Blockchain and small-world network-based ai corpus poisoning detection method and system

Abstract

The application discloses a kind of AI corpus poisoning detection method and system based on block chain and small world network, method includes: obtaining target corpus of to be accessed AI training corpus library, and generating decentralized identity for it and calculating content hash, associated storage to block chain;Determine the propagation path information of target corpus in social network;According to propagation path information, build corpus, user, platform triadic heterograph;The propagation topological feature of triadic heterograph is extracted using graph neural network, the deviation degree of clustering coefficient and average path length relative to benchmark small world mode is calculated, and the propagation anomaly score is obtained;Verify the validity of decentralized identity, and obtain identity verification result;When propagation anomaly score is over threshold value and identity verification is invalid, trigger automatic purification.Compared with prior art, the application combines block chain identity evidence and small world network propagation anomaly detection, realizes the accurate identification and automatic purification of AI corpus poisoning.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence technology, and in particular to an AI corpus poisoning detection method and system based on blockchain and small-world networks. Background Technology

[0002] AI corpus poisoning has become a core technological risk threatening the credibility of large-scale models, mainly manifested in two types of attacks: first, data poisoning, which involves injecting false, misleading, or harmful information into the training corpus, causing malicious distortion of the model's training data distribution; second, prompt word injection, which uses carefully designed inputs to induce the model's output to deviate from realistic conclusions. These attacks are often combined with black-hat generative engine optimization (GEO), using automated tools to mass-produce fake articles and fabricate authoritative rankings, abnormally increasing the weight of inferior content in the AI ​​training corpus. This phenomenon leads to a decrease in the accuracy and reliability of AI model outputs, an increase in the error rate of model decisions in high-risk fields such as medicine and finance, and exacerbated recursive pollution during model iteration. The current AI corpus ecosystem faces multiple challenges: high-quality Chinese corpora are scarce, with Chinese accounting for only about 1.3% of mainstream global training corpora; a large amount of AI-cited content originates from unverified self-media; once false information enters the model, even if the original source is removed, it will continue to affect subsequent outputs through recursive pollution.

[0003] To prevent corpus poisoning, existing technologies have proposed various protective measures, mainly including: traceable corpus sources, dynamic filtering of malicious content, adversarial security detection, privacy-preserving computation, and auditable AI output. However, these technologies still have the following shortcomings in practical applications: Detection lag: Most defense systems rely on rule matching or text similarity calculation based on known attack patterns, making it difficult to identify adversarial examples generated through semantic equivalence substitution, sentence restructuring, etc. Research shows that modifying only 0.1% of the training dataset can successfully poison the data and is not easily detected by existing monitoring systems, resulting in the contaminated corpus entering the training process before detection is triggered. High misjudgment rate: In order to reduce risks, some platforms adopt aggressive content de-weighting strategies, misjudging original content that is originally usable based on content feature similarity as poisoned corpus, resulting in the incorrect cleaning of uncontaminated corpus in the training dataset, exacerbating the technical dilemma of the scarcity of high-quality Chinese corpus. Source tracing difficulties: The lack of a unified cryptographic identification standard for cross-platform and cross-entity data flow makes it difficult to achieve full-link tracing; black market operators evade detection based on account behavior by registering accounts in batches, rotating IPs, and fine-tuning content releases, and existing systems lack the ability to perform topological analysis on the propagation path of corpus, making it difficult to locate the source of pollution. High defense costs: Building a complete closed loop of corpus cleaning, anomaly detection, and manual review requires a lot of computing power and a professional team, which is difficult for small and medium-sized enterprises to afford; although technologies such as differential privacy and federated learning can improve security, they will reduce training efficiency and accuracy.

[0004] A search revealed Chinese Patent Publication No. CN121117487A, which discloses a method and system for dynamic credibility assessment of social networks based on blockchain fingerprints. This scheme extracts multimodal content features from social networks, generates blockchain fingerprints using the SHA-3 algorithm and BeiDou timing, and stores them in an improved Merkle Patricia tree. It constructs a dynamic directed acyclic graph to track content propagation and mutation, and combines user reputation scoring with a smart contract hierarchical response mechanism to dynamically assess and regulate the credibility of published content. However, this scheme's dynamic directed acyclic graph is primarily used to track content version changes, making it difficult to distinguish between normal information dissemination and malicious poisoning-driven anomalous cluster outbreaks. Furthermore, the user reputation scoring relies on historical behavior statistics, resulting in a lag in response to first-time coordinated poisoning attacks initiated by a large number of low-trust nodes. Moreover, its hierarchical response mechanism is based solely on content credibility scoring, lacking multi-dimensional cross-verification of the publisher's identity and propagation behavior, thus limiting its effectiveness against highly deceptive poisoning content.

[0005] Therefore, how to effectively identify and block malicious poisoning attacks targeting AI training corpora, and achieve accurate identification, rapid source tracing, and proactive purification of contaminated content, is a technical problem that needs to be solved. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of existing technologies and provide an AI corpus poisoning detection method and system based on blockchain and small-world networks.

[0007] The objective of this invention can be achieved through the following technical solutions: According to a first aspect of the present invention, an AI corpus poisoning detection method based on blockchain and small-world networks is provided, comprising: Obtain the target corpus to be connected to the AI ​​training corpus, generate a decentralized identity identifier for the target corpus and calculate the content hash, and associate the content hash with the decentralized identity identifier and store it in the blockchain; Call the API of the social network platform or web crawler to collect the propagation path information of the target corpus in the social network. The propagation path information includes propagation node identifiers, interaction behavior types and propagation sequence. Based on the propagation path information, a ternary heterogeneous graph of corpus, user, and platform is constructed. The nodes of the ternary heterogeneous graph include corpus nodes, user nodes, and platform nodes. The edges represent the interaction behavior between nodes, and each edge is assigned a propagation strength weight. The propagation topology features of the ternary heterogeneous graph are extracted using a graph neural network. The clustering coefficient and average path length of the corpus propagation path are calculated to determine the degree of deviation from the baseline small-world propagation pattern, and a propagation anomaly score is obtained. Verify the validity of the decentralized identity identifier to obtain the identity verification result; When the propagation anomaly score exceeds a preset threshold and the identity verification result is invalid, an automatic purification operation is triggered.

[0008] As a preferred technical solution, the method further includes: When the authentication result is valid and the propagation anomaly score exceeds a preset threshold, the content hash is written into the list to be reviewed. When the authentication result is invalid and the propagation anomaly score does not exceed the preset threshold, the available state of the content hash remains unchanged.

[0009] As a preferred technical solution, the automatic purification operation process specifically includes: The automatic purification operation process specifically includes: Freeze the right to use the target corpus in the AI ​​training corpus; The pollution fingerprint of the target corpus is broadcast to all access nodes in the blockchain network. The pollution fingerprint includes content hash and propagation topology features. Update the permission status field of the decentralized identity identifier corresponding to the target corpus to a prohibited publishing status; The system automatically submits a traceability report to the regulatory platform. The traceability report includes a timestamp, node identifier, and behavior sequence.

[0010] As a preferred technical solution, the method further includes: after triggering the automatic purification operation, by taking advantage of the short path characteristics of the small-world network, automatically selecting a trusted node in the graph whose centrality metric value exceeds a preset threshold as a correction source, and broadcasting correction information to the associated nodes on the propagation path of the correction source, wherein the correction information includes the content hash and evidence hash stored on the chain.

[0011] As a preferred technical solution, the formula for calculating the propagation intensity weight is: , Wherein, the interaction frequency is the historical cumulative number of interaction behaviors between two nodes; Δt is the time interval from the time the interaction behavior occurs to the current time; λ is a preset time decay coefficient; the interaction behaviors include publishing, forwarding, quoting and commenting.

[0012] As a preferred technical solution, the metadata of the decentralized identity includes: collection timestamp, original source URL, collection node public key, and processing log identifier; the decentralized identity adopts the W3C standard.

[0013] As a preferred technical solution, the graph neural network is a graph attention network (GAT), and the initial feature vector of the nodes in the ternary heterogeneous graph includes: the semantic encoding vector of the corpus node, the historical behavior statistics vector of the user node, and the historical corpus quality statistics of the platform node.

[0014] As a preferred technical solution, the preset threshold is dynamically adjusted through a federated learning mechanism: based on the false alarm rate and false negative rate fed back by each access node, the preset threshold is updated at preset intervals.

[0015] According to a second aspect of the present invention, a system is provided for implementing the AI ​​corpus poisoning detection method based on blockchain and small-world networks, comprising: The evidence storage module is used to generate a decentralized identity identifier for the target corpus to be accessed by the AI ​​training corpus and calculate the content hash, and associate the content hash with the decentralized identity identifier and store it in the blockchain; The graph construction module is used to construct a ternary heterogeneous graph of corpus, users, and platforms. The nodes include corpus nodes, user nodes, and platform nodes, and the edges represent the interaction behavior between nodes and are assigned propagation strength weights. An anomaly detection module is used to extract the propagation topology features of the ternary heterogeneous graph using a graph neural network, calculate the degree of deviation of the clustering coefficient and average path length of the corpus propagation path from the baseline small-world propagation pattern, and obtain a propagation anomaly score. The identity verification module is used to verify the validity of the decentralized identity identifier and obtain the identity verification result; The purification execution module is used to trigger an automatic purification operation when the propagation anomaly score exceeds a preset threshold and the authentication result is invalid.

[0016] As a preferred technical solution, the system further includes a correction broadcast module, which, after triggering the automatic purification operation, automatically selects a trusted node in the graph whose centrality metric exceeds a preset threshold as a correction source based on the short path characteristics of the small-world network, and broadcasts correction information to associated nodes on the propagation path.

[0017] Compared with the prior art, the present invention has the following advantages: 1. This invention generates decentralized identity identifiers for the corpus and stores them on the blockchain. Combined with the detection of propagation topology anomalies based on small-world networks, it constructs a dual verification mechanism for source credibility and propagation rules, which realizes accurate identification and automatic purification of polluted corpus. At the same time, it provides rapid source tracing capabilities by utilizing the immutability of blockchain, effectively solving the problems of detection lag, high false judgment rate and difficulty in source tracing.

[0018] 2. This invention constructs a ternary heterogeneous graph of corpus, users, and platform, and uses graph attention network to analyze the propagation topology features. It can identify abnormal clusters from the perspective of propagation rules, improve the ability to detect covert poisoning attacks, and provide early warning before the polluted corpus invades the training set on a large scale.

[0019] 3. This invention combines identity verification with propagation anomaly analysis. When the source is trustworthy but the propagation is abnormal, the content hash is only written to the list to be reviewed without triggering automatic purification. When the source is suspicious but the propagation is normal, the usability of the content hash remains unchanged, which reduces the false alarm rate and avoids the false cleaning of high-quality corpora.

[0020] 4. After detecting contaminated corpus, this invention reverses the short-path characteristics of small-world networks and uses highly central nodes to cover the correction information to the vast majority of affected nodes, thereby achieving proactive propagation blocking and system self-purification, overcoming the shortcomings of traditional passive defense methods that are difficult to quickly block the spread of contamination.

[0021] 5. This invention deploys automatic purification operations on blockchain smart contracts to automate processes such as freezing corpora, broadcasting polluted fingerprints, updating DID permission status, and automatic reporting. It also combines federated learning to dynamically optimize detection thresholds, reducing manual intervention costs and operational expenses. Attached Figure Description

[0022] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system framework diagram of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] Example 1: like Figure 1 As shown, this invention provides an AI corpus poisoning detection method based on blockchain and small-world networks, the method comprising: Step S1: Obtain the target corpus to be connected to the AI ​​training corpus, generate a decentralized identity for the target corpus and calculate the content hash, and associate the content hash with the decentralized identity and store it in the blockchain; Step S2: Determine the propagation path information of the target corpus in the social network, the propagation path information including propagation node identifiers, interaction behavior types, and propagation sequence; Step S3: Construct a ternary heterogeneous graph of corpus, user, and platform based on the propagation path information. The nodes of the ternary heterogeneous graph include corpus nodes, user nodes, and platform nodes. The edges represent the interaction behavior between nodes and are assigned propagation strength weights. Step S4: Use graph neural networks to extract the propagation topology features of the ternary heterogeneous graph, calculate the degree of deviation of the clustering coefficient and average path length of the corpus propagation path from the baseline small-world propagation pattern, and obtain the propagation anomaly score. Step S5: Verify the validity of the decentralized identity token to obtain the identity verification result; Step S6: When the propagation anomaly score exceeds a preset threshold and the identity verification result is invalid, an automatic purification operation is triggered.

[0025] The steps of this invention will be described in detail below.

[0026] Step S101: Corpus storage and DID binding.

[0027] First, the target corpus to be integrated into the AI ​​training corpus is obtained. This target corpus can be multimodal data such as text, images, and videos. To ensure the credibility of the corpus source and the traceability of its entire lifecycle, this invention generates a unique decentralized identifier (DID) for each corpus and uses the SHA-3-512 algorithm to calculate the hash value of the corpus content. The DID follows the W3C standard, does not rely on a centralized identity registration authority, and supports cross-platform mutual recognition.

[0028] The specific method for storing the association on the blockchain is as follows: the metadata such as the content hash, the decentralized identity identifier, the collection timestamp, the original source URL, the collection node public key, and the processing flow identifier are encapsulated into a JSON format transaction. By calling the smart contract deployed on the consortium blockchain, the transaction is written into the distributed ledger. This design utilizes the immutability and decentralized trust foundation of the blockchain, ensuring that the identity file of each piece of corpus cannot be tampered with once it is on the chain, providing an evidence chain for subsequent responsibility determination and pollution source tracing.

[0029] Step S201: Determine the propagation path information.

[0030] By using publicly available social media APIs, web crawlers, or browser event tracking SDKs, the propagation trajectory of the target corpus on the Internet is collected. The collected propagation path information includes: propagation node identifiers, such as user ID and platform ID; interaction behavior types, such as posting, forwarding, quoting, and commenting; and propagation time sequence, such as the precise timestamp of each behavior. This information is the basic data for subsequent construction of propagation graphs and calculation of small-world topological features.

[0031] Since most existing AI corpus governance technologies only focus on the content features of the corpus itself and ignore its propagation patterns in real social networks, this invention can identify poisoned corpus that appears normal in content but has an obviously abnormal propagation pattern by actively acquiring and analyzing the propagation path of the corpus, thereby making up for the blind spots of pure content detection.

[0032] Step S301: Construct a ternary heterogeneous spectrum.

[0033] Using the propagation path information obtained in step S201, a ternary heterogeneous graph of corpus, users, and platform is constructed. The node types in the graph include: Corpus nodes: Represent specific text, image, or video content; User node: Represents a social media account or publisher involved in the dissemination; Platform node: Represents the social media platform or website that carries the dissemination.

[0034] Edge types include: post edges, forward edges, quote edges, comment edges, etc.; each edge is assigned a propagation strength weight, the calculation formula of which is: , Wherein, the interaction frequency is the historical cumulative number of interaction behaviors between two nodes; Δt is the time interval from the time the interaction behavior occurs to the current time; λ is a preset time decay coefficient; the interaction behaviors include publishing, forwarding, quoting and commenting.

[0035] Compared to traditional models that only focus on content or user relationships, ternary heterogeneous graphs can more comprehensively depict the propagation ecology of corpora in complex social networks. By introducing propagation intensity weights, subsequent graph neural networks can focus on high-influence, high-credibility propagation paths, thereby improving the accuracy and robustness of anomaly detection.

[0036] Step S401: Graph neural network calculates propagation anomaly score.

[0037] This step uses a Graph Attention Network (GAT) to learn node representations for the ternary heterogeneous graph constructed in step S301. The core advantage of GAT is that it automatically learns the importance weights of different neighboring nodes to the target node through the attention mechanism, which can better handle heterogeneous graphs and multiple types of edges compared with traditional Graph Convolutional Networks (GCN).

[0038] The initial feature vectors of the nodes are designed as follows: Corpus nodes: semantic codes extracted using the BERT model; User node: Consists of a statistical vector of user's historical behavior, including posting frequency, the proportion of historical posts marked as polluted, etc. This vector is automatically calculated by the system based on on-chain records. Platform Nodes: Composed of historical corpus quality statistics of the platform, automatically calculated based on the proportion of previously published corpus on the platform that was marked as polluted.

[0039] The three types of feature vectors are concatenated and used as input to the GAT model.

[0040] After multi-layer information aggregation, the GAT model outputs the final representation of each corpus node. At the same time, based on the edge connection structure of the ternary heterogeneous graph, it calculates the clustering coefficient and average path length of the corpus propagation path. The clustering coefficient measures the tightness of the connection between the neighbors of the node, and the average path length measures the average number of hops required for information to propagate in the graph.

[0041] The benchmark small-world propagation benchmark model is established in the following way: collect corpora that have been verified by on-chain DID and whose historical propagation behavior has not triggered abnormal alarms as a reliable sample set, and calculate the mean distribution of the clustering coefficient of its propagation graph as Cnorm, and calculate the mean distribution of the average path length as Lnorm. For example, a large number of real and harmless corpora will exhibit the small-world characteristics of high clustering coefficient and short average path length in natural propagation.

[0042] The calculation method for the propagation anomaly score is as follows: , α and β are weighting coefficients. α corresponds to the deviation of the clustering coefficient from the weight, and β corresponds to the deviation of the average path length from the weight. These can be adjusted according to the application scenario. When the actual propagation topology deviates significantly from the small-world benchmark, the score increases.

[0043] This step introduces the small-world theory from social network analysis into the field of AI corpus security. Small-world networks are characterized by high clustering and short paths, and a large amount of real, harmless corpus will exhibit this pattern in natural propagation. Conversely, maliciously poisoned corpus often uses low-reputation accounts and fake social relationships to spread rapidly, resulting in concentrated and unrelated outbreaks. Its propagation topology either has an extremely low clustering coefficient and lacks real social relationships between nodes, or has an abnormal average path length with too many or too few jumps. By quantifying the degree of this deviation, efficient early warning can be achieved before the polluted corpus invades the training set on a large scale.

[0044] Step S501: Verify the decentralized identity token.

[0045] In this step, the system reads the DID bound to the target corpus from the blockchain and calls the verification function in the smart contract to check whether the DID matches the valid identity certificate registered by the system, whether the DID document is active, and whether it is included in the system's disabled list. If the DID is valid and matches the hash of the corpus content, the identity verification result is valid; otherwise, it is invalid.

[0046] Among them, DID verification provides credible proof of the source of the corpus. Even if the content and propagation pattern of a certain corpus seem normal, if its DID is forged or has been blacklisted, the system can still determine that it is risky. This makes up for the source forgery problem that pure propagation analysis may ignore.

[0047] Step S601: Conditional decision and automatic purification.

[0048] This invention categorizes judgment scenarios into three types to achieve differentiated handling: When the authentication result is invalid and the propagation anomaly score exceeds the preset threshold, the system determines that the corpus is polluted and immediately triggers an automatic purification operation. When the identity verification result is valid and the propagation anomaly score exceeds the preset threshold, the system will write the content hash into the list to be reviewed without triggering automatic purification operation. When the authentication result is invalid and the propagation anomaly score does not exceed the preset threshold, the system maintains the usability of the content hash and does not trigger automatic purification actions.

[0049] The automatic purification operation includes the following measures: Freeze access rights: Mark the data status corresponding to the content hash of the corpus as unavailable in the distributed ledger, preventing it from entering the subsequent AI training process; Broadcasting polluted fingerprints: Broadcasting the polluted fingerprints of the corpus to all access nodes in the blockchain network. The polluted fingerprints include content hashes and propagation topology features. Update permission status: Update the permission status field of the decentralized identity corresponding to this corpus to the prohibited publishing status; Automatic reporting: Generate a source tracing report containing timestamps, abnormal node identifiers, and behavior sequences, and submit it to the regulatory platform.

[0050] The aforementioned purification operation is automatically executed by a smart contract deployed on the consortium blockchain.

[0051] Furthermore, the present invention also includes a correction and active purification mechanism: When the system detects contaminated corpus and triggers purification, in order to quickly correct user perceptions or downstream models that may have been contaminated, the system reversely utilizes the short-path characteristics of small-world networks: it automatically selects nodes (i.e., high-influence nodes) from the graph whose betweenness centrality meets preset conditions as correction sources, generates correction information containing on-chain evidence IDs and evidence hashes, and broadcasts it to all access nodes through a message queue. Due to the short-path advantage of small-world networks, the correction information can cover most of the nodes that have been exposed to contaminated corpus within a preset number of hops, thereby effectively blocking the continuous spread of erroneous information.

[0052] In addition, the preset thresholds in the system can be dynamically adjusted through the federated learning mechanism: Each access node regularly reports its local false alarm rate and false negative rate. The system uses a federated learning framework to aggregate the feedback data from each node in an encrypted state and regularly updates the threshold for anomaly scoring, so that the detection performance can be continuously optimized to adapt to the ever-evolving attack methods.

[0053] The method of the present invention will be described in detail below with reference to a specific scenario.

[0054] Scenario setting: An AI training platform accesses a fake advertorial claiming "XX medical aesthetics has remarkable effects, with results in three days." This article is then forwarded and referenced by 100 low-activity accounts on social media platforms to create false popularity.

[0055] Step A1: Corpus storage and DID binding.

[0056] Obtaining the target corpus: The system retrieved a text from a self-media website: "XX medical aesthetics has remarkable effects, with results visible in three days"; Generate DID: The system assigns a unique decentralized identity to the corpus, for example, did:example:123456789abcdef; Calculate the content hash: Use the SHA-3-512 algorithm to calculate the hash value of the text, resulting in: a1b2c3d4e5f6... (a 64-bit hexadecimal string); Linking storage to the blockchain: The DID, content hash, and metadata (collection timestamp 2025-03-01T10:00:00Z, source URL https: / / weibo.com / xxx, collection node public key node_pubkey_01) are encapsulated into a JSON transaction and written to the Hyperledger Fabric consortium blockchain via a smart contract.

[0057] Step A2: Determine the propagation path information.

[0058] The system used the Weibo API and web crawler to collect the propagation trajectory of the text within one hour of its publication, obtaining: Propagation node identifiers: 100 user IDs, such as user_water_001 to user_water_100, and one initial publisher ID, user_spammer_001; Interaction types: Post (1 time), Forward (98 times), Quote (2 times); Propagation timing: All interactive behaviors are concentrated between 10:00:00 and 10:03:00, with extremely short time intervals.

[0059] Step A3: Construct a ternary heterogeneous map.

[0060] node: Corpus node: content_001; User nodes: user_spammer_001, user_water_001…user_water_100; Platform node: platform_weibo; Edges and weights: The weight of each edge is calculated using the formula w = log(interaction frequency + 1) × e. -λ·Δt calculate; Taking user_spammer_001 publishing this corpus as an example: interaction frequency = 1, Δt = 0, λ = 0.1, then w = log(2) × 1 ≈ 0.693; Taking user_water_001 forwarding as an example: This account has no interaction with the corpus nodes in the past, the interaction frequency is 1, Δt = 10 seconds, then w = log(2) × e -0.1×10 / 3600 ≈0.693×0.9997≈0.692; Graph characteristics: In this propagation subgraph, there are no mutual follows or comments among the 100 low-activity user nodes, the clustering coefficient is ≈0, and the average path length from the publisher to the low-activity user node is only 1 hop (short path but extremely low clustering).

[0061] Step A4: Graph neural network calculates propagation anomaly score.

[0062] GAT input characteristics: Corpus nodes: BERT encoded as [0.12, -0.34, ...] (768 dimensions); User node: Historical behavior statistics vector: Abnormal accounts posting with extremely high frequency (100 times / day), historical pollution rate of 80%, generating vector [0.8, 0.9, ...]; Platform node: The historical contamination rate of the Weibo platform is 5%, and the generated statistics are expanded from 0.05 to 32 dimensions; Benchmark Small World Model: 10,000 real news articles verified by DID and without anomaly alerts were selected from the blockchain. The results showed: benchmark clustering coefficient C_norm = 0.65; benchmark average path length L_norm = 3.2. Calculate the propagation anomaly score: With the actual subgraph clustering coefficient C = 0.02, average path length L = 1.0, and taking α = 0.6 and β = 0.4, then: ; The preset threshold θ = 0.80 (updated regularly by federated learning), and the current score is 0.856 > 0.80.

[0063] Step A5: Verify the decentralized identity token.

[0064] The system reads the DID bound to the corpus, did:example:123456789abcdef, from the blockchain and calls the smart contract to verify it. DID Existence: Check the on-chain ledger to see if this DID is appearing for the first time; Signature validity: The data was collected without a valid digital signature, verification failed; Disabled list check: This DID is not in the disabled list; Authentication result: Invalid (due to lack of a valid signature).

[0065] Step A6: Conditional Decision and Automatic Cleanup.

[0066] Verdict: The identity verification result is invalid and the propagation anomaly score of 0.856 > 0.80, which meets the triggering conditions.

[0067] Automatic purification operation: Freeze access: Mark the content hash a1b2c3d4e5f6... as status:frozen in the blockchain state database to prevent the corpus from entering the AI ​​training queue; Broadcast polluting fingerprint: Broadcasts the message to all consortium blockchain nodes: {"content_hash": "a1b2c3...", "anomaly_score": 0.856, "reason": "low_clustering+short_path"}; Update DID permission status: Change the permission field of publisher DID did:example:123456789abcdef from active to banned, prohibiting it from submitting any corpus in the future; Automatic reporting: Generate a traceability report {timestamp: "2025-03-01T10:05:00Z", nodes: ["user_spammer_001", ...], behavior_sequence: ["publish", "mass_forward"]} and send it to the regulatory API.

[0068] Correction and active purification mechanisms (optional follow-up operations): The system automatically filters nodes with high intermediary centrality on the Weibo platform (such as the official account @official_health) and broadcasts correction information through the Kafka message queue: {"corrected_content": "XX medical aesthetic institution has been confirmed to be engaging in false advertising", "evidence_tx": "0x9abc...", "polluted_hash": "a1b2c3..."}.

[0069] Federated learning thresholds are dynamically adjusted: Each node reports its false alarm rate monthly. After federated learning aggregates the data, the threshold will be adjusted to improve sensitivity.

[0070] The method of this invention generates decentralized identity identifiers for the corpus and stores them on the blockchain. It combines the construction of a ternary heterogeneous graph of corpus, users, and platform and uses graph attention network to analyze the deviation of the clustering coefficient and average path length of the propagation path from the small-world propagation pattern. When the identity verification is invalid and the propagation is abnormal, automatic purification is triggered. This achieves accurate identification, reliable source tracing, and proactive purification of AI training corpus poisoning attacks, effectively reducing the false judgment rate and improving the real-time performance of defense response.

[0071] Example 2: This invention provides a system for implementing the above-described method. This system can adopt a layered heterogeneous deployment architecture: the corpus access layer consists of distributed edge nodes, responsible for corpus collection and cleaning; the blockchain layer consists of consortium blockchain nodes, responsible for DID notarization and smart contract execution; the graph computing layer uses a GPU-accelerated cluster to run the GAT model for propagation anomaly scoring; the collaborative response layer is a highly available microservice (Spring Boot + Redis), responsible for correcting broadcasts and auditing logs. All layers communicate through a standardized API gateway, supporting concurrent processing of tens of millions of corpora. Figure 2 As shown, the system includes the following modules: Evidence storage module 1: The evidence storage module is responsible for generating decentralized identity identifiers (DIDs) for target corpora to be integrated into the AI ​​training corpus and calculating content hashes. This module packages the content hashes and DID metadata and stores them in the blockchain ledger by calling a smart contract on the consortium blockchain. This module ensures the immutability of the corpus's source and its full lifecycle traceability.

[0072] Mapping Module 2: The graph construction module constructs a ternary heterogeneous graph of corpus, users, and platforms based on the propagation path information of the target corpus in social networks. The nodes include corpus nodes, user nodes, and platform nodes; the edges represent interactive behaviors such as forwarding, commenting, liking, and quoting. Each edge is assigned a propagation strength weight. The output of this module is structured graph data for subsequent anomaly detection.

[0073] Anomaly detection module 3: The anomaly detection module uses the Graph Attention Network (GAT) as its core model. The input node features of GAT include: BERT semantic encoding of corpus nodes, historical behavior statistical vectors of user nodes, and historical corpus quality statistics of platform nodes. Through training, this module enables GAT to learn the clustering coefficients and average path lengths of a small-world baseline propagation pattern composed of reliable corpora. During the inference phase, for the input target corpus and its propagation graph, the module calculates the deviation of the clustering coefficients and average path lengths of the propagation paths from the baseline pattern, outputting a propagation anomaly score (a value between 0 and 1). This design can identify anomalous clusters that violate the small-world propagation rules, such as mass poisoning behavior concentrated in nodes with low historical behavior statistics.

[0074] Authentication module 4: The authentication module reads the DID metadata of the target corpus from the blockchain, verifies its validity, including the existence of the DID, the legality of the signature, and whether the DID is included in the system's disabled list, and outputs the authentication result.

[0075] Purification Execution Module 5: The purification execution module receives outputs from the anomaly detection module and the identity verification module, and implements coordinated decisions: when the propagation anomaly score exceeds a preset threshold and the identity verification result is invalid, an automatic purification operation is triggered; when the identity verification result is valid and the propagation anomaly score exceeds the preset threshold, the content hash is written to the pending review list, and purification is not triggered; when the identity verification result is invalid and the propagation anomaly score does not exceed the preset threshold, the usable state of the content hash remains unchanged, and purification is not triggered. The purification operation includes: marking the data state corresponding to the content hash as unavailable in the distributed ledger; broadcasting the contaminated fingerprint to all access nodes in the blockchain network; updating the permission status field of the corresponding DID to a prohibited publishing state; and automatically submitting a traceability report to the regulatory platform. This module can call smart contracts to automatically execute the above operations, ensuring response speed.

[0076] Correction broadcast module 6: The correction broadcast module starts after the purification execution module is triggered. By leveraging the short-path characteristics of the small-world network, it automatically selects nodes in the graph whose betweenness centrality meets the preset conditions as correction sources and broadcasts correction information to associated nodes on the propagation path. The correction information includes the content hash and evidence hash of the on-chain evidence. This module utilizes the short-path advantage of the small-world network to cover most of the affected nodes with the correction information within a preset number of hops, thereby achieving proactive propagation blocking.

[0077] The system of this invention enables automatic purification and correction of poisoned corpora by the collaborative work of its various modules. It can achieve automatic blocking and rapid coverage of poisoned corpora in a lightweight manner, thereby enhancing the security and robustness of the AI ​​corpus.

[0078] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting AI corpus poisoning based on blockchain and small-world networks, characterized in that, include: Obtain the target corpus to be connected to the AI ​​training corpus, generate a decentralized identity identifier for the target corpus and calculate the content hash, and associate the content hash with the decentralized identity identifier and store it in the blockchain; Call the API of the social network platform or web crawler to collect the propagation path information of the target corpus in the social network. The propagation path information includes propagation node identifiers, interaction behavior types and propagation sequence. Based on the propagation path information, a ternary heterogeneous graph of corpus, user, and platform is constructed. The nodes of the ternary heterogeneous graph include corpus nodes, user nodes, and platform nodes. The edges represent the interaction behavior between nodes, and each edge is assigned a propagation strength weight. The propagation topology features of the ternary heterogeneous graph are extracted using a graph neural network. The clustering coefficient and average path length of the corpus propagation path are calculated to determine the degree of deviation from the baseline small-world propagation pattern, and a propagation anomaly score is obtained. Verify the validity of the decentralized identity identifier to obtain the identity verification result; When the propagation anomaly score exceeds a preset threshold and the identity verification result is invalid, an automatic purification operation is triggered.

2. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The method further includes: When the authentication result is valid and the propagation anomaly score exceeds a preset threshold, the content hash is written into the list to be reviewed. When the authentication result is invalid and the propagation anomaly score does not exceed the preset threshold, the available state of the content hash remains unchanged.

3. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The automatic purification operation process specifically includes: Freeze the right to use the target corpus in the AI ​​training corpus; The pollution fingerprint of the target corpus is broadcast to all access nodes in the blockchain network. The pollution fingerprint includes content hash and propagation topology features. Update the permission status field of the decentralized identity identifier corresponding to the target corpus to a prohibited publishing status; The system automatically submits a traceability report to the regulatory platform. The traceability report includes a timestamp, node identifier, and behavior sequence.

4. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The method further includes: after triggering the automatic purification operation, taking advantage of the short path characteristics of the small-world network, automatically selecting trusted nodes whose centrality metric value in the graph exceeds a preset threshold as correction sources, and broadcasting correction information to associated nodes on the propagation path of the correction sources, wherein the correction information includes the content hash and evidence hash stored on the chain.

5. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The formula for calculating the propagation intensity weight is: ， Wherein, the interaction frequency is the historical cumulative number of interaction behaviors between two nodes; Δt is the time interval from the time the interaction behavior occurs to the current time; λ is a preset time decay coefficient; the interaction behaviors include publishing, forwarding, quoting and commenting.

6. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The metadata of the decentralized identity includes: collection timestamp, original source URL, collection node public key, and processing log identifier.

7. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The graph neural network is a graph attention network (GAT). The initial feature vectors of the nodes in the ternary heterogeneous graph include: the semantic encoding vector of the corpus node, the historical behavior statistics vector of the user node, and the historical corpus quality statistics of the platform node.

8. The AI ​​corpus poisoning detection method based on blockchain and small-world networks according to claim 1, characterized in that, The preset threshold is dynamically adjusted through a federated learning mechanism: based on the false alarm rate and false negative rate reported by each access node, the preset threshold is updated at preset intervals.

9. A system for implementing the AI ​​corpus poisoning detection method based on blockchain and small-world networks as described in any one of claims 1-8, characterized in that, include: The evidence storage module is used to generate a decentralized identity identifier for the target corpus to be accessed by the AI ​​training corpus and calculate the content hash, and associate the content hash with the decentralized identity identifier and store it in the blockchain; The graph construction module is used to construct a ternary heterogeneous graph of corpus, users, and platforms. The nodes include corpus nodes, user nodes, and platform nodes, and the edges represent the interaction behavior between nodes and are assigned propagation strength weights. An anomaly detection module is used to extract the propagation topology features of the ternary heterogeneous graph using a graph neural network, calculate the degree of deviation of the clustering coefficient and average path length of the corpus propagation path from the baseline small-world propagation pattern, and obtain a propagation anomaly score. The identity verification module is used to verify the validity of the decentralized identity identifier and obtain the identity verification result; The purification execution module is used to trigger an automatic purification operation when the propagation anomaly score exceeds a preset threshold and the authentication result is invalid.

10. The system according to claim 9, characterized in that, The system also includes a correction broadcast module, which, after triggering the automatic purification operation, automatically selects trusted nodes in the graph whose centrality metric exceeds a preset threshold as correction sources based on the short-path characteristics of the small-world network, and broadcasts correction information to associated nodes on the propagation path.

Images