A method and system for defending against backdoor of graph neural network trained in conjunction with isolation and forgetting

Abstract

This invention discloses a graph neural network backdoor defense method and system based on decoupling and forgetting collaborative training, belonging to the field of network information security technology. The method includes: training a graph neural network model and obtaining a loss evolution sequence of node loss as the training loss changes with each training round, based on the training loss of each node in each training round; identifying a set of target nodes exhibiting abnormal loss premature convergence behavior based on the loss evolution sequence; dividing the target node set into an abnormal node subset and a normal node subset; performing decoupling and forgetting training on the graph neural network model on the abnormal node subset, and performing normal supervised training on the normal node subset, to obtain a graph neural network model with adversarial attack defense capabilities. This invention can achieve automatic identification and effective suppression of abnormal nodes, significantly reducing the impact of attacks while maintaining model prediction performance.

Description

Technical Field

[0001] This invention belongs to the field of network information security technology, and in particular relates to a backdoor defense method and system for graph neural networks that employs separation and forgetting collaborative training. Background Technology

[0002] Graph-structured data, as an important form of data organization, is widely used in practical applications such as social networks, recommender systems, financial analysis, and military equipment relationship networks. Nodes represent entities, and edges characterize the relationships between entities. Graph neural networks jointly model graph structures and node features through an iterative information transmission mechanism, demonstrating high modeling capabilities in tasks such as node classification and relationship analysis.

[0003] However, research has found that graph neural networks are vulnerable to adversarial attacks. Since the Laplacian basis of graphs is more sensitive to perturbations, this further increases the severity of attacks against graph neural networks, thus requiring further investigation. As a branch of adversarial attack paradigms, backdoor attacks offer greater controllability and stealth compared to traditional adversarial attacks. Specifically, graph backdoor attacks involve attackers embedding specific triggering patterns into the training data, such as adding nodes, local substructures, or feature perturbations. This causes the model to produce pre-set incorrect predictions for nodes carrying the triggering patterns during the inference phase, while maintaining high prediction accuracy on clean samples, thus posing a potential threat to security-sensitive applications.

[0004] Existing defenses against backdoor attacks on graph neural networks primarily mitigate the impact of triggering patterns through structural pruning, anomaly node detection, or random perturbation training. However, most of these methods rely on detecting graph structural anomalies or outliers in node distribution, offering limited protection against covert attacks manipulated through subtle features. Unlike structural attacks, feature-based backdoor attacks often modify key node features without altering the overall graph topology, thus circumventing detection methods based on structural anomalies. This makes existing defense mechanisms ineffective in identifying and eliminating their impact.

[0005] Therefore, identifying and mitigating the impact of backdoor attacks on the learning behavior of graph neural networks, without relying on explicit structural anomalies or prior attack information, starting from the model training process itself, has become a pressing technical problem. Existing research shows that backdoor attacks often introduce abnormally strong signals in the early stages of training, causing the training loss of affected nodes to converge prematurely and gradually affecting neighboring nodes. This provides a new approach for designing defense methods based on training phase features. Summary of the Invention

[0006] To address the shortcomings of existing graph neural networks in adversarial attacks, especially backdoor attacks during the training phase, this invention proposes a graph neural network backdoor defense method and system based on separation and forgetting co-training. This aims to overcome the problems of existing defense technologies relying on structural anomaly detection or prior attack information, which makes it difficult to cope with attacks based on concealed features. By analyzing the loss evolution behavior during model training, it achieves automatic identification and effective suppression of anomalous nodes, significantly reducing the impact of attacks while maintaining model prediction performance.

[0007] To achieve the above-mentioned objectives, the present invention adopts the following technical solution.

[0008] A backdoor defense method for graph neural networks that employs separation and forgetting co-training, the method comprising: The graph neural network model is trained, and the loss evolution sequence of node loss as training rounds is obtained based on the training loss of each node in each training round. Based on the loss evolution sequence, identify the set of target nodes that exhibit abnormal loss early convergence behavior; Divide the target node set into a subset of abnormal nodes and a subset of normal nodes; Decoupled and forgetting training is performed on the graph neural network model on the subset of abnormal nodes, and normal supervised training is performed on the subset of normal nodes to obtain a graph neural network model with adversarial attack defense capabilities.

[0009] Furthermore, based on the loss evolution sequence, a set of target nodes exhibiting abnormal early convergence behavior is identified, including: Based on the initial set ratio, define the initial training rounds; Based on the loss evolution sequence, the loss value of each node in the initial training rounds is obtained; Based on the loss value of each node, calculate the average loss value of each type of node, and obtain the discrimination threshold of that type of node according to the second set ratio and the average loss value. Nodes whose loss value is not higher than the discrimination threshold are designated as target nodes exhibiting abnormal loss and early convergence behavior.

[0010] Furthermore, the target node set is divided into an abnormal node subset and a normal node subset, including: Cluster analysis is performed on the node loss of the target node set to obtain several classes; Calculate the variance in each class and identify the class with the largest variance as the malicious class. For nodes in the malicious class, calculate the mean and standard deviation of the inverse cross-entropy loss value of the node, and standardize the inverse cross-entropy loss value based on the mean and standard deviation; A Gaussian mixture model is fitted based on the loss standardization results, and the malicious class is divided into a low-loss cluster and a high-low loss cluster based on the Gaussian mixture model. Calculate the difference between the expected inverse cross-entropy loss values ​​of the low-loss cluster and the high-loss cluster in each initial training round, and select the initial training round that maximizes the difference as the optimal split round; wherein, the initial training round is obtained based on a first set ratio and the total number of training rounds; At the optimal splitting round, an adaptive splitting point is defined based on the loss standardization results of each node in the low-loss cluster and the high-low loss cluster. Based on this adaptive delimiter, nodes in the malicious class are divided into abnormal nodes and normal nodes; Generate a subset of abnormal nodes based on the abnormal nodes in the malicious class, and generate a subset of normal nodes based on the normal nodes in the malicious class and the nodes in the non-malicious class.

[0011] Furthermore, the adaptive separation point ;in, Represents a node In the optimal splitting round The standardized processing results of the loss at the location Indicates the optimal split round Low-loss clusters at the location, Indicates the optimal split round High-loss clusters at the location.

[0012] Furthermore, the overall objective function is as follows: Decoupled and forgetting training is performed on the graph neural network model on the subset of anomalous nodes, while normal supervised training is performed on the subset of normal nodes. in, The parameters represent the graph neural network model. Represents the total loss function of the graph neural network model. and Let represent the subset of abnormal nodes and the subset of normal nodes obtained in the t-th round of training, respectively. For parameters Parameterized model prediction function Let cross-entropy be the loss function. Indicates abnormal nodes Correction tags, This indicates a malicious label set by the attacker. Represents a node The true label, These are weighting coefficients used to balance the contributions of random label relabeling and gradient ascent.

[0013] A backdoor defense system for graph neural networks trained using separation and forgetting techniques, the system comprising: The data acquisition module is used to train the graph neural network model and obtain the loss evolution sequence of node loss as training rounds based on the training loss of each node in each training round. The node identification module is used to identify a set of target nodes that exhibit abnormal early convergence behavior based on the loss evolution sequence. The node partitioning module is used to divide the target node set into a subset of abnormal nodes and a subset of normal nodes; The model training module is used to perform decoupled and forgetting training on the graph neural network model on the subset of abnormal nodes, and normal supervised training on the subset of normal nodes, so as to obtain a graph neural network model with adversarial attack defense capabilities.

[0014] A computer device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the graph neural network backdoor defense method of separation and forgetting co-training as described above.

[0015] A computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the graph neural network backdoor defense method of separation and forgetting co-training as described above.

[0016] A computer program product, characterized in that, when the computer program product is run on a computer device, the computer device executes the graph neural network backdoor defense method of separation and forgetting co-training as described above.

[0017] Compared with the prior art, the present invention has at least the following beneficial effects.

[0018] 1. This invention starts from the model training process and does not rely on explicit structural anomaly detection or attack prior information, making it suitable for defense scenarios against covert feature-based adversarial attacks.

[0019] 2. By dynamically selecting the training phase and performing node segmentation, abnormal nodes affected by adversarial attacks can be accurately identified, improving the targeting of the defense.

[0020] 3. By employing a decoupling and forgetting training mechanism, the model's predictive performance on clean samples is effectively maintained while mitigating the impact of adversarial attacks.

[0021] 4. This invention is applicable to various graph neural network structures and application scenarios, and has good versatility and engineering practical value. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the LoSplit framework of the present invention.

[0023] Figure 2 A flowchart of a graph neural network backdoor defense method trained in conjunction with separation and forgetting.

[0024] Figure 3 A block diagram of a graph neural network backdoor defense system trained for separation and forgetting.

[0025] Figure 4 A block diagram of a computer device. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0027] This invention provides a backdoor defense method for graph neural networks that utilizes separation and forgetting co-training, such as... Figure 1 As shown, it mainly includes two stages: dynamic partitioning and decoupling-forgetting defense.

[0028] Dynamic Partitioning Phase: In the early stages of training, this invention dynamically partitions nodes based on the significant differences in loss characteristics exhibited by different node samples during graph neural network training using the Reverse Cross Entropy (RCE) loss function. Research has found that target nodes affected by backdoor triggers often exhibit different loss reduction rates and convergence trends compared to normal nodes in the early stages of training. Based on these characteristics, this invention continuously monitors the loss changes of node samples in the early stages of model training and uses this dynamic loss information to distinguish potential target nodes from normal nodes, thereby achieving automatic identification of nodes suspected of being attacked by backdoors. This dynamic partitioning process requires no manual annotation or pre-assumption of the specific form of the backdoor trigger, exhibiting strong versatility and adaptability.

[0029] Decoupling-Forgetting Defense Phase: After identifying the target nodes, this invention further introduces a decoupling-forgetting defense mechanism to specifically process the identified target nodes, weakening their association with malicious labels. Specifically, in this phase: for the identified target nodes, on the one hand, random label reassignment disrupts their original malicious label dependencies; on the other hand, a gradient ascent optimization strategy is applied to the target nodes, prompting the model to actively move away from parameter directions related to malicious labels during training. Through this combination of random label perturbation and gradient ascent, effective decoupling of the relationship between target nodes and malicious labels is achieved, gradually forgetting the erroneous mapping relationships introduced by the backdoor trigger.

[0030] Through the synergistic effect of the two stages mentioned above, this invention can effectively separate and suppress target nodes in backdoor attacks without accessing real labels or relying on attack assumptions, significantly reducing the success rate of backdoor attacks while maintaining the model's predictive performance on normal nodes.

[0031] Specifically, the graph neural network backdoor defense method of the present invention, which involves separation and forgetting co-training, is as follows: Figure 2 As shown, it includes the following steps.

[0032] Step 1: Train the graph neural network model and obtain the loss evolution sequence of node loss as training rounds based on the training loss of each node in each training round.

[0033] The core of the graph neural network model training process in this invention is to extract and update graph data features layer by layer. These features integrate node attributes with graph structure information, and the inter-layer update formula is as follows: ,in, Indicates the first The node feature matrix of the layer, This represents the normalized adjacency matrix. Indicates the first The trainable weights of the layer This represents the activation function.

[0034] Specifically, before training begins, all weight parameters of the graph neural network model need to be initialized. After training begins, the graph neural network model uses the features from the previous layer... and normalized adjacency matrix As input, after linear transformation and neighborhood aggregation, the next layer of features is obtained through activation function σ. The model is trained by minimizing the difference between the predicted labels and the true node labels (e.g., cross-entropy loss). At the end of each training epoch, the loss value of the current model on all training nodes is calculated. This loss value is recorded in real time and arranged in the order of training epochs, thus forming a loss evolution sequence. This loss evolution sequence satisfies: (1) the loss of anomalous nodes converges rapidly in the early stages of training; (2) the features of the loss of anomalous nodes diffuse to neighboring nodes during the training process, forming a loss drift phenomenon; wherein, the loss drift is used to characterize the impact of adversarial attacks on the model learning process during the training phase.

[0035] Step 2: Based on the loss evolution sequence, identify the set of target nodes that exhibit abnormal loss early convergence behavior.

[0036] In one embodiment, the abnormal loss early convergence behavior of the present invention includes: the loss value of the target node in the initial training rounds (the first 10%–40% of the total training rounds of the model in the initial rounds, preferably the first 20%–30%) is not higher than 50%–80% of the average loss value of the same type of normal node.

[0037] Step 3: Divide the target node set into a subset of abnormal nodes and a subset of normal nodes.

[0038] In one embodiment, the process of dividing the abnormal node subset and the normal node subset includes the following sub-steps.

[0039] Step 3.1: Perform cluster analysis on the node loss of the target node set to obtain several classes.

[0040] Step 3.2: Calculate the variance in each class and identify the class with the largest variance as the malicious class.

[0041] In one embodiment, the present invention calculates the variance of the node loss values ​​in each class and selects the class with the largest variance as the identified malicious label. , in, Indicates malicious labeling; Represents the set of candidate target labels; Represents any category label in the candidate target label set; This indicates the selection of category labels that maximize the objective function; This represents the variance operator, used to measure the degree of dispersion of the node loss distribution; This represents the loss value of the i-th node in the t-th round of training; This represents the actual label of the i-th node.

[0042] Step 3.3: For nodes in the malicious class, calculate the mean and standard deviation of the inverse cross-entropy loss value of the node, and standardize the inverse cross-entropy loss value based on the mean and standard deviation.

[0043] Malicious tags were identified in the previous step. Subsequently, this invention will extract all categories as The node is denoted as In the given early training rounds Calculate the mean of its back cross-entropy loss value. and standard deviation Then, their loss values ​​are standardized to the form of z-score: .

[0044] Step 3.4: Fit a Gaussian mixture model based on the loss standardization result, and divide the malicious class into a low-loss cluster and a high-low loss cluster based on the Gaussian mixture model.

[0045] Target nodes tend to form a dense cluster at the low end of the loss value distribution. In practical terms, this invention categorizes... The loss values ​​within the model are sorted in ascending order, and then a Gaussian Mixture Model (GMM) is fitted to identify low-loss clusters (i.e., outlier nodes). Let... and These represent the training rounds. The two node clusters with lower and higher average loss values ​​are located at the same point.

[0046] Step 3.5: Calculate the difference between the expected inverse cross-entropy loss values ​​of the low-loss cluster and the high-loss cluster in each initial training round, and select the initial training round that maximizes the difference as the optimal split round.

[0047] In each early round The difference between the expected back cross-entropy loss values ​​of the two clusters is calculated. The round that maximizes this difference is selected as the optimal round. .

[0048] Step 3.6: At the optimal split round, based on the loss standardization results of each node in the low-loss cluster and the high-low loss cluster, define an adaptive split point.

[0049] This invention defines an adaptive separating point by calculating the midpoint between high-loss and low-loss clusters: Step 3.7: Based on the adaptive dividing point, divide the nodes in the malicious class into abnormal nodes and normal nodes.

[0050] This invention considers nodes with loss values ​​less than the optimal split point as candidate anomalous nodes, while simultaneously considering the remaining nodes in the training set as candidate clean nodes. Step 3.8: Generate a subset of abnormal nodes based on the abnormal nodes in the malicious class, and generate a subset of normal nodes based on the normal nodes in the malicious class and the nodes in the non-malicious class.

[0051] Step 4: Perform decoupling and forgetting training on the abnormal node subset of the graph neural network model, and perform normal supervised training on the normal node subset to obtain a graph neural network model with adversarial attack defense capabilities.

[0052] This invention proposes a unified decoupling forgetting strategy that combines random label redistribution (decoupling) with gradient ascent (forgetting) methods.

[0053] Random label reassignment breaks the strong correlation established between the backdoor trigger and the malicious label. In each training round, this invention reassigns a label other than a malicious label to each target node. New random tags Unlike static reassignment, this dynamic relabeling acts as a diversified perturbation across multiple rounds, preventing the target node from overfitting to any single mislabeled node.

[0054] While random relabeling can prevent shortcut effects, it can cause the representation of the target node to converge toward the centroid of the embedding space, which can sometimes still align with certain malicious categories. To counteract this, this invention introduces a method for targeting malicious tags. The gradient ascent explicitly pushes the target node's representation away from the malicious decision boundary, thus generating a stronger, more directional forgetting signal.

[0055] Overall objective function: for the identified target nodes This invention employs an overall objective function, combining random label relabeling with gradient ascent, and balances parameters... Balance the nodes. In contrast, clean nodes... Then continue training as usual to maintain model performance: in, Represents the parameters of the GNN model. To optimize the overall objective function, Weighting coefficients used to balance the contributions of random label relabeling and gradient ascent; This represents the sample at the i-th node. and Let represent the set of abnormal target nodes and the set of normal nodes obtained in the t-th round of training, respectively; For parameters Parameterized model prediction function The cross-entropy loss function; Indicates abnormal nodes Correction tags, This indicates that the attacker sets malicious labels by imposing label re-constraints on abnormal nodes and simultaneously suppressing the malicious labels on normal nodes. This method improves the prediction probability and enhances the ability to distinguish non-target labels, thereby effectively weakening the correlation between backdoor triggering and target labels, and achieving robust defense against graph backdoor attacks. The graph neural network model trained based on the method described in this invention can be applied to multiple tasks such as situational awareness, risk assessment, target recognition, or collaborative decision-making.

[0056] Experiments show that, on multiple real-world node classification datasets, the model (LoSplit) proposed in this invention outperforms existing state-of-the-art defense methods such as ABL and RIGBD in identifying attacked nodes, as shown in Table 1.

[0057] Table 1 Comparison of Target Node Recognition Performance On six real-world node classification datasets, the proposed model (LoSplit) outperforms existing state-of-the-art defense methods such as RIGBD in overall defense, as shown in Table 2.

[0058] Table 2: Comparison of LoSplit with baseline and state-of-the-art defense methods Based on the same concept, this invention also provides a graph neural network backdoor defense system that uses separation and forgetting co-training, such as... Figure 3 As shown, the system includes: The data acquisition module is used to train the graph neural network model and obtain the loss evolution sequence of node loss as training rounds based on the training loss of each node in each training round. The node identification module is used to identify a set of target nodes that exhibit abnormal early convergence behavior based on the loss evolution sequence. The node partitioning module is used to divide the target node set into a subset of abnormal nodes and a subset of normal nodes; The model training module is used to perform decoupled and forgetting training on the graph neural network model on the subset of abnormal nodes, and normal supervised training on the subset of normal nodes, so as to obtain a graph neural network model with adversarial attack defense capabilities.

[0059] Based on the same concept, the present invention also provides a computer device, which may be a terminal, a laptop computer, a desktop computer, a server, a computer cluster, or other types of computer devices.

[0060] Reference Figure 4 A computer device may include at least one processor and memory. The processor can execute instructions stored in the memory. The processor is communicatively connected to the memory via a data bus. In addition to memory, the processor can also be communicatively connected to input devices, output devices, and communication devices via the data bus.

[0061] The processor can be any conventional processor. Processors may include central processing units (CPUs), graphics processing units (GPUs), field-programmable gate arrays (FPGAs), systems on chips (SoCs), application-specific integrated circuits (ASICs), or combinations thereof.

[0062] Memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0063] In this embodiment of the invention, an executable instruction is stored in a memory. The processor can read the executable instruction from the memory and execute the instruction to implement all or part of the steps of the method of the invention.

[0064] Based on the same concept, the present invention also provides a computer program product or a computer-readable storage medium storing the computer program product. The computer product includes computer program instructions that can be executed by a processor to perform all or part of the steps described in the exemplary embodiments above.

[0065] Computer program products can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. These programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages, and scripting languages ​​(e.g., Python). The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0066] Computer-readable storage media can take the form of any combination of one or more readable media. A readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media include: static random access memory (SRAM) having one or more electrically connected wires; electrically erasable programmable read-only memory (EEPROM); erasable programmable read-only memory (EPROM); programmable read-only memory (PROM); read-only memory (ROM); magnetic storage; flash memory; magnetic disk or optical disk; or any suitable combination thereof.

[0067] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A backdoor defense method for graph neural networks using separation and forgetting co-training, characterized in that, The method includes: The graph neural network model is trained, and the loss evolution sequence of node loss as training rounds is obtained based on the training loss of each node in each training round. Based on the loss evolution sequence, identify the set of target nodes that exhibit abnormal loss early convergence behavior; Divide the target node set into a subset of abnormal nodes and a subset of normal nodes; Decoupled and forgetting training is performed on the graph neural network model on the subset of abnormal nodes, and normal supervised training is performed on the subset of normal nodes to obtain a graph neural network model with adversarial attack defense capabilities.

2. The method according to claim 1, characterized in that, Based on the loss evolution sequence, a set of target nodes exhibiting abnormal early convergence behavior is identified, including: Based on the initial set ratio, define the initial training rounds; Based on the loss evolution sequence, the loss value of each node in the initial training rounds is obtained; Based on the loss value of each node, calculate the average loss value of each type of node, and obtain the discrimination threshold of that type of node according to the second set ratio and the average loss value. Nodes whose loss value is not higher than the discrimination threshold are designated as target nodes exhibiting abnormal loss and early convergence behavior.

3. The method according to claim 1, characterized in that, The target node set is divided into an abnormal node subset and a normal node subset, including: Cluster analysis is performed on the node loss of the target node set to obtain several classes; Calculate the variance in each class and identify the class with the largest variance as the malicious class. For nodes in the malicious class, calculate the mean and standard deviation of the inverse cross-entropy loss value of the node, and standardize the inverse cross-entropy loss value based on the mean and standard deviation; A Gaussian mixture model is fitted based on the loss standardization results, and the malicious class is divided into a low-loss cluster and a high-low loss cluster based on the Gaussian mixture model. Calculate the difference between the expected inverse cross-entropy loss values ​​of the low-loss cluster and the high-loss cluster in each initial training round, and select the initial training round that maximizes the difference as the optimal split round; wherein, the initial training round is obtained based on a first set ratio and the total number of training rounds; At the optimal splitting round, an adaptive splitting point is defined based on the loss standardization results of each node in the low-loss cluster and the high-low loss cluster. Based on this adaptive delimiter, nodes in the malicious class are divided into abnormal nodes and normal nodes; Generate a subset of abnormal nodes based on the abnormal nodes in the malicious class, and generate a subset of normal nodes based on the normal nodes in the malicious class and the nodes in the non-malicious class.

4. The method according to claim 3, characterized in that, The adaptive dividing point ;in, Represents a node In the optimal splitting round The standardized processing results of the loss at the location Indicates the optimal split round Low-loss clusters at the location, Indicates the optimal split round High-loss clusters at the location.

5. The method according to claim 1, characterized in that, The overall objective function is as follows: Decoupled and forgetting training is performed on the graph neural network model on the subset of anomalous nodes, while normal supervised training is performed on the subset of normal nodes. in, The parameters represent the graph neural network model. Represents the total loss function of the graph neural network model. and Let represent the subset of abnormal nodes and the subset of normal nodes obtained in the t-th round of training, respectively. For parameters Parameterized model prediction function Let cross-entropy be the loss function. Indicates abnormal nodes Correction tags, This indicates a malicious label set by the attacker. Represents a node The true label, These are weighting coefficients used to balance the contributions of random label relabeling and gradient ascent.

6. A graph neural network backdoor defense system that uses separation and forgetting co-training, characterized in that, The system includes: The data acquisition module is used to train the graph neural network model and obtain the loss evolution sequence of node loss as training rounds based on the training loss of each node in each training round. The node identification module is used to identify a set of target nodes that exhibit abnormal early convergence behavior based on the loss evolution sequence. The node partitioning module is used to divide the target node set into a subset of abnormal nodes and a subset of normal nodes; The model training module is used to perform decoupled and forgetting training on the graph neural network model on the subset of abnormal nodes, and normal supervised training on the subset of normal nodes, so as to obtain a graph neural network model with adversarial attack defense capabilities.

7. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the graph neural network backdoor defense method of separation and forgetting co-training as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the graph neural network backdoor defense method of separation and forgetting co-training as described in any one of claims 1-5.

9. A computer program product, characterized in that, When the computer program product is run on a computer device, the computer device performs the graph neural network backdoor defense method of separation and forgetting co-training as described in any one of claims 1-5.

Images