Data Poisoning Attacks on Factorization-Based Collaborative Filtering

By Bo Li, Yining Wang, Aarti Singh, Yevgeniy Vorobeychik. 2016

383 citations recorded by the source corpus.

Recommendation and collaborative filtering systems are important in modern information and e-commerce applications. As these systems are becoming increasingly popular in the industry, their outputs could affect business decision making, introducing incentives for an adversarial party to compromise the availability or integrity of such systems. We introduce a data poisoning attack on collaborative filtering systems. We demonstrate how a powerful attacker with full knowledge of the learner can generate malicious data so as to maximize his/her malicious objectives, while at the same time mimicking normal user behavior to avoid being detected. While the complete knowledge assumption seems extreme, it enables a robust assessment of the vulnerability of collaborative filtering schemes to highly motivated attacks. We present efficient solutions for two popular factorization-based collaborative filtering algorithms: the \emph{alternative minimization} formulation and the \emph{nuclear norm minimization} method. Finally, we test the effectiveness of our proposed algorithms on real-world data and discuss potential defensive strategies.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Recommender Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Recommender Systems

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Attacker’s goal: Like many studies on poisoning attacks [7, 8, 30, 33, 50, 62, 65], we consider an attacker’s goal is to manipulate the learnt global model such that it has a high error rate indiscriminately for testing examples.”
Data Poisoning against Differentially-Private Learners: Attacks and Defenses (2019, background): “In data poisoning attacks [2, 11, 14, 1, 13, 21, 15, 9, 23, 22], the adversary corrupts examples at training time to manipulate the learned model.”
Dataset Distillation (2018, neutral): “Compared to prior data poisoning attacks (Biggio et al., 2012; Li et al., 2016; Muñoz-González et al., 2017; Koh & Liang, 2017), our approach crucially does not require the poisoned training data to be stored and trained on repeatedly.”
Stronger data poisoning attacks break data sanitization defenses (2018, methodology): “(2012), and has subsequently been extended to linear and logistic regression (Mei and Zhu, 2015b), topic modeling (Mei and Zhu, 2015a), collaborative filtering (Li et al., 2016), and neural networks (Koh and Liang, 2017; Yang et al.”
Certified Defenses for Data Poisoning Attacks (2017, methodology): “…(Xiao et al., 2015a), clustering (Biggio et al., 2013; 2014c), PCA (Rubinstein et al., 2009), topic modeling (Mei and Zhu, 2015a), collaborative ﬁltering (Li et al., 2016), neural networks (Yang et al., 2017), and other models (Mozaffari-Kermani et al., 2015; Vuurens et al., 2011; Wang, 2016).”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “…have demonstrated that machine learning is vulnerable to adversarial examples [7,12,27,30,37,40,43,46,51,53,56, 68], poisoning attacks [8,18,31,38,67,70], privacy attacks for users (e.g., model inversion attacks [19,20], membership inference attacks [49,52], property inference attacks…”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam filters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2017, background): “Various studies have demonstrated poisoning attacks to spam filter [16], support vector machines [1], deep neural networks [20], and recommender systems [10, 24].”
Adversarial Attacks on Neural Networks for Graph Data (2018, background): “While (continuous) bilevel problems for attacks have been addressed in the past by gradient computation based on first-order KKT conditions [21, 24], such a solution is not possible in our case due to the data’s discreteness and the large number of parameters θ .”
Using Trusted Data to Train Deep Networks on Labels Corrupted by Severe Noise (2018, background): “Additionally, label corruption may arise in data poisoning [8, 22].”
Adversarial Attacks and Defences: A Survey (2018, background): “Bo Li et al [45] demonstrated poisoning attacks on collaborative filtering systems where an attacker, having complete knowledge of the learner, can generate malicious data to degrade the effectiveness of the system.”
A survey on adversarial attacks and defences (2021, background): “Bo Li et al. [48] demonstrated poisoning attacks on collaborative filtering systems where an attacker can generate malicious data to degrade the effectiveness of the system if he has the complete knowledge of the learner.”
Understanding Black-box Predictions via Influence Functions (2017, methodology): “Copyright 2017 by the author(s). point (Ribeiro et al., 2016) or by perturbing the test point to see how the prediction changes (Simonyan et al., 2013; Li et al., 2016b; Datta et al., 2016; Adler et al., 2016).”
Humpty Dumpty: Controlling Word Meanings via Corpus Poisoning (2020, positive): “Gradient-based poisoning attacks on matrix factorization have been suggested in the context of collaborative filtering [43] and adapted to unsupervised node embeddings [68].”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “The poisoning attack is a type of causative attack, which disrupts the availability and the integrity of machine learning models via injecting adversarial samples to the training data set [36], [37].”
Data Poisoning Attack against Unsupervised Node Embedding Methods (2018, background): “Moreover, poisoning attack has been demonstrated for matrix factorization problem (Li et al., 2016).”
Adversarial Attacks on Node Embeddings via Graph Poisoning (2018, background): “Lastly, since graphs are discrete, gradient-based approaches (Li et al., 2016; Mei & Zhu, 2015) for ﬁnding adversarial perturbations that were designed for continuous data are not well suited.”