Study Of Backdoor Attack And Defense On Graph Neural Network

Graph neural networks(GNN)is a kind of deep learning model to process the structural information and semantic features of graph data.They are widely used in node classification,graph classification,link prediction.However,this kind of deep learning models require a lot of training data and computational costs and users usually choose the models provided by the third-party platforms.Attackers make full use of their insecurity,subtly modify the training data,and affect the model accuracy.To ensure the service quality and the model robustness,researches on model attacks and defenses are launched.This paper studies the backdoor attack and defense of graph neural network.Backdoor attack,as a new attack method,has been verified on graph neural network.However,the existing research is still limited.In this paper,a graph neural network backdoor attack based on subgraph trigger is proposed.The nodes with high importance are selected to attack according to the global and local structural features of nodes,which solves the problem of randomization of attack node selection.At the same time,the trigger nodes features design is combined with sample information,and fine-tuning the structural when inserting triggers,and presents diversified characteristics in the insert process.We validate our method on several GNN models.Finally,the result of verification on multiple real datasets is that the attack model can normally classify the clean data samples,and classify the samples with special triggers as the target tag specified by the attacker.On the premise that the attacker is known to use the subgraph trigger to complete the attack,the main goal of the defender is to detect and find the abnormal structure,clean up the abnormal nodes or edges.Aiming at the backdoor attack in the field of network graph,this paper proposes a backdoor attack defense scheme based on "detection + cleaning".Firstly,the abnormal nodes are detected by using the node embedding information provided by the model,and then the abnormal structure is cleaned from the perspective of data.At the same time,the candidate trigger subgraph structure is removed by using the abnormal structure deletion method based on fine-tuning.Experiments show that the defense scheme proposed in this paper can be applied to a variety of GNN models,reduce the attack success rate while ensuring the accuracy of the model,and effectively deal with the backdoor attack of graph neural network.