidate poisoning samples All candidate poisoning samples constitute the candidate poisoning sample set .

[0020] Step 2: Based on the candidate poisoning sample set constructed in step 1 Perform dynamic poisoning sample screening driven by forgetting events.

[0021] Specifically, the screening strategy includes the following steps:

[0022] Step 2.1: From Random sampling Sample, get the initial poisoned sample set .Will and Corresponding The remaining samples that have not been sampled together constitute the initialized backdoor training set ; Set the initial replacement ratio .in, is the pollution rate.

[0023] Step 2.2: Summarize the poisoned sample set Round screening, each round trains the neural network model on the backdoor training set After the training, Each sample in , count the number of forgetting events during training ,in, For the Model pair samples in round training The prediction results; For the Round model pair samples The prediction results; is an indicator function, whose value is 1 when the condition is met and 0 otherwise. The more times the forgetting events occur in the poisoned sample, the greater the impact on the backdoor attack.

[0024] Step 2.3: Calculate the attack success rate in each round , and get Change from the previous round , record each round And this round of poisoned sample set .

[0025] Step 2.4: According to The value of dynamically adjusts the replacement ratio :like like like And the sample set rolls back to the previous round;

[0026] in, Indicates the The sample replacement ratio during rounds; Indicates the The sample replacement ratio during rounds; and It is a hyperparameter that determines the adjustment amplitude; Indicates the set adjustment judgment threshold.

[0027] Step 2.5: Based on the adjusted replacement ratio , each round will The lowest number of forgetting events The poisoned samples were removed and then Random supplement samples, and obtain the A new sample set For the next round of training, express The number of samples in ; Indicates the Poisoning sample set during rounds; Indicates the The poisoning sample set of the round.

[0028] Step 3: According to the records in step 2, and , select the best The data set corresponding to the value is trained to obtain a backdoor model, and the backdoor model is used to carry out backdoor attacks.

[0029] When performing a backdoor attack, the sample to be predicted is injected with a trigger through step 1, so that the trained backdoor model can predict the sample injected with the trigger into the desired prediction result, that is, the attack target label .

[0030] Beneficial effects

[0031] This method combines graph structure perturbations based on edge degree centrality with a dynamic sample screening mechanism driven by forgetting events, resulting in a low-contamination, high-invisibility, and robust backdoor attack against graph neural networks. Compared to traditional subgraph insertion and random sample injection strategies, this method improves attack success rates and reduces the risk of detection while maintaining clean sample classification accuracy, thereby increasing stealth and being widely applicable to different types of graph classification models and application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of the core steps of the method of the present invention. DETAILED DESCRIPTION

[0033] The method of the present invention is further described in detail below with reference to the accompanying drawings.

[0034] like Figure 1 As shown in FIG, a backdoor attack method for a graph classification model with enhanced concealment includes the following steps:

[0035] Step 1: Inject graph structure perturbation triggers. This includes the following steps:

[0036] Step 1.1: Obtain the image classification task training set , where each graph sample is represented as , represents the set of nodes in the graph, Represents the set of edges in a graph.

[0037] Step 1.2: For each graph sample , each node in the computation graph Degree centrality . ,in, represents the degree of each node, is the number of nodes in the graph.

[0038] Step 1.3: For each edge , calculate the degree centrality of the edge , ,in, and are the two end nodes of the edge, Indicates the The degree centrality of the nodes, Indicates the The degree centrality of a node.

[0039] Step 1.4: Take the logarithm of the degree centrality of the edge and normalize it to get the removal probability , ,in, Indicates the value of the degree centrality of the edge after logarithmic change; represents the overall removal probability of the control edge; They represent the maximum and minimum values ​​of the degree centrality of all edges after logarithmic transformation; It represents the calculated removal probability of each edge. The smaller the degree centrality, the greater the removal probability of the edge.

[0040] Step 1.5: All graph data in ,according to Delete the edges to inject triggers and generate a graph with structural perturbations .

[0041] Step 1.6: Generate the graph With the target label Pairing to form candidate poisoning samples All candidate poisoning samples constitute the candidate poisoning sample set .

[0042] Step 2: Based on the candidate poisoning sample set constructed in step 1 Perform dynamic poisoning sample screening driven by forgetting events.

[0043] The screening strategy includes the following steps:

[0044] Step 2.1: From Random sampling Sample, get the initial poisoned sample set .Will and Corresponding The remaining samples that have not been sampled together constitute the initialized backdoor training set ; Set the initial replacement ratio .

[0045] Step 2.2: Summarize the poisoned sample set Round screening, each round trains the neural network model on the backdoor training set After the training, Each sample in , count the number of forgetting events during training ,in, For the Model pair samples in round training The prediction results; For the Round model pair samples The prediction results; is an indicator function, whose value is 1 when the condition is met and 0 otherwise. The more times the forgetting events occur in the poisoned sample, the greater the impact on the backdoor attack.

[0046] Step 2.3: Calculate the attack success rate in each round , and get Change from the previous round , record each round And this round of poisoned sample set .

[0047] Step 2.4: According to The value of dynamically adjusts the replacement ratio :like like like And the sample set rolls back to the previous round;

[0048] in, Indicates the The sample replacement ratio during rounds; Indicates the The sample replacement ratio during rounds; and It is a hyperparameter that determines the adjustment amplitude; Indicates the set adjustment discrimination threshold;

[0049] Step 2.5: Based on the adjusted replacement ratio , each round will The lowest number of forgetting events The poisoned samples were removed and then Random supplement samples, and obtain the A new sample set For the next round of training, express The number of samples in ; Indicates the Poisoning sample set during rounds; Indicates the Poisoning sample set during rounds;

[0050] Step 3: According to the records in step 2, and , select the best The data set corresponding to the value is trained to obtain a backdoor model, and the backdoor model is used to carry out backdoor attacks.

[0051] Specifically, the method includes the following steps:

[0052] Step 3.1: Select all rounds Optimal As the final poisoning sample set .

[0053] Step 3.2: and The remaining corresponding samples in the are combined as the final backdoor training set, and the backdoor model is trained.

[0054] When conducting a backdoor attack, you only need to inject the trigger of the sample to be predicted through step 1, and the trained backdoor model can predict the sample injected with the trigger into the desired prediction result.

[0055] Example

[0056] In this example, two public graph classification datasets, PROTEINS and NCI1, were selected. The dataset was divided into 75% for training, 5% for validation, and 20% for testing. The model used for sample screening in the experiment was the GCN model, and the attack models were the GCN model and the GIN model. The model training used the Adam optimizer with a learning rate of 0.01 and a weight decay coefficient of The maximum number of training rounds is set to 100, and an early termination mechanism (patience=10) is used to prevent overfitting. Initial replacement ratio Set to 0.5, the number of screening rounds is set to 40, and Set to 1, Set to 0.05, is set to 0.8, and the sample contamination rate is set to 10%.

[0057] This embodiment compares the proposed backdoor attack method with the existing technology and uses the attack success rate as an evaluation indicator. It represents the proportion of samples in the test set that originally belonged to the non-target category and were successfully misclassified as the target category after the backdoor trigger was inserted. The method of the present invention is denoted as Deg. The experimental results are shown in Table 1:

[0058]

[0059] The results in Table 1 show that the proposed method achieves superior attack effectiveness compared to other methods at the same contamination rate, particularly on the PROTEINS dataset. This demonstrates that the model has learned the backdoor trigger patterns described in this paper. Furthermore, the proposed method considers the sample's contribution to the backdoor attack and performs sample screening, achieving even better results.

Claims

1. A backdoor attack method for graph classification models with enhanced stealth, characterized in that: The following steps are involved: First, a graph structure perturbation trigger is injected. Edge removal is performed based on the probability calculated based on the degree centrality of the edge. The smaller the degree centrality, the higher the probability of edge removal. The implementation method includes: Step 1: Graph structure perturbation trigger injection; Step 1.1: Obtain the image classification task training set , where each graph sample is represented as , represents the set of nodes in the graph, Represents the set of edges in the graph; Step 1.2: For each graph sample , each node in the computation graph Degree centrality ; Step 1.3: For each edge , calculate the degree centrality of the edge ; Step 1.4: Take the logarithm of the degree centrality of the edge and normalize it to get the removal probability ; Step 1.5: All graph data in ,according to Delete the edges to inject triggers and generate a graph with structural perturbations ; Step 1.6: Generate the graph With the target label Pairing to form candidate poisoning samples ; All candidate poisoning samples constitute the candidate poisoning sample set ; Then, a dynamic sample selection mechanism driven by forgetting events is used to screen and replace the poisoned sample set. In each round, the poisoned samples are sorted according to the number of forgetting events that occurred during the training process. The number of retained samples is determined according to the replacement ratio. Based on this number, the poisoned samples are retained from high to low according to the sorting results, and new samples are sampled from the candidate set to replace the remaining unretained samples. The replacement ratio is dynamically adjusted according to the changing trend of the attack success rate to improve the sample screening efficiency. Finally, the training set corresponding to the round with the highest attack success rate is selected as the final backdoor training set to train and generate the backdoor model. When conducting a backdoor attack, the sample to be predicted is injected with a trigger, and the trained backdoor model is used to predict the sample injected with the backdoor trigger into the desired prediction result.

2. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 1, characterized in that: The following steps are involved: Step 1: Graph structure perturbation trigger injection; Step 2: Based on the candidate poisoning sample set Perform forgetting event-driven dynamic poisoning sample screening; the screening strategy includes the following steps: Step 2.1: From Random sampling Sample, get the initial poisoned sample set ;Will and Corresponding The remaining samples that have not been sampled together constitute the backdoor training set ; Set the initial replacement ratio ;in, is the contamination rate; Step 2.2: Summarize the poisoned sample set Round screening, each round trains the neural network model on the backdoor training set After the training, Each sample in , count the number of forgetting events during training ; Step 2.3: Calculate the attack success rate in each round , and get Change from the previous round , record each round And this round of poisoned sample set ; Step 2.4: According to The value of dynamically adjusts the replacement ratio : Step 2.5: Based on the adjusted replacement ratio , each round will The lowest number of forgetting events The poisoned samples were removed and then Random supplement samples, and obtain the A new sample set For the next round of training; in, express The number of samples in ; Indicates the Poisoning sample set during rounds; Indicates the Poisoning sample set during rounds; Step 3: According to the records in step 2, and , select the best The data set corresponding to the value is trained to obtain a backdoor model, and the backdoor model is used to perform backdoor attacks; When conducting a backdoor attack, the sample to be predicted is triggered through step 1, and the trained backdoor model predicts the sample injected with the trigger as the desired prediction result.

3. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, characterized in that: In step 1.2, each node in the calculation graph Degree centrality The method is: ,in, represents the degree of each node, is the number of nodes in the graph.

4. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, wherein: In step 1.3, calculate the degree centrality of the edge The method is: ,in, and are the two end nodes of the edge, Indicates the The degree centrality of the nodes, Indicates the The degree centrality of a node.

5. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, characterized in that: In step 1.4, calculate the removal probability The method is: ,in, Indicates the value of the degree centrality of the edge after logarithmic change; represents the overall removal probability of the control edge; They represent the maximum and minimum values ​​of the degree centrality of all edges after logarithmic transformation, It represents the calculated removal probability of each edge. The smaller the degree centrality, the greater the removal probability of the edge.

6. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, characterized in that: In step 2.2, calculate the number of forgetting events ,in, For the Model pair samples in round training The prediction results; For the Round model pair samples The prediction results; is an indicator function, whose value is 1 when the condition is met and 0 otherwise. The more times the forgetting events occur in the poisoned sample, the greater the impact on the backdoor attack.

7. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, characterized in that: In step 2.4, according to The value is dynamically adjusted , as follows: If like like And the sample set rolls back to the previous round; in, Indicates the The sample replacement ratio during rounds; Indicates the The sample replacement ratio during rounds; and It is a hyperparameter that determines the adjustment amplitude; Indicates the set adjustment judgment threshold.

8. The method for enhancing the concealment of a graph classification model backdoor attack according to claim 2, characterized in that: Step 3 includes the following steps: Step 3.1: Select all rounds Optimal As the final poisoning sample set ; Step 3.2: and The remaining corresponding samples in the are combined as the final backdoor training set, and the backdoor model is trained.

Images