Influence Function based Data Poisoning Attacks to Top-N Recommender Systems

Abstract

Recommender system is an essential component of web services to engage users. Popular recommender systems model user preferences and item properties using a large amount of crowdsourced user-item interaction data, e.g., rating scores; then top-N items that match the best with a user's preference are recommended to the user. In this work, we show that an attacker can launch a data poisoning attack to a recommender system to make recommendations as the attacker desires via injecting fake users with carefully crafted user-item interaction data. Specifically, an attacker can trick a recommender system to recommend a target item to as many normal users as possible. We focus on matrix factorization based recommender systems because they have been widely deployed in industry. Given the number of fake users the attacker can inject, we formulate the crafting of rating scores for the fake users as an optimization problem. However, this optimization problem is challenging to solve as it is a non-convex integer programming problem. To address the challenge, we develop several techniques to approximately solve the optimization problem. For instance, we leverage influence function to select a subset of normal users who are influential to the recommendations and solve our formulated optimization problem based on these influential users. Our results show that our attacks are effective and outperform existing methods. CCS CONCEPTS• Security and privacy → Web application security. KEYWORDSAdversarial recommender systems, data poisoning attacks, adversarial machine learning.

Revisiting Adversarially Learned Injection Attacks Against Recommender Systems

“…The first part (partial derivative ∂L adv /∂ X ) assumes X is independent to other variables, while the second part suggests θ * can be also a function containing X . Among all existing studies [11,13,14,26], we found the second part in Eq. 4has been completely ignored.…”

“…There are a few studies [11,13,14,26] in the literature tried to regard the injection attack as an optimization problem and learn fake data for adversarial goals. However, we found there exist two major limitations in existing works.…”

“…As we can see from Algorithm 1, solving the inner objective for surrogate model training is simple and conventional, while the challenge comes from obtaining the adversarial gradient ∇ X L adv to update fake data. In the literature, existing works either tried to estimate this gradient [11], or tried to directly compute it [13,14,26]. But under the problem formulation in Eqs.…”

“…Lacking vital experimental studies. Another major limitation in all previous experimental studies [11,13,14,26], is that the target model is set to be identical to the surrogate model, which is known as "white-box attack". One could think this is an extreme case where target model is visible to the adversary and this can serve as a upper bound of the attack capability.…”

“…By unrolling fewer steps, we still need extra time and space. While in this subsection, we revisit another way adopted by existing works [13,26], to approximate the gradient by its partial derivatives:…”