PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Personalized Ranking for Recommendation

Xiangnan He, Zhankui He, Xiaoyu Du, Tat-Seng Chua

arXiv:1808.03908v1cs.IRcs.LGstat.ML

TL;DR

BPR-trained recommendation models, including MF, can be vulnerable to adversarial perturbations on their parameters, while input perturbations are unsuitable for discrete recommender features. The paper proposes APR, which adds adversarial training to BPR, and its MF implementation outperforms MF-BPR by 11% on average in NDCG and hit ratio across three public datasets. The work concludes that adversarial training has a highly positive effect for personalized ranking, while extending APR beyond shallow MF embedding layers remains future work.

  • Problem

    BPR-trained recommender models can be vulnerable to adversarial parameter perturbations, and image-style input attacks are unsuitable for discrete recommendation features.

  • Method

    APR augments BPR with adversarial training that minimizes ranking loss under parameter perturbations, using a minimax formulation and an SGD-based solver.

  • Results

    11% average improvement in NDCG and hit ratio over MF-BPR is reported for AMF across experiments on Yelp, Pinterest, and Gowalla.

  • Takeaways & Limitations

    Adversarial training improves personalized ranking performance and provides a framework for learning more robust recommender models.

  • Takeaways & Limitations

    The demonstrated method addresses only the embedding layer of a shallow MF model, leaving adversarial training on deep hidden layers as a challenge for future work.

Abstract

from arXiv · show

Item recommendation is a personalized ranking task. To this end, many recommender systems optimize models with pairwise ranking objectives, such as the Bayesian Personalized Ranking (BPR). Using matrix Factorization (MF) --- the most widely used model in recommendation --- as a demonstration, we show that optimizing it with BPR leads to a recommender model that is not robust. In particular, we find that the resultant model is highly vulnerable to adversarial perturbations on its model parameters, which implies the possibly large error in generalization. To enhance the robustness of a recommender model and thus improve its generalization performance, we propose a new optimization framework, namely Adversarial Personalized Ranking (APR). In short, our APR enhances the pairwise ranking method BPR by performing adversarial training. It can be interpreted as playing a minimax game, where the minimization of the BPR objective function meanwhile defends an adversary, which adds adversarial perturbations on model parameters to maximize the BPR objective function. To illustrate how it works, we implement APR on MF by adding adversarial perturbations on the embedding vectors of users and items. Extensive experiments on three public real-world datasets demonstrate the effectiveness of APR --- by optimizing MF with APR, it outperforms BPR with a relative improvement of 11.2% on average and achieves state-of-the-art performance for item recommendation. Our implementation is available at: https://github.com/hexiangnan/adversarial_personalized_ranking.

1 INTRODUCTION

This work identifies a robustness gap in recommendation: BPR-trained models can be vulnerable to parameter perturbations, while input-level image-style attacks are unsuitable for discrete recommender features. It therefore proposes adversarial training for personalized ranking and demonstrates it with MF.

  • Learning-to-rank methods such as BPR may inherit robustness problems because they are trained by optimizing classification functions.The paper frames this as an unexplored adversarial-learning issue in information retrieval and recommendation.
  • Directly perturbing user IDs, item IDs, or other categorical inputs is infeasible because noise can change their semantics.The proposed direction is to investigate robustness at the level of intrinsic model parameters instead.
  • MF-BPR is vulnerable to adversarial perturbations on its embedding parameters despite being a highly competitive recommendation baseline.This finding motivates methods that learn more robust recommender models.
  • APR augments BPR with an adversarial objective that trains the model to minimize ranking loss under parameter perturbations.Its minimax formulation optimizes perturbations to maximize BPR loss while training the model against that loss.
  • AMF applies APR to matrix factorization, and experiments on Yelp, Pinterest, and Gowalla report a significant average improvement of 11% in NDCG and hit ratio over MF-BPR.The experiments combine quantitative and qualitative analyses of adversarial training for personalized ranking.

2 PRELIMINARIES

This section introduces MF and BPR for personalized ranking, then shows that MF-BPR is vulnerable to purposefully designed parameter perturbations. It motivates adversarial training by comparing adversarial and random perturbations and measuring their effects on recommendation and training accuracy.

  • 2.1 Matrix Factorization: MF represents users and items as embedding vectors and estimates preference through their inner product.The model parameters comprise all user and item embeddings.
  • 2.2 Bayesian Personalized Ranking: BPR learns personalized rankings by encouraging observed interactions to score higher than unobserved items.It uses pairwise training instances and is optimized with stochastic gradient descent.
  • 2.3 MF-BPR is Vulnerable to Adversarial Noises: MF-BPR is tested for robustness against perturbations to model parameters because changing discrete input IDs would change their semantics.The comparison uses random perturbations as a baseline for assessing whether more effective perturbations expose vulnerability.
  • 2.3 MF-BPR is Vulnerable to Adversarial Noises: Adversarial perturbations are designed to maximize the BPR objective, with their magnitude constrained by ϵ and approximated by linearizing the objective.The experiments apply these perturbations to MF embeddings and compare them with random perturbations.
  • 2.3 MF-BPR is Vulnerable to Adversarial Noises: 21.2%: On Gowalla at ϵ = 0.4, adversarial perturbations reduce testing NDCG, versus 1.6% for random perturbations.The adversarial drop is reported as 13 times larger than the random-perturbation drop.
  • 2.3 MF-BPR is Vulnerable to Adversarial Noises: MF-BPR is relatively robust to random noise but vulnerable to purposefully designed perturbations that substantially harm recommendation performance.On Gowalla at ϵ = 1, testing NDCG drops 55.4% while training accuracy drops 5.1%; on Pinterest at ϵ = 2, the corresponding drops are 57.8% and 10.1%.

3 PROPOSED METHODS

APR extends BPR with adversarial training that minimizes ranking loss while defending against parameter perturbations. Its MF implementation, AMF, alternates perturbation construction and model updates using SGD and applies perturbations to user and item embeddings.

  • 3.1 Adversarial Personalized Ranking: APR adds an adversarial BPR loss so recommender models optimize personalized ranking while remaining robust to parameter perturbations.The framework uses a minimax formulation in which perturbations maximize BPR loss and model parameters minimize the ordinary and perturbed losses.
  • 3.1 Adversarial Personalized Ranking: APR is model-independent for differentiable recommenders and introduces perturbation magnitude ϵ and adversarial-loss weight λ as additional hyper-parameters.The framework can be optimized with backpropagation and gradient-based methods.
  • 3.2 A Generic SGD Solver for APR: The generic SGD solver alternates between constructing adversarial perturbations for sampled training instances and updating model parameters.Perturbations are approximated with a fast gradient method under a max-norm constraint, followed by an SGD parameter update.
  • 3.3 Adversarial Matrix Factorization: AMF first pre-trains MF with BPR, then continues optimization under APR by perturbing user and item embedding vectors.The perturbation vector is constrained at magnitude ϵ, and updates are applied to embeddings occurring in each mini-batch.
  • 3.3.1 Mini-batch Training for AMF: AMF uses mini-batch training, updates perturbations before model parameters, and stops when convergence is reached or validation performance degrades.Items are tracked as both positive and negative participants when constructing embedding updates.

4 EXPERIMENTS

The experiments evaluate whether adversarial learning improves AMF over MF-BPR, how AMF compares with state-of-the-art recommendation methods, and how ϵ and λ affect performance.

  • Research Questions: The experiments first test whether adversarial learning improves AMF over MF-BPR.This is posed as the first research question.
  • Research Questions: The second research question compares AMF with state-of-the-art item recommendation methods.The comparison is part of the paper’s experimental evaluation.
  • Research Questions: The third research question examines how hyper-parameters ϵ and λ affect performance and how to choose their values.The experiments report results after describing the settings and addressing the research questions in sequence.

4.1 Experimental Settings

The study evaluates recommendation methods on three public million-scale datasets representing business, image, and location check-in scenarios. It uses leave-one-out top-K evaluation with HR and NDCG, common settings, tuned baselines, and selected AMF hyper-parameters.

  • Datasets: Three public datasets cover business, image, and location check-in recommendation scenarios: Yelp, Pinterest, and Gowalla.The datasets are million-size scale after preprocessing.
  • Datasets: Yelp and Gowalla merge repeated interactions to the earliest event, while Pinterest is used without changes because it contains no repetitive interactions.Gowalla additionally filters items with fewer than 10 interactions and users with fewer than 2 interactions.
  • Evaluation Protocol: Leave-one-out evaluation holds out each user’s latest interaction for Yelp and Gowalla, while Pinterest uses a randomly held-out interaction.The remaining interactions form the training data.
  • Evaluation Protocol: Top-K lists rank all non-training items, use K=100 by default, and are evaluated with Hit Ratio and NDCG.HR measures whether the test item appears in the top-K list, whereas NDCG rewards hits at higher positions.
  • Baselines: The comparison includes popularity ranking, MF-BPR, CDAE, NeuMF, and IRGAN as recommendation baselines.NeuMF is described as a state-of-the-art neural matrix factorization method, while IRGAN uses generative adversarial training.
  • Implementation and Parameter Settings: All models use embedding size 64, mini-batch Adagrad with batch size 512, and tuned learning rates; AMF performs well with ϵ=0.5 and λ=1 across datasets.Hyperparameters are selected using validation NDCG@100.

4.2 Effect of Adversarial Learning (RQ1)

Adversarial training improves MF beyond prolonged BPR training, across datasets and embedding sizes, while making the model less sensitive to parameter perturbations. Its regularization mechanism differs from conventional L2 regularization.

  • Training Process: On Yelp, APR improves MF-BPR’s best HR from 0.1721 to 0.1881 and NDCG from 0.0420 to 0.0470.The improvement is roughly 10% relative while keeping the underlying MF model unchanged.
  • Training Process: 13.5% in HR and 16.8% in NDCG are the improvements achieved by AMF over MF-BPR on Gowalla.
  • Improvements vs. Model Size: APR yields smaller gains for small embeddings and larger gains for large embeddings, where overfitting makes robustness more consequential.
  • Robustness of AMF: At noise level 0.5 on Gowalla, adversarial perturbations reduce NDCG by 26.3% for MF-BPR but only 2.9% for AMF.The table measures relative NDCG decrease under perturbations.
  • Adversarial Regularization vs. L2 Regularization: Adversarial regularization increases embedding norms, unlike L2 regularization, while the authors attribute its benefit to meaningful robustness-oriented parameter updates.

4.3 Performance Comparison (RQ2)

AMF is compared with recommendation baselines using top-K evaluation at K = 50 and K = 100. The reported comparison highlights AMF’s advantage over IRGAN and explains why larger K values are practically relevant.

  • Top-K recommendation is evaluated at K = 50 and K = 100 because ranking all items causes larger variance at smaller K.
  • Larger K values are more instructive for practitioners because collaborative filtering commonly performs candidate selection using a high-recall objective.
  • AMF betters IRGAN by 5.9% on average in the reported comparison.The authors describe APR as more efficient and easier to train than IRGAN, which requires careful tuning to avoid mode collapse.
  • Among the baselines, NeuMF performs best, IRGAN usually exceeds MF-BPR, and personalized methods substantially outperform ItemPop.

4.4 Hyper-parameter Studies (RQ3)

APR’s performance depends on the perturbation magnitude and regularizer strength. The reported settings favor ϵ = 0.5 and λ = 1 or another sufficiently large value.

  • The hyperparameter trends shown on Pinterest and Gowalla are reported to match those on Yelp.
  • Perturbation Magnitude: With λ = 1, AMF performs best around ϵ = 0.5 on Pinterest and Gowalla.Values below 0.1 produce only minor improvements over MF-BPR, whereas values above 1 cause a dramatic performance drop.
  • Perturbation Magnitude: Too-large perturbations destroy the parameter-learning process, motivating ϵ = 0.5 when AMF is pretrained with BPR.
  • Regularizer Strength: With ϵ = 0.5, increasing λ below 1 gradually improves performance, while larger values remain effective until λ reaches 1,000.
  • Regularizer Strength: The authors suggest setting λ to 1 or a larger value such as 10 because AMF is insensitive once λ sufficiently reflects the adversarial effect.

5 RELATED WORK

Related work covers MF and BPR for collaborative filtering, neural recommendation, adversarial learning, and ranking. APR extends BPR with parameter-level adversarial training, addressing a robustness setting distinguished from profile injection attacks.

  • Item Recommendation: MF is described as a basic yet effective latent-factor recommender, while recommendation research shifted from explicit ratings toward one-class implicit feedback.
  • Item Recommendation: BPR frames item recommendation as personalized ranking by learning that observed interactions should outrank unobserved items.
  • Item Recommendation: APR directly enhances BPR through adversarial training and could improve recommender systems that use BPR.
  • Neural Recommendation: Neural collaborative filtering learns user-item interaction functions from data instead of fixing them as MF’s inner product.
  • Adversarial Learning: Adversarial learning research largely developed in image classification, where training methods dynamically generate adversarial examples.
  • Adversarial Learning: APR studies resistance to parameter perturbations, whereas recommender-system robustness research commonly addresses profile injection attacks.

6 CONCLUSION AND FUTURE WORK

The work identifies vulnerability in BPR-optimized recommender models and proposes adversarial training through APR to learn more robust personalized-ranking models. Future work extends APR beyond shallow MF and recommendation.

  • Conclusion: BPR-optimized models can be vulnerable to adversarial parameter perturbations, motivating more robust personalized-ranking methods.The authors frame this vulnerability as a possible weakness in generalization.
  • Conclusion: APR performs adversarial training on BPR and is implemented with a generic SGD-based learning algorithm for MF.The method aims to optimize recommender models while addressing adversarial perturbations.
  • Future Work: Future work targets feature-based, neural, and other recommender models, as well as information-retrieval tasks beyond recommendation.The authors identify extending adversarial training to deep hidden layers as a challenge because this work addresses only the embedding layer of shallow MF.
Loading 1808.03908v1…