Attacking Recommender Systems with Augmented User Profiles

Abstract

Recommendation Systems (RS) have become an essential part of many online services. Due to its pivotal role in guiding customers towards purchasing, there is a natural motivation for unscrupulous parties to spoof RS for profits. In this paper, we study the shilling attack: a subsistent and profitable attack where an adversarial party injects a number of user profiles to promote or demote a target item. Conventional shilling attack models are based on simple heuristics that can be easily detected, or directly adopt adversarial attack methods without a special design for RS. Moreover, the study on the attack impact on deep learning based RS is missing in the literature, making the effects of shilling attack against real RS doubtful. We present a novel Augmented Shilling Attack framework (AUSH) and implement it with the idea of Generative Adversarial Network. AUSH is capable of tailoring attacks against RS according to budget and complex attack goals, such as targeting a specific user group. We experimentally show that the attack impact of AUSH is noticeable on a wide range of RS including both classic and modern deep learning based RS, while it is virtually undetectable by the state-ofthe-art attack detection model.

DeepInsight: Interpretability Assisting Detection of Adversarial Samples on Graphs

“…Adversaries often regard the GCN model as their attack target, due to its outstanding performance on node classification. Traditionally, a GCN model with two layers is represented by: z = sof tmax( Âσ( ÂXW (1) )W (2) ),…”

“…Using different adversarial attack methods, adversaries can downgrade the performance of graph data mining algorithms by adding or removing some nodes or links. For example, adversaries can register fake accounts and add some fake records to mislead a recommendation system to recommend illegal products to ordinary users, leading to serious consequences [1], [2].…”

PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion

“…the correctness of the learned recommender in the presence of malicious users, where the trained model can be induced to deliver altered results as the adversary desires, e.g., promoting a target product 1 such that it gets more exposures in the item lists recommended to users. This is termed poisoning attack [12,25], which is usually driven by financial incentives but incurs strong unfairness in a trained recommender. In light of both privacy and security issues, there has been a recent surge in decentralizing recommender systems, where federated learning [28,33,34] appears to be one of the most representative solutions.…”

“…Moreover, it also prevents a recommender from being poisoned. The rationale is, in recommendation, the predominant poisoning method for manipulating item promotion is data poisoning, where the adversary manipulates malicious users to generate fake yet plausible user-item interactions (e.g., ratings), making the trained recommender biased towards the target item [12,13,25,36]. However, these aforementioned data poisoning attacks operate under the assumption that the adversary has prior knowledge about the entire training dataset.…”

“…Apparently, such assumption is voided in federated recommendation as the user data is distributively held, thus restricting the adversary's access to the entire dataset. Though the adversary can still conduct data poisoning by increasing the amount of fake interactions and/or malicious user accounts, it inevitably makes the attack more identifiable from either the abnormal user behavioral footprints [23,38] or heavily impaired recommendation accuracy [25]. Thus, we aim to answer this challenging question: can we backdoor federated recommender systems via poisoning attacks?…”