Poisoning Attacks to Graph-Based Recommender Systems

By Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, Jia Liu. 2018

233 citations recorded by the source corpus.

Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning attacks, in which an attacker injects fake data to a recommender system such that the system makes recommendations as the attacker desires. However, these poisoning attacks are either agnostic to recommendation algorithms or optimized to recommender systems (e.g., association-rule-based or matrix-factorization-based recommender systems) that are not graph-based. Like association-rule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store (a big app store in China). However, how to design optimized poisoning attacks for graph-based recommender systems is still an open problem. In this work, we perform a systematic study on poisoning attacks to graph-based recommender systems. We consider an attacker's goal is to promote a target item to be recommended to as many users as possible. To achieve this goal, our a"acks inject fake users with carefully crafted rating scores to the recommender system. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. The key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning attacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our attacks and compare them with existing attacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and blackbox (recommendation algorithm is unknown) settings using two real-world datasets. Our results show that our attack is effective and outperforms existing attacks for graph-based recommender systems. For instance, when 1% of users are injected fake users, our attack can make a target item recommended to 580 times more normal users in certain scenarios.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems, Safety, Robustness & Interpretability, Recommender Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

In Safety, Robustness & Interpretability

In Recommender Systems

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “These attacks are also known as data poisoning attacks) [3, 8, 13, 19, 27, 30, 33, 43, 45, 50, 51, 56, 61, 62, 65].”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “However, existing studies [7,8,12,18,19,21,27,30, 31,37,38,40,43,46,49,51–53,56,60,61,67,68,70] on adversarial machine learning mainly focused on machine learning for non-graph data, with only a few studies [15,16,59,74] as exceptions.”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “One well-studied victim of training-only attacks is recommendation systems [15], [16],”
Poisoning Attack in Federated Learning using Generative Adversarial Nets (2019, background): “As one type of causative attack [9], [10], poisoning attack enables an attacker to manipulate partial training data with attacking labels to change the model parameters of the target learning model in training phase, and then the poisoned learning model would have some attacker expected properties t”
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping (2020, unknown): “[17], [25], [45], neural networks [11], [18], [27], [30], [36], [37], and graph-based methods [20], [41], [49], as well as distributed privacy-preserving data analytics [10], [14].”
Data Poisoning Attacks Against Federated Learning Systems (2020, background): “Poisoning attacks are highly relevant in domains such as spam ﬁltering [10,32], malware and network anomaly detection [11,24,39], disease diagnosis [29], computer vision [34], and recommender systems [15,54].”
PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning (2022, background): “Examples include recommender systems [19, 21, 27, 36, 60], federated analytics [7, 9, 10, 18, 20, 39, 58], search engines [33], as well as natural language models [47, 48].”
Adversarial Attack and Defense on Graph Data: A Survey (2018, methodology): “Attack Model GNN [8], [12], [17], [21], [23], [28], [73], [92], [93], [103], [106], [125], [145], [147] [20], [36], [42], [49], [67], [96], [97], [104], [120], [122], [134], [141], [146] Non-GNN [2], [18], [19], [24], [27], [33], [43], [50], [108], [109], [128], [129], [136], [143] [26], [34], [39] ”