Rank List Sensitivity of Recommender Systems to Interaction Perturbations

Abstract

While deep learning-based sequential recommender systems are widely used in practice, their sensitivity to untargeted training data perturbations is unknown. Untargeted perturbations aim to modify ranked recommendation lists for all users at test time, by inserting imperceptible input perturbations during training time. Existing perturbation methods are mostly targeted attacks optimized to change ranks of target items, but not suitable for untargeted scenarios. In this paper, we develop a novel framework in which user-item training interactions are perturbed in unintentional and adversarial settings. First, through comprehensive experiments on four datasets, we show that four popular recommender models are unstable against even one random perturbation. Second, we establish a cascading effect in which minor manipulations of early training interactions can cause extensive changes to the model and the generated recommendations for all users. Leveraging this effect, we propose an adversarial perturbation method CASPER which identifies and perturbs an interaction that induces the maximal cascading effect. Experimentally, we demonstrate that CASPER reduces the stability of recommendation models the most, compared to several baselines and state-of-the-art methods. Finally, we show the runtime and success of CASPER scale near-linearly with the dataset size and the number of perturbations, respectively.

Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders

“…Substitution-based adversarial attacks manipulate vulnerable items in previous or ongoing interactions to sabotage the recommendation (i.e., untargeted attacks) or manipulate the recommended items (i.e., targeted attacks) [16,20,26,37]. Previous works on profile pollution study attack algorithms and have the following limitations: (1) Existing methods designed for traditional recommenders can not be applied, or are not tailored for sequential recommenders [32,34,43]; (2) Previous methods do not explore substitution-based attacks, instead, they focus on the injection of adversarial items [36,43]; and (3) Adversarial defense methods are not discussed [24,32,34,36,43].…”