Abstract:Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning attacks, in which an attacker injects fake data to a given system such that the system makes recommendations as the attacker desires. However, these poisoning attacks are either agnostic to recommendation algorithms or optimized to recommender systems that are not graph-based. Like association-rule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store. However, how to design optimized poisoning attacks for graph-based recommender systems is still an open problem. In this work, we perform a systematic study on poisoning attacks to graph-based recommender systems. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. The key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning attacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our attacks and compare them with existing attacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and black-box (recommendation algorithm is unknown) settings using two real-world datasets. Our results show that our attack is effective and outperforms existing attacks for graph-based recommender systems. For instance, when 1% fake users are injected, our attack can make a target item recommended to 580 times more normal users in certain scenarios.

Manipulating Supply Chain Demand Forecasting With Targeted Poisoning Attacks

Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios.

With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Models

Poisoning Attack Against Online Regression Learning with Maximum Loss for Edge Intelligence

Accumulative Poisoning Attacks on Real-time Data

Research on Data Poisoning Attack against Smart Grid Cyber–Physical System Based on Edge Computing

Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasures

Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks

PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion

Model-Targeted Poisoning Attacks with Provable Convergence

PoisonRec: an Adaptive Data Poisoning Framework for Attacking Black-box Recommender Systems

Indiscriminate Data Poisoning Attacks on Neural Networks

Data Poisoning Attacks on Regression Learning and Corresponding Defenses

Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks

Invisible Poisoning: Highly Stealthy Targeted Poisoning Attack

Accelerating Poisoning Attack Through Momentum And Adam Algorithms

Poisoning Attacks to Graph-Based Recommender Systems

Accelerating the Surrogate Retraining for Poisoning Attacks against Recommender Systems

Concealed Data Poisoning Attacks on NLP Models

Revisit Targeted Model Poisoning on Federated Recommendation: Optimize Via Multi-objective Transport

Temporal Robustness against Data Poisoning