Node category prediction method and device for backdoor attack, equipment and medium

Abstract

The invention provides a node category prediction method, device and equipment for a backdoor attack and a medium, and relates to the technical field of deep learning, and the method comprises the steps: obtaining a disturbance diagram of the backdoor attack; determining at least one sub-graph corresponding to the perturbation graph based on the adjacency matrix of the perturbation graph and the similarity of each node in the perturbation graph; inputting each sub-graph into an integrated model to obtain a prediction category corresponding to each node in a disturbance graph output by the integrated model; the integrated model is obtained by training a plurality of sub-sample graphs corresponding to the sample graph attacked by the backdoor. According to the method, the accuracy of predicting each node category in the disturbance graph of the backdoor attack by the integrated model is improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to a node category prediction method, device, equipment and medium for backdoor attacks. Background Art

[0002] As a neural network technology specialized in processing graph-structured data, the Graph Neural Network (GNN) model plays an important role in various graph-related fields, such as link prediction, graph classification, and community discovery.

[0003] In actual application scenarios, graph neural networks are susceptible to interference from backdoor attacks. To defend against backdoor attacks, existing defense methods focus on detecting and removing perturbation edges in the graph to destroy the trigger structure, or assigning lower weights in message passing to mitigate negative impacts. However, due to the dynamic changes in the graph structure and backdoor attacks, traditional defense methods are not ideal in such dynamic environments, resulting in reduced accuracy of classification models in predicting node categories in backdoor-attacked graphs. Summary of the Invention

[0004] The present invention provides a node category prediction method, device, equipment and medium for backdoor attacks, which are used to solve the problem in the prior art that due to the dynamic changes of the graph structure and backdoor attacks, the traditional defense method is not ideal in such a dynamic environment, resulting in a reduction in the accuracy of the classification model in predicting the node category in the backdoor attacked graph. The method generates multiple subgraphs with diversity, randomness and robustness through the adjacency matrix of the perturbation graph and the similarity of each node in the perturbation graph, simulates various structural changes that may occur in the graph in actual applications, and uses these subgraphs as the input of the integrated model to improve the dynamic defense capability of the graph neural network, and further improves the accuracy of the integrated model in predicting the category of each node in the perturbation graph of backdoor attacks.

[0005] The present invention provides a node category prediction for backdoor attacks, comprising the following steps: Get the perturbation graph attacked by the backdoor; Determining at least one subgraph corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph and similarities of the nodes in the node perturbation graph; the adjacency matrix is ​​used to represent a connection relationship between each node in the node perturbation graph and other nodes; Based on each of the subgraphs and the integrated model, a predicted category corresponding to each node in the node perturbation graph is obtained; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

[0006] According to a node category prediction method for backdoor attacks provided by the present invention, the method determines at least one subgraph corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph and the similarity of each node in the node perturbation graph, including: determining a degree matrix corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph; the degree matrix is ​​used to characterize the number of edges connecting each node to other nodes; determining a sampling probability matrix of the node perturbation graph based on the degree matrix and the identity matrix; determining a similarity probability matrix of each node in the node perturbation graph based on the feature similarity of each node in the node perturbation graph; and determining at least one subgraph corresponding to the node perturbation graph based on the sampling probability matrix and the similarity probability matrix.

[0007] According to a node category prediction method for backdoor attacks provided by the present invention, the sampling probability matrix of the node perturbation graph is determined based on the degree matrix and the identity matrix, including: determining a first matrix based on the degree matrix and the identity matrix; obtaining a second matrix based on the first matrix and a mask operation; and determining the sampling probability matrix of the node perturbation graph based on the second matrix.

[0008] According to a node category prediction method for backdoor attacks provided by the present invention, the integrated model is trained based on the following steps: obtaining multiple sub-sample graphs corresponding to a sample graph attacked by the backdoor and the category labels corresponding to each node in the sample graph; inputting each of the sub-sample graphs into at least one initial sub-model in the initial integrated model to obtain a prediction vector for each node in the sub-sample graph output by each initial sub-model; the number of the initial sub-models corresponds one-to-one to the number of the sub-sample graphs; and updating the model parameters of each initial sub-model based on each prediction vector and the corresponding category label to obtain the integrated model.

[0009] According to a node category prediction method for backdoor attacks provided by the present invention, the model parameters of each initial sub-model are updated based on each prediction vector and the corresponding category label to obtain the integrated model, including: sequentially calculating the first mutual information between each target prediction vector and each non-target prediction vector to obtain a first mutual information set; the target prediction vector is a prediction vector selected from all prediction vectors each time, and the non-target prediction vector is a prediction vector other than the target prediction vector in all prediction vectors; the first mutual information is used to characterize the similarity between the target prediction vector and the non-target prediction vector; the corresponding mutual information of each node in each prediction vector is calculated. The predicted value of the category label is deleted to obtain the predicted vector corresponding to the negative sample; the second mutual information between the predicted vector corresponding to each target negative sample and the predicted vector corresponding to each non-target negative sample is calculated in sequence to obtain a second mutual information set; the target negative sample is a negative sample selected from all negative samples each time, and the non-target negative sample is a negative sample other than the target sample in all negative samples, and the second mutual information is used to characterize the similarity between the target negative sample and the non-target negative sample; based on the first mutual information set and the second mutual information set, a first loss value is determined; based on the first loss value, the model parameters of each of the initial sub-models are updated to obtain the integrated model.

[0010] According to a node category prediction method for backdoor attacks provided by the present invention, based on the first loss value, the model parameters in each of the initial sub-models are updated to obtain the integrated model, including: determining the weight corresponding to each of the initial sub-models based on the category probability of each node in the sub-sample graph output by the initial sub-model; obtaining the target discrete information corresponding to each of the initial sub-models based on the weight corresponding to each of the initial sub-models and a game right model; the game right model is used to characterize the degree of discreteness between each of the initial sub-models; determining the second loss value based on the weight corresponding to each of the initial sub-models and the target discrete information corresponding to each of the initial sub-models; based on the first loss value and the second loss value, updating the model parameters in the initial sub-model to obtain a sub-model; taking the sub-model whose target discrete information is greater than the discrete information threshold as the target sub-model; and determining the integrated model based on each of the target integrated models.

[0011] According to a node category prediction method for backdoor attacks provided by the present invention, the integrated model includes at least one sub-model, and the method of obtaining the prediction category corresponding to each node in the node perturbation graph based on each of the sub-graphs and the integrated model includes: obtaining candidate prediction categories corresponding to each node in each of the sub-graphs in the node perturbation graph based on each of the sub-graphs and the integrated model; the number of the sub-graphs is the same as the number of the sub-models; and determining the prediction category corresponding to each node in the node perturbation graph from the candidate prediction categories based on a majority voting mechanism.

[0012] The present invention also provides a node category prediction device for backdoor attacks, comprising the following modules: The acquisition module is used to obtain the perturbation graph attacked by the backdoor; A determination module, configured to determine at least one subgraph corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph and similarities between nodes in the node perturbation graph; the adjacency matrix is ​​used to represent a connection relationship between each node in the node perturbation graph and other nodes; A prediction module is used to obtain the predicted category corresponding to each node in the node perturbation graph based on each of the subgraphs and the integrated model; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the node category prediction method for backdoor attacks as described in any one of the above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for predicting node categories against backdoor attacks as described above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the above-described node category prediction methods for backdoor attacks.

[0016] The present invention provides a node category prediction method, device, equipment, and medium for backdoor attack prevention. The method obtains a perturbed graph attacked by a backdoor; determines at least one subgraph corresponding to the perturbed graph based on the adjacency matrix of the perturbed graph and the similarity between each node in the perturbed graph; and inputs each subgraph into an integrated model to obtain the predicted category corresponding to each node in the perturbed graph output by the integrated model. The integrated model is trained based on multiple subgraphs corresponding to sample graphs attacked by the backdoor. In this way, multiple subgraphs with diversity, randomness, and robustness are generated based on the adjacency matrix of the perturbed graph and the similarity between each node in the perturbed graph, simulating various structural changes that may occur in graphs in practical applications. Using these subgraphs as input to the integrated model improves the dynamic defense capability of the graph neural network and further enhances the accuracy of the integrated model in predicting the category of each node in the perturbed graph subjected to backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is one of the flow charts of the node category prediction method for backdoor attacks provided by the present invention.

[0019] Figure 2 This is the second flow chart of the node category prediction method for backdoor attacks provided by the present invention.

[0020] Figure 3 It is a structural diagram of the node category prediction device for backdoor attacks provided by the present invention.

[0021] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0023] Due to its excellent modeling ability for relational data, graph neural networks have achieved remarkable achievements in many fields such as reinforcement learning, text classification, and traffic prediction. However, graph neural networks are susceptible to interference from backdoor attacks. Backdoor attacks against graph neural network models generally inject perturbed edges into the training graph to form subgraph triggers and modify their labels to poison the graph. Then, when the trained GNN model encounters a test graph with the same trigger, it will be misled and incorrectly classify the test graph as the target category specified by the attacker. Compared with other attacks, backdoor attacks are more concealed and are only activated when specific triggers appear.

[0024] In many real-world application scenarios, graph structures often change dynamically, such as friendships in social networks, connection status in communication networks, or transaction patterns in financial transaction networks. These changes in graph structure can be driven by a variety of factors, including user behavior, technological advancements, and market dynamics. At the same time, backdoor attacks are constantly evolving, and attackers may exploit the structural characteristics of graphs to launch new, more subtle, or more destructive attacks. Traditional defense methods are not ideal in such dynamic environments, and retraining these models requires significant time and computational resources, which is impractical in a frequently changing environment. Therefore, existing defense methods are unable to improve the dynamic defense capabilities of graph neural networks, resulting in reduced accuracy in classification models' predictions of node categories in perturbed graphs subjected to backdoor attacks.

[0025] Based on the above problems, the present invention provides a node category prediction method for backdoor attacks. By using the adjacency matrix of the perturbation graph and the similarity of each node in the perturbation graph, multiple subgraphs with diversity, randomness and robustness are generated to simulate various structural changes that may occur in the graph in practical applications. These subgraphs are used as the input of the integrated model to improve the dynamic defense capability of the graph neural network, and further improve the accuracy of the integrated model in predicting the category of each node in the perturbation graph of backdoor attacks.

[0026] The following combination Figure 1 The present invention describes a node category prediction method for backdoor attacks. The method can be applied to predict the category of each node in any graph attacked by a backdoor. The execution subject of the method can be an electronic device, or it can be a node category prediction method for backdoor attacks set in the electronic device. The node category prediction device for backdoor attacks can be implemented by software, hardware, or a combination of the two.

[0027] Figure 1 This is one of the flow charts of the node category prediction method for backdoor attacks provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Obtain a perturbation graph attacked by a backdoor.

[0028] Here, backdoor attacks include but are not limited to Universal Backdoor Graph Attack (UBGA), Graph Trojan Attack (GTA), and Structured Backdoor Attack (SBA) and other backdoor poisoning types.

[0029] Here, the node perturbation graph refers to a structural graph that is attacked by a backdoor and includes multiple nodes. The nodes can be any objects, including but not limited to people, documents, devices, etc.

[0030] Step 102: Determine at least one subgraph corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph and the similarity between the nodes in the node perturbation graph.

[0031] The adjacency matrix is ​​used to represent the connection relationship between each node and other nodes in the node perturbation graph.

[0032] Here, the adjacency matrix is ​​used to represent the connection relationship between each node and other nodes in the perturbation graph. For example, for a perturbation graph with n nodes, its adjacency matrix is ​​an n×n matrix A, where each element A ij Represents the connection relationship between node i and node j. If A ij is 1, then there is an edge connection between node i and node j. If A ij If it is 0, there is no edge connection between node i and node j.

[0033] It should be noted that, the higher the similarity between two nodes, the greater the difference between the types of the two nodes, and vice versa, the smaller the difference between the types of the two nodes.

[0034] Optionally, the subgraph can be determined by any suitable method, for example, the sampling probability matrix and the similarity probability matrix are calculated according to the formula, and then the subgraph is obtained based on the sampling probability matrix and the similarity probability matrix subgraph; for example, the adjacency matrix of the perturbation graph and the similarity of each node in the perturbation graph are input into the generation model to directly generate the subgraph.

[0035] Step 103: Based on each of the subgraphs and the integrated model, obtain the predicted category corresponding to each node in the node perturbation graph.

[0036] The integrated model is trained based on multiple sub-sample graphs corresponding to the sample graph attacked by the backdoor.

[0037] Optionally, the sampling probability matrix and similarity probability matrix of the sample can be calculated according to the formula, and then multiple sub-sample graphs can be obtained based on the sampling probability matrix and similarity probability matrix subgraphs of the sample; or the adjacency matrix of the node perturbation graph of the sample graph and the similarity of each node in the perturbation graph can be input into the generation model to directly generate multiple sub-sample graphs.

[0038] Here, the ensemble model can be a single model or a combination of multiple sub-models. The prediction category can be directly output by a single model or can be obtained by combining the candidate prediction categories of each node in the subgraph output by each sub-model.

[0039] In an embodiment of the present invention, a perturbed graph subjected to a backdoor attack is obtained; at least one subgraph corresponding to the perturbed graph is determined based on the adjacency matrix of the perturbed graph and the similarity between each node in the perturbed graph; each subgraph is input into an integrated model to obtain the predicted category corresponding to each node in the perturbed graph output by the integrated model; the integrated model is trained based on multiple subgraphs corresponding to the sample graph subjected to the backdoor attack. In this way, multiple subgraphs with diversity, randomness, and robustness are generated based on the adjacency matrix of the perturbed graph and the similarity between each node in the perturbed graph, simulating various structural changes that may occur in graphs in practical applications. Using these subgraphs as input to the integrated model improves the dynamic defense capabilities of the graph neural network and further enhances the accuracy of the integrated model's prediction of the category of each node in the perturbed graph subjected to backdoor attacks.

[0040] Furthermore, the method of determining at least one subgraph corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph and the similarity of each node in the node perturbation graph includes: determining the degree matrix corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph; the degree matrix is ​​used to characterize the number of edges connecting each node to other nodes; determining the sampling probability matrix of the node perturbation graph based on the degree matrix and the identity matrix; determining the similarity probability matrix of each node in the node perturbation graph based on the feature similarity of each node in the node perturbation graph; and determining at least one subgraph corresponding to the node perturbation graph based on the sampling probability matrix and the similarity probability matrix.

[0041] Here, you can use Extract the number of edges connecting each node to other nodes to obtain the diagonal elements of the adjacency matrix, which is the degree matrix.

[0042] Here, the sampling probability matrix of the perturbation graph refers to the set of sampling probability matrices of all nodes.

[0043] It should be noted that the lower the node's degree, the fewer nodes it connects to, and the more likely it is to be the attacker's target node. Therefore, a degree sampling strategy is needed to calculate the node's degree to measure the likelihood of connections between nodes, resulting in a sampling probability matrix P.

[0044] It should be noted that when performing the mask operation, by changing the number of selected nodes and the degree of the node can get different sampling probability matrices, so it can be controlled by configurable parameters produce m Sampling probability matrix P, namely P1, P2, ..., P m .here, m is the number of subgraphs and the number of submodels.

[0045] Here, the method for determining the sampling probability matrix can be any appropriate method, for example, substituting the degree matrix and the identity matrix into the calculation formula to obtain the sampling probability matrix, or for example, inputting the sampling matrix and the identity matrix into the neural network model to directly obtain the sampling probability matrix.

[0046] It should be noted that, considering that attackers tend to connect target nodes with nodes that have very different features, a similarity sampling strategy is used to calculate the feature similarity between nodes, and then delete nodes with feature similarity lower than the feature similarity threshold. , and obtain the probability matrix Q based on similarity.

[0047] Here, methods for determining feature similarity include but are not limited to Euclidean distance, cosine similarity, similarity based on kernel function, and the like.

[0048] It should be noted that the higher the feature similarity, the smaller the difference between the two nodes, and vice versa, the greater the difference between the two nodes.

[0049] It should be noted that by changing the similarity threshold , we can get different similarity probability matrices , therefore, we can control the similarity threshold produce m Similarity probability matrix , i.e. Q1, Q2, ..., Q m .

[0050] Example, similarity probability matrix of perturbation graph The calculation is as follows formula (1): (1) in, Indicates the Node and The similarity probability matrix between nodes, Indicates the nodes, Indicates the nodes, is the set of all edges of the adjacency matrix A.

[0051] further, The calculation is as follows formula (2): (2) in, Represents the similarity calculation function, Represents the similarity threshold.

[0052] Here, the method for determining the subgraph can be any appropriate method, for example, substituting the sampling probability matrix and the similarity probability matrix into the calculation formula to obtain the subgraph, or inputting the sampling probability matrix and the similarity probability matrix into the neural network to directly output the subgraph.

[0053] For example, the calculation of the subgraph is as follows: (3) in, Indicates the sub-graphs, Indicates the The adjacency matrix of the subgraphs, Represents node features, further, The calculation is as follows formula (4): (4) in, Indicates the A sampling probability matrix, Indicates the A similarity probability matrix.

[0054] In an embodiment of the present invention, two graph sampling strategies, degree sampling and similarity sampling, are used to better identify the attacked target nodes, purify the perturbed graph attacked by the backdoor, and output multiple subgraphs to simulate various structural changes that may occur in the graph in actual applications, thereby further improving the dynamic defense capability of the graph neural network.

[0055] Exemplarily, determining the sampling probability matrix of the node perturbation graph based on the degree matrix and the identity matrix includes: determining a first matrix based on the degree matrix and the identity matrix; obtaining a second matrix based on the first matrix and a mask operation; and determining the sampling probability matrix of the node perturbation graph based on the second matrix.

[0056] Here, the first matrix may be the sum of the degree matrix and the identity matrix or the weighted sum of the degree matrix and the identity matrix.

[0057] For example, the first matrix The calculation is as follows formula (5): (5) in, Indicates extracting the diagonal elements of the adjacency matrix, which is the degree matrix mentioned above. represents a small constant, Represents the identity matrix.

[0058] Here, the second matrix may directly perform a mask operation on the first matrix, or may perform a mask operation on the first matrix and the transpose of the first matrix.

[0059] For example, the second matrix The calculation is as follows formula (6): (6) in, Represents a mask operation, represents the transpose of the first matrix.

[0060] Here, the second matrix is ​​normalized to obtain the sampling probability matrix of the perturbation graph.

[0061] For example, the sampling probability matrix P is calculated as follows (7): (7) in, represents the sum of the second matrices of all nodes.

[0062] In the embodiment of the present invention, the unit matrix is ​​used to perform numerical stability adjustment, and the mask operation is used to determine the probability of a node becoming an attacker target, thereby determining the sampling probability matrix, thereby improving the accuracy of the sampling probability matrix.

[0063] The above is the application of the integrated model. The following is an explanation of the training process of the integrated module: Furthermore, the integrated model is trained based on the following steps: obtaining multiple sub-sample graphs corresponding to the sample graph attacked by the backdoor and the category labels corresponding to each node in the sample graph; inputting each of the sub-sample graphs into at least one initial sub-model in the initial integrated model, and obtaining the prediction vector of each node in the sub-sample graph output by each initial sub-model; the number of the initial sub-models corresponds one-to-one to the number of the sub-sample graphs; based on each of the prediction vectors and the corresponding category labels, updating the model parameters of each of the initial sub-models to obtain the integrated model.

[0064] Here, the method for obtaining the subsample graph may refer to the above method for determining the subgraph corresponding to the perturbation graph, which will not be described in detail in the present invention.

[0065] It should be noted that one subsample graph corresponds to one initial submodel for training to obtain a submodel. The number of submodels is the same as the number of initial submodels and subsample graphs, and one submodel corresponds to one subgraph for category prediction. Therefore, the number of subgraphs is the same as the number of submodels and subsample graphs.

[0066] Here, the prediction vector may include the predicted category of each node and the probability value corresponding to the predicted category.

[0067] It should be noted that the number of sub-sample graphs is the same as the number of initial sub-models. One sub-sample graph is input into one initial sub-model to obtain the prediction vector of each node in each sub-sample graph.

[0068] Here, the method for updating the model parameters of the initial sub-model can be to update the model parameters based on the loss value between the prediction vector and the category label; or to determine the positive examples and negative examples based on the prediction vector and the category label, and then update the model parameters based on the mutual information between the positive examples and the mutual information between the negative examples.

[0069] In the embodiment of the present invention, multiple sub-models are dynamically integrated to learn category prediction, multiple sub-sample graph data and dynamically changing model structures, and an optimal sub-model combination is selected for defense in different scenarios to improve the robustness of the integrated model.

[0070] Furthermore, based on each of the prediction vectors and the corresponding category labels, the model parameters of each of the initial sub-models are updated to obtain the integrated model, including: sequentially calculating the first mutual information between each target prediction vector and each non-target prediction vector to obtain a first mutual information set; the target prediction vector is a prediction vector selected from all prediction vectors each time, and the non-target prediction vector is a prediction vector other than the target prediction vector in all prediction vectors; the first mutual information is used to characterize the similarity between the target prediction vector and the non-target prediction vector; and the prediction value of the category label corresponding to each node in each of the prediction vectors is deleted. Obtain a prediction vector corresponding to the negative sample; sequentially calculate the second mutual information between the prediction vector corresponding to each target negative sample and the prediction vector corresponding to each non-target negative sample to obtain a second mutual information set; the target negative sample is a negative sample selected from all negative samples each time, and the non-target negative sample is a negative sample other than the target sample in all negative samples, and the second mutual information is used to characterize the similarity between the target negative sample and the non-target negative sample; based on the first mutual information set and the second mutual information set, determine a first loss value; based on the first loss value, update the model parameters of each of the initial sub-models to obtain the integrated model.

[0071] It should be noted that the prediction vector output by the initial sub-model is also called a positive example or positive sample, and the first mutual information is also the mutual information between positive examples. The mutual information is used to characterize the similarity between positive samples.

[0072] Here, the method for determining the first mutual information may be any appropriate method, for example, substituting the prediction vectors of the two subsample images into a calculation formula, or directly obtaining the first mutual information by inputting the prediction vectors of the two subsample images into a mutual information model.

[0073] Optionally, the first mutual information and the second mutual information may be obtained by inner product calculation.

[0074] For example, the first mutual information The calculation of can be obtained using the inner product function, as shown in formula (8): (8) in, Indicates the The prediction vector output by the initial sub-model, Indicates the The prediction vector output by the initial sub-model, express The transpose of Represents the dot product symbol.

[0075] Here, the method for determining the second mutual information may be any appropriate method, for example, substituting the prediction vector of the negative example into the calculation formula, or directly obtaining it by inputting the prediction vector of the negative example into the mutual information model.

[0076] Exemplarily, the second mutual information The calculation of can be obtained using the inner product function, as shown in formula (9): (9) in, Indicates the The prediction vector corresponding to the negative samples is Indicates the The prediction vector corresponding to the negative samples is express The transpose of .

[0077] Here, the first loss value may be the sum of the first mutual information and the second mutual information or the weighted sum of the first mutual information and the second mutual information.

[0078] For example, the first loss value is calculated as follows: (10) in, represents the weight coefficient of negative examples, represents the weight coefficient of the positive example, represents the number of initial sub-models, Represents the logarithmic function.

[0079] Here, the model parameters of the initial sub-model can be updated directly according to the first loss function, or the second loss value can be determined based on discrete information, and the model parameters of the initial sub-model can be updated based on the first loss value and the second loss value.

[0080] In an embodiment of the present invention, a diversity enhancement strategy based on mutual information is adopted to increase the differences between sub-models in the integrated model, so that different sub-models focus on different defense directions, encourage sub-models to produce different predictions for backdoor samples, make it difficult for backdoors to migrate between sub-models, and prevent sub-models from being fooled by the same attack.

[0081] Furthermore, based on the first loss value, the model parameters of each initial sub-model are updated to obtain the integrated model, including: determining the weight corresponding to each initial sub-model based on the category probability of each node in the sub-sample graph output by the initial sub-model; obtaining the target discrete information corresponding to each initial sub-model based on the weight corresponding to each initial sub-model and the game right model; the game right model is used to characterize the degree of discreteness between each initial sub-model; determining the second loss value based on the weight corresponding to each initial sub-model and the target discrete information corresponding to each initial sub-model; based on the first loss value and the second loss value, updating the model parameters of the initial sub-model to obtain a sub-model; taking the sub-model whose target discrete information is greater than the discrete information threshold as the target sub-model; and determining the integrated model based on each target integrated model.

[0082] Here, the target discrete information is the sum of the discrete degrees of an initial sub-model and other initial sub-models, wherein the more accurate the prediction category output by the sub-model itself is, the larger the target discrete information is.

[0083] Here, the category probability can be substituted into the calculation formula to obtain the weight, or the category probability can be input into the weight model to directly obtain the weight.

[0084] For example, the weights corresponding to the initial sub-models The calculation is as follows formula (11): (11) in, Express Probability distribution, , For the The initial sub-model is at node Targeted The probability of the categories, Greater than or equal to 1 Less than or equal to , greater than 1, , Represented as an indicator variable, if the node Belong to category ,but =1, otherwise =0, if The more correctly a sub-model is classified at a certain node, the lower the loss will be, resulting in The smaller.

[0085] For example, the game model is established based on the weights corresponding to the initial sub-models, as shown in the following formula (12): (12) in, Indicates the The sum of the discrete degrees of the initial sub-model and other initial sub-models, Indicates the The transpose of the weights corresponding to the initial sub-model, Indicates the The transpose of the weights corresponding to the initial sub-models, || || represents the modulus.

[0086] The optimization condition of the game power model is set as the following formula (13): (13) in, Indicates the The sum of the discrete degrees of an initial sub-model from other initial sub-models.

[0087] Furthermore, the constraints are determined and formula (13) is transformed into the following formula (14): (14) Among them, the constraints are as follows formula (15): (15) in, represents the coefficient, Indicates parameters, Used to dynamically adjust the volatility or dispersion of weights.

[0088] The augmented Lagrangian function is used to solve the optimization equation and the following formula (16) is obtained: (16) Solve and get The value of is as follows: (17) in, Indicates the The sum of the discrete degrees of a sub-model and other sub-models. If most of the model outputs are incorrect, the minority of accurate model outputs must show greater target discrete information for their own results, that is, The bigger.

[0089] Here, the second loss value The calculation is as follows formula (18): (18) Here, the model parameters are updated according to the sum of the first loss value and the second loss value or the weighted sum of the first loss value and the second loss value to obtain a sub-model, and the sub-model with a discreteness greater than the discreteness threshold is used as the target sub-model in the integrated model.

[0090] In an embodiment of the present invention, a game theory-based arbitration strategy is adopted to dynamically adjust the discreteness of each sub-model, and train the optimal sub-model for prediction in different scenarios to adapt to the dynamic environment, better optimize the individual sub-model and the overall integrated model, and improve the accuracy and robustness of the integrated model.

[0091] Furthermore, the integrated model includes at least one sub-model, and obtaining the prediction category corresponding to each node in the node perturbation graph based on each of the sub-graphs and the integrated model includes: obtaining the candidate prediction category corresponding to each node in each of the sub-graphs in the node perturbation graph based on each of the sub-graphs and the integrated model; the number of the sub-graphs is the same as the number of the sub-models; and determining the prediction category corresponding to each node in the node perturbation graph from the candidate prediction categories based on a majority voting mechanism.

[0092] It should be noted that each Figure 1 In the corresponding input sub-model, the candidate prediction category of each node corresponding to each sub-graph output by each sub-model is obtained. Based on the majority voting mechanism, the category with the most occurrences of each node in the candidate prediction category is determined as the final prediction category of the node.

[0093] In an embodiment of the present invention, a majority voting mechanism is used to determine the final category of a node using candidate prediction categories output by multiple sub-models, thereby improving the accuracy of the model prediction category and reducing the possibility of a few high-quality models being ignored.

[0094] Figure 2 This is the second flow chart of the node category prediction method for backdoor attacks provided by the present invention. Figure 2 As shown, including: Step 201: Obtain a perturbation graph of a sample node attacked by a backdoor.

[0095] Step 202: Utilize degree sampling and similarity sampling to generate m Subsample graph G 1 , G 2 …G m 。

[0096] Among them, degree sampling and similarity sampling are graph sampling strategies. Degree sampling is essentially sampling based on the degree matrix of the node perturbation graph, and similarity sampling is essentially sampling based on the similarity between nodes.

[0097] Step 203: m subsamples Figure 1 One by one, input the initial integrated model m Initial sub-model F 1 , F 2 …F m middle.

[0098] Step 204: Determine the first mutual information and the second mutual information between the prediction vectors outputted by each initial sub-model.

[0099] Step 205: Determine a second loss value using the weights corresponding to the initial sub-models and the target discrete information corresponding to the initial sub-models.

[0100] The target discrete information may be determined based on the weight corresponding to the initial sub-model and the arbitration strategy of the game right model.

[0101] Step 206: Based on the first loss value and the second loss value, update the model parameters of each initial sub-model to obtain the target loss value corresponding to each initial sub-model; Step 207: Determine the initial sub-model corresponding to each target loss value as the sub-model, and obtain m An integrated model of sub-models.

[0102] Step 208: Input the test node perturbation graph into the integrated model, and output the predicted category corresponding to each node in the test node perturbation graph.

[0103] The following is a specific application scenario of the node category prediction method for backdoor attacks provided by the present invention.

[0104] In this application scenario, experiments were conducted using three popular graph datasets: Cora, Citeseer, and Pubmed. Cora and Citeseer are considered small graphs, while Pubmed is considered a large graph. In these graphs, nodes represent documents, edges represent links between documents, and features correspond to bag-of-words representations. Three recent backdoor poisoning attacks, UBGA, GTA, and SBA, were used to dynamically adjust parameters for attack. Table 1 shows the evaluation metrics for defending against the three backdoor attacks on the three datasets: Table 1: Evaluation metrics for defending against three backdoor attacks on three datasets

[0105] The evaluation indicators in Table 1 include the attack success rate (ASR) when the attacker attacks the defense method and the accuracy (ACC) of the attacked model on clean samples. It should be noted that the smaller the ASR, the worse the backdoor attack effect and the better the defense capability of the defense method, and vice versa.

[0106] From the results in Table 1, it can be observed that the node category prediction method for backdoor attacks provided by the present invention can defend against three most advanced backdoor attacks in three data sets, and achieves the best results in each case. The beneficial effects include: (1) Excellent protection performance: It can accurately identify and effectively resist backdoor attacks in a variety of scenarios, while ensuring high recognition accuracy for normal samples, showing its excellent defense capability; (2) Dynamic adaptability: The present invention adopts the idea of ​​dynamic ensemble learning to adaptively select the sub-model combination that is most suitable for the current environment. It can not only accurately capture the structural changes of graph data, but also keenly perceive the pattern changes of backdoor attacks; (3) Universal applicability: Experimental data confirms that the present invention can not only effectively defend against specific attack patterns, but also adapt to a variety of different data set environments, which demonstrates its excellent versatility and adaptability.

[0107] The node category prediction device for backdoor attacks provided by the present invention is described below. The node category prediction device for backdoor attacks described below and the node category prediction method for backdoor attacks described above can be referenced to each other.

[0108] Figure 3 This is a flow chart of the node category prediction device for backdoor attacks provided by the present invention. Figure 3 As shown, the node category prediction device 200 for backdoor attacks includes the following: An acquisition module 210 is used to obtain a perturbation graph attacked by a backdoor; A determination module 220 is configured to determine at least one subgraph corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph and similarities between nodes in the node perturbation graph; the adjacency matrix is ​​configured to represent a connection relationship between each node in the node perturbation graph and other nodes; The prediction module 230 is used to obtain the predicted category corresponding to each node in the node perturbation graph based on each of the subgraphs and the integrated model; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

[0109] In another embodiment, the determination module 220 is specifically used to: determine the degree matrix corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph; the degree matrix is ​​used to characterize the number of edges connecting each node to other nodes; determine the sampling probability matrix of the node perturbation graph based on the degree matrix and the unit matrix; determine the similarity probability matrix of each node in the node perturbation graph based on the feature similarity of each node in the node perturbation graph; determine at least one subgraph corresponding to the node perturbation graph based on the sampling probability matrix and the similarity probability matrix.

[0110] In another embodiment, the determination module 220 is further specifically used to: determine a first matrix based on the degree matrix and the identity matrix; obtain a second matrix based on the first matrix and a mask operation; and determine a sampling probability matrix of the node perturbation graph based on the second matrix.

[0111] In another embodiment, the node category prediction device 200 for backdoor attacks also includes a training module, which is specifically used to: obtain multiple sub-sample graphs corresponding to the sample graph attacked by the backdoor and the category labels corresponding to each node in the sample graph; input each of the sub-sample graphs into at least one initial sub-model in the initial integrated model to obtain the prediction vector of each node in the sub-sample graph output by each initial sub-model; the number of the initial sub-models corresponds one-to-one to the number of the sub-sample graphs; based on each of the prediction vectors and the corresponding category labels, the model parameters of each of the initial sub-models are updated to obtain the integrated model.

[0112] In another embodiment, the training module is further specifically used to: sequentially calculate the first mutual information between each target prediction vector and each non-target prediction vector to obtain a first mutual information set; the target prediction vector is a prediction vector selected from all prediction vectors each time, and the non-target prediction vector is a prediction vector other than the target prediction vector in all prediction vectors; the first mutual information is used to characterize the similarity between the target prediction vector and the non-target prediction vector; delete the prediction value of the category label corresponding to each node in each prediction vector to obtain the prediction vector corresponding to the negative sample; sequentially calculate the second mutual information between the prediction vector corresponding to each target negative sample and the prediction vector corresponding to each non-target negative sample to obtain multiple second mutual information sets; the target negative sample is a negative sample selected from all negative samples each time, and the non-target negative sample is a negative sample other than the target sample in all negative samples, and the second mutual information is used to characterize the similarity between the target negative sample and the non-target negative sample; determine a first loss value based on the first mutual information set and the second mutual information set; and update the model parameters of each of the initial sub-models based on the first loss value to obtain the integrated model.

[0113] In another embodiment, the training module is further specifically used to: determine the weight corresponding to each of the initial sub-models based on the category probability of each node in the sub-sample graph output by the initial sub-model; obtain the target discrete information corresponding to each of the initial sub-models based on the weight corresponding to each of the initial sub-models and the game weight model; the game weight model is used to characterize the degree of discreteness between each of the initial sub-models; determine the second loss value based on the weight corresponding to each of the initial sub-models and the target discrete information corresponding to each of the initial sub-models; update the model parameters of the initial sub-model based on the first loss value and the second loss value to obtain a sub-model; use the sub-model whose target discrete information is greater than the discrete information threshold as the target sub-model; and determine the integrated model based on each of the target integrated models.

[0114] In another embodiment, the integrated model includes at least one sub-model, and the prediction module 230 is specifically used to: obtain the candidate prediction category corresponding to each node in each sub-graph in the node perturbation graph based on each sub-graph and the integrated model; the number of the sub-graphs is the same as the number of the sub-models; based on a majority voting mechanism, determine the prediction category corresponding to each node in the node perturbation graph from the candidate prediction categories.

[0115] Figure 4 Schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other via the communications bus 840. The processor 810 may call logic instructions in the memory 830 to execute a node category prediction method for backdoor attacks, the method comprising: obtaining a perturbation graph attacked by a backdoor; determining at least one subgraph corresponding to the perturbation graph based on an adjacency matrix of the perturbation graph and similarities between nodes in the perturbation graph; the adjacency matrix is ​​used to represent the connection relationship between each node in the perturbation graph and other nodes; obtaining a predicted category corresponding to each node in the perturbation graph based on each subgraph and an integrated model; the integrated model is trained based on multiple subgraphs corresponding to the sample graph attacked by the backdoor.

[0116] Furthermore, the logic instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0117] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the node category prediction method for backdoor attacks provided by the above methods, and the method includes: obtaining a perturbation graph attacked by a backdoor; determining at least one subgraph corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph and the similarity of each node in the node perturbation graph; the adjacency matrix is ​​used to characterize the connection relationship between each node and other nodes in the node perturbation graph; based on each of the subgraphs and the integrated model, obtaining the predicted category corresponding to each node in the node perturbation graph; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

[0118] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the node category prediction method for backdoor attacks provided by the above-mentioned methods, the method comprising: obtaining a perturbation graph attacked by a backdoor; determining at least one subgraph corresponding to the node perturbation graph based on the adjacency matrix of the node perturbation graph and the similarity of each node in the node perturbation graph; the adjacency matrix is ​​used to characterize the connection relationship between each node and other nodes in the node perturbation graph; based on each of the subgraphs and the integrated model, obtaining the predicted category corresponding to each node in the node perturbation graph; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

[0119] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0120] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A node category prediction method for backdoor attacks, characterized in that: include: Obtain the perturbation graph of nodes attacked by the backdoor; Determining at least one subgraph corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph and similarities of the nodes in the node perturbation graph; the adjacency matrix is ​​used to represent a connection relationship between each node in the node perturbation graph and other nodes; Based on each of the subgraphs and the integrated model, a predicted category corresponding to each node in the node perturbation graph is obtained; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

2. The node category prediction method for backdoor attacks according to claim 1 is characterized in that: The determining, based on the adjacency matrix of the node perturbation graph and the similarity of each node in the node perturbation graph, at least one subgraph corresponding to the node perturbation graph comprises: Determining a degree matrix corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph; the degree matrix is ​​used to represent the number of edges connecting each node to other nodes; Determining a sampling probability matrix of the node perturbation graph based on the degree matrix and the identity matrix; Determining a similarity probability matrix of each node in the node perturbation graph based on feature similarities of each node in the node perturbation graph; At least one subgraph corresponding to the node perturbation graph is determined based on the sampling probability matrix and the similarity probability matrix.

3. The node category prediction method for backdoor attacks according to claim 2 is characterized in that: The step of determining a sampling probability matrix of the node perturbation graph based on the degree matrix and the identity matrix includes: Determining a first matrix based on the degree matrix and the identity matrix; Obtaining a second matrix based on the first matrix and a mask operation; Based on the second matrix, a sampling probability matrix of the node perturbation graph is determined.

4. The node category prediction method for backdoor attacks according to any one of claims 1 to 3, characterized in that: The ensemble model is trained based on the following steps: Obtain multiple sub-sample graphs corresponding to the sample graph attacked by the backdoor and category labels corresponding to each node in the sample graph; Inputting each of the subsample graphs into at least one initial submodel in the initial integrated model, respectively, to obtain a prediction vector for each node in the subsample graph output by each initial submodel; the number of the initial submodels corresponds to the number of the subsample graphs; Based on each of the prediction vectors and the corresponding category labels, the model parameters of each of the initial sub-models are updated to obtain the integrated model.

5. The node category prediction method for backdoor attacks according to claim 4 is characterized in that: The updating of model parameters of each of the initial sub-models based on each of the prediction vectors and the corresponding category labels to obtain the integrated model includes: sequentially calculating a first mutual information between each target prediction vector and each non-target prediction vector to obtain a first mutual information set; the target prediction vector is a prediction vector selected from all prediction vectors each time, and the non-target prediction vector is a prediction vector from all prediction vectors other than the target prediction vector; the first mutual information is used to characterize the similarity between the target prediction vector and the non-target prediction vector; Deleting the predicted value of the category label corresponding to each node in each prediction vector to obtain a prediction vector corresponding to the negative sample; Sequentially calculating the second mutual information between the prediction vector corresponding to each target negative sample and the prediction vector corresponding to each non-target negative sample to obtain a second mutual information set; the target negative sample is a negative sample selected from all negative samples each time, and the non-target negative sample is a negative sample other than the target sample from all negative samples, and the second mutual information is used to characterize the similarity between the target negative sample and the non-target negative sample; Determining a first loss value based on the first mutual information set and all second mutual information sets; Based on the first loss value, the model parameters of each of the initial sub-models are updated to obtain the integrated model.

6. The node category prediction method for backdoor attacks according to claim 5, characterized in that: The updating of model parameters of each of the initial sub-models based on the first loss value to obtain the integrated model includes: Determining a weight corresponding to each of the initial sub-models based on the category probability of each node in the sub-sample graph output by the initial sub-model; Based on the weights and game weight models corresponding to the initial sub-models, target discrete information corresponding to the initial sub-models is obtained; the game weight model is used to characterize the degree of discreteness between the initial sub-models; Determining a second loss value based on the weights corresponding to the initial sub-models and the target discrete information corresponding to the initial sub-models; Based on the first loss value and the second loss value, updating model parameters of the initial sub-model to obtain a sub-model; The sub-model whose target discrete information is greater than the discrete information threshold is used as the target sub-model; Based on each of the target integration models, the integration model is determined.

7. The node category prediction method for backdoor attacks according to any one of claims 1 to 3, characterized in that: The integrated model includes at least one sub-model, and obtaining the predicted category corresponding to each node in the node perturbation graph based on each sub-graph and the integrated model includes: Based on each of the subgraphs and the integrated model, obtaining a candidate prediction category corresponding to each node in each of the subgraphs of the node perturbation graph; the number of the subgraphs is the same as the number of the submodels; Based on a majority voting mechanism, a prediction category corresponding to each node in the node perturbation graph is determined from the candidate prediction categories.

8. A node category prediction device for backdoor attacks, characterized in that: include: The acquisition module is used to obtain the perturbation graph of the node attacked by the backdoor; A determination module, configured to determine at least one subgraph corresponding to the node perturbation graph based on an adjacency matrix of the node perturbation graph and similarities between nodes in the node perturbation graph; the adjacency matrix is ​​used to represent a connection relationship between each node in the node perturbation graph and other nodes; The prediction module obtains the prediction category corresponding to each node in the node perturbation graph based on each of the subgraphs and the integrated model; the integrated model is trained based on multiple subsample graphs corresponding to the sample graph attacked by the backdoor.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the node category prediction method for backdoor attacks according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the node category prediction method for backdoor attacks according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the node category prediction method for backdoor attacks according to any one of claims 1 to 7 is implemented.

Images