PaperlayerView exact revision on arXiv

Source-linked AI summary

Data Poisoning Attacks to Deep Learning Based Recommender Systems

Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, Mingwei Xu

arXiv:2101.02644v2cs.CRcs.AI

TL;DR

Deep learning recommender systems lack a systematic study of data poisoning attacks, despite their use in filtering information and their vulnerability to crafted fake-user ratings. The paper formulates such attacks as constrained optimization, develops heuristics to approximate the solution, and evaluates them across datasets and detection settings. The attack effectively promotes target items, outperforms existing attacks, and remains effective with partial knowledge and rating-based detection.

  • Problem

    The paper addresses the lack of a systematic study of data poisoning attacks against deep learning based recommender systems, which can influence recommendations and Internet opinions.

  • Method

    The attack injects fake users with crafted ratings and formulates rating selection as a constrained hit-ratio optimization approximated using multiple heuristics and a poison model.

  • Results

    Across three real-world datasets, the attack effectively promotes target items and significantly outperforms existing attacks, including when knowledge is partial or a rating-based detector is deployed.

  • Takeaways & Limitations

    The attack remains effective without full neural-architecture or interaction-matrix access and despite deployment of a rating-score-based fake-user detector.

Abstract

from arXiv · show

Recommender systems play a crucial role in helping users to find their interested information in various web services such as Amazon, YouTube, and Google News. Various recommender systems, ranging from neighborhood-based, association-rule-based, matrix-factorization-based, to deep learning based, have been developed and deployed in industry. Among them, deep learning based recommender systems become increasingly popular due to their superior performance. In this work, we conduct the first systematic study on data poisoning attacks to deep learning based recommender systems. An attacker's goal is to manipulate a recommender system such that the attacker-chosen target items are recommended to many users. To achieve this goal, our attack injects fake users with carefully crafted ratings to a recommender system. Specifically, we formulate our attack as an optimization problem, such that the injected ratings would maximize the number of normal users to whom the target items are recommended. However, it is challenging to solve the optimization problem because it is a non-convex integer programming problem. To address the challenge, we develop multiple techniques to approximately solve the optimization problem. Our experimental results on three real-world datasets, including small and large datasets, show that our attack is effective and outperforms existing attacks. Moreover, we attempt to detect fake users via statistical analysis of the rating patterns of normal and fake users. Our results show that our attack is still effective and outperforms existing attacks even if such a detector is deployed.

I. INTRODUCTION

This paper studies poisoning attacks against deep learning recommender systems, where attackers inject crafted fake-user ratings to promote target items. It formulates the attack as an optimization problem, develops approximate solution techniques, and evaluates effectiveness against existing attacks and fake-user detection.

  • Motivation: Recommender systems mitigate information overload by using historical user-item interactions to personalize recommendations.They are widely deployed across shopping, news, music, and video services.
  • Threat: Data poisoning attacks inject fake users with crafted ratings so attacker-chosen target items reach many normal users.Such attacks threaten recommender-system trustworthiness and may manipulate Internet opinions.
  • Attack design: The attack maximizes target-item hit ratio under limits on fake users and rated items, making the formulation a non-convex integer optimization problem.Heuristics and a poison model are used because discrete inputs and repeated deep-network training make direct optimization difficult.
  • Evaluation: 5% fake users made unpopular target items recommended to about 52.6 times more normal users in Last.fm.On MovieLens-1M, the attack achieved hit ratio 0.0099 for random targets, about 1.2 times the best baseline hit ratio.
  • Detection: A detector falsely identified a large fraction, e.g. 30%, of the attack’s fake users as normal, leaving the attack effective and superior to existing attacks.The detector extracts rating features, trains a binary classifier, and removes detected fake users before recommender training.
  • Evaluation: The study evaluates the attack against existing attacks on three real-world datasets with different sizes.The datasets are MovieLens-100K, Last.fm, and MovieLens-1M.

II. BACKGROUND AND RELATED WORK

The paper situates deep learning recommender systems within collaborative filtering and distinguishes training-time data poisoning from testing-time profile pollution. It focuses on NeuMF, which combines matrix factorization and multilayer perceptron components to model nonlinear interactions.

  • Recommender systems: Collaborative filtering represents sparse historical user-item interactions in a user-item matrix and recommends highly ranked items for each user.Each row represents a user’s interaction or preference scores across items.
  • Recommender systems: Traditional recommender systems include neighborhood-based, association-rule-based, matrix-factorization-based, and graph-based approaches.Matrix factorization is described as widely used because of its performance and flexibility.
  • Deep learning recommendation: Deep learning recommender systems use neural-network structures to model user-item interactions and improve recommendation performance.Examples include multilayer perceptrons, autoencoders, adversarial networks, and deep reinforcement learning.
  • Neural Collaborative Filtering: Neural Collaborative Filtering models sophisticated nonlinear user-item interactions with deep neural networks rather than a simple linear interaction model.The paper uses NCF as its general deep learning recommender framework.
  • Neural Collaborative Filtering: NeuMF combines matrix factorization and multilayer perceptron models by learning separate embeddings and concatenating their final hidden layers.Its input uses one-hot encoded user and item vectors projected into dense latent vectors.
  • Attacks to recommender systems: Data poisoning attacks compromise training by injecting fake users with crafted ratings, whereas profile pollution attacks compromise testing by polluting user profiles.These are presented as two broad categories of recommender-system attacks.
  • Attacks to recommender systems: Profile pollution attacks rely on CSRF, limiting large-scale deployment, and cannot target item-to-item recommenders because item profiles cannot be polluted.These are identified as two key limitations of that attack category.

III. PROBLEM FORMULATION

The threat model limits an attacker’s injected users, rated items, and available knowledge, while the attack objective maximizes a target item’s top-K hit ratio. The resulting formulation is a constrained discrete optimization problem over fake-user ratings.

  • III. PROBLEM FORMULATION: The section introduces the threat model and formulates poisoning attacks as an optimization problem.The formulation concerns personalized recommender systems under an attacker’s resource and knowledge assumptions.
  • A. Threat Model: The attacker seeks to place a target item in as many normal users’ top-K recommendation lists as possible.The paper also notes that demoting a target item could be an alternative objective.
  • A. Threat Model: The attacker is assumed to access the user-item interaction matrix, which may be complete or partial, and may or may not know the recommender’s neural architecture.Public ratings on services such as Amazon and Yelp motivate the matrix-access assumption.
  • A. Threat Model: The attacker can inject at most m fake users, with each fake user rating the target item and up to n filler items.The filler-item limit is intended to help evade trivial detection based on unusually large profiles.
  • B. Formulating Attacks as an Optimization Problem: The target item’s hit ratio HR_t is the fraction of normal users receiving it in their top-K recommendation lists.Equivalently, HR_t indicates the probability that the target is recommended to a normal user.
  • B. Formulating Attacks as an Optimization Problem: Each fake user’s rating vector contains integer scores from 0 through r_max, where zero denotes an unrated item.Positive values represent the fake user’s preference score for an item.
  • B. Formulating Attacks as an Optimization Problem: The optimization maximizes HR_t subject to ||y(v)||0 ≤ n + 1 for every fake user and integer rating-score constraints.The constraint counts nonzero ratings, including the target item and filler items.

IV. ATTACK CONSTRUCTION: SOLVING THE OPTIMIZATION PROBLEM

The attack approximates an intractable non-convex integer optimization problem by relaxing ratings, approximating hit ratio with losses, and using heuristics to generate fake users. Its pipeline repeatedly trains a poison model and selects filler items until enough fake users are produced.

  • Attack pipeline: The overall pipeline approximates hit ratio, constructs a poison model, and repeatedly selects filler items using predicted rankings and selection probabilities.The second and third stages repeat until enough fake users are generated.
  • Optimization formulation: The original problem is computationally intractable because rating scores are discrete and the hit ratio is highly non-linear and non-differentiable.Deep neural-network training also makes repeated optimization iterations impractical.
  • Approximation techniques: The method transforms the problem into a tractable one by relaxing rating scores to continuous variables and replacing hit-ratio optimization with an approximate loss.Final scores can be projected into discrete integer ratings when necessary, and smaller loss roughly corresponds to higher hit ratio.
  • Approximation techniques: For each user, the loss promotes the target item when it is absent from the recommendation list and becomes zero when the target is already included under κ = 0.The parameter κ preserves a distance between the target and the lowest-rated recommended item.
  • Approximation techniques: The attack replaces the ℓ0 constraint with an ℓ2 norm to enable gradients and stepwise approximation, then limits filler items by selecting only a fixed number after optimization.The authors avoid ℓ1 regularization because it would reduce filler-item diversity.

C. Constructing the Poison Model

The poison model simulates the compromised deep-learning recommender system and is trained first for normal validity, then toward the attack objective using a combined loss.

  • Model construction: The poison model is constructed using the target system’s algorithm, training data, and an attack-derived loss function.Its purpose is to guide filler-item selection efficiently.
  • Model construction: The poison model’s internal structure and hyperparameters are consistent with the target recommender system, and its initial training dataset is identical.Fake users can then be inserted one by one to simulate attack results.
  • Poison-model objective: The combined loss balances normal model validity against the attack objective through λ > 0.L measures prediction validity, while G[by(v)] correlates with attack effectiveness.
  • Training procedure: During pre-training, the poison model uses the original recommender loss until it resembles a normally trained recommender system.This preserves validity before poison training begins.
  • Training procedure: During poison training, the model is repeatedly updated over all parameters with back-propagation using the combined attack loss.λ is initialized so validation loss and attack-effectiveness loss have roughly comparable magnitudes.

D. Selecting Filler Items

Filler items are selected from the poison model’s predicted ratings, adjusted by selection probabilities that reduce repetition and broaden item coverage. This process is repeated for each fake user.

  • Ranking-based selection: The final poison model predicts a rating-score vector for each fake user, and the highest-scoring non-target items are selected as filler items.The basic procedure selects the top-n items other than the target.
  • Selection probability: Sparse data and model randomness make recommendations unstable, so direct use of poison-model predictions may gradually deviate from the desired direction.The attack therefore introduces a selection-probability vector.
  • Selection probability: Selected items receive lower future selection probabilities through an attenuation coefficient δ, reducing repeated choices.The probability vector is initially set with all elements equal to 1.0 and can be reinitialized after the attack.
  • Iterative selection: The method combines predicted ratings with selection probabilities, chooses the top-n resulting scores, and updates probabilities after each fake user.This gives more candidate items opportunities to be selected and may build target-item correlations more broadly.
  • Iterative selection: Algorithm 1 repeats fake-user construction by initializing, pre-training, and poison-training the model before selecting filler items and updating selection probabilities.The algorithm takes the interaction matrix, target item, and parameters m, n, K, λ, η, and κ as inputs.
  • Iterative selection: The number of filler items may be fixed across fake users or added incrementally until the target item’s hit ratio begins to decrease.Filler ratings are generated from previously fitted normal distributions.

V. EXPERIMENTS

The experiments evaluate poisoning attacks on NeuMF using three real-world datasets, varied target-item choices, attack sizes, and recommendation metrics.

  • Datasets: Experiments use MovieLens-100K, MovieLens-1M, and Last.fm, spanning small and large datasets with explicit and implicit interactions.Last.fm is processed into 701 users, 1,594 items, and 36,626 ratings after binarization, deduplication, and filtering.
  • Target Recommender System: The target recommender system is Neural Matrix Factorization (NeuMF), a representative neural collaborative-filtering model.The experiments use NeuMF to evaluate attack effectiveness.
  • Baseline Attacks: The study compares the proposed attack with random, bandwagon, and matrix-factorization-based poisoning attacks.All attacks inject fake users, while their filler-item selection strategies differ.
  • Target Items: Target items include random items and unpopular items selected using dataset-specific rating-count thresholds.The experiments sample multiple instances of each target-item type.
  • Evaluation Metrics: Attack effectiveness is measured by HRt@K, the fraction of normal users whose top-K recommendation lists contain the target item.The study compares hit ratios before and after poisoning.
  • Parameter Setting: Unless otherwise stated, attacks inject fake users equal to 1% of normal users, select 30 filler items, and use K = 10.The parameter settings also specify κ, λ, η, and dataset-specific δ values.

B. Effectiveness of Poisoning Attacks

The proposed attack is evaluated under white-box conditions across datasets and parameter settings. It consistently outperforms baselines, while attack effectiveness varies with attack size, recommendation-list length, filler-item count, and δ.

  • Attack Size: 5% fake users increase the proposed attack’s ML-100K random-target hit ratio from 0.0034 at 0.5% poisoning to 0.0151.Increasing fake users causes target items to appear more frequently in the poisoned training data.
  • Attack Size: The proposed attack significantly outperforms baseline attacks across attack-size conditions and target-item settings.For ML-100K unpopular targets with 5% fake users, it achieves HR@10 = 0.0206, about 6.2 times the best baseline.
  • Dataset Effects: On Last.fm, 5% fake users make unpopular targets about 52.7 times more likely to be recommended than before poisoning.The corresponding increase for random targets is about 9.1 times.
  • Number of Recommended Items: When K = 20, the proposed attack reaches HR@K = 0.0061 on Music versus 0.0040 for the best existing attack.On ML-100K at K = 20, its hit ratio is about 6.0 times the best baseline.
  • Number of Recommended Items: The proposed attack’s ML-100K hit ratio at K = 20 is about 3.5 times its value at K = 5.Hit ratios generally increase as the recommendation list contains more items.
  • Number of Filler Items: Filler-item count need not improve effectiveness monotonically: on ML-100K, the proposed attack performs best at n = 20.It remains the strongest method across tested filler-item counts, including relatively small n.
  • Impact of δ: The proposed attack maintains diverse filler-item selections; on ML-100K, the most frequent filler item appears 13 times, about 1.4% of normal users.The smaller δ used for Music is reported to ensure better diversity there.
  • Impact of δ: For ML-100K random targets with 5% fake users, δ significantly affects effectiveness, with the best value around 0.9.Values below 1 outperform δ = 1 in the reported comparison, and the proposed attack wins in most cases.

C. Attacks with Partial Knowledge

The attack remains effective when the attacker has only partial knowledge of the training data, retaining performance close to the full-knowledge setting and exceeding baselines.

  • 0.0092 hit ratio is achieved with only 30% of the original rating matrix, compared with 0.0099 under full knowledge.
  • The attack outperforms the random attack’s 0.0069 hit ratio under partial rating knowledge.
  • With knowledge of only partial users’ ratings, the attack still outperforms baseline attacks and remains close to its full-knowledge performance.

D. Transferability

The attack transfers effectively when the target recommender system differs from the surrogate model, outperforming existing attacks across most evaluated situations.

  • The attack shows the best transferability in most situations compared with existing attacks.
  • 0.0150 hit ratio is achieved for random target items on ML-100K with a 5% attack size, about 1.6 times the best baseline.
  • 0.0184 hit ratio is reached for unpopular Music targets with 5% fake users, versus 0.0101 for the strongest existing attack.
  • 22.8 times and 5.5 times increases occur on Music and ML-100K random targets, respectively, at a 5% attack size.
  • The stronger increase on Music is attributed to its greater sparsity.
  • The attack’s transferability poses a greater threat to unknown target recommender systems.

VI. DETECTING FAKE USERS

The paper evaluates rating-pattern-based fake-user detection using statistical features and SVM-TIA, then measures both detector errors and attack effectiveness after filtering.

  • Rating-score detection distinguishes normal and fake users using statistical features extracted from users’ ratings.
  • The detector uses features including RDMA, WDA, WDMA, MeanVar, and FMTD to characterize rating-pattern differences.
  • SVM-TIA first filters suspicious users with an SVM, then identifies target items by counting extreme ratings.
  • The detector is designed for explicit datasets; Music is purely implicit, making these rating-based features zero and requiring other techniques.
  • On ML-100K, the detector’s FPR is around 12% and FNR around 30% for the proposed attack, allowing about 30% of fake users into training.
  • Attackers may evade detection by controlling item-selection frequencies or omitting target items by default while retaining attack effectiveness.
  • Certified robustness guarantees for classifiers do not directly apply because recommender systems output top-K item lists rather than single labels.

VII. CONCLUSION AND FUTURE WORK

The paper concludes that heuristic optimization makes poisoning attacks effective against deep learning recommender systems across knowledge settings and against rating-based detection.

  • The attack formulates poisoning against deep learning recommender systems as an optimization problem approximately solved with multiple heuristics.
  • Across three real-world datasets, the attack promotes target items to substantially more normal users and outperforms existing attacks.
  • The attack remains effective without access to the target architecture, with only partial user-item interaction data, and when a rating-based detector is deployed.
  • Future work includes stronger fake-user detection and recommender systems robust against data poisoning attacks.

APPENDIX

The appendix examines variability and coverage across target items as attack size changes. The proposed attack shows the largest standard deviations in most settings, while larger attack sizes promote more target items.

  • Standard deviations: Our attack has the highest standard deviations in most cases, indicating greater variation in target-item hit ratios.The passage attributes this to stronger overall promotion and faster increases for some target items than others.
  • Standard deviations: After injecting 5% fake users, every attack method has average hit ratios exceeding standard deviations for random target items on ML-100K.For the None setting, the average hit ratio is 0.0025 while the standard deviation is 0.0033.
  • Appendix analyses: The appendix reports standard deviations for different attacks and attack sizes and counts promoted target items under the same conditions.These analyses correspond to Tables X and XI.
  • Promoted target items: Small attack sizes do not promote all target items, but increasing the attack size promotes more items until all target items are promoted.Table XI reports the number of promoted target items for different attacks and attack sizes.
Loading 2101.02644v2…