Data poisoning attacks on neighborhood‐based recommender systems

Abstract

Nowadays, collaborative filtering recommender systems have been widely deployed in many commercial companies to make profit. Neighbourhood-based collaborative filtering is common and effective. To date, despite its effectiveness, there has been little effort to explore their robustness and the impact of data poisoning attacks on their performance. Can the neighbourhood-based recommender systems be easily fooled? To this end, we shed light on the robustness of neighbourhood-based recommender systems and propose a novel data poisoning attack framework encoding the purpose of attack and constraint against them. We firstly illustrate how to calculate the optimal data poisoning attack, namely UNAttack. We inject a few well-designed fake users into the recommender systems such that target items will be recommended to as many normal users as possible. Extensive experiments are conducted on three real-world datasets to validate the effectiveness and the transferability of our proposed method. Besides, some interesting phenomenons can be found. For example, 1) neighbourhood-based recommender systems with Euclidean Distance-based similarity have strong robustness. 2) the fake users can be transferred to attack the state-of-the-art collaborative filtering recommender systems such as Neural Collaborative Filtering and Bayesian Personalized Ranking Matrix Factorization.

Data Poisoning Attacks to Deep Learning Based Recommender Systems

“…For instance, random attacks just choose rated items at random from the whole item set for fake users, and bandwagon attacks tend to select certain items with high popularity in the dataset for fake users. The algorithm-specific data poisoning attacks are optimized to a specific type of recommender systems and have been developed for graph-based recommender systems [13], association-rule-based recommender systems [46], matrix-factorization-based recommender systems [12], [28], and neighborhood-based recommender systems [4]. As these attacks are optimized, they often are more effective.…”

DeepInsight: Interpretability Assisting Detection of Adversarial Samples on Graphs

“…Adversaries often regard the GCN model as their attack target, due to its outstanding performance on node classification. Traditionally, a GCN model with two layers is represented by: z = sof tmax( Âσ( ÂXW (1) )W (2) ),…”

“…Using different adversarial attack methods, adversaries can downgrade the performance of graph data mining algorithms by adding or removing some nodes or links. For example, adversaries can register fake accounts and add some fake records to mislead a recommendation system to recommend illegal products to ordinary users, leading to serious consequences [1], [2].…”

Re‐ranking with multiple objective optimization in recommender system

“…The recommendation list is the suggestion provided by the recommender. Personalized recommendation refers to providing recommendations that meet the user's preferences based on understanding the user 1,2 …”