PaperlayerView exact revision on arXiv

Source-linked AI summary

Knowledge-enhanced Black-box Attacks for Recommendations

Jingfan Chen, Wenqi Fan, Guanghui Zhu, Xiangyu Zhao, Chunfeng Yuan, Qing Li, Yihua Huang

arXiv:2207.10307v1cs.LGcs.AIcs.IR

TL;DR

DNN-based recommender systems are vulnerable to fake-profile attacks, but generating profiles under black-box constraints is challenging. KGAttack incorporates knowledge graphs into hierarchical policy networks and learns attack policies with deep reinforcement learning; experiments across real-world datasets and recommender types demonstrate effectiveness.

  • Problem

    Black-box attacks are practical under security and privacy constraints, but generating high-quality fake profiles is challenging and existing approaches have limitations.

    Source: §1 · p. 1

  • Method

    KGAttack uses item knowledge graphs in hierarchical policy networks and deep reinforcement learning to generate fake profiles for black-box attacks.

    Source: §1 · p. 2

  • Results

    Extensive experiments on three real-world datasets demonstrate the effectiveness of KGAttack under the black-box setting.

    Source: §6 · p. 9

  • Takeaways & Limitations

    Experiments cover NeuMF, Pinsage, and KGCN, and ablations support the effectiveness of the framework's designed components.

    Source: §6 · p. 9

    The work considers promotion attacks only; demotion attacks are left for future work.

    Source: §3 · p. 3

Abstract

from arXiv · show

Recent studies have shown that deep neural networks-based recommender systems are vulnerable to adversarial attacks, where attackers can inject carefully crafted fake user profiles (i.e., a set of items that fake users have interacted with) into a target recommender system to achieve malicious purposes, such as promote or demote a set of target items. Due to the security and privacy concerns, it is more practical to perform adversarial attacks under the black-box setting, where the architecture/parameters and training data of target systems cannot be easily accessed by attackers. However, generating high-quality fake user profiles under black-box setting is rather challenging with limited resources to target systems. To address this challenge, in this work, we introduce a novel strategy by leveraging items' attribute information (i.e., items' knowledge graph), which can be publicly accessible and provide rich auxiliary knowledge to enhance the generation of fake user profiles. More specifically, we propose a knowledge graph-enhanced black-box attacking framework (KGAttack) to effectively learn attacking policies through deep reinforcement learning techniques, in which knowledge graph is seamlessly integrated into hierarchical policy networks to generate fake user profiles for performing adversarial black-box attacks. Comprehensive experiments on various real-world datasets demonstrate the effectiveness of the proposed attacking framework under the black-box setting.

1 INTRODUCTION

DNN-based recommender systems are vulnerable to fake-profile attacks, while black-box constraints and limitations of existing approaches make profile generation challenging. KGAttack uses publicly accessible knowledge-graph relationships in a deep-reinforcement-learning framework with hierarchical policy networks, and experiments on real-world datasets demonstrate its effectiveness.

1 INTRODUCTION

  • DNN-based recommender systems are vulnerable to attackers injecting fake user profiles to promote or demote target items.A fake profile is a set of items with which a fake user has interacted.Source: §1 · p. 1
  • PoisonRec queries massive item sets, whereas CopyAttack relies on cross-domain profiles unavailable in general recommendation scenarios.The paper identifies both as limitations of existing black-box profile-generation approaches.Source: §1 · pp. 1–2
  • Black-box attacks are more practical than white- or grey-box attacks under privacy and security concerns, but knowledge-graph-guided attacks had been rarely explored.Black-box methods use query feedback without requiring full or partial access to the target system.Source: §1 · pp. 1–2
  • Knowledge-graph connections among items, including substitutes and complements, can guide fake profiles toward items related to a promotion target.The paper illustrates this with movies connected through attributes such as producers, actors, and genre.Source: §1 · p. 2
  • KGAttack integrates knowledge graphs into hierarchical policy networks and uses deep reinforcement learning to generate fake profiles for black-box attacks.Its proposed components include knowledge-enhanced state representation learning and candidate selection.Source: §1 · p. 2
  • Experiments on various real-world datasets demonstrate the effectiveness of KGAttack for black-box recommender attacks.The paper presents this as one of its main contributions.Source: §1 · p. 2

2 RELATED WORK

Prior recommender attacks include methods requiring access to target systems and data, alongside black-box methods that rely on extraction, query-based generation, or cross-domain profiles. KGAttack addresses limitations of these approaches by using publicly available item attributes as auxiliary knowledge in black-box attacks.

2 RELATED WORK

  • White- and grey-box methods use target-system or training-data access for gradient-based optimization or GAN-based profile generation.TripleAttack extends GANs to generate fake profiles using TripleGAN.Source: §2 · p. 2
  • Black-box approaches include extracting system data [37], PoisonRec's reinforcement-learning profile generation, and CopyAttack's copying of cross-domain profiles.CopyAttack uses deep reinforcement learning to copy rather than generate fake profiles.Source: §2 · pp. 2–3
  • KGAttack responds to prior methods' limitations by using publicly available item attributes as auxiliary knowledge for black-box profile generation.The paper describes seamlessly integrating knowledge graphs into black-box recommender attacks as its first such effort.Source: §2 · p. 3

3 PROBLEM DEFINATION

The paper defines user-item interactions, profiles, item knowledge graphs, and ranked recommendations, then frames promotion attacks as injecting fake users to increase a target item's presence in recommendation lists. Demotion attacks are left for future work.

3 PROBLEM DEFINATION

  • A user profile P_t is the set of t historical items the user interacted with, while a knowledge graph represents item attributes as entity-relation-entity triples.The passage gives a film-director triple as an example of a knowledge-graph fact.Source: §3 · p. 3
  • A recommender system predicts likely user-item interactions by producing a ranked list of top-k potential items.The ranking orders items by relative likelihood of user interaction.Source: §3 · p. 3
  • A promotion attack injects fake users under an attacker budget Δ to increase a target item's appearance in users' recommendation lists.The resulting interaction matrix and user set are described as polluted by the injected profiles.Source: §3 · p. 3
  • The paper considers promotion attacks only; demotion attacks are reserved for future work.Source: §3 · p. 3

4 THE PROPOSED FRAMEWORK

KGAttack uses knowledge-graph information and deep reinforcement learning to generate fake profiles for black-box recommender attacks. Its framework represents profile state, narrows item candidates, selects items hierarchically, and learns from query feedback.

4.1 An Overview of the Proposed Framework

  • KGAttack models profile generation as a black-box Markov decision process and uses actor–critic deep reinforcement learning to address large discrete action spaces and sparse rewards.The attacker seeks an optimal policy that maximizes expected cumulative reward.Source: §4.1 · pp. 3–4

4.2 Knowledge-enhanced State Representation Learning

  • The current fake profile, including the target item, is encoded as the state representation used by the policy network.The profile at step t is P_t = {v*, v_1, ..., v_(t−1)}.Source: §4.2 · p. 4

4.2.1 Knowledge-enhanced Item Representation

  • TransE initializes KG entity and item embeddings, relation-attentive GNN aggregation incorporates local neighbors, and a GRU encodes the resulting item sequence.The resulting state representation carries auxiliary knowledge about the target item from item attributes.Source: §4.2.1 · pp. 4–5

4.3 Knowledge-enhanced Candidate Selection

  • KGAttack extracts H-hop neighbors of an anchor item and collects a fixed-size candidate pool to localize relevant items and address sample efficiency.The selected candidates can share attributes such as substitute or complement relations.Source: §4.3 · p. 5

4.4 Hierarchical Policy Networks

  • Two policies first select an anchor from the profile and then pick an item from its candidate pool, while an anchor ratio balances target-item exploitation with policy exploration.A mask excludes invalid anchor positions in the dynamic action space.Source: §4.4 · p. 5

4.5 Injection Attack and Queries

  • After a generated profile reaches length T, it is injected and spy-user top-k recommendations provide hit-ratio feedback for policy optimization.The spy users may be a subset of normal users already established in the target system.Source: §4.5 · pp. 5–6

4.6 Model Training

  • PPO training generates N fake profiles in parallel, shares the obtained reward across their trajectories, and updates actor and critic networks from stored transitions.The item-picking actor is updated in the same way as the anchor actor, while the critic uses a temporal-difference approach.Source: §4.6 · p. 6

5 EXPERIMENTS

The experiments evaluate KGAttack on three real-world datasets across evasion and poisoning settings. Reported results favor KGAttack in most tested comparisons, while the benefit of KG-based sampling varies by dataset and target recommender.

5.2 Overall Attacking Performance Comparison

  • The experiments compare black-box attacking performance on PinSage and report findings for evasion and poisoning attacks.Source: §5 · p. 6, §5.2.1 · p. 6

5.1.1 Datasets.

  • The evaluation used MovieLens-1M, Book-Crossing, and Last.FM, with their knowledge graphs extracted from Microsoft Satori.The datasets cover movie, book, and music-listening interactions, respectively.Source: §5.1.1 · p. 6

5.1.2 Attacking Environment: Target Recommender System.

  • Evasion attacks targeted frozen PinSage, while poison attacks retrained NeuMF and KGCN on data injected with fake profiles.Source: §5.1.2 · p. 6

5.1.3 Baselines.

  • The seven baselines included random and target-item sampling, KG-neighbor sampling, PoisonRec variants, and KGAttack anchor-selection variants.PoisonRec is a black-box DRL baseline; its KG variant uses KG-enhanced item representations and constrains the RL action space.Source: §5.1.3 · p. 6

5.2.1 Evasion Attack (Pinsage).

  • RandomAttack showed no remarkable improvement over WithoutAttack on Pinsage, whereas TargetAttack significantly improved attacking performance by including the target item in profiles.Source: §5.2.1 · p. 6
  • Across black-box recommender systems, KGAttack achieved the best attacking performance in most cases under different metrics, except KGAttack-Target on HR@20; TargetAttack-KG beat TargetAttack on Book-Crossing and Last.FM, but not ML-1M.The authors suggest the ML-1M exception might be attributed to the large number of entities in its knowledge graph.Source: §5.2.1 · p. 7
  • DRL-based PoisonRec and KGAttack outperformed random-sampling methods, while KGAttack-Target outperformed KGAttack-Seq on Pinsage.The authors link the latter comparison to using the target item as an anchor to exploit its knowledge-graph neighbors.Source: §5.2.1 · p. 7

5.2.2 Poison Attack (KGCN and NeuMF).

  • KGAttack almost beat all baselines on KGCN and NeuMF, and its results support applicability to different recommender types.The reported NeuMF result also shows improved attacking performance under the black-box setting.Source: Figure 4 · p. 7, §5.2.2 · p. 7

5.3 Ablation Study

The section tests KGAttack’s component contributions and parameter choices, reporting benefits from knowledge-enhanced representations, candidate selection, and hierarchical anchor selection.

5.3 Ablation Study

  • Ablations associate KGAttack’s gains with knowledge-enhanced item representations, reduced candidate action spaces, and anchor-guided hierarchical selection.The representation components encode semantic correlations; candidate selection reduces the action space, while anchor selection guides candidate choice.Source: §5.3 · p. 8

5.4.1 Effect of anchor ratio.

  • Attack performance is better when the anchor ratio exceeds 0.5, but excessive target-item anchoring degrades performance.The results indicate a need to balance policy exploration with target-item exploitation.Source: §5.4.1 · p. 8, Table 3 · p. 8

5.4.2 Effect of hop number.

  • KGAttack performs best with H=3 on Book-Crossing and Last.FM, but with H=2 on ML-1M.The authors attribute the dataset difference to richer KG correlations in ML-1M, where larger H may introduce noise into item selection.Source: §5.4.2 · p. 8, Table 4 · p. 8

5.4.3 Effect of budget.

  • For Last.FM on Pinsage, KGAttack achieves the best performance most often when the fake-profile budget exceeds 30.The comparison varies the number of injected profiles and measures NDCG@20.Source: Figure 5 · p. 8, §5.4.3 · p. 8

6 CONCLUSION

KGAttack uses knowledge graphs and deep reinforcement learning to generate fake user profiles for black-box recommender attacks. Experiments across datasets and recommender systems report effectiveness, and ablations support the contribution of its designed components.

6 CONCLUSION

  • KGAttack integrates knowledge graphs into deep reinforcement learning and hierarchical policy networks to generate fake user profiles for black-box recommender attacks.Its components support state representation learning and attacking-strategy learning.Source: §6 · pp. 8–9
  • Experiments on three real-world datasets and Pinsage, NeuMF, and KGCN demonstrate the proposed method’s effectiveness under the black-box setting.The conclusion also reports that ablation studies demonstrate the effectiveness of the framework’s designed components.Source: §6 · p. 9

A.1 Statistics of Datasets

The appendix points to a table of basic statistics for the three datasets.

A.1 Statistics of Datasets

  • Table 5 summarizes basic statistics for the three datasets and defines item overlap with the knowledge graph and average H-hop neighbors.“# Items in KG” counts items appearing in both the graph and dataset; “Avg. H-hop NBR” is the average number of H-hop neighbors per item.Source: §A.1 · p. 10

A.2 Implementation Details

The implementation section describes the data split, evaluation protocol, and target-model configurations used in experiments.

A.2 Implementation Details

  • Each user’s last 30% of interacted items form the test set, while the remainder is used for training.The study evaluates ranking with HR@20, HR@10, NDCG@20, and NDCG@10.Source: §A.2 · p. 10
  • Attacks promote 10 target items with fewer than 10 interactions, using 50 spy users for reward training and 500 normal users for evaluation.The target item is checked in the top-k list among 100 sampled non-interacted test candidates; target-model feedback is queried every three injections.Source: §A.2 · p. 10
  • The final performance evaluation uses the same target recommender systems across baselines and shallow target models for efficiency.Table 5’s “# Items in KG” counts items shared by the knowledge graph and dataset; “Avg. H-hop NBR” gives average H-hop neighbors per item.Source: §A.2 · p. 10, Table 5 · p. 10
  • Pinsage uses 1,000 training epochs, while NeuMF and KGCN use dataset-specific settings of 5–20 epochs.Fake-profile lengths vary by model and dataset; for Pinsage and NeuMF they are 16 for ML-1M and Book-Crossing and 4 for Last.FM, while KGCN uses 16 and 8, respectively.Source: §A.2 · p. 10

A.3 Training Process of KGAttack

Algorithm 1 describes KGAttack training in two phases: trajectory generation and network updates.

A.3 Training Process of KGAttack

  • Training initializes the actor and critic networks and replay memory buffer D.Source: §A.3 · p. 10
  • During trajectory generation, the algorithm obtains the next state from the current state and v_t, together with reward r_t.Source: §A.3 · p. 10
  • For network updates, it samples transitions from D, minimizes the critic loss in Equation (2), and updates the actor networks via stochastic gradient ascent with Adam on Equation (13).The replay memory buffer is cleaned at the end of the listed process.Source: §A.3 · p. 10
Loading 2207.10307v1…