PaperlayerView exact revision on arXiv

Source-linked AI summary

Attacking Recommender Systems with Augmented User Profiles

Chen Lin, Si Chen, Hui Li, Yanghua Xiao, Lianyun Li, Qian Yang

arXiv:2005.08164v2cs.IRcs.CRcs.LG

TL;DR

Shilling attacks are adversarial attacks in recommender systems, and image- or text-classification attacks cannot be directly employed at full power because of domain-specific challenges. AUSH uses a GAN-inspired generator to augment real-user profile templates, with reconstruction and shilling losses for realistic profiles and secondary attack goals. AUSH is reported effective across traditional collaborative-filtering and modern deep-learning recommenders, while virtually undetectable by a state-of-the-art attack detector.

  • Problem

    Shilling attacks are adversarial attacks in recommender systems, and image- or text-classification attacks cannot be directly employed at full power because of domain-specific challenges.

    Source: §1 · p. 1

  • Method

    AUSH uses a GAN-inspired generator to augment real-user profile templates, with reconstruction and shilling losses for realistic profiles and secondary attack goals.

    Source: §1 · p. 2

  • Results

    AUSH is reported effective across traditional collaborative-filtering and modern deep-learning recommenders, while virtually undetectable by a state-of-the-art attack detector.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The framework supports secondary goals such as targeting user groups or long-tail items through a shilling loss.

    Source: §1 · p. 2

    For simplicity, the paper considers push attacks in the sequel, noting that push and nuke attacks are similar and can be exchanged by changing the target rating.

    Source: §3.2 · p. 4

Abstract

from arXiv · show

Recommendation Systems (RS) have become an essential part of many online services. Due to its pivotal role in guiding customers towards purchasing, there is a natural motivation for unscrupulous parties to spoof RS for profits. In this paper, we study the shilling attack: a subsistent and profitable attack where an adversarial party injects a number of user profiles to promote or demote a target item. Conventional shilling attack models are based on simple heuristics that can be easily detected, or directly adopt adversarial attack methods without a special design for RS. Moreover, the study on the attack impact on deep learning based RS is missing in the literature, making the effects of shilling attack against real RS doubtful. We present a novel Augmented Shilling Attack framework (AUSH) and implement it with the idea of Generative Adversarial Network. AUSH is capable of tailoring attacks against RS according to budget and complex attack goals, such as targeting a specific user group. We experimentally show that the attack impact of AUSH is noticeable on a wide range of RS including both classic and modern deep learning based RS, while it is virtually undetectable by the state-of-the-art attack detection model.

1 INTRODUCTION

The paper addresses shilling attacks, in which injected profiles promote or demote items, and the limits of existing approaches: weak personalization, restricted model coverage, and difficulty balancing complex goals. It introduces AUSH, which augments real-user templates and combines adversarial training with losses tailored to recommendation attacks.

1 INTRODUCTION

  • The motivation is that recommender systems guide users toward desirable items and can also help companies promote products, creating incentives to manipulate recommendations.The paper frames shilling as profile injection intended to promote or demote a target item.Source: §1 · p. 1
  • Existing shilling attacks may be easy to detect, work on only some traditional recommenders, and be difficult to tailor to multiple goals.The paper notes that combining attack goals may reduce individual goal performance or make attacks detectable; conventional attacks also have not been studied on deep-learning recommenders.Source: §1 · p. 2
  • AUSH generates fake profiles by augmenting existing real-user templates, aiming to diversify profiles and make them harder to distinguish from real users.Its neural generator is designed to capture complex user-item associations, while a discriminator guides it toward less detectable profiles.Source: §1 · p. 2
  • AUSH is reported effective across traditional collaborative-filtering and modern deep-learning recommenders, and virtually undetectable by a state-of-the-art attack detector.The paper reports that AUSH requires no more prior knowledge than conventional shilling attacks.Source: §1 · p. 2
  • A reconstruction loss and a shilling loss tailor AUSH to recommendation attacks and support secondary goals such as targeting user groups or long-tail items.The paper describes the target group as users preferring a predefined set of competitor items.Source: §1 · p. 2

2 RELATED WORK

Related work covers recommender-system models, adversarial attacks, GANs, and shilling attacks. It motivates AUSH by noting that adversarial methods cannot be directly transferred to shilling and that the impact of shilling attacks on deep-learning recommenders remains little studied.

2.1 Recommender Systems (RS)

  • Traditional recommender systems commonly use collaborative filtering and matrix factorization, while deep-learning approaches model nonlinear correlations and complex feature representations.The paper lists MLPs, CNNs, RNNs, GNNs, autoencoders, and attention mechanisms among deep-learning techniques used in recommenders.Source: §2.1 · p. 2

2.2 Adversarial Attacks

  • Adversarial attacks manipulate model outputs with crafted examples, but the paper says they cannot be directly adopted for shilling attacks.Shilling must account for recommender correlations across user-item pairs, black-box models, and potentially competing attack goals.Source: §2.2 · p. 3

2.3 Generative Adversarial Network

  • GANs train a generator to produce real-like data against a discriminator, and related work also applies GAN variants to adversarial-example generation.The paper describes their minimax optimization as reaching a saddle point.Source: §2.3 · p. 3

2.4 Shilling Attacks against RS

  • Prior shilling research studies profile-injection attacks on collaborative filtering, but the impact on deep-learning recommenders remains limited in the literature.Some prior work uses GANs for shilling, while AUSH is presented as more specifically tailored to recommendation settings and factors such as attack cost and undetectability.Source: §2.4 · p. 3

3 AUGMENTED SHILLING ATTACK

AUSH augments real user profiles to create fake profiles that can promote or demote items under practical budget and attack-goal constraints. Its framework encompasses segment and bandwagon attacks while allowing more natural profiles and multiple attack goals.

3.1 Terminology

  • AUSH uses one target item, shared selected items, and profile-specific filler items to specify the contents of each fake user profile.Filler items are sampled from items rated by the corresponding real template user.Source: §3.1 · p. 3, §3.3 · p. 4

3.2 Attack Budget and Goal

  • AUSH treats attack size and profile size as budget factors and distinguishes push or nuke attacks, target user groups, and ancillary effects as attack goals.The paper focuses on push attacks for simplicity because push and nuke attacks can be exchanged by changing the target rating.Source: §3.2 · pp. 3–4

3.3 Overview of AUSH

  • AUSH samples real user profiles as templates, patches them with selected-item ratings, and uses reconstruction, shilling, and adversarial losses to generate realistic fake profiles.The shilling loss can support effects such as demoting competitors or targeting special user groups.Source: §3.3 · p. 4
  • Using real-user templates is intended to make generated profiles harder to distinguish and preserve community preference diversity, including tastes for niche items.The authors contrast this with random or average attacks, whose fake users do not show specific tastes.Source: §3.3 · p. 4

3.4 Relation to Segment/Bandwagon Attack

  • Segment and bandwagon attacks are special cases of AUSH, while AUSH can tune selected-item ratings to fillers, reveal real filler-rating patterns, and pursue multiple goals.Fixing filler and selected ratings to their minimum and maximum yields segment attack; selecting frequently rated items yields bandwagon attack.Source: §3.4 · pp. 4–5

4 IMPLEMENTATION

AUSH samples real-user templates and generates profiles with a towered MLP optimized by reconstruction, shilling, and adversarial objectives. The discriminator distinguishes real from generated profiles as the generator learns realistic profiles with ancillary attack effects.

4 IMPLEMENTATION

  • The generator maps an input rating sub-matrix to fake profiles, each with exactly P non-zero entries.The rating matrix uses items as rows and users as columns.Source: §4 · p. 5

4.1 Sampling

  • AUSH samples templates from real users with at least P ratings and supports random, rating-based, popularity-based, or similarity-based filler-item sampling.At test time, it samples exactly A fake profiles.Source: §4.1 · p. 5

4.2 Generator

  • The generator uses a towered MLP with MSE reconstruction loss on selected items, which the authors found worked best among the structures they tried.The reconstruction objective includes observed selected-item ratings and sampled unobserved selected items, helping generated ratings remain consistent with template-user preferences.Source: §4.2 · p. 5
  • The shilling loss enhances attack effects on in-segment users, making generated profiles more likely to associate with them and encouraging preference for the target over competitors' selected items.In-segment users are users who liked the selected items before the attack.Source: §4.2 · p. 6

4.3 Discriminator

  • The discriminator estimates whether a profile is real, while adversarial training pits its classification objective against the generator's production of realistic profiles.The adversarial objective uses real user profiles and fake profiles drawn from the generator distribution.Source: §4.3 · p. 6

4.4 Learning

  • AUSH's complete learning objective combines adversarial, reconstruction, and shilling losses, with generator and discriminator taking alternating turns to improve against each other.The reconstruction loss promotes similarity to real profiles, while shilling loss adds ancillary influence such as demoting competitors or biasing in-segment users.Source: §4.4 · p. 6

5 EXPERIMENT

The experiments compare AUSH with heuristic and general-GAN attacks across three recommendation benchmarks, then examine secondary attack goals, component effects, and detectability. AUSH generally performs strongly, and its tailored design supports targeted impact while making injected profiles difficult to detect.

5.1 Experimental Setup

  • Experiments used ML-100K, FilmTrust, and Automotive, injecting 50 profiles per attack and measuring prediction shift and HR@10 on held-out data.Source: §5.1 · p. 6, §5.2 · p. 7

5.2 Attack Performance (RQ1, RQ2, RQ3)

  • DCGAN and WGAN did not outperform simple heuristic attacks and sometimes produced negative PS and HR@K, supporting the need for a shilling-tailored GAN.Source: §5.2 · p. 7
  • AUSH produced greater attack impact on in-segment users than on all users, while other baselines could not achieve this secondary targeting goal.Source: §5.2 · p. 7
  • AUSH generally achieved strong target-item impact across recommendation models, leading PS and HR@10 in most categories, although conventional attacks sometimes surpassed it.Source: §5.2 · p. 7, Table 2 · p. 8, Table 3 · p. 8

5.4 Attack Detection (RQ5)

  • On ML-100K, the detector had its worst precision and recall on AUSH profiles, while conventional attack profiles were generally easy to detect.Source: Figure 2 · p. 8, §5.4 · pp. 8–9

5.3 Impacts of Sampling Strategies and Each Loss (RQ4)

  • Rating-based sampling performed best; complete AUSH surpassed reconstruction-only AUSHrec, while reconstruction loss improved on adversarial-loss-only AUSHadv.Source: §5.3 · p. 8, Table 6 · p. 9

5.4 Attack Detection (RQ5)

  • With 943 fake ML-100K profiles, AUSH had the smallest TVD and JS, indicating preservation of overall rating-distribution patterns and diversity.Source: Table 7 · p. 9, §5.4 · pp. 9–10

6 CONCLUSION

AUSH combines a minimax game between an attack-profile generator and fake-profile discriminator with reconstruction and shilling losses. Experiments show AUSH’s superiority; the authors propose learning item selection to make the attack’s goal harder to infer.

6 CONCLUSION

  • AUSH uses a minimax game in which the attack-profile generator and fake-profile discriminator iteratively improve against each other.Reconstruction and shilling losses help generate fake profiles and pursue secondary attack goals.Source: §6 · p. 10
  • Experiments show the superiority of AUSH.Source: §6 · p. 10
  • The authors propose learning selected items rather than choosing them manually, making the attack’s ultimate goal harder to infer.Source: §6 · p. 10

Related papers

Loading 2005.08164v2…