Revisiting Injective Attacks on Recommender Systems
Authors: Haoyang LI
Shimin Di
Lei Chen
Venue: NeurIPS 2022 Accept (2022)
Keywords: Recommender system
Injective Attacks
Poisoning Attack

Abstract: Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks.
Given a limited fake user budget, attackers can inject fake users with carefully designed behaviors into the open platforms, making RecSys recommend a target item to more real users for profits. In this paper, we first revisit existing attackers and reveal that they suffer from the difficulty-agnostic and diversity-deficit issues. Existing attackers concentrate their efforts on difficult users who have low tendencies toward the target item, thus reducing their effectiveness. Moreover, they are incapable of affecting the target RecSys to recommend the target item to real users in a diverse manner, because their generated fake user behaviors are dominated  by large communities. To alleviate these two issues, we propose a difficulty and diversity aware attacker, namely DADA. We design the difficulty-aware and diversity-aware objectives to enable easy users from various communities to contribute more weights when optimizing attackers. By incorporating these two objectives, the proposed attacker DADA can concentrate on easy users while also affecting a broader range of real users simultaneously, thereby boosting the effectiveness. Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.

Revisiting Injective Attacks on Recommender Systems
Haoyang LI', Shimin DI Lei CHEN2
Computer Science and Engineering, HKUST, Hong Kong, China Data Science and Analytics, HKUST(GZ), Guangzhou, China {hlicg, sdiaa, leicee)/ccceee.e.... ust.hk
Abstract
Recent studies have demonstrated that recommender systems (RecSys) are vulnera- ble to injective attacks. Given limited fake user budget, attackers can inject fake users with carefully designed behaviors into the open platforms, making RecSys recommend target item to more real users for profits. In this paper, we first revisit existing attackers and reveal that they suffer from the difficulty-agnostic and diversity-defie issues. Existing attackers concentrate their efforts difficult users who have low tendencies toward the target item, thus reducing their effecctiveness. Moreover, they incapable of affecting the target RecSys to recommend the target item to real users in a diverse manner, because their generated fake user behaviors are dominated by large communities. To alleviate these issues, we propose a difficulty and diversity aware attacker, namely DADA. We design the difficulty-aware and diversity-awar objectives to enable easy users from various communities to contribute more weights when optimizing attackers. By incorpo- rating these two objectives, the proposed attacker DADA can concentrate on easy users while also affecting broader range of real users simultaneously, thereby boosting the effectiveness. Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.
introduction
key component to help users locate items that they may be interested in. Generally. given the user behaviors, such as item purchase history and movie viewing history, RecSys learn the latent tendency of users regarding each item, and then recommend the top-N matched items for each user. Over the past decade, various RecSys have been proposed to provide services for users. Recent studies [17] 24 33 45 51)
In the era of big data, recommender systems (RecSys) 8 28
36 39
53
demonstrate that RecSys are vulnerable to adversarial attacks, e.g., fake user behaviors. It is because the training of RecSys relies on user behaviors and attackers can easily inject fake users into open- world web platforms. Specifically, attackers want to promote an item to real users, which can increase the opportunity that users purchase this target item and thus bring economic profits. To achieve such goals, attackers generally inject limited number of fake users with designed behaviors, i.e., injective attacks. Then, the target RecSys may be affected with these injected fake users, and then recommends the target item into the top-N item list of real users.
Based on the techniques that employed design the behaviors of injected fake users, existing [TT
attackers [
6 [TC 12
20
6U 38
49)
52
can be classified into three types: heuristies-
based 4 30 29], neural network-based [10]
38
45
52 and gradient-based attackers (6) 1
20. 41 51. Heuristics-baset attackers 4
30 49 sample popular items together with the target
item as the behaviors of each fake user to increase the co-occurrence between popular items and the target item, i.e., trying to increase the popularity of the target item. Then, RecSys can be affected,
"Corresponding author
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

and will recommend the target item to more users. However, such a way does not directly optimize the attack objective, reducing the effectiveness of attackers 52]. Instead, neural network- attackers [1O. 38 45 [52] utilize neural networks to generate influential fake user behaviors. They maximize the attack objective by optimizing the parameters of neural networks. Gradient-based attackers G 11 12 20 41 51 adopt the continuous relaxation to project user behaviors from the discrete space into the continuous space, This enables attackers to parameterize the fake user behaviors and maximize the attack objective by optimizing them with gradients.
Though existing attackers can achieve reasonably good attacking performance. they still suffer from two crucial issues from the local and global views: difficulty-gnoosti and diversity-defiet First, existing attackers do not consider the promotion difficulty of each user regarding the target item. Particularly, users who have a higher (resp. lower) tendency toward the target item are referred to easier (resp. more difficult) users. According to the formulated attack objective of existing attackers, difficult users will contribute more weights to optimize attackers' parameters, e.g., neural network parameters for generating fake users. It makes attackers put more efforts to recommend the target item to difficult users. However, the RecSys platforms will usually monitor the user registration, i.e. attackers only have very limited budget for generating fake users. Thus, attackers that focus on difficult users may only achieve small attacking gain, i.e., the target item can only be recommended to a small number of users. Second, the generated fake behaviors of existing attackers cannot influence real users diversely. Specifically, real users with different preferences are dispersed into different communities. Communities with more users may dominate the optimization of attackers. Consequently, the generated fake users cannot affect RecSys to promote the target item to various communities, decreasing the effectiveness of attackers.
To address
and diversity-defcii issues, we propose Difficulty-Aware and Diversity-Awar attacker, namely DADA, which takes the promotion difficulty and diversity into consideration simultaneously. First, to handle the difficulty-agnoste difficulty- aawae objective that more emphasizes easier users than difficult users when optimizing attack parameters. Moreover, we propose diversity- attack objective that allows the generated fake user behaviors to affect the target RecSys to recommend the target item to real users diversely, thereby avoiding the diversity- deffcct issue. By incorporating both attack objectives, attacker DADA can concentrate on easy users and generate fake user behaviors that are capable of affecting real users in diverse manner. Overall, our contributions summarized as follows:
issue, we propose novel
proposed
We revisit attackers on RecSys and reveal that existing attackers suffer from difficull-agnostic and diversity-defici issues. More specifically, the objective designs in existing attackers make them more focus on promoting the target item to those difficult users in the dominant community. However, it is hard to handle difficult users with only a limited number of generated fake users. Besides, the generated fake users tend to fall into the dominant community, which not helpful to affect real users in other communities.
We propose two novel attack objectives (difficult--ware and diversity- objectives) that force the RecSys attacker to attack easy users distributed various communities. Generally, the proposed objectives could enable the easy users and unaffected real users to contribute more weights when optimizing the parameters of the RecSys attacker.
Experiments on three real-world datasets demonstrate that the proposed attacker DADA achieves superior performance compared with sfte--of-the-at attackers. Besides, extensive experiments show that the generated fake users indeed focus on easy users in a diverse way.
2 Related Work
Formally, let U and 7 denote users and items, respectively. R E {0. 1 denotes the records of user-item interactions. Specifically, each entry R [u] denotes whether the user u E U interacts with the item E I, and I, = {i: R(u = 1} denotes the interacted item set of each user u E U.
2.1 Recommender System
Recently, various RecSys 47 48 have been proposed and deployed in the website applications, which recommend the items for users that match the preference of users. Formally, given users U. items 1, and user behaviors R e {0, 101x|11 RecSys Ma learns the latent tendency score

---

Table 1: Summary of existing RecSys attackers. v and x indicate that the attacker can and cannot satisfy the property, respectively. is the target item that attackers are interested in. The function [[R[u]tt, R(w](() = if both R[u][i] = and R [M] = 1, and g(x) = b, b, and by are hyperparameters, and and c constants. S' and S are learned tendency before and after attacks, respectively. We discuss them in detail in Sec. 2.2
Attuck Objective
Type
Attacker
Catt Formolation
Diftienity
Diversity
Heuristic: bused
Popular 29
CoVis [9
Lier
R RO
x
PuisonRec X
x
X
Neural network-bbsed
Copy 10
x
TrialAttakk 45
2ruger 2rigr,
[n S(u
x
PGA 120
Zuur S.u
x
SGLD 20
2weet S
x
SRWA
x
Gradient-based
TNA 101
2 Luccur 2.r (S[uu] S(u((()
x
PAPU [1
Lmeer Zier, 9[ Sp
x
RevAdv 41
Lucor log(
Zist Sxp
x
Σ Eucura CTT, log(1 by ((
DADA (Ours)
+h.o(b2 * (S)u)) s' [w]l -e)
V
== (R) UXxl between users and items. The parameters 0 can be optimized as follows:
arg min Lira
(I)
where (MM- (R),R) measures the training loss of RecSys model Mg based latent tendency S and user behaviors R. Then, based on the learned tendency S, the RecSys MM recommends the top-N un-interacted items I', with the highest lendency scores for each user u E U, i... I. C CL\A Lu and [r', = N. Generally, current RecSys can be classified into three categories, i.e., neighborhood-
[T5] 50 Take the fundamental mmatrix-factorization RecSys WRMF [18] as an example, it maps users U and items I into latent representations U E TR Ux)x and I E TR !||xd= respectively. Then, it predicts the tendency "IT between users and items. Particularly, WRMF takes {U. [} as the parameter and refor- mulates Eq. ( into arg (un)= Eneuier Wes ( (S[u][i] R[u](t)²² + 7(| + [[])). where || |l2 is the la norm distance, Wai is the weight hyperparamter to differentiate the existing and un-existing interactions, and 7) is regularization hyperparameter. More details of recommender systems can be referred to comprehensive surveys 47
based 27 35
fanrriiiaattoiztiion--oo based [88] 32], and neural-network-boee -based
2.2 Injective Attacks Recommender System
Given a target item that attackers are interested in, attackers can inject fake users with carefully crafted behaviors into platforms. The attacker's goal is to affect the RecSys to promote the target item into the top-N recommendation item list of as many real users as possible. Note that attackers can also demote a target item, i.e., maximizing the number of real users whose top-N recommendation list does not include the target item. In this paper, we focus on promotion, because attacks for demotion
can be constructed by a similar technique as promotion [10 12 38 (2,52
Formally, let U and U denote real users and fake users, respectively. Given the real user behaviors R E {0, 1} |0111, the target item I, and the target RecSys model Ma, the goal is to generate the fake user data R/ E {0, 1 x|4| with the constraints, injection budget |U'| < å and the maximum number || R [w]]lo S r of items that each fake user can interact with, which can maximize the attack objective as follows:
max O (M (R); UR);U" ,),
RJ
s.t. 8" = arg min Cira (Mo R), s [R S T for any U..
#
where Outk (.) is the attack objective, Lira()) is the training loss of RecSys Mo as Eq. T. and R"
R
E {0, (001)11000100000011 is matrix concatenation. Based on this formulation, various
R/
attackers against RecSys are mainly different from three aspects: (1). The formulation of the attack objective Oaxi (2). Technique used to optimize Eq. (2); (3). Knowledge accessed by attackers.
3

---

Formulation of Oatk. Hit ratio [10. 38 is a common formulation, i.e., (.t [T Euerre I[tt, Fu), where indicator I(t. of u, i... 1 E a. Also, several attackers | 12 tendency between real users and the target item, and propose several attack objective variants. The objective details of these attackers are listed in Tab For clarification, we specifically list the part of the attack objective that is related to the learned latent tendency S between real users U" and items i E I, and omit unrelated parts, such as the regularization of attacker neural network parameters. Note that several attackers [1 [5] try minimize the attack loss Latk- For generality, we set their attack objective Oatk Lath and use two notations interchangeably in this paper.
is recommended in the top-N item list
20
41
51 5 try to maximize the latent 45
Technique. It is non-trivial task to generate the exact optimal fake user behaviors R/ that can achieve the maximum attack objective due the exponential candidate search space, i.e., 0(11)-111)))
As shown in Tab. 1 regarding the technique that generates behaviors for injected fake users, there are three types of attackers: heuristics-based. neural nelwork-based, and gradient-bused attackers. As introduced in Sec. [ heuristics-brre bbaiic attackers [4, (30] [4) cannot cover various behavior patterns and do not directly optimize the attack objective, leading to unsatisfied performance [52 Instead, neural network- based attackers [10, 38 (5]551 propose neural networks A,p parameterized with yp to learn probability distributions of selected items for each fake user. Then, they sample fake user be- haviors R ~ Ap(R. accordingly. Formally, the parameter yp can be optimized by maximizing the attack objective as max,,,0 (R (aar))OOttk (atte(Moo (R); U")]). Besides, gradient- based attackers
A 6 20 5D relax the discrete fake user behaviors into continuous R RRIL1XII [x|], Then, they directly parameterize R and maximize attack objective as maxiu,e ,e Oatk (MM UR) t)-
After finishing the optimization of R they use a projector function to project the continuous user behaviors R into discrete fake behaviors R..
In this paper, we design gradient-based based attacker generate fake user behaviors. For generality, use up denote the parameterized R/. Specifically, existing gradient-basse attackers A use gradient ascent approach [34] to optimize by maximizing the attack objective (-) as follows
80 OER U.);
s -
p
Σ NEU
(3)
where a is the learning rate, and Outh (Ma- (R); t) denotes the objective value of user regarding the target item t. Particularly, when user u provides more gradients @M.xx(Mp (R)vv.t) to optimize parameter yo, the attacker will prioritize maximizing the user's objective. For simplicity, we use Oan(U" t) and Oack (u, t) to denote Oau (R): U", t) and Oas (R); u, t), respectively.
dep
Knowledge. Regarding the knowledge accessed by attackers, existing attackers can be classified into two categories. White-box attackers [1] 20 take real user behaviors and the target ReeSys parameters as inputs to generate fake user behaviors. Unlike white-box attackers, gray-box attack- assume that the target RecSys parameters are inaccessible. Instead, the first type of gray-box attackers [10 38 assume that the top-N item lists of real users recommended
ers 10 38
45
51 (2)
by the target RecSys are available. Also, the second type of gray-box attackers 41 45
51 52) only
access user behaviors and use a surrogate RecSys MM to replace the target RecSys Me in Eq. (2). which is expected to mimic the target RecSys. In summary, the second type of gray-box attackers are more realistic than white-box and the first type of gray-box. The reason is that the target RecSys parameters and the recommendation lists of real users are difficult to obtain. Instead, due to the openness of web platforms, it is easy to collect real user behaviors [41] such as movie viewing history. More discussions on user behavior collection can be referred Appx. B.5. Thus, we focus on the second type of gray-box attacks on RecSys in this paper.
3 DADA Attacker
In this section, we introduce our attacker DADA. We first propose two attack objectives that consider the promotion difficulty and the diversity of users, respectively. Then, we formulate a novel difficulty and diversity-aware attack objective that enables our attacker DADA to simultaneously focus on easy users and affect real users diversely, and propose efficient greedy-based algorithm to optimize it.

---

Eey
<14
1.0
43
43
12345 22000/0aa
12255N 1EROUNRRAA
(a) Average gradient on (b) HR@ @50 on each user (c) Fake user distribution on (d) HR @5 on cach commu- nity.
cach user group.
group.
cach community.
Figure I: Difficult--agnostei and diversity-deficit analysis.
3.1 Difficulty-aware Attack Objective
3.1.1 Motivational Observations of Difficulty-agnosic
As discussed in Sec. given a target item and a set of real users, existing RecSys attackers more focus promoting the target item to difficult users when designing fake user behaviors. We first demonstrate several motivational observations in existing works. Specifically, we employ the representative and state-of-the-arr gradient- attackers, including RevAdv [11), TNA [ and PAPU [5T, to inject fake users into the ML-100K dataset [144, where fake user budget & = 0.01|U7"|. Specifically,
use the representative RecSys WRMF [18] as the target RecSys Ma for evaluation. We first train WRMF on ML-100K without attacks, and output the latent tendency between each user u U and each item I. We then randomly select an item the target item. For simplicity and clarification, we separate real users into three groups as an example. Specifically, if the latent tendency of user u toward the target item S(u][(] is at the top of (33.3%, 33.3% ~ 66.7%, 66.7% ~ 100%} largest among all items I, it will be regarded as {casy, medium, dif f ficult) users, respectively. Then, we can obtain three groups {Ue, U Ud..
I as
For clarification, we show the result of RevAdv in Fig. and similar results of TNA and PAPU in Appx. A.I.1 For each group U {Ue, Um Ud), J. we show its average gradient for optimizing the attacker parameter & in Fig. (a), i.e., Enevy |V VV,aas(a,))] We can easily observe that the gradient value is directly proportional to the degree of difficulty. In other words, the more difficult it is, the greater gradient it is. It indicates that RevAdv puts more efforts to promote the target item to difficult and medium users than easy users. Then, we investigate the hit ratio of 50 (HR 50) performance on three different user groups. As illustrated in Fig. T (b), despite that RevAdv puts more effort on medium and difficult users, the HR 50 of them is only marginally improved. Moreover, putting more effort medium and difficult users leads that the HR @ 550 of easy users increases unstably. Therefore, with a limited budget for fake users, is preferable to concentrate on easy users, as is easier to promote the target item for them.
[00)-((U7))11)))
3.1.2 Insights Diffieulty-agnostic Issue
Motivated by the observations, we plan to design a new difficulty-aware attack objective, which enables attackers to focus on easy users primarily and achieve more recommendation gain. The basic idea is to let easier users outweigh difficult users when optimizing the attacker's parameter yp As introduced in Eq. 33) the gradients for optimizing attack parameter y that each user provides are related the attack objective Oark. Particularly, due to the chain rule, the gradients (0.r)(u.)) of Bip
each user u E U can be formulated as (0.))(u.t) (0.t) aS[w][t]
0e where 80 (0. only [S[w]]]]
0G
aS[w]4]
relates to the attacker objective design. as[u][t] only relies on the attacker parameters, which is fixed 0'p and unrelated to attack objective (.) Thus, we can increase the a0..(u.t) of easier user to let []][[]]]
them more determine the optimization direction of attacker parameters. Besides, if user has received the target item in the top-N recommendation list, it indicates that the RecSys has promoted the target item to this user successfully. Thus, this user should not provide any gradient, because increasing its tendency toward the target item will not have any improvement on the recommendation gain.
Based on the above analysis, the difficulty- properties: (1) given two users u and v, if the tendency score S[u][t] < S(u][t] and t & T.,
attack objective should satisfy two difficulty
(0.. (0..nlu..) (2) if the target item t E l'u. (Q.1) = 0. As shown in Tab. I the attack d
objectives of existing attackers do not satisfy both properties simultancously. In this paper, based on the two properties, we formulate difficulty-aware attack objective. Formally, given the tendency $
5

---

learned by the surrogate RecSys Mg. the target item t, the difficulty- attack objective regarding each real user u E U formulated as follows:
Dict(Mg. uR 1) [-oog(1
log(1 - b. S[u][t), I'.. LET.
(4)
0,
where bj is positive hyperparameter. Furthermore, Eq. 4 enables easier users to more dominate the the attack parameter optimization than difficult users. Due space limit, we put the proof in Appx. A.2.1
the following Proposition 1 to show that
Proposition 1. Our difficulty- attack objective satisfies difficulty property I and property 2.
3.2 Daver Attack Objective
3.2.1 Motivational Observations of Diversity-deficit
As introduced in Sec. I existing attackers have the diversity-deficit issue that the generated fake behaviors are dominated by large communities, where users each community have similar prefer- ences. Specifically, as introduced in Eq. (3), each real user E U will provide gradients optimize the attackers' parameters şp Since similar real users have similar preferences on items, real users can form several communities }= where each community Cj has n, real users. Thus, from the community perspective, the optimization process of the attacker parameter ip via maximizing the at- tack objective (-t can be reformulated as follows: &p 4 + Σ)= Euec, 80 (MM. (R)a..)
dep Intuitively, users in the same community who are similar will give the gradients in similar directions. Thus, there a potential risk that the large communities C₁ will dominate the optimization direction of attacker parameter & via Σvec. a0.t (R):a.t) Consequently, this community will dominate Bi
the generated fake user behaviors. The generated fake user behaviors can only manipulate the target RecSys to promote the target item to the dominated communities. In another words, the target RecSys is incapable of promoting the target item to more users in other communities diversely.
Similar to Sec. 3.I.I. we demonstrate several motivational observations. We use state-of-the aftt gradient-based attackers RevAdv 41, TNA [[]] and PAPU [S]], and neural network-basee attacker TrialAttack [5]] generate 0.05 [ fake users and inject them into the ML-100K dataset [T.. Then, we train the target RecSys WRMF and study the attacking results. For simplicity and clarification, we put the result of Rev in Fig. and similar results of TNA, PAPU, and TrialAttack in Appx. A. Following [11. we extract the representations of real and fake users learned by WRMF, and use PCA 0 to visualize them. Based on the result of PCA, we separate real users into three communities by KMeans [19] As shown in Fig. (c), the fake users (blue points) tend to form cluster that is distributed in the community (yellow points). indicates that community dominates the generated fake users. It is because users in the same community will generate gradients with similar directions. Thus, large communities with more users are more likely to dominate the optimization directions of the attacker parameter. Consequently, RecSys can only be affected by the generated fake user behaviors to recommend the target item to more users in the community 1.
To further verify this, we list the hit ratio 50 (HR @ 50) of each community before and after injecting fake users in Fig. (d). It shows that the generated fake users improve the HR@50 @50 of the community I significantly. while maintaining similar HR @ 50 in the other two communities. To enable Rev Adv to affect users diversely, we add our formulated diversity-awan attack objective (see See. 3.2.2) into RevAdy's objective. As shown in Fig. (d), Rev Adve+ie improves HR @50 of community 2 and 3. Particularly, @R@50 @ 50 on community increases as well. As described in Sec. 3.I.T Adv more focuses on difficult users, thus the generated fake user behaviors may not be able to affect the target RecSys to recommend the target item to other less difficult users in community 1. Fortunately, the diverse-aware objective allows RevAdy to put more efforts on these users, thereby improving the performance of community 1.
3.2.2 Insights on Diversity-deficit Issue
Motivated by these observations, we propose a diversity-awand aware attack objective that enables fake user behaviors to affect real users diversely. The basic idea that if the real users are less affected by fake user behavior, the diversity-aware objective will concentrate on these real users in the subsequent gradient computation process. Then, the attacker will be optimized to generate fake user behaviors that can affect these users. In such a way, users in different communities can be affected diversely.

---

Specifically, the influence of fake user behaviors on each user regarding the target item can be measured by the difference between tendencies before and after attacks. Formally, let S' and S denote the tendencies learned by RecSys MM before and after attacks, the influence of fake user behaviors R/ on user u regarding the target item computed by AS [t] = Slu]( - ['[u] [t] To enable attackers to affect more real users, the attack objective should focus users with smaller A.S/u](
when optimizing the attacker parameter yp Specifically, according the chain rule and dASjuld
05
the gradients (0rx)(u.)) regarding the attacker parameter yp in Eq. of each user u E U can be formulated as (0.u((.tt
(
dep Thus, we can increase the (Qau(())) of real users a to let them more determine the attacker parameter optimization
de
with smaller influence AS Su|
direction. Similar to Sec. [3..2] the liversity-wwar attacker objective should satisfy two diversity
properties: (1) given two users and if AS
AS[u][t], and tt & Tu.. 04S 04S(u]le
(v.a(v,t) a0.
(2) if the target item has been recommended to user u, the user should have effect on the 80ark(u,)) attackers' parameter optimization, i.e., if E Tu. 8AS(m[[t
Obviously, existing attackers do not satisfy both properties because they do not consider the difference of tendency between before and after attacks. Based on the two properties, we formulate a diversity- aware attack objective. Formally, given the target item t, and the real user u E U let S' and ô denote the tendencies learned by the surrogate RecSys Ma before and after injecting fake user behaviors R/, the diversity-aware objective on each user E U regarding the target item t is computed as:
[bbb * (Stu]l - S'jul((] - c)). 1 F.
Diu (S( [u] 4, S' [w][()
(5)
o.
t EET.
where min ($ |1 - $'1: (1])) is constant for normalization, and by is positive hyperpa- rameter to scale the tendency difference. (x)) = I+exp(-2) is the Sigmoid funetion. Additionally, we use Proposition
show that Eq. ( enables users with a smaller AS [[][t] to contribute more weights to the attack parameter optimization. Due to space limit, we put the proof in Appx. AA222
Proposition 2. Our diversity-aware attack objective satisfies diversity property and property
3.3
Difficulty and Diversity Aware Attacker
3.3.1 Problem Formulation
Based on two measurements proposed in Eq. 4 and Eq. (5), we formally formulate the Difficulty- Aware and Diversity-Aware (DADA) RecSys attacking problem as follows.
Definition 1 (DADA Problem). Given the real user behaviors R E {0, 111""((11), the target item t, and the surrogate RecSys Mg. the goal is to generate the fake user behaviors R/ E {0, 13.1 1311/ x( with the constraints, injection budget | S and the maximum number [|R[u]]lo S of items that each fake user can interact with, which can maximize the attack objective as follows:
max Σ Dict(M uR) (R): R/
Div(S(u)) u, (u[[((
(6)
NEt*
s.t. = min Lira Mg R). R), |0 S 6, [R[ulllo S T for any U$,
#
where X trade-off hyperparanter. E {0, 11 [xX1 concatenates the real and fake user representations, S and S' are the learned latent tendencies of the surrogate RecSys Mú on R and RJ, respectively. L-ra(-) is the training loss of Mg as in Eq. I..
3.3.2 Greedy Algorithm
Due to the exponential search space =((7)=- it is nontrivial to find the exact optimal fake user behaviors for the difficulty-awarr and diversity- optimization problem in Eq (6) Thus, we propose mradient-based greedy algorithm to maximize the objective in Alg D in Appx. A.3, With the help of gradients, our algorithm can give a good direction to find effective fake user behaviors. Specifically, we first initialize the fake user behaviors R/ E {0, 1x17 (line 1). In each epoch I, we first train the surrogate model M, R, and then compute the attack objective O.r in
7

---

Eq. 66 (line 4-5). Second, we relax the discrete fake user behaviors R into continuous one R E R RRMMIII x and take it attacker's parameter yp (line 6). Then, we compute the gradients VR according [41] (line 7). Finally, we update the R/ and utilize projector to map into discrete hehaviors R.,, where each fake user can select items most (line 8). Formally, given the continuous user behaviors R/, the maximum number of items that each fake user u E U can interact with, and the pre-defined threshold th, the projector is formulated as follows:
0. R [u] | th th
Proj (R ;T, th)
1, R [ thAiE
where P. is top-7 largest item set of user u according to the value in R [u]. After finishing L epochs, output R/ for injection. We analyze the time complexity of Alg. in Appx. A.4
4 Experiments
4.1 Experiment Setting
Datasets. We evaluate our attacker widely used three real-world datasets: MovieLens- 100K (MI-100K) [14), MovieL.nnsIIM (MI-1M) [14), and Gowalla [5]. We put the descriptions of three datasets in Appx. B.1 B.
Attacker Baselines. To verify the effectiveness of our proposed attacker, we compare our proposed attacker DADA with the three types of attackers in Tab. [ Specifically, heuristic-bused attackers in-
clude Random 12 51 and Popular 29 51, neural network-based attackers include TrialAttack 45
and gradient-based attackers include CoVis [4]]. PGA (20). SGLD 20). SRWA [12), TNA [1
RevAdv [41] and PAPU [51]. Particularly, we do not compare PoisonRec (8 and CopyAttack [T0]
in Tab. because they need to access the predictions of the target RecSys for real users. Also,
we compare two variants: DADA-DICT and DADA-DIV, which only optimize the difficulty and
diversity-aware objective in Eq. and Eq. (5), respectively.
Targeted Recommender Systems. Following 44 51] we choose three representative target Rec- Sys to evaluate the attacking performance of RecSys attackers, i.e.. matrix fictorization-based WRMF [8], neural network-based NCF [6], and graph neural network-based LightGCN [15].
Target Items and Evaluation Metric. Following 41 51, we uniformly sample 5 items as a target item set I, and measure the hit ratio Hit@N of 1, on the real users U". If one of these target items appears the top-N recommended item list of a user u. E U", the target item set considered as hit. Besides, we use the Normalized Discounted Cumulative Gain (NDCG) to measure the rank quality of the target items in the recommendation list. Specifically, we set the relevance score of target items and the other items for all real users I and O, respectively. Then, higher NDCG value indicates better attack performance, where target items are ranked higher in the recommendation list. The reported results are averaged over five different runs.
Hyperparamter Setting. Due datasets with different sizes, we set the fake user budget 8 31 | and the maximum number of selected items 3 17), where 31 and 82 are the parameters to control 8 and т. For default, we set 31 = 0.01 for all datasets. For unnoticeable, we set the default r to be similar to the average number of interacted items of real users as shown in Tab. 4 ie.. B3 is (0.05, 0.05, 0.002] for ML-100K, ML-IM, and Gowalla, respectively. The details about hyper-parameter settings are listed in Appx. B.2
4.2 Experiment Results
We report the HR performance of attackers ML-100K and ML-1M in Tab. and Tab. To better show the improvement, we add the improvement ratio of HR @ 10 for each attacker compared with the result in clean data. Due space limit, report similar results of Gowalla in Appx. B.3 We report the NDCG results on three datasets in Appx. B.4 Under the same target RecSys, the bold and underlined numbers indicate the first and second best performance, respectively.
Baseline Comparison. As shown in Tab. 2 and Tab. 3 our attacker DADA outperforms baselines under different target RecSys on both ML-100K and ML- IM datasets. Specifically, heuristics-basee
8

---

Table 2: Evaluation on ML-100K dataset under fake user budget 5 = 0.01|U*)
WRMF
[8
NCF [G]
LightGCN [5]]
Attacker
HR
50
H 100
HR
HRO 50
HR 100
HR 10
HR
HR 100
Clean
0,0901
0.3606
0.5677
0,1094
0.4799
0.7462
0,0977
0,3813
0.7941
Random 1 L2
0.0907
(-0.67%)
0.3701
0.5536
0.1134
(43.66%)
0.5031
0,7511
0.0987
(=1.02%)
0.3887
0.7824
Popular
20
0.0912
(+1.22%)
0.3743
0.5695
0.1145
(+4.66%)
0.5221
0.7574
0.0998
(+2.15%)
0.3918
0.7973
CnVis
49
0.0965 (+7.10%)
0.3722
0,5778
0.1
(+4.1
0.5585
0.7798
0.0985
(+0.82%)
0.3960
0.7946
IrialAitack
[55
0,1002
(+11.2199)
0.3902
0
0.1203
(+9.96%)
0.5998
0.7868
0.0998
(+2.15%%)
0,3992
0.7983
SRWA
12
0,0906
(-0.55%8)
0,3721
0.5732
0.1172
(+7.13%)
0.5124
0.7521
0,0991
(+1.43%)
0.3927
0,7981
PGA 20
0.0923 (+2.4458)
0.3752
0.5769
0.1211 (+ (+10699)
0,5483
0.7668
0.0967
(+1.0298)
0.3971
0.7946
SGLD 20
0.0923 (+2.44%)
0.3721
0.5716
0,1187 (+8.50%)
0.5530
0.7675
0.0966 (-1.13%%)
0.3824
0.7952
TNA
(-8.10%8)
0.5843
0.1199 (+9.60%))
0.5812
0.7826
0.0924
(-5.4258)
0,3928
RevAdv
41
0.1017 (+12.87%%
0.4167
0.6285
0. 0.1229 (+ (+12.345%
0.6128
0,7885
0.1008 (+3.17%))
0.4181
0.8026
PAPU
0.1039 (+15.325%)
0.4231
0.6361
1405 (+28.433%
0.6354
0.7983
0.1012 (+3.589)
0,4191
0.7998
DADA-DICT
0.1145 (+227.08%)
0,4380
0.6971
0. 0.1418 (2%)
0.6387
0.8130
0.1019
(+4.30%)
0,4212
0 0.8061
DADA-DIV
0.1078 (+19.64%)
0.4218
0.6411
0.1375
(+25 69%)
0.6292
0.8017
0.1011
(+3.48%)
0,4196
0.8033
DADA
0.1220 (+35.41%)
0.4453
0.6585
0.1513 (+38.30%)
0.6623
0.8225
0.1040 (+6.45%) %.
0.4286
0.8127
Table 3: Evaluation on ML-IM IM dataset under fake user budget ò = 0.01|U"|.
WRMF [R]]
NCF [T6]
LighiGCN [T5]
Attacker
10
5R@
HR@ 100
HR@10 10
HR@50
HR@100
HR@
HR000
HRØ 100
Clean
0.0195
0.0970
0,1912
0.0158
0.0925
0.1965
0.0257
0.1008
0.1572
Random
12
0.0196
(-0.51%8)
0,1002
0.2030
0.0174
13)
0.0948
0.1983
0.0264 (+2.72%)
0.1028
0,1618
Popular
AM
0.0196 (-0.51%)
0.1007
0,2028
0.0202 (+27.85%)
0.0976
0.2008
0.0268 (44.28%)
0.1035
0.1692
CoVis
0,0212 (+8.72%)
0.1061
0,2148
0.0198 (+25.325%)
0,1073
0,2180
0.0279 (+8.56%%
0.1057
0.1793
IrialAttack
45
0.0218
0.0218 7+))
0,8084
0.2205
0.0213 (+34.81%)
0,8088
0.2159
0.0295 (+14.79%)
0.1115
0,1864
SRWA
12
0.0202 (+3.59%)
1,10
0.2060
0.0194 (+22.78%%)
0.1021
0.2061
0.0272 (+5.84%)
0.1031
0.1711
PGA 20
0.0206 (-5.64%)
0, 1021
0.2072
0.0201 (+27.211%)
0,1017
0,2048
0.0276 (+7.39%)
0.1046
0.1715
SGLD
(-7.18%%
0,1020
0,2025
0.0192 (+21.52%)
0.0992
0,2008
0.0267 (+3.899)
0.1029
0.1702
TNA m
0.0221 (+13.33%)
0. 1068
0,2182
0.0195 (+23,42%)
0,1049
0,2065
0.0282 (49.73%)
0,1074
0,18
RevAdv
41
0.0227 (+16.41%)
0.1168
0.2412
0.0224 (+41.77%)
0.1109
0.2197
0,0318
(+23.74%)
0.1206
0,2037
PAPU
51
0.0246 (4226115%)
0.1126
0,2462
0.0221 (+39.87%)
0.1125
0,2173
0.0334 (+29.966)
0.1257
0.2977
DADA DICT
0.0253 (+29.74%)
0.1217
0.2581
0.0230
(+-55)5%%)
0.1290
0.2219
0
(333.466)
0.1312
0.2184
DADA-DIV
0.0236 (+21.03%)
0.1175
0.2460
0.0227 (+43.67%)
0.1146
0.2201
0.0331 (+28.7966)
0.1214
0.2049
DADA
0.0286 (+46.67%)
0.1407
0.2746
0.0233 (+47.47%)
0.1315
0,2313
0.0362 (+40.866%
0.1407
0.2308
approaches, such as Random, Popular, and Co achieve unsatisfied results. Because they only consider to increase the co-occurrence between several items and the target items, which does not relate to the attack objective directly and cannot cover various behavior patterns [4 [52.. Instead, neural network-based and baased attackers optimize the attack objective directly. Compared with Atial,ttack, RevAdy and PAPU, several gradient-based attackers, including SRWA, PGA, SGLD, and TNA, achieve inferior performance. It is because when computing the gradients to design fake user behaviors, these approaches approximate the gradients in a biased way instead of exact computing gradients [41]. Our attacker DADA outperforms the above baselines significantly, because it enables the fake user behaviors to affect real users in a diverse manner.
Ablation Study. As shown in Tab. 2 and Tab. 3 DADA-DICT achieves the second best results, outperforming all baselines. It is because the difficulty-awe attack objective allows DADA-DICT to concentrate easy users with high tendencies toward the target items. Moreover, DADA-DIV achieves satisfied performance. It outperforms current state-of-the-art attackers, including Rev Ady and PAPU, in most cases. It is because the diversity-aware attack objective allows the generated fake user behaviors to affect real users more diversely, avoiding large communities dominating the generated fake users. Nevertheless, DADA-DIV does not outperform DADA-DICT. because DADA- DIV cannot differentiate easy users from all real users and put more efforts on them. Furthermore, DADA that considers both user difficulty and diversity can perform the best. In such way, it can potentially affect easy users from different communities, thereby boosting attacker's 's effectiveness.
4.3 Parameter Sensitivity
In this subsection, we evaluate DADA under different parameters. As shown in Tab and Tab. 3 the results of DADA and baselines on different target RecSys and hit ratios have similar trends. For clarification, we use WRMF and HR 50 for evaluation on 100K100K and MI.-1M datasets.
Fake User Budget d. We study the effect of fake user budget = 3 [ by varying 31 E {0.01. 0.03. 0.05, 0.07, 0.09}. For clarification, we only compare the effective baselines, including TrialAttack, TNA, RevAdv, and PAPU. As shown in Fig. 2 and (b), HR 50 of all attackers increases as the fake user budget increases on both ML- 100K and ML-1M datasets. Furthermore,

---

0.34
0033
0.20
0.4
0.58
0.38
0.36
0.18
2.00
0.00
The Pane tier Budget
The Fate Uher Budget
Meximum Katio Selccled
Masimar Nummer Selected From
(a) 8 on MI.-100K.
(b) 5 on ML.-MM.
(c) T on ML-100K.
(d) T on ML-IM.
Figure 2: Evaluation on the fake user budget and maximum selected items.
DADA outperforms all baselines under different attack budgets, i.e., the red solid line is above other lines, demonstrating effectiveness. Particularly, as the fake user budget increases, our attacker and baselines improve HR @ 50 on ML-100K more than that on ML-IM. The reason is that ML-100K only has 1682 items, while ML-IM has 3706 items. As a result, items into the top-50 recommendation list of each user in ML- 1M than ML-100K.
more difficult to promote target
Maximum Selected Items т. We study the effect of different maximum number of selected items = | by varying 32 E {0.01, 0.03, 0.05, 0.07, J. As shown in Fig. 2 (c) and (d), as the maximum number of items increases, the performance of attackers first increases and then decreases on both datasets. It indicates that selecting suitable items can increase the attacker's power. But more items will reduce the effectiveness of attackers, since the valuable items are limited, and extra items will introduce noise [22 29 ST]. Furthermore, compared with these powerful baselines, DADA can achieve stable and the best performance under different maximum number of selected items.
4.4
More Insights via Empirical Study
Due to space limit, we include more experiments in Appx. B for more insights. In Appx. B.5 to better mimic the real-world applications, demonstrate the generality and practicability of our attacker on partial and noisy user behaviors. In Appx. B.6 we evaluate our attacker under different item popularity. In Appx. B- we more comprehensively reveal the effectiveness of the difficulty- aware objective and quantitatively measure the diversity brought by the diversity objective. In [.8 Appx. B.8 we evaluate our attacker under more parameter settings, including extremely limited fake user budget and X in Eq (6). In Appx. [B.9] we analyze the hit ratio improvement under different target RecSys. In Appx. B.10 we provide visualizations on gradients provided by different users and fake user distributions. Finally, in Appx. B.11 we list several future directions based on our observations.
5 Conclusion
In this paper, we revisit the problem of injective attacks against recommender systems and reveal two issues of existing attackers: difficulty- and diversity- -eficii issues. To address these two issues, we propose DADA, difficulty and diversity aware attacker. Within a limited fake user budget, DADA enables the generated fake user behaviors to concentrate on easy users who have high tendencies toward the target item, and affect real users in a more diverse manner. Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker. In this paper, we mainly reveal the weakness of existing recommender systems and discuss how to attack them. For the sake of society, we discuss how to defense and resist such attacks in Appx. B.12
6 Acknowledgement
Lei Chen's work is partially supported by National Key Research and Development Program of China Grant No. 2022YF60200500 and 2018AAA0101 100, the Hong Kong RGC GRF Project 16213620, CRF Project C6030-18G, C1031-18G, C5026-18G, CRF C2004-21GF, AOE Project
AoE/E603/18, RIF Project R6020-19, tiemme-bsed project TRS T43-603/0 China NSFC No. 61729201, Guangdong Basic and Applied Basic Research Foundation 2019B15153000 Hong Kong ITC ITF grants TTS/044/18FX and TTS/470/18FX, Microsoft Research Asia Collaborative Research Grant, HIKUST-NAEE/LLNG AI Lab, Didi-HKUST joint research lab, KEUUST-Webant joint research lab grants and HKUST Global Strategic Partnership Fund (2021 SITU-HKUST). Shimin Di's work is supported by the JC STEM Lab of Data Science Foundations funded by The Hong Kong Jockey Club Charities Trust.
10

---

References
[1] Hervé Abdi and Lynne J Williams. Principal component analysis. Wiley interdisciplinary reviews: computational statisties, 2(4):433-459, 2010.
[2] Ofer Arazy, Nanda Kumar, and Bracha Shapira. Improving social recommender systems. IT professional, 11(4):38 44, 2009.
[3] Atilim Gunes Baydin et al. Automatic differentiation in machine learning: survey. JMLR, 18:1 2018.
[4] Robin Burke et al. Limited knowledge shilling attacks collaborative filtering systems. In IICAD) pages 17-24, 2005.
[5] Eunjoon Cho et al. Friendship and mobility: user movement location-based social networks. In SIGKDD, pages 1082-1090, 2011.
[6] Konstantina Christakopoulou and Arindam Banerjee. Adversarial attacks on an oblivious recommender. In RecSys, pages 322-330, 2019.
[7] Anahita Davoudi and Mainak Chatterjee. Detection of profile injection attacks in social recommender systems using outlier analysis. In 2017 IEEE International Conference Big Data (Big Data), pages 2714-2719, IEEE, 2017.
[8] Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. A survey adversarial recommender systems: from attack/defense strategies to generative adversarial networks. ACM Computing Surveys (CSUR), 54(2):1-38. 2021.
[9] Shimin Di, Yanyan Shen, and Lei Chen. Relation extraction via domain-aware transfer learning. In Proceedings of the 25th ACM SIGKDD international conference knowledge discovery & Data Mining, pages 1348 1357, 2019.
[10] Wenqi Fan et al. Attacking black-box recommendations via copying cross-domain profiles. In ICDE, pages 1583-1594. IEEE, 2021.
[11] Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. Influence function based data poisoning attacks to top-n recommender systems. In WWW, pages 3019-3025, 2020.
[12] Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. Poisoning attacks graph- based recommender systems. ACSAC, pages 381-392, 2018.
[13] Matthias Fey, Jan E Lenssen, Frank Weichert, and Jure Leskovec. Gnnautoscale: Scalable and expressive graph neural networks via historical embeddings. In International Conference on Machine Learning, pages
PMLR, 2021.
[14] Maxwell Harper et al. The movielens datasets: History and context. THSS 5(4):1-19, 2015.
[15] Xiangnan He, Kuan Deng. Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. Lightgnn: Simplifying and powering graph convolution network for recommendation. SIGIR, pages 639 648, 2020.
[16] Xiangnan He et al. Neural collaborative filtering. In WWW, pages 173-182, 2017.
[17] Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Li, Bin Liu, and Mingwei Xu. Data poisoning attacks to deep learning based recommender systems. arXiv preprint arXiv:2101.02644 2021.
[18] Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recom- mender systems. Computer, 42(8):30-37, 2009.
[19] K Krishma et al. Genetic k-means algorithm. Cybernetics, 29(3):433-433 1999.
[20] Bo Li et al. Data poisoning attacks on factorization-baase collaborative filtering. NeurIPS,
29: 19:1885-189, 2016.

---

[21] Haoyang Li and Lei Chen. Cache-based gnn system for dynamic graphs. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 937-946, 2021.
[22] Haoyang Li, Shimin Di, Zijian Li, Lei Chen, and Jiannong Cao. Black-box adversarial attack and defense on graph neural networks. In ICDE, pages 1017-1030. IEFE, 2022.
[23] Haoyang Li, Xueling Lin, and Lei Chen. Fine-grained entity typing via label noise reduc- tion and data augmentation. In International Conference on Database Systems for Advanced Applications, pages 356-374. Springer. 2021.
[24] Chen Lin, Si Chen, Hui Li, Yanghua Xiao, Lianyun Li, and Qian Yang. Attacking recommender systems with augmented user profiles. In Proceedings of the 29th ACM international conference on information & knowledge management, pages 855 865, 2020.
[25] Xueling Lin, Lei Chen, and Chaorui Zhang. Tenet: Joint entity and relation linking with coherence relaxation. In Proceedings of the 2021 International Conference Management of Data, pages 1152-1555 2021.
[26] Xueling Lin, Haoyang Li, Hao Xin, Zijian Li, and Lei Chen. Kbpearl: knowledge base population system supported by joint entity and relation linking. Proceedings of the VLDB Endowment, 13(7)11035-1049, 2020.
[27] Greg Linden et al. Amazon. com recommendations: Item-to-item collaborative filtering. IEEE Internet computing, 7(1):76-80) 80, 2003.
[28] Jiaqi Ma. Zhe Zhao, Xinyang Yi, Ji Yang, Minmin Chen, Jiaxi Tang, Lichan Hong, and Ed H Chi. Off-policy learning in two-stage recommender systems. In Proceedings of The Web Conference 2020, pages 003-473,20 2020.
[29] Bamshad Mobasher et al. Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness. TOIT, 7(4):23-es, 2007.
[30] Michael O' O''Mahnny, Neil Hurley, and Guénolé CM Silvestre. Recommender systems: Attack types and strategies. In AAAI, pages 334-339, 2005.
[31] Steffen Rendle et al. Bpr: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618, 2012.
[32] Steffen Rendle, Walid Krichene, Li Zhang, and John Anderson. Neural collaborative filtering
vs. matrix factorization revisited. In RecSys, pages 240 248, 2020.
[33] Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. Fedrecattack: Model poisoning attack to federated recommendation. arXiv preprint arXiv:2204.01499, 2022.
[34] Sebastian Ruder. An overview of gradient descent optimization algorithms. arXiv preprint
arXiv:1609.04447,, 2016.
[35] Badrul Sarwar, George Karypis, Joseph Konstan, and John Riedl. Item-based collaborative filtering recommendation algorithms. In Proceedings of the 10th international conference on World Wide Web, pages 285-295, 2001.
[36] Lalita Sharma and Anju Gera. A survey of recommendation system: Research challenges. IJTT, 4(5):1989-1992. 2013.
[37] DI Shimin, YAO Quamming, Yongqi ZHANG, and CHEN Lei. Efficient relation-awar aware scoring function search for knowledge graph embedding. 2021 IEEE 37th International Conference on Data Engineering (ICDE), pages 1104-1115, IEFF, 2021.
[38] Junshuai Song et al. Poisonrec: an adaptive data poisoning framework for attacking black-box recommender systems. In ICDE, pages 157-168. IEEE, 2020.
12

---

[39] Jiaxi Tang, Francois Belletti, Sagar Jain, Minmin Chen, Alex Beutel, Can Xu, and Ed H. Chi. Towards neural mixture recommender for long range dependent user sequences. The World Wide Web Conference, pages 1782-1793, 2019.
[40] Jiaxi Tang and Ke Wang. Personalized top-n sequential recommendation via convolutional sequence embedding. In WSDM, pages 563-573, 2018.
[41] Jiaxi Tang, Hongyi Wen, and Ke Wang. Revisiting adversarially learned injection attacks against recommender systems. In RecSys, pages 318-327, 2020.
[42] Xin Wang, Ziwei Zhang, and Wenwu Zhu, Automated graph machine learning: Approaches, libraries and directions. arXiv preprint
2022.
[43] Zhili Wang, Shimin Di, and Lei Chen. Autogel: An automated graph neural network with explicit link information. Advances in Neural Information Processing Systems, 34:24509- 24522, 2021.
[44] Chenwang Wu, Defu Lian, al. Fight fire with fire: Towards robust recommender systems via adversarial poisoning training. In SIGIR, pages 1074-1083, 2021.
[45] Chenwang Wu, Defu Lian, et al. Triple adversarial learning for influence based poisoning attack in recommender systems. In SIGKDD, pages 1830-1840, 2021.
[46] Huijun Wu, Chen Wang, Yuriy Tyshetskiy, et al. Adversarial examples for graph data: deep insights into attack and defense. In IJCAL, pages 48 4816-4823, 2019.
[47] Le Wu et al. survey on neural recommendation: From collaborative filtering to content and context enriched recommendation. arXiv preprint (1XXix:2104,3030 2021.
[48] Shiwen Wu, Fei Sun, Wentao Zhang, and Bin Cui. Graph neural networks in recommender systems: a survey, arXiv preprint arXiv:2011.02260, 2020.
[49] Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. Fake co-visitation injection attacks to recommender systems. In NDSS, 2017.
[50] Rex Ying et al. Graph convolutional neural networks for web-scale recommender systems. In SIGKDD, pages 974-983, 2018.
[51] Hengtong Zhang al. Data poisoning attack against recommender system using incomplete and perturbed data. In SIGKDD, pages 15642164, 2021.
[52] Hengtong Zhang, Yaliang Li, Bolin Ding, and Jing Gao. Practical data poisoning attack against next-item recommendation. In WWW, pages 2458-2464, 2020.
[53] Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. Deep learning based recommender system: survey and new perspectives. CSUR, 52(1):1-38, 2019.
[54] Ziwei Zhang, Xin Wang, and Wenwu Zhu. Automated machine learning graphs: A survey. arXiv preprint wtXiv:2103.007440 2021.
[55] Huan Zhao, Lanning Wei, and Quanming Yao. Simplifying architecture search for graph neural network. arXiv preprint arXiv:2008.1 11652, 2020.
Checklist
Please do not modify the questions and only use the provided macros for your answers. Note that the Checklist section does not count towards the page limit. In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questionssansswrs below.
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
13

---

(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative socictal impacts of your work? [Yes] This paper mainly reveals the potential way to attack some recommendation systems. We discuss some existing defense models and future directions in Appx.
(d) Have you read the ethies review guidelines and ensured that your paper conforms them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as URL)? [No]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [No]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes]
4. If you are using existing assets (e.g., code, data, models) or curating/relcusing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes]
(c) Did you include any new assets either in the supplemental material or as URL? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you're 're using/curating? [Yes]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "yifqC9_KMdK", "reviewer": "Reviewer_CMWp", "summary": "The paper investigates injection attacks on recommender systems, where an adversary injects a number of fake user profiles into the training data of the system, with behaviors chosen such that the system is more likely to recommend specific items to real users. To this end, the authors investigate existing attack schemes and find that they spend too much effort -- and thus fake-user budget -- on targeting users that are hard to recommend the chosen item to (i.e. the attacks are difficulty-agnostic) and that they predominantly target the chosen item to users belonging to a specific cluster of the population (i.e. they suffer from a diversity deficit).\nTo mitigate these issues, the authors propose two new targeting objectives: a difficulty-aware objective that focuses the optimization effort on users closer to the top-k threshold of having the target item recommended and a diversity-aware objective that steers the optimization towards users where it can cause the largest increase in recommendation score. These objectives are then combined to create a new type of attacker called DADA (difficulty-aware and diversity-aware), together with a greedy algorithm that optimizes the joint objective. In an empirical evaluation on three datasets with three types of recommender systems, the authors demonstrate that DADA outperforms existing attacks, leading to a higher number of users that receive the target item(s) in their top-k recommendations.", "questions": "- Why does the diversity-aware objective increase diversity, i.e. why did you chose it to be what it is? As far as I understand, the objective seems to primarily focus optimization effort on users where this effort would maximize the increase in targeting score for the target item. This in itself seems reasonable, but I am not convinced that it will necessarily increase the diversity in the targeted set of users. There also seems to be no metric that quantitatively measures diversity in the paper, so the provided visual results (scatter plots) feel a inconclusive regarding a lack of diversity for existing methods as well as an increase in diversity as the result of applying the diversity-aware objective. To be clear: I do not necessarily think that the objective is a bad one, but I don't think it can be called diversity-aware with the current amount of justification and doing so can be misleading.\n- Were the experiments conducted over multiple runs? It looks like there is only one run (see weaknesses).\n- As an ablation, it might be interesting to study some of the existing objectives (e.g. RevAdv) with the change of zeroing gradients corresponding to users where the target item is in the top-k recommendations. This might reveal how much of the gains come from the changed objectives, vs how much from concentrating optimization effort on users where the goal is not reached yet.\n- The description of the attack objectives describes the case where there is one target item, however, in the empirical analysis target sets of multiple items are used. In this case, do you zero-out the contribution of a user to the gradient as soon as one of the target items appears in the top-k recommendations or do you continue until all items are recommended?\n- Why is the difficulty-aware objective called $Ten(.)$?", "limitations": "- The proposed attack might run into some scalability issues, since for any change in the training dataset or for generating more or less fake users a full re-run is required. Since this is an attack and not a production system it is probably ok, but it might be helpful to briefly mention this and maybe discuss whether there is the possibility of a warm-start using a previously computed solution.\n- Again, the threat-model should be discussed more extensively in this context, in particular which types of platforms offer enough public data to enable the attacks.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n- The paper proposes two interesting hypothesis for why existing injection attacks on recommender systems can fail to be effective in promoting items to more users: a) being difficulty-agnostic and wasting attack-budget on users where it likely won't make a difference instead of succeeding for more easier users and b) suffering from a lack of diversity in in the set of targeted users and only reaching sub-communities.\n- The paper introduces two new targeting objectives as well as a way to combine them to mitigate these problems. It empirically demonstrates that these objectives lead to more effective attacks where the target item is recommended to more users, outperforming prior approaches.\n- The paper is overall easy to understand and follow, though there are a number of presentation issues (see weaknesses).\n\n### Weaknesses\n- It is not clear how the diversity-aware objective increases diversity, and more justification is needed. See the questions part for more details.\n- More clarity is needed regarding the threat-model. The paper assumes a gray-box threat-model where attackers don't have access to the targeted system, but have knowledge of the user data used to train the system such as movie viewing history. This seems like a strong assumption to me, though I'm willing to accept it, given that prior work also makes it. However, there needs to be more discussion of how this training data can be obtained, i.e. which pieces of information about user behavior are typically accessible on platforms and whether they are sufficient to train a surrogate model.\n- As far as I can see and inferring from the review-checklist, the results (e.g. in table 3 and 4, figure 1) are only computed for one run. Given that there are a number of stochastic components involved here (the selection of the target items, k-means initialization, etc.), results should really be provided as aggregates over multiple runs, else the confidence in the conclusions is low. If the based on multiple runs this should be clearly stated and e.g. error bars should be provided.\n- There are some presentation issues:\n    - I have an issue with some of the formulations repeatedly used throughout the paper, for instance:\n        - The phrase \"without loss of generality\" is used a few times (e.g. in section 3.1.1 and 3.2.1) to refer to some of the choices made in the experiments. However, in its precise use, this phrase is reserved for assumptions in mathematical statements and not to justify design choices in empirical experiments. If you would want to use it there, you should show that other choices lead to similar results.\n        - The phrase some \"users contribute more gradients\" is used a number of times. It's possible to understand it's meaning, but it feels rather imprecise. It could be understood as some users appearing multiple times in the objective and therefore being counted more than once in the gradient computation. An alternative such as some \"users dominate the gradient computation\" or something similar seems preferable.\n    - There are a number of language and grammatical issues that make the paper feel not very polished.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "rSQDEt8VkVF", "reviewer": "Reviewer_e81i", "summary": "In this paper, the authors pointed out two issues with existing recommender system attackers, difficulty-agnostic and diversity-deficit. They then analyzed these two issues and proposed two ways to alleviate them. Both methods modify the loss function and introduced new notions in the gradient. Comparison with multiple baselines over the ML-100K and ML-1M datasets showed that the proposed approach can outperform all of them.", "questions": "Please see my questions in the last section.", "limitations": "It would be great and super helpful to have more discussions (with more details) on the defense of the proposed attack.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n1. The diversity-agnostic issue is well explained and justified. The proposed solution is intuitive and reasonable.\n2. The authors conducted comparisons with more than 10 baselines and did very detailed analysis.\n3. Different recommendation algorithms (WRMF, NCF, LightGCN) were experimented with, which demonstrates the generalisability and robustness of the proposed approach.\n\nWeakness:\n1. The diversity-deficit issue is not very convincing to me. Do the fake injected users always form a cluster that is always a subgroup of a larger cluster of users? More explanations and proof (if there is any) of this phenomenon can be very helpful to the readers.\n2. I wonder if the choice of \\beta_1 and \\beta_2 can reflect the real-world scenario. In other words, is it possible to inject 1% of users with 1% of items into a recommender system in real world? This seems to be quite unlikely. It would be very interesting to see the results when \\beta_1 and \\beta_2 are much smaller (0.01%ish), which can mimic the real-world scenario better.\n3. It would be helpful to annotate if the results in Table 1 and 2 shows significant differences.\n4. It would be great and super helpful to have more discussions (with more details) on the defense of the proposed attack.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "XBk45udVwZs", "reviewer": "Reviewer_Es2b", "summary": "This paper pointed out two issues of existing injective attacks against recommender systems, difficulty-agnostic and diversity-deficit issues.\nTo address these two issues, the paper propose a difficulty and diversity aware attacker, name DADA, to force the attacker to attack easy users distributed in various communities.\nThe experimental results on three real-world datasets demonstrate that the proposed method achieves superior performance compared with state-of-the-art attackers.\nBesides, the analytical experiments also show the proposed objectives could generated fake users indeed focus on easy users in a diverse way.\n", "questions": "see above", "limitations": "The method proposed in this paper could be used to attack the real-world recommendation application for profits.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n* This is a well-structured paper with clear presentation. \n* Motivational observation subsections are very insightful.\n* The paper conducted very solid experiments with state-of-the-art baselines on three benchmark datasets.\n\n\n## weakness\n*  The paper lacks explanations for some phenomena in the experiments. For example, the results in Table 2 and Table 3 imply that stronger models are more robust to attacks.\n*  Hit Ration ignore the rank of the target items in top-N recommended list. Thus, metrics like NDCG should be also reported in the experiments.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["Privacy and Security (e.g., consent)"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept