Abstract:To make room for privacy and efficiency, the deployment of many recommender systems is experiencing a shift from central servers to personal devices, where the federated recommender systems (FedRecs) and decentralized collaborative recommender systems (DecRecs) are arguably the two most representative paradigms. While both leverage knowledge (e.g., gradients) sharing to facilitate learning local models, FedRecs rely on a central server to coordinate the optimization process, yet in DecRecs, the knowledge sharing directly happens between clients. Knowledge sharing also opens a backdoor for model poisoning attacks, where adversaries disguise themselves as benign clients and disseminate polluted knowledge to achieve malicious goals like promoting an item's exposure rate. Although research on such poisoning attacks provides valuable insights into finding security loopholes and corresponding countermeasures, existing attacks mostly focus on FedRecs, and are either inapplicable or ineffective for DecRecs. Compared with FedRecs where the tampered information can be universally distributed to all clients once uploaded to the cloud, each adversary in DecRecs can only communicate with neighbor clients of a small size, confining its impact to a limited range. To fill the gap, we present a novel attack method named Poisoning with Adaptive Malicious Neighbors (PAMN). With item promotion in top-K recommendation as the attack objective, PAMN effectively boosts target items' ranks with several adversaries that emulate benign clients and transfers adaptively crafted gradients conditioned on each adversary's neighbors. Moreover, with the vulnerabilities of DecRecs uncovered, a dedicated defensive mechanism based on user-level gradient clipping with sparsified updating is proposed. Extensive experiments demonstrate the effectiveness of the poisoning attack and the robustness of our defensive mechanism.

Preventing the Popular Item Embedding Based Attack in Federated Recommendations

FedRecAttack: Model Poisoning Attack to Federated Recommendation

Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios.

Untargeted Attack Against Federated Recommendation Systems Via Poisonous Item Embeddings and the Defense

PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion

Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasures

Poisoning Federated Recommender Systems with Fake Users

Poisoning Decentralized Collaborative Recommender System and Its Countermeasures

FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling

Robust Federated Recommendation System

Robust Federated Contrastive Recommender System against Model Poisoning Attack

Manipulating Visually-aware Federated Recommender Systems and Its Countermeasures

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

User Consented Federated Recommender System Against Personalized Attribute Inference Attack

Interaction-level Membership Inference Attack Against Federated Recommender Systems

PORE: Provably Robust Recommender Systems against Data Poisoning Attacks

Poison-Tolerant Collaborative Filtering Against Poisoning Attacks on Recommender Systems

Towards Adversarially Robust Recommendation from Adaptive Fraudster Detection

Defending Against Membership Inference Attack for Counterfactual Federated Recommendation With Differentially Private Representation Learning

RFed: Robustness-Enhanced Privacy-Preserving Federated Learning Against Poisoning Attack

PrivFR: Privacy-Enhanced Federated Recommendation With Shared Hash Embedding