Dual semantic and neighborhood anomaly based graph neural network backdoor defense method and system

Abstract

The application belongs to the technical field of neural network backdoor defense, in order to improve the security of the existing graph neural network in the backdoor attack scene, a graph neural network backdoor defense method and system based on dual semantics and neighborhood anomaly are proposed, the feature semantic representation and the structure semantic representation of the nodes in the graph data are constructed respectively, and the feature semantic representation and the structure semantic representation of the nodes are modeled; the representation level difference and the relationship level difference between the nodes in the feature semantic representation and the structure semantic representation are compared; the representation deviation degree or the relationship consistency of the nodes relative to the neighborhood nodes is analyzed; the cross semantic difference information and the local anomaly score of the nodes are fused to obtain the comprehensive anomaly score of the nodes; the node training weight is constructed according to the comprehensive anomaly score, and then the model is trained. The application improves the security and robustness of the graph neural network in the backdoor attack scene.

Description

Technical Field

[0001] This invention belongs to the technical field of neural network backdoor defense, and particularly relates to a graph neural network backdoor defense method and system based on dual semantics and neighborhood anomalies. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Security issues with graph neural networks are becoming increasingly prominent in open environments, especially in scenarios where training data sources are complex and the training process is difficult to fully control, making models vulnerable to backdoor attacks. Attackers can subtly modify some node features, graph structure, or training sample labels to make the model learn specific malicious triggering patterns. Models trained with contaminated data may perform normally when faced with normal input, but will output incorrect results preset by the attacker when the input meets the triggering conditions, seriously threatening the model's security, reliability, and usability.

[0004] To address the aforementioned issues, existing defense technologies primarily focus on anomaly detection, data cleaning, sample filtering, and robust training. However, these technologies still have significant limitations: First, some methods model node anomalies from a single semantic perspective, making it difficult to simultaneously characterize the consistency and differences of nodes across different semantic spaces, resulting in limited ability to identify highly concealed backdoor nodes. Second, some methods prioritize global distribution or overall statistical characteristics, neglecting the relative anomalous behavior of nodes in their local neighborhoods. Backdoor nodes in actual attacks often do not manifest as significant global outliers, but rather as inconsistencies with their neighboring nodes; therefore, relying solely on global anomaly analysis is insufficient to accurately identify such covert attacks. Third, some methods directly delete, filter, or sever connections after identifying suspicious nodes. While this can mitigate the attack's impact to some extent, it can also easily damage the original graph structure and its effective semantic information, thus affecting the model's performance on normal samples. Summary of the Invention

[0005] To overcome the shortcomings of the prior art, this invention provides a graph neural network backdoor defense method and system based on dual semantics and neighborhood anomalies. It combines node feature semantics and graph structure semantics to characterize the cross-semantic differences of nodes, and further combines local neighborhood information to model the relative anomalies of nodes. It achieves effective identification and suppression of backdoor nodes without destroying the original graph structure, thereby improving the security and robustness of graph neural networks in backdoor attack scenarios.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a graph neural network backdoor defense method based on dual semantics and neighborhood anomalies, comprising:

[0008] For the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the node are constructed respectively, and the feature semantic representation and structural semantic representation of the node are modeled using a shared graph encoder;

[0009] By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes can be obtained.

[0010] Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node.

[0011] The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for the nodes;

[0012] Node training weights are constructed based on the comprehensive anomaly score, and the graph neural network model is trained with weights based on the training weights to obtain a graph neural network model optimized for backdoor defense.

[0013] Secondly, the present invention provides a graph neural network backdoor defense system based on dual semantics and neighborhood anomalies, comprising:

[0014] The dual semantic representation module is configured to: construct feature semantic representations and structural semantic representations of nodes for node attribute information and graph topology information in graph data, respectively, and model the feature semantic representations and structural semantic representations of nodes using a shared graph encoder;

[0015] The cross-semantic difference module is configured to: compare the representation-level differences and relation-level differences between the feature semantic representation and the structural semantic representation of nodes to obtain cross-semantic difference information of nodes;

[0016] The local anomaly scoring module is configured to: extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node.

[0017] The comprehensive anomaly scoring module is configured to fuse the cross-semantic difference information of a node with the local anomaly score to obtain the comprehensive anomaly score of the node.

[0018] The weighted training module is configured to: construct node training weights based on the comprehensive anomaly score, and perform weighted training on the graph neural network model based on the training weights to obtain a graph neural network model optimized for backdoor defense.

[0019] Thirdly, the present invention provides an electronic device including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the first aspect.

[0020] Fourthly, the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in the first aspect.

[0021] Fifthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0022] The above one or more technical solutions have the following beneficial effects:

[0023] This invention constructs a dual semantic representation mechanism that combines feature semantics and structural semantics, enabling the characterization of abnormal node behavior from different semantic perspectives. Compared to detection methods based solely on single semantic information, this approach more effectively identifies backdoor nodes with strong concealment. Furthermore, by jointly modeling nodes from both cross-semantic differences and local neighborhood anomalies, it more effectively identifies backdoor nodes that are difficult to detect using a single global statistical feature. By fusing dual semantic difference signals and local anomaly scores, a more stable comprehensive anomaly score for each node is obtained. Based on this comprehensive anomaly score, node training weights are constructed, which are then used to weight the graph neural network model. This reduces the impact of abnormal nodes on model parameter updates without directly deleting nodes or disrupting the original graph structure.

[0024] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0025] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0026] Figure 1 The overall flowchart of the graph neural network backdoor defense method based on dual semantics and neighborhood anomalies provided in the embodiments of the present invention is shown below.

[0027] Figure 2 This is a schematic diagram of a node anomaly detection and scoring mechanism based on dual semantic differences and local neighborhood anomalies provided in an embodiment of the present invention. Detailed Implementation

[0028] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0029] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0030] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0031] Example 1

[0032] With the widespread application of Graph Neural Networks (GNNs) in graph-structured data modeling tasks, they have demonstrated superior performance in scenarios such as recommender systems, social network analysis, knowledge graph reasoning, fraud detection, node classification, and link prediction. Compared to traditional machine learning methods, GNNs can simultaneously utilize node attribute information and graph topology information for joint modeling, thereby more effectively uncovering potential relationships in complex graph data. In recent years, with the rapid development of graph learning technology, GNNs have gradually become an important technique for processing non-Euclidean data and have been deployed in many practical scenarios.

[0033] Existing technologies primarily focus on backdoor defense research in graph neural networks, addressing issues such as anomaly detection, data cleaning, sample filtering, and robust training. One type of method emphasizes node attributes, identifying potential anomalous nodes by analyzing node feature distribution, the degree of feature anomaly, or embedding space deviation. Another type focuses on graph structure, identifying suspicious nodes by analyzing node connectivity, neighborhood structure patterns, or topological consistency. Some methods, after detecting anomalous nodes, directly remove the corresponding nodes, edges, or samples from the training set, or enhance the model's resistance to attacks through additional training strategies.

[0034] However, existing technologies still have significant limitations. First, some methods model node anomalies from a single semantic perspective, such as relying solely on node feature information or graph structure information. This makes it difficult to simultaneously characterize the consistency and differences of nodes across different semantic spaces, resulting in limited ability to identify highly concealed backdoor nodes. Second, some methods focus more on global distribution or overall statistical characteristics, ignoring the relative anomalies of nodes in their local neighborhoods. However, backdoor nodes in actual attacks often do not manifest as significant global outliers, but rather as inconsistencies with their neighboring nodes. Therefore, relying solely on global anomaly analysis is insufficient to accurately identify this type of covert attack. Third, some methods directly delete, filter, or sever connections after identifying suspicious nodes. While this can mitigate the impact of attacks to some extent, it can also easily damage the original graph structure and its effective semantic information, thus affecting the model's performance on normal samples. Furthermore, some methods rely on additional auxiliary models, complex training processes, or high prior conditions, leading to high computational costs, complex engineering deployments, and difficulty in balancing defensive effectiveness with practical application efficiency.

[0035] To address this, this embodiment proposes a graph neural network backdoor defense method based on dual semantics and neighborhood anomalies. This method can effectively identify potential backdoor nodes by starting from the feature semantic information and structural semantic information of nodes in graph data without relying on external auxiliary models. Furthermore, it suppresses the interference of abnormal nodes on the model training process through an anomaly perception training optimization mechanism, thereby improving the security and robustness of the graph neural network model in backdoor attack scenarios.

[0036] The method described in this embodiment is applicable to graph learning tasks such as node classification, and is especially suitable for graph neural network application scenarios where training data may be contaminated and the model faces the risk of covertly triggered attacks.

[0037] The method described in this embodiment can be applied to tasks such as abnormal user detection and information dissemination analysis in social networks. In this scenario, users can be represented as nodes in a graph, and the attention relationships, interaction relationships, or communication relationships between users constitute the edge structure of the graph. Node features can be composed of user behavior features, interest tags, or historical interaction information.

[0038] In practical applications, attackers may construct malicious accounts with specific behavioral patterns and embed specific structures within their relationships, thereby inducing graph neural network models to deviate in node classification or community identification tasks, thus creating backdoor attacks. Because such attacks often propagate through local structures, they are highly covert and difficult to detect effectively using traditional methods.

[0039] For example, in social media platforms such as Douyin, Weibo, and Xiaohongshu, each user is considered a node, interactions between users (such as likes, comments, and follows) are considered edges, and user information (such as profiles, interests, tags, etc.) are considered features. These nodes, edges, and features together form a graph.

[0040] The attack occurred as follows: Suppose there is a group of user accounts that follow each other and simulate normal users posting content, posts, etc., but in reality, these user accounts are engaging in malicious activities such as data manipulation. These user accounts appear to be normal users, but their structure is flawed, which is a backdoor or attack node.

[0041] This embodiment employs a dual-semantic method, viewing a user from two perspectives: Feature semantics, encompassing the user's behavior, interests, etc.; and Structural semantics, which considers the connection topology between the user and other users through social relationships, interactions, or follower chains. Normal users exhibit normal behavior and their relationship networks appear normal. However, attacker accounts may feign normal behavior, but their relationship structures lack naturalness. This approach stems from the dual-semantic perspective.

[0042] From the perspective of local anomalies, or neighborhoods, the relationship networks of normal users are very similar to those of their neighbors. The difference between abnormal users and their neighbors is large. Then, the weights are retrained. Normal users have high weights and have a greater impact in training, while abnormal users have low weights and have less influence in training.

[0043] This embodiment constructs feature semantic representations and structural semantic representations of user nodes to characterize user behavior features from multiple semantic perspectives. It also combines local neighborhood anomaly modeling methods to evaluate the degree of anomaly in a user's social relationships. Furthermore, by fusing cross-semantic difference information with local anomaly scores and weighting the model training process based on these scores, it reduces the interference of anomalous users on model training, thereby improving the model's security and robustness in social network analysis tasks.

[0044] In this embodiment, firstly, at the representation learning level, a feature semantic perspective and a structural semantic perspective are constructed for node attribute information and graph topology information in the graph data, respectively. A shared graph encoder is then used to obtain the feature semantic representation and structural semantic representation of the nodes. By modeling these two types of semantic representations in a unified latent space, this embodiment can characterize the consistency and differences of nodes in different semantic spaces, providing a multi-perspective semantic foundation for subsequent backdoor node detection. Compared to single anomaly detection methods based solely on node features or solely on graph structure, this embodiment can more comprehensively reflect the potential abnormal behavior of nodes.

[0045] Secondly, at the anomaly detection level, this embodiment further performs joint modeling of nodes from two aspects: cross-semantic differences and local neighborhood anomalies. On the one hand, by comparing the representation-level differences and relation-level differences between the feature semantic representation and the structural semantic representation of a node, a dual semantic difference signal is obtained to measure the degree of inconsistency of the node under different semantic perspectives. On the other hand, by extracting the local neighborhood set of a node, the representation deviation or relational consistency of the node relative to its neighboring nodes is analyzed to obtain a local anomaly score of the node, reflecting the relative anomaly of the node in the local structure. Through the above dual anomaly modeling mechanism, this embodiment can more effectively identify backdoor nodes that are highly concealed and difficult to detect through a single global statistical feature.

[0046] Furthermore, at the level of anomaly fusion and training optimization, this embodiment fuses the dual semantic difference signal and local anomaly score to obtain a comprehensive anomaly score for each node, and assigns corresponding training weights to each node based on this comprehensive anomaly score. For nodes with a high degree of anomaly, this embodiment reduces their impact on model parameter updates by lowering their training weights, rather than directly deleting the node or destroying the original graph structure. This approach not only preserves the effective information of the original graph data but also suppresses the interference of backdoor nodes on the model training process. This method not only enhances the model's defense against backdoor attacks but also helps maintain the model's task performance on normal samples.

[0047] Finally, after completing the anomaly scoring fusion and weight allocation, this embodiment performs weighted training on the graph neural network model based on the training weights, outputting a robust graph neural network model after defense. By coupling node anomaly detection with the model training optimization process, this embodiment constructs a closed-loop defense mechanism from anomaly identification to training suppression and then to model output. This mechanism can improve the reliability, stability, and engineering application value of graph neural networks in backdoor attack environments without significantly increasing system complexity.

[0048] The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies proposed in this embodiment will be described in detail below:

[0049] Step 1: Obtain graph structure data and node feature data.

[0050] By acquiring the graph data to be processed and completing the data standardization and graph structure preprocessing required for subsequent dual semantic representation learning, a unified input foundation is provided for subsequent node semantic modeling and anomaly detection.

[0051] In this embodiment, step one may include the following specific steps:

[0052] S101: Obtain graph structure data and node feature data.

[0053] The process involves acquiring graph data to be processed. This graph data can originate from public graph datasets used in node classification tasks or from actual business graph data, such as social network graphs, knowledge graphs, recommendation system interaction graphs, or fraud relationship graphs. This embodiment does not impose specific limitations on this.

[0054] S102: Construct an adjacency matrix and add self-loops.

[0055] Based on node set Sum of edges Constructing the adjacency matrix of the graph , indicating that the adjacency matrix A is a matrix Among them, when node With nodes When there is an edge connecting them, ;otherwise, .

[0056] To preserve node information during graph neural network propagation, this embodiment adds self-loops to the original adjacency matrix to obtain an extended adjacency matrix. :

[0057]

[0058] in, Represents the identity matrix.

[0059] Define the corresponding degree matrix for:

[0060]

[0061] in, Represents a node and nodes The connection relationships include the connections between nodes themselves.

[0062] The purpose of this step is to enhance the self-sustaining ability of nodes during the structure propagation process and prevent the characteristics of nodes from being diluted by the information of their entire neighborhood during multi-layer propagation.

[0063] S103: Normalize the graph structure.

[0064] To improve the numerical stability of the graph neural network propagation process and reduce the impact of node degree differences on feature aggregation results, the adjacency matrix is ​​extended. Normalization is performed to obtain the normalized extended adjacency matrix. :

[0065]

[0066] in, This represents the normalized extended adjacency matrix, used for graph structure information propagation; Degree matrix; This represents the extended adjacency matrix after adding self-loops.

[0067] In some embodiments, row normalization may also be used:

[0068]

[0069] in, This indicates that the extended adjacency matrix after adding self-loops is to ensure that nodes retain their own information during propagation, otherwise it would be diluted by the information from their neighbors.

[0070] This embodiment does not limit the specific normalization method, as long as it can be used for subsequent structural semantic propagation.

[0071] The purpose of this step is to provide a stable graph propagation foundation for subsequent structural semantic representation learning.

[0072] S104: Preprocess the node features.

[0073] To reduce the impact of differences in the dimensions of different features on the construction of feature semantics, node features can be normalized.

[0074] In one embodiment, for node eigenvectors , can be carried out Normalization:

[0075]

[0076] in, Represents a node Normalized node feature vectors express Norm.

[0077] In other embodiments, the node feature matrix can also be used. Perform standardized processing:

[0078]

[0079] in, and These represent the mean and standard deviation of the feature dimension, respectively. This represents the standardized node feature matrix.

[0080] The purpose of this step is to reduce the difference in feature scale and improve the reliability of subsequent feature semantic similarity calculation.

[0081] After the above processing steps, the output includes: graph structure data G, and a normalized extended adjacency matrix. The preprocessed node feature matrix X or X', node-level feature vectors These results serve as input for constructing feature semantic representations and structural semantic representations in step two. Step one completes the data preparation process from raw graph data to data that can be used for dual semantic representation learning.

[0082] Step 2: Construct feature semantic representations and structural semantic representations of nodes for node attribute information and graph topology information in graph data, respectively, and use a shared graph encoder to model the feature semantic representations and structural semantic representations of nodes.

[0083] This embodiment performs representation learning on nodes from two semantic perspectives: node feature information and graph topology information. It obtains the feature semantic representation and structural semantic representation of nodes in a unified latent space, thereby providing a foundation for subsequent cross-semantic difference calculation.

[0084] In this embodiment, step two may include the following sub-steps:

[0085] S201: Construct feature semantic relationships.

[0086] First, a feature semantic relationship matrix is ​​constructed based on the similarity between node features. For any two nodes... and Its semantic similarity It can be represented as:

[0087]

[0088] because Since it has been normalized, the above formula can be simplified to the following in some embodiments:

[0089]

[0090] in, Represents a node and In terms of similarity in the feature semantic space, in order to reduce the interference of noisy links; the superscript T indicates transpose; Represents a node Normalized node feature vectors; Represents a node Normalized node feature vectors.

[0091] In a preferred embodiment, only the nearest neighbor of each node can be retained. Construct a sparse feature semantic relation matrix from the feature neighbors. Its definition is:

[0092]

[0093] in, Represents a node The front in the feature space A set of nearest neighbor nodes; Represents a node With nodes The sparse feature semantic relation value.

[0094] Define the degree matrix of the semantic relations of features :

[0095]

[0096] in, Represents a node The degree matrix of the semantic relationships of features.

[0097] The corresponding normalized feature semantic propagation matrix It can be represented as:

[0098]

[0099] The purpose of this step is to construct a "feature semantic graph" for each node from the perspective of node attribute similarity, so that subsequent feature semantic representation learning can reflect the semantic relationship of nodes at the attribute level.

[0100] S202: Constructing structural semantic propagation relations.

[0101] Unlike the feature semantic perspective, the structural semantic perspective models directly based on the topological connectivity relationships in the original graph.

[0102] In this embodiment, the normalized extended adjacency matrix obtained in step one is used. As a structural semantic propagation matrix, it is used to describe the local associations of nodes in the graph topology space. For a node, its structural semantics mainly reflect the following information: the connection relationship between the node and its one-hop neighbors; the relative position of the node in the local topology; and the interaction pattern between the node and its neighboring nodes during graph propagation. Therefore, the propagation relationship matrix from the perspective of structural semantics can be directly represented as:

[0103] The purpose of step S202 is to model the nodes from the perspective of graph topology connection patterns, so that the node representation can retain its local neighborhood relationships in the original graph structure.

[0104] S203: Obtain a dual semantic representation through a shared graph encoder.

[0105] To ensure that the feature semantic representation and the structural semantic representation reside in the same latent space and facilitate subsequent difference comparison, this embodiment employs a shared graph encoder to extract node representations from different semantic perspectives.

[0106] In one embodiment, the general propagation form of a shared graph encoder can be represented as:

[0107]

[0108] in, Indicates the first Layer input representation, Indicates the first Layer trainable parameters, () represents the activation function. This represents the propagation matrix from the corresponding semantic perspective.

[0109] when = At that time, the feature semantic representation of the node can be obtained. :

[0110]

[0111] It can be further written as:

[0112]

[0113] in, Represents the semantic features of node i;

[0114] when = This allows us to obtain the structural semantic feature representation of the nodes. :

[0115]

[0116] It can be further written as:

[0117]

[0118] in, The structural semantic representation of node i is given.

[0119] Although two semantic representations and While both employ the same graph encoding structure in form, their essential difference lies in the different normalized adjacency matrices used, due to differences in semantic representation. and Different information needs to be disseminated. Feature semantic representation. Used It is a normalized feature semantic propagation matrix constructed based on node feature similarity, which reflects the semantic associations of nodes in the attribute space; structural semantic feature representation. The normalized extended adjacency matrix used It reflects the connectivity of nodes in the topological space.

[0120] Specifically represented in a two-layer graph encoder:

[0121]

[0122]

[0123] in, This represents the two trainable parameters of the shared encoder. Using this parameter can avoid the additional bias introduced by the difference in encoder structure under different semantic perspectives, so that the subsequent double semantic difference can better reflect the semantic inconsistency of the node itself, rather than the representation offset brought about by the encoding process. () represents the activation function.

[0124] Although the graph encoders are identical in form, the obtained node representations depict different semantic information of nodes in the feature semantic space and the structural semantic space due to the different semantic sources of the input propagation structure, thus providing a basis for subsequent cross-semantic difference analysis.

[0125] S204: Constrain and align the dual semantic representation.

[0126] In a preferred embodiment, to improve the stability of subsequent cross-semantic difference analysis, the feature semantic representation and the structural semantic representation can be scale-aligned or normalized.

[0127] For example, for nodes Normalized bisemantic representations can be defined. , for:

[0128]

[0129]

[0130] This way it can be used , Instead of using the original structural and feature semantics for difference calculation, a dual semantic alignment term can be introduced as an auxiliary reference for subsequent consistency analysis. This embodiment does not limit the type of auxiliary term used and will not elaborate on it here. Constraint alignment in this embodiment can enhance the comparability between different semantic representations, providing a unified and stable basic representation for calculating representation-level and relation-level differences in the subsequent step three.

[0131] Step 3: Compare the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of the nodes to obtain cross-semantic difference information of the nodes.

[0132] Step 3 is used to model the inconsistency of nodes in different semantic spaces based on the feature semantic representation and structural semantic representation obtained in Step 2, thereby obtaining cross-semantic difference information of nodes and providing an important basis for subsequent anomaly detection.

[0133] In this embodiment, step three may include the following sub-steps:

[0134] S301: Representation-level semantic differences of compute nodes.

[0135] First, based on the representation vectors of nodes in the feature semantic space and the structural semantic space, the representation-level semantic difference of nodes is calculated.

[0136] For any node Its representation level semantic differences It can be represented as:

[0137]

[0138] In other embodiments, the squared form of the L2 norm or other distance metrics may be used, or a cosine distance may be used, such as:

[0139]

[0140] The purpose of this step is to characterize the differences in the representation of a node in the two semantic spaces. Normally, normal nodes have high consistency in feature semantics and structural semantics, while nodes affected by backdoor attacks often show a large shift in representation between the two semantic spaces. Therefore, this difference can serve as an important basis for anomaly detection.

[0141] S302: Construct a semantic relation matrix and calculate relation-level differences.

[0142] To further enhance the ability to characterize the semantic inconsistencies of nodes, this embodiment not only considers the differences in the representation of the nodes themselves, but also models the relationship between the nodes and other nodes.

[0143] First, construct a feature semantic relation matrix based on feature semantic representation. :

[0144]

[0145] Simultaneously, a structural semantic relation matrix is ​​constructed based on structural semantic representation. :

[0146]

[0147] in, and These represent the relation strengths of nodes i and j in the feature semantic space and the structural semantic space, respectively; for node... Relationship-level differences can represent for:

[0148]

[0149] in, Represent the nodes in the relation matrix respectively. The corresponding row vector.

[0150] The main purpose of this step is to characterize the consistency of relationships between nodes across different semantic spaces. Compared to considering only the differences in the representation of the nodes themselves, relation-level differences can more comprehensively reflect the semantic deviations of nodes in the overall graph structure, thereby improving the ability to identify hidden backdoor nodes.

[0151] S303: Merge representation-level differences and relation-level differences.

[0152] In obtaining representation-level differences and relational level differences Then, the two are fused to obtain the cross-semantic difference signal of the node.

[0153] In one embodiment, the fusion method can be represented as:

[0154]

[0155] in, This is a balancing coefficient used to adjust the contribution ratio of representation-level differences and relation-level differences.

[0156] In some embodiments, fusion weights It can also be adaptively adjusted based on the local characteristics of the node, for example:

[0157]

[0158] in, This is the balance coefficient corresponding to node i; the parameter k can be manually adjusted, and the strength of k may affect the final defense effect. This indicates the degree of anomaly or semantic difference of node i.

[0159] In step S303, the semantic inconsistencies of the nodes themselves and the inconsistencies of the node relationships are combined to enable cross-semantic difference signals to more comprehensively reflect the abnormal characteristics of the nodes.

[0160] S304: Normalize cross-semantic differences.

[0161] To eliminate the impact of different graph sizes or different data distributions on the difference values, in some embodiments, cross-semantic difference representations can be used. Normalization process is performed to obtain .

[0162] For example:

[0163]

[0164] This ensures that the difference values ​​of different nodes are within a uniform scale range, which facilitates subsequent fusion with local neighborhood anomaly scores.

[0165] Step 4: Extract the local neighborhood set of the node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node.

[0166] Step four is used to further model the degree of anomaly of a node relative to its neighborhood by combining the local graph structure environment in which the node is located, based on the cross-semantic difference analysis of the node, thereby identifying potential backdoor nodes that are not obvious in the global distribution but show significant inconsistency in the local neighborhood.

[0167] In this embodiment, step four includes the following specific steps:

[0168] S401: Extract the local neighborhood set of the target node.

[0169] For any target node First, extract its local neighborhood node set. In one embodiment, the local neighborhood set can be defined as the set of one-hop neighbor nodes of the target node. ,Right now:

[0170]

[0171] Where A represents the adjacency matrix of the original graph. Represents a node With nodes There are edges connecting them.

[0172] In other embodiments, to enhance the ability to model a wider range of local structures, the local neighborhood set can be extended to a multi-hop neighborhood within a preset number of hops, such as a two-hop neighborhood node set. It can be represented as:

[0173]

[0174] Similarly, the neighborhood hop count can be preset. This step serves to establish a local structural context for each node, so that subsequent anomaly analysis no longer relies solely on the node itself or global statistical features, but rather on the local relationships between its surrounding nodes.

[0175] S402: Construct a local neighborhood reference representation.

[0176] After obtaining the local neighborhood set of the target node, the representations of the neighborhood nodes are further aggregated to form a reference representation of the local environment of the target node.

[0177] In one embodiment, the target node can be obtained by mean aggregation of neighboring nodes based on structural semantic representation. Local neighborhood reference representation :

[0178]

[0179] in, Representing neighboring nodes Structural semantic representation, Represents the target node The local neighborhood average representation.

[0180] The purpose of this step is to provide a local semantic benchmark for the target node, so that subsequent deviation calculations can reflect the node's anomaly relative to its local neighborhood, rather than just the node's absolute representation characteristics.

[0181] S403: Calculate the local neighborhood anomaly score of the node.

[0182] After obtaining the local neighborhood reference representation of the target node, the deviation of the target node from its local neighborhood is calculated, and a local anomaly score is constructed accordingly.

[0183] In one embodiment, a local anomaly score can be calculated based on the Euclidean distance between the semantic representation of a node structure and its neighboring reference representation:

[0184]

[0185] in, Represents a node Local anomaly score.

[0186] Alternatively, the local anomaly score can be calculated using the average deviation between a node and all its neighbors.

[0187]

[0188] To further enhance sensitivity to local structural disturbances, a neighborhood-weighted approach can be introduced.

[0189] The purpose of this step is to characterize the degree of inconsistency of a node relative to its surrounding neighbors by measuring the deviation of its representation from its local neighborhood. Compared to detection methods that rely solely on the global anomaly distribution, this local anomaly scoring is more suitable for identifying hidden backdoor nodes, because backdoor nodes are often not extreme globally, but are more likely to exhibit semantic inconsistencies with their neighbors in their local neighborhood.

[0190] S404: Stabilize local anomaly scores.

[0191] To reduce the impact of outlier scale fluctuations on subsequent comprehensive outlier score fusion, in some embodiments, local outlier scores can be normalized or smoothed.

[0192] For example, a minimum-maximum normalization method can be used:

[0193]

[0194] in, This represents the normalized score for local anomalies. and These represent the minimum and maximum values ​​of the local anomaly scores for all nodes, respectively. Through the above normalization process, the local anomaly scores of different nodes can be mapped to a unified numerical range, facilitating subsequent fusion with cross-semantic difference signals.

[0195] After step four, the local anomaly score for each node can be obtained. Normalized local anomaly score .

[0196] The above results will serve as an important input for the comprehensive anomaly score fusion in step five, and together with the node cross-semantic difference signal obtained in step three, they will constitute the dual basis for node anomaly detection.

[0197] Step 5: Fuse the cross-semantic difference information of the node with the normalized local anomaly score to obtain the comprehensive anomaly score of the node.

[0198] Step 5 is used to fuse the node cross-semantic difference signal obtained in Step 3 with the local neighborhood anomaly score obtained in Step 4 to construct a unified node comprehensive anomaly score.

[0199] In this embodiment, for any node Its comprehensive anomaly score can be obtained through cross-semantic difference signals. Compared with normalized local anomaly scores Obtained through fusion.

[0200] In one embodiment, the fusion method can be represented as:

[0201]

[0202] in, Represents a node The overall abnormality score, and To integrate the weighting coefficients, and satisfy the following conditions: ≥0.

[0203] By using the above fusion method, the inconsistency of nodes in different semantic spaces and the relative anomalies of nodes in local neighborhoods can be utilized simultaneously under a unified numerical scale, so that the comprehensive anomaly score can more comprehensively reflect the potential anomaly characteristics of nodes.

[0204] In a preferred embodiment, the fusion weights may be normalized, for example:

[0205]

[0206] This ensures that different anomalous signals are linearly combined at the same scale.

[0207] In some embodiments, the fusion weights can be adaptively adjusted based on the local structural characteristics of the nodes. For example, dynamic weights can be defined based on the structural complexity of the node's neighborhood or the degree of local variation fluctuations.

[0208]

[0209]

[0210] in, To prevent the use of tiny constants with a denominator of zero, the comprehensive anomaly score in this case can be expressed as:

[0211]

[0212] By introducing an adaptive weighting mechanism, the model can automatically adjust the importance of the two types of abnormal signals under different data distributions or different attack modes, thereby improving the robustness of anomaly detection.

[0213] Furthermore, in some embodiments, to enhance the discriminative power of the anomaly score, a nonlinear mapping can be applied to the comprehensive anomaly score, for example:

[0214]

[0215] in, The transformed comprehensive anomaly score, To adjust the parameters.

[0216] Performing this non-linear transformation can enhance the difference between high-anomaly nodes and low-anomaly nodes, improving the sensitivity of subsequent weight allocation stages. After the above fusion process, a comprehensive anomaly score for each node can be obtained. Or the transformed abnormal score This result will serve as the direct basis for the node training weight allocation in step six.

[0217] Step 6: Construct node training weights based on the comprehensive anomaly score, and perform weighted training on the graph neural network model based on the training weights to obtain a graph neural network model optimized for backdoor defense.

[0218] Step six is ​​used to assign corresponding training weights to each node based on the comprehensive anomaly score of the nodes obtained in step five, thereby reducing the impact of abnormal nodes during model training and suppressing backdoor attacks.

[0219] In this embodiment, for any node Its training weights Based on comprehensive anomaly score Or the transformed abnormal score Obtained through mapping.

[0220] In one embodiment, the training weights can be defined using a monotonically decreasing function, i.e.:

[0221]

[0222] The function f() must satisfy: when When it increases, It should decrease monotonically.

[0223] In a preferred embodiment, an exponential decay function can be used for weight mapping:

[0224]

[0225] in, >0 is an adjustment parameter used to control the impact of outlier scores on the degree of weight decay. The above form indicates that when a node has a high outlier score, its corresponding training weight will decrease rapidly, thereby reducing the node's contribution to model training.

[0226] In some embodiments, a normalized weight allocation method may also be used, for example:

[0227]

[0228] This method normalizes the weights of all nodes to a uniform scale, making the training process more stable.

[0229] In other embodiments, to avoid the model learning stability being affected by excessively low weights for some nodes in extreme cases, a lower bound constraint on the weights can be set:

[0230]

[0231] in, A minimum weight threshold is preset. The core idea of ​​step six is ​​to "softly suppress" abnormal nodes by mapping the degree of node anomaly to continuous weights, rather than directly deleting nodes or cutting edge connections. Compared with defense methods based on data cleaning or node filtering, this invention can preserve the effective information between normal nodes without destroying the original graph structure, while reducing the interference of backdoor nodes on model parameter updates, thus achieving a better balance between defense effectiveness and model performance.

[0232] Based on the obtained node training weights, the graph neural network model is trained with weights. By adjusting the contribution of different nodes in the model parameter update process, the interference of abnormal nodes on model learning is suppressed, thereby obtaining a robust graph neural network model with backdoor defense capability.

[0233] In this embodiment, let the original loss function of the graph neural network model be... for:

[0234]

[0235] in, This represents the set of nodes participating in the training. This indicates that the graph neural network model represents the nodes. The prediction results Represents a node The true label, () represents a single-sample loss function, such as the cross-entropy loss function.

[0236] Based on the node training weights obtained in step six The original loss function is extended into a weighted loss function. :

[0237]

[0238] in, Represents a node The training weights; This indicates that the graph neural network model represents the nodes. The prediction results Represents a node The true label.

[0239] The weighted loss function described above shows that the contribution of different nodes to the overall loss during model training is determined by their weights. When a node has a high overall anomaly score, its corresponding weight... The smaller the weight, the more significant its contribution to the loss function; conversely, the larger the weight of normal nodes, the more dominant they are in model training.

[0240] From the perspective of gradient update, the weighted training process can be represented as:

[0241]

[0242] in, Represents the parameters of the graph neural network model; This indicates that the graph neural network model represents the nodes. The prediction results Represents a node The true label.

[0243] From the above formula, we can see that the node weight It directly affects the gradient calculation process, thereby adjusting the degree of influence of different nodes on model parameter updates. When the weights corresponding to abnormal nodes are low, their influence on the gradient direction is weakened, making the model more inclined to fit the distribution characteristics of normal nodes during training.

[0244] Through the aforementioned weighted training mechanism, this embodiment directly integrates node anomaly detection results into the model optimization process, achieving integrated defense from "anomaly identification" to "training suppression".

[0245] Compared to existing technologies that rely on deleting abnormal nodes, cutting abnormal edges, or cleaning data, this embodiment employs a continuous weight adjustment mechanism to "softly suppress" abnormal nodes without disrupting the original graph structure. This approach not only effectively reduces the interference of backdoor nodes on model training but also preserves the structural information and semantic relationships between normal nodes in the original graph to the greatest extent possible, thus achieving a better balance between defense performance and model accuracy.

[0246] In some embodiments, a dynamic weight update strategy during training can also be incorporated, i.e., in each training round, the node anomaly score is recalculated based on the current model state. And update the training weights accordingly. This forms a dynamic adaptive defense mechanism:

[0247]

[0248] Where t represents the training round.

[0249] By dynamically updating the weights, the model can gradually strengthen its ability to identify abnormal nodes during training, thereby improving the overall defense effect. After the weighted training process, a graph neural network model optimized for backdoor defense is obtained. Under normal input conditions, the model can maintain its original task performance, while under input conditions that trigger backdoor mode, the interference to its output results is significantly reduced, thus improving the model's security and robustness in backdoor attack scenarios.

[0250] After weighted training, a graph neural network model optimized for backdoor defense is obtained, and the target task prediction is performed based on the model.

[0251] In this embodiment, after a weighted training process, a trained graph neural network model is obtained, denoted as . The trained graph neural network model Under normal input conditions, it can maintain accurate prediction of node labels. At the same time, because the influence of abnormal nodes on model parameter updates is suppressed during training, the interference to the output results of the model is significantly reduced when faced with inputs containing backdoor triggering patterns.

[0252] In practical applications, given a set of nodes to be predicted The output of the graph neural network model can be represented as:

[0253]

[0254] in, This represents the graph data input during the testing phase. The corresponding prediction result is represented by the above method. This embodiment realizes a complete defense process from graph data input, anomaly detection, anomaly suppression to model output, and constructs a closed-loop defense mechanism for backdoor attacks on graph neural networks.

[0255] This embodiment constructs a dual-semantic representation mechanism combining feature semantics and structural semantics, enabling the characterization of abnormal node behavior from different semantic perspectives. Compared to detection methods based solely on single semantic information, it can more effectively identify backdoor nodes with strong concealment. Furthermore, this embodiment introduces a local neighborhood anomaly modeling mechanism to analyze the degree of abnormal deviation of a node relative to its local neighborhood, thereby enhancing the detection capability for locally concealed backdoor attacks. Building upon this, this embodiment obtains a more stable comprehensive node anomaly score by fusing dual-semantic difference signals and local anomaly signals. Through an anomaly-aware weighted training mechanism, it reduces the impact of abnormal nodes on model parameter updates without directly deleting nodes or disrupting the original graph structure. Therefore, this embodiment can effectively suppress the security risks posed by backdoor attacks while maintaining the normal task performance of the graph neural network model, demonstrating good engineering feasibility and application promotion value.

[0256] Example 2

[0257] The purpose of this embodiment is to provide a graph neural network backdoor defense system based on dual semantics and neighborhood anomalies, including:

[0258] The dual semantic representation module is configured to: construct feature semantic representations and structural semantic representations of nodes for node attribute information and graph topology information in graph data, respectively, and model the feature semantic representations and structural semantic representations of nodes using a shared graph encoder;

[0259] The cross-semantic difference module is configured to: compare the representation-level differences and relation-level differences between the feature semantic representation and the structural semantic representation of nodes to obtain cross-semantic difference information of nodes;

[0260] The local anomaly scoring module is configured to: extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node.

[0261] The comprehensive anomaly scoring module is configured to fuse the cross-semantic difference information of a node with the local anomaly score to obtain the comprehensive anomaly score of the node.

[0262] The weighted training module is configured to: construct node training weights based on the comprehensive anomaly score, and perform weighted training on the graph neural network model based on the training weights to obtain a graph neural network model optimized for backdoor defense.

[0263] In further embodiments, the following is also provided:

[0264] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor. When executed by the processor, the computer instructions perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0265] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0266] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0267] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in Embodiment 1.

[0268] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0269] A computer program product includes a computer program that, when executed by a processor, implements the method described in Embodiment 1.

[0270] The present invention also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the processes / methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided among program modules as needed. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside in both local and remote storage media.

[0271] The computer program code used to implement the methods of the present invention may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the computer or other programmable data processing device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0272] In the context of this invention, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0273] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0274] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A graph neural network backdoor defense method based on dual semantics and neighborhood anomalies, characterized in that, include: For the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the node are constructed respectively, and the feature semantic representation and structural semantic representation of the node are modeled using a shared graph encoder; By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes can be obtained. Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node. The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for the nodes; Node training weights are constructed based on the comprehensive anomaly score, and the graph neural network model is trained with weights based on the training weights to obtain a graph neural network model optimized for backdoor defense.

2. The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies as described in claim 1, characterized in that, For the node attribute information and graph topology information in the graph data, feature semantic representations and structural semantic representations of the nodes are constructed respectively. A shared graph encoder is then used to model these feature semantic representations and structural semantic representations of the nodes, specifically: For any two nodes, construct a feature semantic propagation matrix based on the similarity between the semantic features of the nodes; The normalized adjacency matrix is ​​used as the structural semantic propagation matrix; By using a shared graph encoder, the feature semantic propagation matrix and structural semantic propagation matrix of nodes from different semantic perspectives are modeled to obtain the feature semantic representation and structural semantic representation of nodes.

3. The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies as described in claim 1, characterized in that, By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes is obtained, specifically: Based on the feature semantic representation and structural semantic feature representation of nodes, calculate the representation-level semantic difference of nodes; Based on the feature semantic representations of different nodes, a feature semantic relationship matrix representing the strength of the relationship between nodes in the feature semantic space is constructed; Based on the structural semantic feature representation of different nodes, a structural semantic relation matrix representing the strength of the relationship between nodes in the structural semantic space is constructed; Calculate the relation-level differences of nodes based on their feature semantic relation matrix and structural semantic relation matrix. By fusing the representation-level semantic differences and relation-level differences of nodes, cross-semantic difference information of nodes can be obtained.

4. The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies as described in claim 1, characterized in that, Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node, specifically: For any target node, extract a local neighborhood node set; wherein, the local neighborhood set is defined as the one-hop or two-hop neighborhood node set of the target node; The mean aggregation of neighboring nodes is performed based on structural semantic representation to obtain the local neighborhood reference representation of the target node; The local anomaly score of a node is calculated based on the local neighborhood reference representation of the target node and the structural semantic feature representation of the neighboring nodes.

5. The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies as described in claim 1, characterized in that, The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for each node, specifically: The cross-semantic difference information of nodes and local anomaly scores are dynamically weighted and fused to obtain the comprehensive anomaly score of the nodes; the dynamic weights are defined based on the structural complexity of the node's neighborhood or the degree of fluctuation of local differences.

6. The graph neural network backdoor defense method based on dual semantics and neighborhood anomalies as described in claim 1, characterized in that, Based on the comprehensive anomaly score, node training weights are constructed using a monotonically decreasing function.

7. A graph neural network backdoor defense system based on dual semantics and neighborhood anomalies, characterized in that, include: The dual semantic representation learning module is configured to: construct feature semantic representations and structural semantic representations of nodes for node attribute information and graph topology information in graph data, respectively, and model the feature semantic representations and structural semantic representations of nodes using a shared graph encoder; The cross-semantic difference module is configured to: compare the representation-level differences and relation-level differences between the feature semantic representation and the structural semantic representation of nodes to obtain cross-semantic difference information of nodes; The local anomaly scoring module is configured to: extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node. The comprehensive anomaly scoring module is configured to fuse the cross-semantic difference information of a node with the local anomaly score to obtain the comprehensive anomaly score of the node. The weighted training module is configured to: construct node training weights based on the comprehensive anomaly score, and perform weighted training on the graph neural network model based on the training weights to obtain a graph neural network model optimized for backdoor defense.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.

Images