Defense methods, devices, equipment and media against graph neural network backdoor attacks

Abstract

This application relates to the field of machine learning technology, and in particular to a method, apparatus, device, and medium for defending against backdoor attacks on graph neural networks. Upon receiving an open-domain node classification task, the task is input into a pre-set trigger detection model. This model identifies unknown class nodes and prunes their edges to obtain an initial defense subgraph. Importance scores are calculated for the target defense nodes in the initial defense subgraph to form a final defense subgraph. The final defense subgraph is then input into a pre-set dynamic classifier, which outputs the classification results for the target defense nodes. This application effectively addresses the backdoor attack problem faced by graph neural networks in open-domain scenarios, improving classification accuracy and security.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, and in particular to a method, apparatus, device, and medium for defending against backdoor attacks on graph neural networks. Background Technology

[0002] In numerous internet applications, data is often presented in the form of graphs, such as traffic flow networks, social networks, knowledge graphs, and molecular information. In recent years, Graph Neural Networks (GNNs) have gradually become a research hotspot due to their powerful representation capabilities on graph-structured data. GNNs typically employ a message-passing mechanism, updating node representations through recursive propagation and aggregation of neighbor information, ensuring that the learned node representations retain both node attributes and local graph structure information. Node classification is a common task in graph-structured data, requiring the prediction of node categories based on graph structure and node attribute features. Traffic flow prediction, as an important task in the transportation field, requires combining regional flow (nodes), road (edges), and time dimension information to predict the flow of each region in future periods; therefore, GNNs are well-suited for handling these two tasks. However, GNN models have relatively simple structures and often heavily rely on high-quality datasets, exhibiting short training times but poor generalization, resulting in low model scalability. In real-world scenarios, graph-structured data is highly vulnerable to attacks that can alter node attribute features or graph structure, causing a significant performance drop in classic GNN methods under such circumstances. Furthermore, real-world applications often exist in an open set state, containing some nodes that do not belong to a known class, i.e., Out-of-Distribution (OOD) type node samples. These OOD type node samples are data information that is difficult to process outside the known categories; they are outliers during the training phase and open set samples during the testing phase. Backdoor attacks generate and connect backdoor triggers on a set of selected nodes (target nodes), assigning the target class to the target node. Triggers are usually composed of nodes or subgraphs and can be generated by predefined or trained trigger generators. When the GNN model is trained on a dataset with triggers, it will associate the triggers with the target class, causing the backdoored model to misclassify nodes with triggers as the target class during the subsequent testing phase, while the clean model can still maintain a high prediction accuracy.

[0003] Regarding graph dataset acquisition, taking node classification datasets as an example, while manual or expert annotation can avoid the introduction of backdoor attacks and ensure model purity, it is difficult, costly, and hard to implement. Using web searches, crowdsourcing, or other automated collection methods inevitably introduces malicious data, unintentionally poisoning the model and causing it to misclassify the target class. Previous backdoor attacks often exhibited OOD (Out of Detail) characteristics, aiming to perturb the graph neural network's ability to aggregate information by inserting aggressive, anomalous trigger nodes, thus collecting erroneous information, such as GTA (Graph Attack Tag) backdoor attacks, which effectively interfere with graph structure information. For attacks with significant feature distribution differences from known nodes, outlier detection algorithms can effectively remove attack nodes from a black-box defense perspective. Generally, there are three solutions for backdoor defense: backdoor detection, sample filtering, and model backdoor mitigation. Backdoor detection identifies potential triggers or backdoor features by analyzing model behavior, input-output relationships, or reverse engineering; sample filtering removes anomalous nodes or edges based on trigger detection, or prunes edges by analyzing edge importance using interpretable tools; model backdoor mitigation removes backdoors from infected models while preserving normal task performance. Existing defense methods include outlier detection algorithms that combine graph convolutional networks and deep autoencoders for anomaly detection on attribute networks; GNNGuard, which dynamically adjusts edge weights by calculating the similarity between node features to weaken the impact of anomalous edges; research on protecting model copyright by coupling main task and backdoor task parameters during training using Soft Nearest Neighbor Loss; the robustness-inspired defense method RIGBD, which detects contaminated nodes by randomly discarding edges and mitigates the impact of backdoors by combining robust training; interpretable adaptive edge pruning algorithms based on integral gradients and the iterative pruning method E-sage for dealing with multi-subgraph insertion attacks; and the MADE defense method, which resists GNN backdoor attacks through masked non-learning. In open-domain node classification tasks, dynamic thresholding or generative methods are mainly used. For example, G2pxy has an efficient strategy for generating unknown class proxies and an open-set classifier learning method, supplemented by cross-entropy and complementary entropy loss constraints, which improves its performance on relevant graph datasets. However, there is limited work on backdoor defense in open domains. In the image domain, some research has designed Open Set Defense Networks (OSDN), which learns a noiseless latent feature space that is robust to adversarial attacks and can effectively identify open-set samples by combining feature denoising, self-supervision, and image reconstruction techniques, thus achieving adversarial attack defense. In the field of face recognition, a solution for detecting backdoor attacks in open-set classification tasks has been proposed by training two models and comparing them, using model pairing and embedding transformation. However, there is still no work on open-set-based backdoor defense in graph neural networks. It is evident that in open-domain scenarios, the structural complexity of graph neural networks and the presence of unknown class data make it difficult to accurately evaluate the effectiveness of backdoor attacks and defenses. Summary of the Invention

[0004] In order to overcome the deficiencies of the prior art, the present invention provides a defense method, device, equipment and medium for backdoor attacks on graph neural networks, which can effectively address the backdoor attack problems faced by graph neural networks in open-domain scenarios and improve classification accuracy and security.

[0005] The first aspect of the present application provides a defense method for backdoor attacks on graph neural networks, and the method includes:

[0006] When receiving an open-domain node classification task, input the open-domain node classification task into a preset trigger detection model, so that the trigger detection model determines unknown-class nodes and performs a clipping operation on the edges of the unknown-class nodes to obtain an initial defense subgraph;

[0007] Calculate the importance scores of target defense nodes in the initial defense subgraph to obtain a final defense subgraph;

[0008] Input the final defense subgraph into a preset dynamic classifier, so that the dynamic classifier outputs the node classification results of the target defense nodes.

[0009] In an optional implementation manner, the step of when receiving an open-domain node classification task, inputting the open-domain node classification task into a preset trigger detection model, so that the trigger detection model determines unknown-class nodes and performs a clipping operation on the edges of the unknown-class nodes to obtain an initial defense subgraph includes:

[0010] Extract an m-hop neighborhood subgraph from the target defense nodes;

[0011] Input the m-hop neighborhood subgraph into the trigger detection model, so that the trigger detection model outputs the confidence scores of each node in the m-hop neighborhood subgraph;

[0012] Mark the nodes with confidence scores exceeding a preset threshold as the unknown-class nodes;

[0013] Remove the edges connecting the nodes in the m-hop neighborhood subgraph to the unknown-class nodes to obtain the initial defense subgraph.

[0014] In an optional implementation manner, the step of calculating the importance scores of target defense nodes in the initial defense subgraph to obtain a final defense subgraph includes:

[0015] Input the initial defense subgraph into an interpreter, so that the interpreter outputs the edge importance scores of the target defense nodes;

[0016] Calculate the degree of the target defense node based on the edge importance score, and set a maximum edge pruning threshold;

[0017] Sort the edges connected to the target defense node from high to low according to the edge importance score;

[0018] According to the maximum edge pruning threshold, select the edges whose edge importance scores do not exceed the preset threshold from the sorted edges for removal, to obtain the final defense subgraph.

[0019] In an optional embodiment, the method further includes:

[0020] Obtain an open-domain dataset, divide the open-domain dataset into a training set and a test set, and generate pseudo out-of-distribution nodes on the contaminated training set, where the pseudo out-of-distribution nodes include close-OOD nodes constructed based on nodes with edges in different classes and far-OOD nodes constructed based on boundary nodes of each class;

[0021] Construct a trigger generator and an attack detector based on a multi-layer perceptron;

[0022] Based on the generative adversarial network framework, adopt an adversarial learning method to alternately adversarially train the attack detector and the trigger generator, and output an attack detector that can effectively identify trigger nodes as the trigger detection model, so that the trigger detection model can detect nodes in an open-set environment and identify aggressive trigger nodes.

[0023] In an optional embodiment, the step of, based on the generative adversarial network framework, adopting an adversarial learning method to alternately adversarially train the attack detector and the trigger generator, and outputting an attack detector that can effectively identify trigger nodes as the trigger detection model includes:

[0024] Construct a comprehensive attack loss for multi-backdoor training;

[0025] Sample the same number of nodes as the inserted trigger nodes from the dataset, and maximize the binary classification loss to enhance the evasion ability of the trigger generator against the attack detector;

[0026] Determine the final loss function of the trigger generator according to the comprehensive attack loss and the binary classification loss;

[0027] Sample a training node set in the training set, and the number of the training node set is the same as the output of the trigger generator;

[0028] Based on the final loss function, the training node set and the victim node are used as edge constraints input to the attack detector for training to generate the trigger detection model; wherein in each training round, the detector parameters are first frozen to update the generator parameters, and then the generator parameters are frozen to optimize the detector parameters.

[0029] In an optional implementation, determining the final loss function of the trigger generator based on the combined attack loss and the binary classification loss includes:

[0030] The final loss function is determined using the following formula:

[0031] ;

[0032] in, The total damage from the attack is as described above. For the binary classification loss, It is the balance coefficient;

[0033] The overall attack loss is determined using the following formula;

[0034] ;

[0035] in, The total damage from the attack is as described above. t Indicates training rounds, Indicates the first n The loss function of each attack strategy;

[0036] The binary classification loss is determined using the following formula:

[0037] ;

[0038] in, m The number of samples; Represents the actual label of the node. Show trigger node, Indicates a clean node; This represents the predicted probability that a sample is predicted to be a trigger node.

[0039] In an optional implementation, the method further includes:

[0040] A graph neural network model is trained on a clean training set to generate a closed-set classifier; the training set includes both the clean training set and the contaminated training set.

[0041] By training a graph neural network model on a dataset containing nodes of both visible and unknown classes, a ( C +1) The classifier of class is used as an open set classifier;

[0042] Construct the dynamic classifier according to the closed-set classifier and the open-set classifier.

[0043] A second aspect of the present application provides a defense device against backdoor attacks on graph neural networks. The device includes:

[0044] A detection module, configured to, when receiving an open-domain node classification task, input the open-domain node classification task into a preset trigger detection model, so that the trigger detection model determines unknown-class nodes and performs a clipping operation on the edges of the unknown-class nodes to obtain an initial defense subgraph;

[0045] A calculation module, configured to calculate an importance score for target defense nodes in the initial defense subgraph to obtain a final defense subgraph;

[0046] A classification module, configured to input the final defense subgraph into a preset dynamic classifier, so that the dynamic classifier outputs a node classification result of the target defense nodes.

[0047] A third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the steps of the defense method against backdoor attacks on graph neural networks are implemented.

[0048] A fourth aspect of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the defense method against backdoor attacks on graph neural networks described above are implemented.

[0049] In summary, the defense method, device, equipment, and medium against backdoor attacks on graph neural networks provided by the present application have at least one of the following beneficial effects:

[0050] 1. By processing the open-domain node classification task through a preset trigger detection model, the trigger detection model can determine unknown-class nodes and perform a clipping operation on the edges of the unknown-class nodes to obtain an initial defense subgraph, which can identify and process possible malicious data information (such as nodes with backdoor triggers), reduce the degradation of model performance caused by data problems, enhance the adaptability of the model to different data situations, and improve generalization;

[0051] 2. The trigger detection model determines unknown-class nodes and performs a clipping operation on the edges of the unknown-class nodes to obtain an initial defense subgraph, which is equivalent to a preliminary screening and processing of such difficult-to-process nodes, avoiding their interference with the model classification result, and providing a more pure subgraph data for subsequent processing;

[0052] 3. Designed for open domain scenarios, by progressively processing and filtering nodes, it can better adapt to the unknown categories of data in the open domain, improve the defense against backdoor attacks, and thus solve the problem of the difficulty in accurately evaluating the effectiveness of backdoor attacks and defenses to a certain extent, making the defense effect more measurable and reliable. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating a defense method against graph neural network backdoor attacks, as shown in an embodiment of this application.

[0054] Figure 2 This is a schematic diagram of the architecture of a defense method against graph neural network backdoor attacks, as shown in an embodiment of this application;

[0055] Figure 3 This is a functional block diagram of a backdoor attack defense device based on open domain graph neural network node classification, as shown in an embodiment of this application.

[0056] Figure 4 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0057] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0058] The following will clearly and completely describe the concept, specific structure, and technical effects of the present invention in conjunction with embodiments and accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention. Furthermore, all connections / linkages involved in the patent do not simply refer to direct contact between components, but rather to the ability to form a better connection structure by adding or reducing connecting accessories according to specific implementation conditions. The various technical features in this invention can be combined interactively without contradicting each other.

[0059] Reference Figure 1 The diagram shown is a flowchart illustrating a defense method against graph neural network backdoor attacks according to an embodiment of this application. The defense method against graph neural network backdoor attacks includes the following steps.

[0060] S11, When an open domain node classification task is received, the open domain node classification task is input into a preset trigger detection model so that the trigger detection model can determine unknown class nodes and perform a pruning operation on the edges of the unknown class nodes to obtain an initial defense subgraph.

[0061] In some embodiments, an open domain node classification task is received, and the task data includes a graph structure. ,in V For a set of nodes, E Let the set of edges and the node feature matrix be... X And the set of edge weights M. For example, in a social network graph, the known class is "user", and the unknown class may be "malicious account" or "bot".

[0062] Furthermore, the graph structure to be classified The input triggers detect the model, and the model outputs the attack confidence score for each node to obtain the initial defense subgraph. Specifically, firstly, from the target defense node... Extract a subgraph ,in express m Jump to the neighborhood and apply the subgraph This is called the m-hop neighborhood subgraph. The m-hop neighborhood subgraph contains information about the target defense node and its surrounding nodes and edges within a certain range. For example, in a social network graph structure, if a user node is considered as the target defense node, extracting its m-hop neighborhood subgraph might include the user's direct neighbors (1-hop), neighbors' neighbors (2-hop), and the connections between them. By analyzing this m-hop neighborhood subgraph, the trigger detection model can determine whether there are trigger nodes that might affect the classification of the target defense node, i.e., unknown class nodes.

[0063] Next, the m-hop neighborhood subgraph is input into the trigger detection model. In the output, the confidence score of each node in the m-hop neighborhood subgraph is calculated. ,in c This represents the confidence level of nodes identified as trigger nodes, and nodes with confidence scores exceeding a preset threshold λ are marked as unknown class nodes, forming a set. .

[0064] It should be noted that the preset threshold λ is determined by different datasets, specifically ranging from 0.5 to 0.8. In this embodiment, a fixed threshold setting is used, which is adjusted according to the recognition effect. Specifically, when the number of categories in the dataset is small and the internal differences are large, the threshold can be set to a larger value to enhance the specificity of recognition; conversely, if the differences between categories are large and the recognition capability of the recognizer is high, the threshold can be appropriately reduced to avoid missed detections and to identify as many trigger nodes as possible, thereby reducing the situation where known nodes are misclassified as trigger nodes.

[0065] When an unknown type node is identified Then, the electronic device needs to remove the edges connecting the nodes in the m-hop neighborhood subgraph to these unknown class nodes to obtain the initial defense subgraph. The formal definition of the clipping operation is as follows:

[0066] ;

[0067] .

[0068] Among them, the trigger detection model This invention relates to an adversarial learning-based OOD attack detector, which employs a fusion model of a multilayer perceptron (MLP) and a graph attention network (GAT) to enhance its ability to identify various backdoor attack patterns. In this embodiment, the electronic device constructs an adversarial learning framework that integrates a trigger generator with multiple backdoor attack methods and an OOD attack detector to train a model with broad attack recognition capabilities. Simultaneously, to endow the GNN model with capabilities for open-domain classification tasks, a pre-trained closed-set GNN model is fine-tuned by generating pseudo-OOD nodes, and an OOD classifier is introduced to enhance its ability to distinguish unknown classes. For ease of understanding, reference is also made to... Figure 2 The following provides a trigger detection model. Specific training process:

[0069] (1) Obtain the original training dataset .

[0070] First, define open domain graph data. ,in , is a set of N nodes. N The number of nodes; , is a node and nodes The edge set between them; It is the node feature matrix. d For node feature dimensions; It is a set of M edge weights, and represents the feature vector of each node. Furthermore, the graph's topology is determined by the adjacency matrix. Indicates. If the node and nodes If connected, then ,otherwise .and This is a label matrix (containing known and unknown classes), where C is the maximum value of the known node classes. In closed-set node classification tasks, a closed dataset can be defined as... Specifically, the node feature matrix X Adjacency matrix A Edge weight set W These are input together into a graph neural network (GNN) to learn the embedding representation of each node, and then the embedding representation is input into a classifier to complete the process.C Category prediction. Therefore, in open-domain node classification tasks, an open-domain dataset can be defined as... , which indicates Unknown category.

[0071] Therefore, in this embodiment of the application, the open domain dataset is obtained. and open domain datasets Divided into training set and test set Original training dataset The training set contains samples of multiple known class nodes, each sample possessing node features and adjacency matrix information. During the training phase, the training set is further... Divided into clean training sets and contaminated training set The training set containing contamination This is achieved by inserting various types of backdoor triggers (including ID triggers, pure OD triggers, and hybrid ID-OD triggers) into a clean training set. It is obtained by selecting nodes in the clean training set. Train an open-domain graph neural network model, denoted as... (That is, a closed-set classifier); in the contaminated training set Train an open-domain graph neural network model, denoted as... .in, Learning the normal patterns and feature representations of data in an environment free from attack interference can accurately capture normal information such as the inherent relationships between nodes and the feature distribution of nodes in graph structure data, thereby enabling reliable classification of known node classes. Simulating real-world backdoor attack scenarios allows the model to learn data patterns incorporating the effects of backdoor attacks, thus exhibiting different classification behavior compared to a clean model. Through comparison... and The classification results of the same test data (including normal nodes and nodes that may be attacked) can intuitively show the classification errors caused by the attack.

[0072] During the training phase, The training node is represented as, and the test node is represented as. ,in , Node set S Includes already appeared Visible classes and node collections in U It includes nodes of unknown class that are not visible to any visible class. During training, a thresholding method is used to convert a closed-set classifier to an open-set classifier, and a ( C +1) Classifier That is, the open set classifier, which makes By minimizing expected risk:

[0073] ;

[0074] in, yes The adjacency matrix. The predicted unknown class consists of a new set of classes, which may contain multiple classes.

[0075] During the testing phase, the test dataset... Triggers were implanted into selected poisoned nodes, including unknown nodes, using a pre-trained model. and The test node after the trigger is implanted is predicted to satisfy the open domain backdoor attack, which can be defined as follows:

[0076] .

[0077] It should be noted that the entire experiment in the backdoor attack was conducted under an inductive setting. The goal of the closed-set backdoor attacker is to disable the trigger. Tr Injected into In this process, triggers (such as nodes or subgraphs) are generated by a specialized trigger generator. Subsequently, the attacker attempts to target the node... Change to ,in This indicates the target category. The inductive learning setting refers to the experimental setup for this open-domain node backdoor attack, where the training process cannot access real unknown classes (it can only access pseudo-OOD nodes simulated based on known class data). In other words, nodes labeled as unknown classes in the test nodes are never encountered by the model during the training phase.

[0078] Backdoor defense aims to detect trigger nodes and mitigate their impact. However, in open domains, graph data is often vulnerable to various backdoor attacks, where the distribution of trigger nodes can be diverse, exhibiting patterns such as OD and ID. OD-distributed trigger nodes typically share highly similar characteristics with OOD-type nodes in open domains. This similarity makes it difficult for existing defense methods (whether designed for OD or ID triggers) to effectively distinguish between OD trigger nodes and genuine OOD nodes. Therefore, in this embodiment, the BOND-GNN method is employed to detect trigger nodes and mitigate their impact, effectively defending against various backdoor attacks in open domains and addressing the diversity of trigger node distributions, particularly distinguishing between OD trigger nodes and genuine OOD nodes. The defense process does not rely on known information about the injected backdoor nodes or the target category of the attack. .

[0079] (2) Generation of pseudo-unknown distribution nodes (pseudo-OOD nodes):

[0080] To ensure effective classification of pseudo-OOD nodes in open-set environments, existing closed-set classifiers must be able to identify open-set nodes. Traditional methods typically employ fixed or dynamic thresholds to identify OOD nodes. However, within a defensive framework, changes in node encoding distribution before and after defense reduce the effectiveness of thresholding methods against backdoor attacks. Inspired by this, the embodiments of this application classify pseudo-OOD nodes in the open set graph node classification into two categories: a) close-OOD, Its distribution is very similar to known categories but does not belong to any of them; b) far-OOD, Its distribution is significantly different from that of the known categories.

[0081] Among them, close-OOD The sampling is based on nodes with edges existing in different classes. Let the number of known classes be . C Select nodes with edges from different classes from the original training dataset. and Random sampling from the Beta distribution. The value is approximately 0.5, and the close-OOD is constructed as follows: :

[0082] ;

[0083] in, yes In the classifier k Embedded representation at the layer level.

[0084] For far-OOD Based on the boundary nodes of each category, far-OOD is constructed in the following way. :

[0085] ;

[0086] in, It is a hyperparameter used to control the distance between generated samples and samples of known classes.

[0087] Specifically, in the contaminated training set This generates pseudo-OOD nodes, which are also the close-OOD node sets to be generated. and far-OOD node set Combined into a pseudo-OOD node set , recorded as This is to simulate the two types of OOD data mentioned above.

[0088] (3) Construct an adaptive trigger generator and trigger detection model .

[0089] Common backdoor attacks often involve injecting OOD-type trigger nodes to pollute the target node. However, in open set scenarios, OOD nodes differ from OOD-based backdoor attacks. Atk There are still some differences. Because OOD nodes in open sets often only indicate a different distribution from known class nodes, they don't actually affect the classification effect of known classes. However, trigger nodes based on OD types, due to their specific structure and characteristics, can cause poisoning of the model. Therefore, this application proposes an OD attack detector, i.e., a trigger detection model. The aim is to identify potentially malicious trigger nodes within the node set. This is to enhance the trigger detection model. To identify multiple backdoor attack patterns, an adversarial learning framework was used to train the detection model, enabling it to effectively generalize to various backdoor attack strategies. Inspired by DGBA attack methods, a multilayer perceptron (MLP) was employed as an adaptive trigger generator. Its features and structure are based on the target node. Its attributes. Specifically:

[0090] Using a multilayer perceptron (MLP) as an adaptive trigger generator For the target node Its node characteristics are The intermediate representation is obtained through MLP computation. Then, the learnable parameters are used to generate the node feature matrices of the trigger nodes respectively. and adjacency matrix That is, an adaptive trigger generator. The characteristics and structure of the trigger node are based on the target node. The attributes and specific generation process can be defined as follows:

[0091] ;

[0092] Adaptive trigger generator The goal is to mislead target nodes into the attack target category while avoiding detection by the trigger detection model. Detected.

[0093] (4) Training the adversarial learning framework.

[0094] Based on the Generative Adversarial Networks (GANs) framework, a trigger detection model is defined. optimization objectives L for:

[0095] ;

[0096] in, For detector parameters, For generator parameters, s This indicates the generated trigger node.

[0097] In the open settings, there are various types of backdoor attacks, denoted as... , where N is the number of attack categories. This is considering training the trigger detection model using only a single attack constraint. This could lead to overfitting to specific backdoor types. Therefore, in the training of the attack detector, this application classifies backdoor attacks into three categories: a) structural perturbation; b) feature perturbation; and c) stealth attacks. For each category, a representative attack method is selected, and its corresponding loss function is defined. For example, for structural perturbation attacks, a method can be chosen to implement a backdoor attack by modifying the graph structure, and a corresponding loss function can be defined to measure the degree of impact of the attack on the model. That is, since GTA attack is a representative attack based on structural perturbation, the loss function is set as GTA attack. For feature perturbation attacks, a method that modifies node features to achieve the attack is selected and a loss function is defined; for stealth attacks, an attack method with stealth characteristics is selected and a loss function is defined.

[0098] Therefore, the overall attack loss from multiple backdoor training depends on the number of training rounds. t Dynamic calculation is formalized as follows:

[0099] ;

[0100] in ，t Indicates training rounds, Indicates the first n The loss function for each attack strategy, N This represents the number of attack categories. This way, different types of backdoor attacks are considered sequentially in different training rounds, avoiding overfitting of the detector to specific backdoor types.

[0101] Meanwhile, to enhance the trigger generator's ability to evade adversarial attack detectors, the same number of nodes as the inserted trigger nodes are sampled from the original training dataset, and the binary classification loss (binary cross-entropy, BCE) is maximized to improve the trigger generator. Counter-detection model The ability to escape. Binary loss. Formalized as follows:

[0102] ;

[0103] in, Represents the actual label of the node. Show trigger node, This indicates a clean node. This represents the probability that a sample is predicted to be a trigger node.

[0104] Therefore, trigger generator The final loss function can be expressed as:

[0105] ;

[0106] in, It is the balancing coefficient, which is a hyperparameter that balances the two loss terms (combined attack loss and binary classification loss).

[0107] The attack detector aims to identify trigger nodes. During adversarial training, the detector parameters are frozen in each training epoch. To update generator parameters Then freeze the generator parameters. To optimize detector parameters This alternation strategy ensures that the detector It can continuously achieve optimal performance against the current attack samples.

[0108] During training, in the training set Sampling a set of nodes Its quantity is the same as the output of the trigger generator, and this set is the same as the victim node. (That is, the attacked node) is combined as an edge constraint and input into the detector for training. The labeling strategy is:

[0109] ;

[0110] in, This represents a set of training nodes sampled from the training set, all labeled as 0, generated by the trigger generator. Marked as 1. By providing and The detector is trained to reduce over-defense and features of some known class nodes are provided to increase generalization.

[0111] By introducing victim nodes as reference anchor points in the decision boundary, the risk of misidentifying trigger nodes is reduced, thus avoiding over-defense responses (such as unnecessary edge pruning or feature modification), ultimately resulting in a well-constructed trigger detection model. .

[0112] S12, calculate the importance score of the target defense nodes in the initial defense subgraph to obtain the final defense subgraph.

[0113] In the entire open-set backdoor defense system, the target defense node is the core object of the defense operation. In an open-set environment, there are normal category nodes, unknown category nodes, and nodes potentially vulnerable to backdoor attacks. The target defense node is the node that needs to be prioritized for protection within this complex network structure to prevent backdoor attacks from affecting its correct classification. For example, in the graph structure of an image classification network, a node representing an image to be classified is the target defense node; the defense system must ensure that it is not misclassified due to being misled by backdoor triggers.

[0114] Although the trigger detection model gains the ability to distinguish trigger nodes during training, it still faces challenges in real-world scenarios. Specifically, because ID attacks are highly similar in distribution to known category nodes, the detector can only clearly identify certain ID trigger nodes. Therefore, the trigger detection model cannot completely defend against ID attacks and can only provide preliminary defense against more easily distinguishable OD backdoors. To enhance the defense effect, further removal of trigger nodes is required. However, since some trigger nodes have been eliminated, the structure of the backdoor subgraph may have been destroyed. If the remaining trigger nodes still affect the trigger detection model, the effectiveness of traditional defense methods based on reconstruction or neighborhood repair will be weakened. On the one hand, the reconstruction model may not be able to detect the remaining trigger nodes, resulting in some backdoor effects still existing; on the other hand, the reconstruction process may further weaken the model's generalization ability after defense, thereby reducing the overall defense performance. In contrast, interpretability-based techniques are less affected by these limitations. As pointed out in E-SAGE, backdoor attacks often cause a sudden increase in the edge importance weight S_imp associated with trigger nodes, making them easier to distinguish. Therefore, this application introduces an interpretability technique. Expl To further enhance the defensive effect.

[0115] The initial defense subgraph obtained after processing by the trigger detection model Then, the initial defense subgraph Along with closed set classifier Input together into the interpreter Expl (e.g., in GNNExplainer). Through the interpreter Expl Computation and target defense nodes Relevant edge importance score and output the target defense node. Set of connected edges :

[0116] ;

[0117] It should be noted that closed set classifiers Only introduced into the interpreter Expl This is used to separate OOD nodes from attack nodes to prevent compromise in OOD detection performance during interpretability-based defense processes.

[0118] When the edge importance score is calculated Then, the electronic equipment can calculate the degree of the target defense node. That is, the number of edges connected to that node, calculated by... This allows us to understand the connectivity of the target defense nodes in the graph. And based on the degree of the target defense nodes... Set the maximum edge trimming threshold max_cut This threshold is used to control the maximum number of edges that can be removed during pruning, in order to avoid over-defense and a decrease in classification performance. For example, if the degree of a target defended node is very small, it means that it has few connected edges, so the maximum edge pruning threshold cannot be set too high, otherwise it may over-prune and destroy the key information of the graph structure for classifying the target node. Conversely, if the degree of the target defended node is large, a larger threshold can be set appropriately to remove as many potential backdoor edges as possible without over-defense.

[0119] Next, scores are awarded based on edge importance. For target defense nodes Set of connected edges The edges in the data are sorted from high to low so that subsequent pruning operations can be performed according to the importance of the edges, prioritizing the removal of less important edges in order to preserve as much edge information as possible that is important to the classification of the target node.

[0120] Furthermore, based on the set maximum edge trimming threshold max_cut And a preset edge importance score threshold δ, from the sorted edge set Select an edge to remove. The specific removal rules are as follows:

[0121] From the sorted edge set In the process of selecting edges sequentially, the number of edges whose importance scores exceed a preset threshold δ is counted. Then take That is, the number of edges whose importance score exceeds the threshold δ does not exceed the maximum edge pruning threshold. max_cutEdges that are selected are retained, and the rest are removed. The set of edges after the removal operation is denoted as . Its mathematical representation is as follows:

[0122] ;

[0123] After importance score calculation and edge pruning, the set of edges retained is... and the set of nodes in the initial defense subgraph Constructing the final defense subgraph .

[0124] S13, the final defense subgraph is input into a preset dynamic classifier so that the dynamic classifier outputs the node classification result of the target defense node.

[0125] The preset dynamic classifier is an open-domain graph neural network (such as GraphSAGE or GAT), which dynamically selects the classifier and integrates closed-set classifiers. With open set classifier Specifically, based on the judgment results of the open set classifier on the input data, the dynamic classifier adaptively selects to use either a closed set classifier or an open set classifier for node classification. During the training phase, the dynamic classifier trains an open domain graph neural network model on a clean training set as the basic model for closed set classification (i.e., the closed set classifier), and trains an open set classification model (i.e., the open set classifier) ​​on a dataset containing unknown classes.

[0126] When a closed-set classifier is obtained through training With open set classifier Then, the final defense subgraph will be... Input to the dynamic classifier to compute the closed-set classifier. With open set classifier The output logits of the closed-set classifier The output logits are Open set classifier The output logits are .

[0127] Calculate the rate of change of logits :

[0128] ;

[0129] Based on the rate of change and preset threshold Based on the comparison results, the classifier output is selected. That is, when the rate of change is less than a preset threshold... If it is determined to be a known class, a closed-set classifier is used. Predict the class; otherwise, classify it as an unknown class and use an open set classifier. The prediction is "unknown".

[0130] Through dynamic classifier Target defense node Perform classification and output the node classification results. Node classification results This indicates the category to which the target defense node belongs, including known and unknown categories. For example, in an e-commerce social network, the target node... For the user "Alice", after inputting its final defense subgraph into the classification model, ΔLogit = 0.28 (threshold δ = 0.25) is calculated. Therefore, the OOD classifier output result is selected. =unknown, identified as a potentially malicious account.

[0131] During the training phase, this application constructs an adversarial learning framework that integrates a trigger generator with multiple backdoor attack methods and an OOD attack identifier to train a model with broad attack identification capabilities. Simultaneously, to endow the GNN model with the ability to perform open-domain classification tasks, a pseudo-OOD node is generated and fine-tuned based on the trained closed-set GNN model, and an OOD classifier is introduced to enhance the ability to distinguish unknown classes. Once the OD attack identifier (i.e., trigger detection model) and dynamic classifier are trained, the OD attack identifier first detects and removes trigger nodes and their related edges to weaken the impact of OD-type backdoor attack nodes, achieving initial defense. Subsequently, since there is a significant difference in the importance scores of malicious and benign edges for nodes in interpretability evaluation, interpretability tools are used to score the edge importance of target nodes, removing edges whose importance is abnormally increased due to malicious attacks, thus completing the second stage of defense. Finally, by comparing the logits change rate before and after the OOD classifier (i.e., open set classifier) ​​defense, the decision is adaptively made to use either the Close-set classifier (i.e., closed set classifier) ​​or the OOD classifier, thereby effectively improving the defense performance and the accuracy of the open set classification task.

[0132] In some embodiments, to verify the performance of this application, experiments were conducted on three major benchmark graph datasets: Cora, Citeseer, and Pubmed (Sen P, Namata G, Bilgic M, et al. Collective classification in network data[J]. AI magazine, 2008, 29(3): 93-93) to evaluate the performance of the method. These three datasets are widely used citation network datasets, and the main statistics of the datasets are shown in Table 1 below. Among them, the Cora and Citeseer datasets are academic paper citation relationship datasets, and the Pubmed dataset is a citation network dataset in the biomedical field. Nodes in the graph represent papers, and edges represent citation relationships between papers.

[0133] Table 1:

[0134]

[0135] For each dataset, nodes with one class label are selected as the unknown class. One node from the unknown class is used for training, and another node from the unknown class is used for testing. The remaining classes are considered known classes. For the known classes, 60% of the nodes are sampled for training, 15% for validation, and 15% for testing. All unknown class nodes are placed in the test set, ensuring a 1:1 ratio of unknown to known class nodes.

[0136] Backdoor attacks primarily employ two sets of attacks: one is a combination of GTA and DGBBA (Zhang Z, Lin M, Dai E, et al. Rethinking graph backdoor attacks: A distribution-preserving perspective[C] / / Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2024: 4386-4397.), and the other is a combination of GTA, UGBA (Dai E, Lin M, Zhang X, et al. Unnoticeable backdoor attacks on graph neural networks[C] / / Proceedings of the ACM Web Conference 2023. 2023: 2263-2273.), and DGBBA. The GTA attack uses predefined subgraph structures (e.g., specific topological patterns) as triggers. These subgraphs are injected into the training set of the graph data. During the testing phase, the nodes to be attacked are attacked again to ensure that the attack can be recognized by the backdoor model. It is ensured that the number of nodes in the new subgraphs inserted by the group of nodes is consistent. UGBA deploys an adaptive trigger generator that optimizes the generation of triggers highly similar to the target nodes, making their distribution approximate normal data, thereby bypassing anomaly detection defenses. DPGBA uses a distribution preservation strategy to ensure that the generated trigger nodes are consistent with the inherent distribution of the graph data, avoiding triggers exhibiting OD characteristics, which would make them difficult for anomaly detection methods to identify.

[0137] The main experimental design revolves around three dimensions: a) graph neural network models; b) defense methods, including defenses based on model stability and defenses based on graph data; and c) open-domain prediction design methods, including thresholding or methods based on model performance. In the sub-experiments, to observe whether defense methods affect the accuracy of the unbackdoored model (i.e., the normal model), a graph neural network model based on G... 2 The Pxy model was designed with different defense methods to observe whether there would be significant fluctuations in accuracy before and after the defense.

[0138] To verify the effectiveness of the invention through experiments, the method of this application was compared with the following baseline:

[0139] 1) GCN_none_thr: This indicates that the GCN layer is used as the GNN model without any defense methods, and a fixed threshold (0.1, 0.2, ..., 0.9) is selected when predicting open set nodes, where the specific result will be selected based on the fixed threshold that yields the best performance;

[0140] 2) G-SAGE_none_thr: Similar to GCN_none_thr, but the backbone network is the GraphSAGE model;

[0141] 3) GAT_none_thr: Similar to GCN_none_thr, but the backbone network is GAT;

[0142] 4) G 2 Pxy_none:G 2 Pxy is a model for open domain node classification based on the GCN model as the backbone network. It generates two types of proxy unknown nodes, In-class and Out-class, based on the distribution characteristics of unknown classes to fully simulate the distribution of unseen classes, thereby giving the model the ability to predict unseen nodes. In this baseline, no defense methods are adopted.

[0143] 5) GNNGuard_thr: Similar to GCN_none_thr, but with GNNGuard as the backbone network, it is a graph adversarial defense model that can be integrated into various GNN backbone networks (such as GCN, GAT, etc.). By combining attention mechanism with cosine similarity, it adaptively evaluates and strengthens feature-compatible neighbor connections and weakens potential attack edges with incompatible features, thereby improving the model's robustness to graph structure adversarial attacks.

[0144] 6) G 2 Pxy_prune: Similar to G 2 Pxy_none, but the difference is that it introduces the Prune defense method, which removes the most unreliable part of the edges in the graph by calculating the feature similarity between nodes or the model attention score, in order to eliminate potential adversarial attack edges and complete the purification preprocessing of the input graph structure to achieve the purpose of defense.

[0145] 7) G 2 Pxy_RS: Similar to G 2 Pxy_none, but the difference is that it introduces the RandomSmoothing defense method, which injects random noise into node features or network weights during the forward propagation process and performs multiple sampling predictions to smooth the decision boundary of the model, thereby enhancing the robustness of the model to small perturbations.

[0146] 8) G 2 Pxy_exp: Similar to G2 While using Pxy_none, E-SAGE, a method for defending against GNN backdoor attacks based on interpretability, is introduced. Since malicious and benign edges show significant differences in importance scores for interpretability evaluation, the E-SAGE method adaptively iteratively prunes the graph based on edge scores, thereby reducing the impact of backdoor attacks on node classification.

[0147] According to the experimental setup, backdoor attack experiments were conducted on various baseline models and the method of this application under two attack scenarios: DPGBA+GTA and DPGBA+GTA+UGBA. Experimental results were obtained by combining different defense strategies, as shown in Tables 2 and 3. Table 2 shows the defense experiment results under the DPGBA+GTA backdoor attack combination, and Table 3 shows the defense experiment results under the DPGBA+GTA+UGBA backdoor attack combination.

[0148] Table 2:

[0149]

[0150] Table 3:

[0151]

[0152] It is evident that under DGBBA+GTA attacks, the baseline model without defenses is almost entirely unable to resist backdoor attacks, and nodes are successfully misled to the target category; while the open domain model G... 2 Pxy also struggles to effectively defend against attacks, offering only limited improvement when combined with traditional defenses. In contrast, interpretability-based defense methods show significant improvements, with the GNNGuard model demonstrating some defensive effectiveness on the Citeseer dataset. However, on most datasets, the BOND defense method proposed in this invention consistently exhibits superior performance. In more complex DGBBA+GTA+UGBA attack scenarios, due to the greater diversity of attack methods, the base model and open-domain models almost completely lose their defensive capabilities. Although GNNGuard_thr still shows some defensive performance on the Citeseer and PubMed datasets, G... 2 Pxy_exp also possesses some resistance, but its overall performance is still inferior to BOND. A comprehensive comparison reveals that BOND demonstrates a significant advantage across most metrics, particularly on the Cora dataset, where it significantly outperforms all baseline methods in open-set accuracy (ACCood), close-set accuracy (ACCclose), and attack success rate (ASR).

[0153] In addition, in the secondary experiments, this application tested G on the Cora and Citeseer datasets.2 Experiments were conducted using the PXY model. Without backdooring, because the prediction targets the attacking node, the attacked node was affected by the inserted new node, causing most nodes to be identified as OOD (Out of Detail). This demonstrates that all defense methods achieve high accuracy in OOD identification. However, the BOND method proposed in this application maintains the performance of the original clean model well compared to other defense methods, as shown in Tables 4 and 5. Table 4 shows the clean model accuracy under DPGBA+GTA attacks, and Table 5 shows the clean model accuracy under DPGBA+GTA+UGBA attacks.

[0154] Table 4:

[0155]

[0156] Table 5:

[0157]

[0158] Reference Figure 3 The diagram shown is a functional block diagram of a defense device against graph neural network backdoor attacks according to an embodiment of this application.

[0159] In some embodiments, the defense device 30 against graph neural network backdoor attacks may include multiple functional modules composed of computer program segments. The computer programs for each program segment of the defense device 30 against graph neural network backdoor attacks may be stored in the memory of an electronic device and executed by at least one processor to perform (see details). Figure 1 (Description) This describes the defense function against graph neural network backdoor attacks. Based on its function, it can be divided into multiple functional modules. These functional modules may include: a detection model 301, a computation model 302, a classification model 303, and a training model 304. The module referred to in this application is a series of computer program segments that can be executed by at least one processor and perform a fixed function, stored in memory. In this embodiment, the functions of each module will be detailed in subsequent embodiments.

[0160] The detection model 301 is used to input the open domain node classification task into a preset trigger detection model when an open domain node classification task is received, so that the trigger detection model can determine unknown class nodes and perform a pruning operation on the edges of the unknown class nodes to obtain an initial defense subgraph.

[0161] The calculation model 302 is used to calculate the importance score of the target defense nodes in the initial defense subgraph to obtain the final defense subgraph.

[0162] The classification model 303 is used to input the final defense subgraph into a preset dynamic classifier, so that the dynamic classifier outputs the node classification result of the target defense node. The training model 304 is used to: acquire an open domain dataset, divide the open domain dataset into a training set and a test set, and generate pseudo-unknown distributed nodes on the contaminated training set, wherein the pseudo-unknown distributed nodes include close-OOD nodes constructed based on nodes with edges of different classes and far-OOD nodes constructed based on boundary nodes of each class; construct a trigger generator and an attack detector based on a multilayer perceptron; and, based on a generative adversarial network framework, use adversarial learning to alternately adversarially train the attack detector and the trigger generator, outputting an attack detector that effectively identifies trigger nodes as the trigger detection model, so that the trigger detection model can detect nodes in the open set environment and identify trigger nodes with offensive capabilities.

[0163] It should be understood that the various variations and specific embodiments of the defense method against graph neural network backdoor attacks provided in the above embodiments are also applicable to the defense device against graph neural network backdoor attacks in this embodiment. Through the foregoing detailed description of the defense method against graph neural network backdoor attacks, those skilled in the art can clearly understand the implementation method of the defense device against graph neural network backdoor attacks in this embodiment. For the sake of brevity, it will not be described in detail here.

[0164] See Figure 4 The diagram shown is a schematic representation of the structure of an electronic device according to an embodiment of this application. In a preferred embodiment of this application, the electronic device 4 includes a memory 41, at least one processor 42, and at least one communication bus 43.

[0165] Those skilled in the art should understand that Figure 4 The structure of the electronic device shown does not constitute a limitation of the embodiments of this application. It can be a bus structure or a star structure. The electronic device 4 may also include more or fewer other hardware or software than shown, or different component arrangements.

[0166] In some embodiments, the electronic device 4 is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), digital processors, and embedded devices. The electronic device 4 may also include user equipment, which includes, but is not limited to, any electronic product capable of human-computer interaction with a user via a keyboard, mouse, remote control, touchpad, or voice control device, such as a personal computer, tablet computer, smartphone, or digital camera.

[0167] In the embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, computer-readable storage media, and electronic devices can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple components or modules may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices, components, or modules may be electrical, mechanical, or other forms.

[0168] The components described as separate parts may or may not be physically separate. The components shown as components may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the components can be selected to achieve the purpose of this embodiment according to actual needs.

[0169] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each component can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0170] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0171] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0172] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0173] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A defense method against backdoor attacks on graph neural networks, characterized in that, The method includes: When an open-domain node classification task is received, the task is input into a preset trigger detection model. This model identifies unknown-class nodes and prunes the edges of these nodes to obtain an initial defense subgraph. The trigger detection model is obtained through the following steps: acquiring an open-domain dataset and dividing it into a training set and a test set; generating pseudo-unknown distributed nodes on the contaminated training set, including close-OOD nodes constructed based on nodes with edges in different classes and far-OOD nodes constructed based on boundary nodes of each class; constructing a trigger generator and an attack detector based on a multilayer perceptron; and using an adversarial learning approach to alternately train the attack detector and the trigger generator based on a generative adversarial network framework. The resulting attack detector, which effectively identifies trigger nodes, is used as the trigger detection model, enabling it to detect nodes in an open-domain environment and identify aggressive trigger nodes. Importance scores are calculated for the target defense nodes in the initial defense subgraph to obtain the final defense subgraph; The final defense subgraph is input into a preset dynamic classifier, so that the dynamic classifier outputs the node classification result of the target defense node; the dynamic classifier is obtained through the following steps: training a graph neural network model on a clean training set to generate a closed-set classifier; the training set includes the clean training set and the contaminated training set; by training a graph neural network model on a dataset containing visible and unknown class nodes, a (C+1) classifier is constructed as an open-set classifier; C is the maximum value of the known node classes; the dynamic classifier is constructed based on the closed-set classifier and the open-set classifier.

2. The defense method against graph neural network backdoor attacks according to claim 1, characterized in that, When an open domain node classification task is received, the task is input into a preset trigger detection model so that the trigger detection model can identify unknown class nodes and perform edge pruning on the unknown class nodes to obtain an initial defense subgraph, including: Extract an m-hop neighborhood subgraph from the target defense node; The m-hop neighborhood subgraph is input into the trigger detection model so that the trigger detection model outputs the confidence score of each node in the m-hop neighborhood subgraph. Nodes whose confidence scores exceed a preset threshold are marked as unknown class nodes; Remove the edges connecting the nodes in the m-hop neighborhood subgraph to the unknown class nodes to obtain the initial defense subgraph.

3. The defense method against graph neural network backdoor attacks according to claim 1, characterized in that, The process of calculating the importance score of the target defense nodes in the initial defense subgraph to obtain the final defense subgraph includes: The initial defense subgraph is input into the interpreter so that the interpreter outputs the edge importance score of the target defense node; The degree of the target defense node is calculated based on the edge importance score, and a maximum edge pruning threshold is set. The edges connected to the target defense node are sorted from highest to lowest according to the edge importance score; Based on the maximum edge pruning threshold, edges whose importance scores do not exceed a preset threshold are selected from the sorted edges and removed to obtain the final defense subgraph.

4. The defense method against graph neural network backdoor attacks according to claim 1, characterized in that, The method based on a generative adversarial network framework, employing adversarial learning to alternately train the attack detector and the trigger generator, and outputting an attack detector that effectively identifies trigger nodes as the trigger detection model, includes: Construct a comprehensive attack loss model for training multiple backdoors; The same number of nodes as the inserted trigger nodes are sampled from the dataset, and the trigger generator's ability to evade the attack detector is enhanced by maximizing the binary classification loss. The final loss function of the trigger generator is determined based on the combined attack loss and the binary classification loss. A training node set is sampled from the training set, the number of which is the same as the output of the trigger generator; Based on the final loss function, the training node set and the victim node are used as edge constraints input to the attack detector for training to generate the trigger detection model; wherein in each training round, the detector parameters are first frozen to update the generator parameters, and then the generator parameters are frozen to optimize the detector parameters.

5. The defense method against graph neural network backdoor attacks according to claim 4, characterized in that, The step of determining the final loss function of the trigger generator based on the combined attack loss and the binary classification loss includes: The final loss function is determined using the following formula: ； in, The total damage from the attack is as described above. For the binary classification loss, It is the balance coefficient; The overall attack loss is determined using the following formula; ； in, The total damage from the attack is as described above. t Indicates training rounds, Indicates the first n The loss function of each attack strategy; The binary classification loss is determined using the following formula: ； in, m The number of samples; Represents the actual label of the node. Show trigger node, Indicates a clean node; This represents the predicted probability that a sample is predicted to be a trigger node.

6. A defense device against backdoor attacks on graph neural networks, characterized in that, The apparatus for performing the defense method against graph neural network backdoor attacks according to any one of claims 1 to 5, the apparatus comprising: The detection module is used to input the open domain node classification task into a preset trigger detection model when it receives the open domain node classification task, so that the trigger detection model can determine the unknown class nodes and perform a pruning operation on the edges of the unknown class nodes to obtain an initial defense subgraph. The calculation module is used to calculate the importance score of the target defense nodes in the initial defense subgraph to obtain the final defense subgraph; The classification module is used to input the final defense subgraph into a preset dynamic classifier, so that the dynamic classifier outputs the node classification result of the target defense node.

7. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the defense method against graph neural network backdoor attacks as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the defense method against graph neural network backdoor attacks as described in any one of claims 1 to 5.

Images