Adversarial attacks on an oblivious recommender

Abstract

Can machine learning models be easily fooled? Despite the recent surge of interest in learned adversarial attacks in other domains, in the context of recommendation systems this question has mainly been answered using hand-engineered fake user profles. This paper attempts to reduce this gap. We provide a formulation for learning to attack a recommender as a repeated general-sum game between two players, i.e., an adversary and a recommender oblivious to the adversary's existence. We consider the challenging case of poisoning attacks, which focus on the training phase of the recommender model. We generate adversarial user profles targeting subsets of users or items, or generally the top-K recommendation quality. Moreover, we ensure that the adversarial user profles remain unnoticeable by preserving proximity of the real user rating/interaction distribution to the adversarial fake user distribution. To cope with the challenge of the adversary not having access to the gradient of the recommender's objective with respect to the fake user profles, we provide a non-trivial algorithm building upon zero-order optimization techniques. We ofer a wide range of experiments, instantiating the proposed method for the case of the classic popular approach of a low-rank recommender, and illustrating the extent of the recommender's vulnerability to a variety of adversarial intents. These results can serve as a motivating point for more research into recommender defense strategies against machine learned attacks. CCS CONCEPTS • Information systems → Recommender systems.

Revisiting Adversarially Learned Injection Attacks Against Recommender Systems

“…The first part (partial derivative ∂L adv /∂ X ) assumes X is independent to other variables, while the second part suggests θ * can be also a function containing X . Among all existing studies [11,13,14,26], we found the second part in Eq. 4has been completely ignored.…”

“…As we can see from Algorithm 1, solving the inner objective for surrogate model training is simple and conventional, while the challenge comes from obtaining the adversarial gradient ∇ X L adv to update fake data. In the literature, existing works either tried to estimate this gradient [11], or tried to directly compute it [13,14,26]. But under the problem formulation in Eqs.…”

“…Lacking vital experimental studies. Another major limitation in all previous experimental studies [11,13,14,26], is that the target model is set to be identical to the surrogate model, which is known as "white-box attack". One could think this is an extreme case where target model is visible to the adversary and this can serve as a upper bound of the attack capability.…”

Attacking Recommender Systems with Augmented User Profiles

“…Inspired by the success of GAN, a few works turn to leverage GAN for shilling attack task [15,16]. However, directly adopting existing GAN methods for generating adversarial examples, without special designs (like AUSH) to tailor them for RS, will not provide satisfactory results in shilling attacks as shown in our experiments.…”

“…Consequently, special designs are required to balance and achieve multiple attack goals simultaneously, while keeping the attack undetectable. Due to the aforementioned challenges, only a few recent works [15,16] consider directly adopting the idea of adversarial attacks for shilling attack, and they do not show satisfactory attack effects on a wide range of RS as illustrated later in our experiments. In addition to these methods, most existing shilling attack methods create injection profiles based on some global statistics, e.g., average rating value [4,9] and rating variance [14] for each item.…”