Abstract:To make room for privacy and efficiency, the deployment of many recommender systems is experiencing a shift from central servers to personal devices, where the federated recommender systems (FedRecs) and decentralized collaborative recommender systems (DecRecs) are arguably the two most representative paradigms. While both leverage knowledge (e.g., gradients) sharing to facilitate learning local models, FedRecs rely on a central server to coordinate the optimization process, yet in DecRecs, the knowledge sharing directly happens between clients. Knowledge sharing also opens a backdoor for model poisoning attacks, where adversaries disguise themselves as benign clients and disseminate polluted knowledge to achieve malicious goals like promoting an item's exposure rate. Although research on such poisoning attacks provides valuable insights into finding security loopholes and corresponding countermeasures, existing attacks mostly focus on FedRecs, and are either inapplicable or ineffective for DecRecs. Compared with FedRecs where the tampered information can be universally distributed to all clients once uploaded to the cloud, each adversary in DecRecs can only communicate with neighbor clients of a small size, confining its impact to a limited range. To fill the gap, we present a novel attack method named Poisoning with Adaptive Malicious Neighbors (PAMN). With item promotion in top-K recommendation as the attack objective, PAMN effectively boosts target items' ranks with several adversaries that emulate benign clients and transfers adaptively crafted gradients conditioned on each adversary's neighbors. Moreover, with the vulnerabilities of DecRecs uncovered, a dedicated defensive mechanism based on user-level gradient clipping with sparsified updating is proposed. Extensive experiments demonstrate the effectiveness of the poisoning attack and the robustness of our defensive mechanism.

Eyes on Federated Recommendation: Targeted Poisoning with Competition and Its Mitigation

FedRecAttack: Model Poisoning Attack to Federated Recommendation

Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios.

Preventing the Popular Item Embedding Based Attack in Federated Recommendations

Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasures

Poisoning Decentralized Collaborative Recommender System and Its Countermeasures

PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion

Revisit Targeted Model Poisoning on Federated Recommendation: Optimize Via Multi-objective Transport

FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling

Poisoning Federated Recommender Systems with Fake Users

Untargeted Attack Against Federated Recommendation Systems Via Poisonous Item Embeddings and the Defense

Robust Federated Recommendation System

Poison-Tolerant Collaborative Filtering Against Poisoning Attacks on Recommender Systems

Robust Federated Contrastive Recommender System against Model Poisoning Attack

Poisoning Attacks and Defenses in Recommender Systems: A Survey

Accelerating the Surrogate Retraining for Poisoning Attacks against Recommender Systems

RoseAgg: Robust Defense Against Targeted Collusion Attacks in Federated Learning

Manipulating Visually-aware Federated Recommender Systems and Its Countermeasures

Partner in Crime: Boosting Targeted Poisoning Attacks against Federated Learning

Influence-Driven Data Poisoning for Robust Recommender Systems

Data poisoning attacks on neighborhood-based recommender systems