Source-linked AI summary
Attacking Black-box Recommendations via Copying Cross-domain User Profiles
Wenqi Fan, Tyler Derr, Xiangyu Zhao, Yao Ma, Hui Liu, Jianping Wang, Jiliang Tang, Qing Li
TL;DR
Deep recommender systems are vulnerable to poisoning, but fake profiles can be detected because they differ from real users. CopyAttack uses reinforcement learning to select and craft real source-domain profiles for black-box target attacks. Experiments on two real-world datasets report superiority over competitive baselines.
Problem
Fake-profile poisoning attacks can be detected because generated profiles differ from real users, leaving realistic profile-based attacks a challenge.
Source: §1 · p. 1Method
Results
Takeaways & Limitations
The study supports cross-domain profile copying as an effective strategy for targeted-item promotion in the evaluated settings.
Source: §1 · p. 2, §6 · p. 9Future work includes targeting items not present in the source domain, demotion attacks, and richer side information.
Source: §6 · p. 10
Abstract
from arXiv · showhide
Recently, recommender systems that aim to suggest personalized lists of items for users to interact with online have drawn a lot of attention. In fact, many of these state-of-the-art techniques have been deep learning based. Recent studies have shown that these deep learning models (in particular for recommendation systems) are vulnerable to attacks, such as data poisoning, which generates users to promote a selected set of items. However, more recently, defense strategies have been developed to detect these generated users with fake profiles. Thus, advanced injection attacks of creating more `realistic' user profiles to promote a set of items is still a key challenge in the domain of deep learning based recommender systems. In this work, we present our framework CopyAttack, which is a reinforcement learning based black-box attack method that harnesses real users from a source domain by copying their profiles into the target domain with the goal of promoting a subset of items. CopyAttack is constructed to both efficiently and effectively learn policy gradient networks that first select, and then further refine/craft, user profiles from the source domain to ultimately copy into the target domain. CopyAttack's goal is to maximize the hit ratio of the targeted items in the Top-$k$ recommendation list of the users in the target domain. We have conducted experiments on two real-world datasets and have empirically verified the effectiveness of our proposed framework and furthermore performed a thorough model analysis.
1 INTRODUCTION
Deep recommender systems are vulnerable to profile-poisoning attacks, while fake profiles can be detected because they differ from real users. CopyAttack addresses this challenge by copying real cross-domain profiles and using reinforcement learning to select profiles with black-box query feedback.
1 INTRODUCTION
- Deep recommender systems are vulnerable to data-poisoning attacks, while defenses detect fake profiles because they differ from real user patterns.The challenge is to attack recommendations with profiles that resemble real users.Source: §1 · p. 1
- CopyAttack copies real user profiles from a source domain into a target domain to promote selected items.The approach uses shared items across domains and seeks profiles that can be copied as new target-domain users.Source: §1 · p. 2
- Under black-box access, CopyAttack uses reinforcement learning to select source-domain profiles from Top-k recommendation feedback.The attacker has query access to the target model rather than full knowledge of its model design, parameters, or dataset.Source: §1 · p. 2
- The paper introduces a profile-copying strategy and evaluates CopyAttack on two real-world datasets.Its stated contributions include efficient and effective profile selection and experiments demonstrating framework effectiveness.Source: §1 · p. 2
2 RELATED WORK
Prior recommendation attacks include methods that optimize fake profiles using full access to the target model and dataset. This work addresses the stated gap in black-box recommendation attacks.
2 RELATED WORK
- Projected Gradient Method and Stochastic Gradient Langevin Dynamics optimize poisoning attacks with full knowledge of factorization-based collaborative filtering [16].Source: §2 · p. 2
- A two-step adversarial framework generates fake users with GANs and then crafts their profiles with Projected Gradient Method.Source: §2 · p. 2
- Existing attacks often require direct access to the target model and dataset, motivating study of black-box recommendation attacks.The related work also describes hybrid fake profiles combining ratings and social relationships for social recommendations.Source: §2 · p. 2
3 PROBLEM STATEMENT
The problem is to promote a target item in a target recommender by injecting copied user profiles from a source domain. The formulation assumes sufficiently many shared items between the domains and defines promotion by changes to users’ Top-k recommendations.
3 PROBLEM STATEMENT
- The source and target domains must share a nonempty, sufficiently large set of items.The paper defines an item profile as the target-domain users who interacted with a shared item.Source: §3 · p. 3
- The target recommender ranks potential items for each user, while user-item interactions form its interaction matrix.A user profile is the set of items that user has interacted with.Source: §3 · pp. 2–3
- The attacker copies source-domain users under a profile budget, and promotion means the target item enters Top-k for target users who previously lacked it.The copied interactions join the target domain and pollute its user-item interaction matrix.Source: §3 · p. 3
4 THE PROPOSED FRAMEWORK
CopyAttack combines profile selection, profile crafting, and injection with queries to attack a black-box recommender. Its environment models the attack as a sequential decision process whose rewards reflect targeted-item ranking.
4 THE PROPOSED FRAMEWORK
- CopyAttack is a reinforcement-learning attack framework with profile selection, profile crafting, and injection-and-query components.Source: §4.1 · p. 3, §4 · p. 3
4.1 An Overview of the Proposed Framework
- Hierarchical policy gradients with masking select useful source profiles, while a second policy decides what percentage to retain around the target item.Crafting considers both attack cost and noise from long profiles; target-system Top-k feedback forms rewards for updating the policies.Source: §4.1 · p. 3
4.2 Attacking Environment Overview
- The attacking environment is modeled as an MDP with states comprising intermediate injected profiles and actions that select and modify source profiles.An action’s crafted profile is ultimately injected into the target recommender.Source: §4.2 · pp. 3–4
- HR@K on the attacker’s pretend users supplies ranking-based reward, and the process stops at the profile budget or once promotion succeeds.The pretend users act as proxies for gauging attack effectiveness.Source: §4.2 · p. 4
Hierarchical-structure Policy Gradient
CopyAttack selects source-domain user profiles through a hierarchical policy structure, masks profiles that lack the target item, and clips selected profiles before injecting them and using target-system feedback to update its policies.
Hierarchical-structure Policy Gradient
- The hierarchical policy network searches for source-domain profiles to promote target items, addressing a discrete action space whose decision cost can grow linearly with the number of profiles.The selection challenge is intensified by limited interaction with the black-box target system.Source: Hierarchical-structure Policy Gradient · p. 5
4.3.1 Hierarchical Clustering Tree over Cross-domain User Profiles.
- A top-down divisive clustering tree groups similar profiles, with profiles at leaves and policy networks at non-leaf nodes.The tree is balanced to avoid a worst-case linked-list structure and preserve speedup.Source: §4.3.1 · p. 5
4.3.2 Masking Mechanism.
- Masking removes profiles that lack the target item from consideration, shrinking the action space while leaving paths available because the target item belongs to both domains.Source: §4.3.2 · p. 5
4.3.3 Hierarchical-structure Policy Gradient. 𝑡|𝑠𝑢
- At each tree node, a policy network assigns probabilities to child nodes, and selection proceeds down the tree to a source-user profile.The process is seeded by choosing the first profile at random because the selected-user set is initially empty and offers no RNN signal.Source: §4.3.3 · pp. 5–6
4.4 User Profile Crafting
- Profile crafting clips selected users’ interaction histories around the target item, choosing a window length to reduce irrelevant interactions and attack cost.The authors argue that retaining nearby interactions preserves temporal relations and may avoid making profiles less realistic.Source: §4.4 · p. 6
4.5 Injection Attack and Queries
- After injection, CopyAttack queries the target system for Top-k recommendations and uses target-item HR@K over pretend users as reward to update both policies.Source: §4.5 · p. 6
5 EXPERIMENT
The section introduces the experimental settings, compares baseline performance, and examines the impact of model components.
5.1 Experimental Settings
Experiments use two cross-domain movie datasets, evaluate Top-K recommendations with HR@K and NDCG@K, and test CopyAttack in a fixed black-box target environment against sampling and component-ablation baselines.
5.1.1 Datasets.
- ML10M-FX pairs MovieLens10M as the target with Flixster as the source, while ML20M-NF pairs MovieLens20M with Netflix; they contain 5,815 and 5,193 overlapping items, respectively.ML10M-FX keeps rating-5 interactions; ML20M-NF matches movies by name and publication year and keeps overlapping source-domain items.Source: §5.1.1 · p. 7
5.1.2 Evaluation Metrics.
- Evaluation uses HR@K and NDCG@K at K=20, 10, and 5, ranking each test item among 100 randomly sampled unobserved items.Higher metric values indicate better predictive performance.Source: §5.1.2 · p. 7
5.1.3 Attacking Environment and Parameter Settings.
- PinSage is the fixed target recommender; attacks use 50 sampled targets with fewer than 10 interactions, a maximum 30-profile budget, and queries after every three injections.The target model is trained with an 80/10/10 train/validation/test split; the attack settings also use 50 pretend users per dataset.Source: §5.1.3 · p. 7
5.1.4 Baselines.
- Baselines include random source-profile sampling, target-item-conditioned TargetAttack variants with 40%, 70%, or 100% profile lengths, and CopyAttack ablations of its tree, masking, and crafting components.PolicyNetwork removes the hierarchical clustering tree; CopyAttack-Masking removes masking and crafting, while CopyAttack-Length removes profile crafting.Source: §5.1.4 · p. 7
5.2 Performance Comparison of Recommender Systems
Target-item-conditioned profile sampling improves attack performance over random sampling, and the reported comparisons indicate that profile crafting and CopyAttack’s selection components matter.
5.2 Performance Comparison of Recommender Systems
- Random cross-domain profile sampling does not promote target items, whereas sampling profiles that include the target items significantly improves attack performance.Restricting selection to source users who include the target item performs better still.Source: §5.2 · p. 8
- Target-item-constrained methods without profile crafting perform worse, supporting the importance of crafting the copied profiles.The unconstrained methods have very low item budgets, reported as fewer than 50.Source: §5.2 · p. 9
- Removing the hierarchical tree degrades CopyAttack, while removing profile crafting sharply reduces promotion and increases item budget; removing masking further worsens performance.PolicyNetwork did not finish on ML20M-NF within 48 hours, while the other methods finished in a few hours.Source: §5.2 · p. 9
5.3 Model Analysis
The analysis examines tree depth, item popularity, and attack budget, reporting depth-dependent performance, vulnerability among popular items, and continued CopyAttack gains as budget grows.
5.3.1 Effect of Depth on Hierarchical Clustering Tree.
- The reported 20M depth comparisons identify d=3 and d=6 as best on HR@20 and NDCG@20; deeper trees require more policy networks, while shallower trees offer runtime efficiency and larger selection clusters.The authors frame depth as a trade-off between cluster detail and the number of policy networks to learn.Source: §5.3.1 · p. 9
- Among popularity groups formed as ten deciles, the top 30% of items are reported vulnerable to attack.The evaluation samples 50 target items from each popularity group.Source: §5.3.2 · p. 9
5.3.2 Effect of Item Popularity.
- On ML10M-FX, RandomAttack remains stable as budget varies, TargetAttack variants stop improving at larger budgets, and CopyAttack continues increasing.The authors attribute CopyAttack's continued gains to querying the target system for rewards that train the attack.Source: §5.3.3 · p. 9
6 CONCLUSION AND FUTURE WORK
CopyAttack uses reinforcement learning to copy and refine source-domain users for black-box attacks, addressing the detectability of fake profiles. Experiments on two real-world datasets show superiority over competitive baselines, while the authors leave broader targeting and additional attack goals for future work.
6 CONCLUSION AND FUTURE WORK
- CopyAttack uses policy-gradient networks to select and refine source-domain users before injecting them into the target domain for black-box promotion attacks.The injected users’ Top-k recommendations provide feedback used to update the model parameters.Source: §6 · p. 9
- Experiments on two real-world datasets show CopyAttack outperforms a set of competitive baselines.Source: §6 · pp. 9–10
- Future work includes targeting items absent from the source domain, demoting items, and incorporating richer side information.Source: §6 · p. 10
A SUPPLEMENTATION
The supplement examines the effect of the copied-profile budget on ML20M-NF. CopyAttack finishes in a few hours, while PolicyNetwork did not finish within 48 hours.
A SUPPLEMENTATION
- CopyAttack obtains results in a few hours, including an example runtime of 3 hours, while PolicyNetwork does not finish within the 48-hour limit.The authors cite this as further support for the hierarchical clustering tree over a single policy-gradient network for the full source-domain action space.Source: A SUPPLEMENTATION · p. 10
- Figure 6 examines the effect of the copied-profile budget on cross-domain user profiles on ML20M-NF.The budget is the number of profiles copied.Source: Figure 6 · p. 10, A SUPPLEMENTATION · p. 10