Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation
Authors: Kaike Zhang
Qi Cao
Yunfan Wu
Fei Sun
Huawei Shen
Xueqi Cheng
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Collaborative Filtering
Robust Recommender System
Poisoning Attacks
Primary area: safety_in_machine_learning
TL;DR: We theoretically analyze Adversarial Collaborative Filtering (ACF) and further propose a method to improve ACF for robust recommendations.

Abstract: Adversarial Collaborative Filtering (ACF), which typically applies adversarial perturbations at user and item embeddings through adversarial training, is widely recognized as an effective strategy for enhancing the robustness of Collaborative Filtering (CF) recommender systems against poisoning attacks. Besides, numerous studies have empirically shown that ACF can also improve recommendation performance compared to traditional CF. Despite these empirical successes, the theoretical understanding of ACF's effectiveness in terms of both performance and robustness remains unclear. To bridge this gap, in this paper, we first theoretically show that ACF can achieve a lower recommendation error compared to traditional CF with the same training epochs in both clean and poisoned data contexts. Furthermore, by establishing bounds for reductions in recommendation error during ACF's optimization process, we find that applying personalized magnitudes of perturbation for different users based on their embedding scales can further improve ACF's effectiveness. Building on these theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Extensive experiments demonstrate that PamaCF effectively defends against various types of poisoning attacks while significantly enhancing recommendation performance.

Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation
Kaike Zhang!.? Qi Cao'; Yunfan Wu 12, Fei Sun', Huawei Shen', Xueqi Cheng'
CAS Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences
University of Chinese Academy of Sciences
Beijing, China
(zhangkaike21s, caoqi, wuyunfan19b, sunfei, shenhuawei, exq)@ict.a..co cn
Abstract
Adversarial Collaborative Filtering (ACF), which typically applies adversarial perturbations at user and item embeddings through adversarial training, is widely recognized as an effective strategy for enhancing the robustness of Collaborative Filtering (CF) recommender systems against poisoning attacks. Besides, numer- ous studies have empirically shown that ACF can also improve recommendation performance compared to traditional CF. Despite these empirical successes, the theoretical understanding of ACF's effectiveness in terms of both performance and robustness remains unclear. To bridge this gap, in this paper, first theoretically show that ACF can achieve a lower recommendation error compared to traditional CF with the same training epochs in both clean and poisoned data contexts. Fur- thermore, by establishing bounds for reductions in recommendation error during ACF's optimization process, find that applying personalized magnitudes of perturbation for different users based on their embedding scales can further improve ACF's effectiveness. Building on these theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Extensive experiments demonstrate that PamaCF effectively defends against various types of poisoning attacks while significantly enhancing recommendation performance.
Introduction
Collaborative Filtering (CF) is widely recognized as powerful tool for providing personalized recom- mendations [ 2 3 across various domains 54. However, the inherent openness of recommender systems allows attackers to inject fake users into the training data, aiming to manipulate recommen- dations, also known as poisoning attacks [6] 7 Such manipulations can skew the distribution of item exposure, degrading the overall quality of the recommender system, thus harming the user experience and hindering the long-term development of the recommender system
Existing methods for defending against poisoning attacks in CF can be categorized into two types S (1) detecting and mitigating the influence of fake users 9 10 robust models via adversarial training, also known as Adversarial Collaborative Filtering (ACF) [I5
14, and (2) developing
16 g 19 20). The first strategy focuses on detecting and removing fake users from the dataset before training 99 I0] IT [4] mitigating their impact during the training phase [12] [3]. These
methods often rely on predefined assumptions about attacks (9] [2] or require labeled data related
to attacks [10] [1] [2 13]. Consequently, deviations from predefined attack patterns may lead to misclassification, failing to resist attacks while potentially harming genuine users' experience [3]
"Corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

In contrast, ACF provides a more general defense paradigm without prior knowledge [15] 16 17 18
19 20]. Poisoning attacks in recommender systems mainly affect the learned embeddings of users and items, i.e., the system's parameters 6 77. Predominant ACF methods, particularly those aligned
with Adversarial Personalized Ranking (APR) framework [15] heuristically incorporate adversarial perturbations at the parameter level during the training phase to mitigate these attacks [15 17 19, 20). This approach employs a "min-max" paradigm, designed to minimize the recommendation error while contending with parameter perturbations aimed at maximizing this error within a specified magnitude [5], thus enhancing the robustness CF.
It is interesting to note that adversarial training in the Computer Vision (CV) domain 21 22 23 has been observed to degrade model performance on clean samples [24 25). Several studies have also theoretically demonstrated trade-off off between robustness against evasion attacks and the performance of adversarial training in CV 26 contrast, ACF recommender systems has been shown in numerous studies not only to enhance the robustness against, poisoning attacks B L3 18] but also improve recommendation performance
[55] 20 27 Despite the empirical evidence highlighting
ACF's advantages, it still lacks a comprehensive theoretical understanding, which limits the ability to fully exploit the benefits and potential of ACF To bridge this gap, in this paper, we propose the following research questions for further investigation:
i. Why does ACF enhance both robustness and performance compared to traditional CF? ii How can we further improve ACF?
To answer these questions, delve into theoretical analysis of simplified CF scenario. This analysis confirms that ACF can achieve a lower recommendation error at the same training epoch in both clean and poisoned data contexts, showing better performance and robustness compared to traditional CF. To investigate potential improvements to ACF, we establish upper and lower bounds for reductions in recommendation error during ACF's optimization process. Our findings indicate that (1) Users have varying constraints for perturbation magnitudes, i.e., different maximum perturbation magnitudes; (2) Within these constraints, applying personalized perturbation magnitudes as much as possible for each user can increase the еrror reduction bounds, further improving ACF's effectiveness.
Extending our theoretical results to practical CF scenarios, we establish positive correlation between users' maximum perturbation magnitudes and their embedding scales. Building on these theoret- ical understandings, we introduce Personalalized Magnitude Adversarial Collaborative Filtering (FamaCF). PamaCF dynamically and personally assigns perturbation magnitudes based on users' embedding scales. Extensive experiments confirm that PamaCF outperforms baselines in both perfor- mance and robustness. Notably, PamaCF increases the average recommendation performance of the backbone model by 13.84% and reduces the average success ratio of attacks by 44.92% compared to the best baseline defense method. The main contributions of our study are summarized as follows:
We provide theoretical evidence that ACF can achieve better performance and robustness compared to traditional CF in both clean and poisoned data contexts.
We further identify upper and lower bounds of reduction in recommendation error for ACF during its optimization and demonstrate that applying personalized magnitudes of perturbation for each user can further improve ACF.
Based on the above theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), with extensive experiments confirming that PamaCF further improves both performance and robustness compared to state-of-the the-thh-rrt art defense methods.
The code of our experiments is available at htttps://github. com/ Kaike- Chang/PamaCF
2 Preliminary
Collaborative Filtering (CF) methods are widely employed in recommender systems. Following M.. we define a set of users 24 = { and a set of items V = {c}. Using data from user-item interactions, our objective is to learn latent embeddings U = [u E R Juuu for users and V = =Iv E levv for items. Then, we employ a preference function f IRd x Rd -> RR which prediets user-item preference scores, denoted as Pu.v = f(u, v).

---

Adversarial Collaborative Filtering (ACF) is acknowledged as effective approach for enhancing both the performance and the robustness of CF recommender systems in the face of poisoning attacks, ACF methods, particularly within the framework of Adversarial Personalized Ranking (APR) [15), integrate adversarial perturbations at the parameter level (i.e., the latent embeddings U and V) during the training phase. Let Z(O) denote the loss function of the CF recommender system, where = (U, V) represents the recommender system's parameters. ACF methods apply perturbations A directly to the parameters as:
LACF (b) =[(() + AC(O + A Anty) L(0
where
A adv arg A, ||
(I)
where c > defines the maximum magnitude of perturbations, and is the adversarial training weight. Due to constraints on space, detailed discussion of related works is provided in Appendix
3 Theoretical Understanding of ACF
In this section, we provide theoretical analysis of why ACF achieves superior performance and robustness compared to traditional CF from the perspective of recommendation error. Then, we explore mechanisms further improve ACF's effectiveness based on its reduction bounds. For clarity and simplicity, we initially focus on a Gaussian Single-item Recommender System, aligning with the frameworks presented in [8] 28 It's important to note that the insights and analytical frameworks developed here are also applicable to more practical scenarios, as discussed in Section 4
corre- sponding to n users, where each rating is randomly selected from [+1], an average embedding vector Rdd and O, the Gaussian Recommender System initializes each user's embedding u from the normal distribution N(ūū 0² I²I). The item embedding v is initialized as the average vector derived from these users: v = n. Ki= rguu; Then, a preference function J .Rd x Rd - {+1) is employed predict user preferences: f(u, = sgn( (v, ui)), where sgn(.) denotes the sign function, returning I if (u, v) >> O and -1 otherwise.
Definition 1 (Gaussian Recommender System), Given rating set R = (r,,,2,.....
Based on Definition 1 we obtain I = ri), (un, rn)). where u represents the system- learned user embedding. With continued training, both each user embedding u and item embedding are iteratively updated. Let u(z) and V(x) denote user and item embeddings at the 5 epoch, respectively. For analytical simplicity and without loss of generality, we define the standard loss function ((O) (as traditional CF) used in the Gaussian Recommender System as follows [8]]
())
Σ [r
(u)))) v(o))
(u,r)e
where the model parameters (()) = (u(z)= [e),,ee) u22(0))... (o,(0) )) To integrate ACF into the
Gaussian Recommender System, we introduce the ad adversarial loss [1). Ladv (9), defined as:
Ladv (0))) (() - Σ [r (u()) + Au. (()) Aw)].
(u,r))Z
where X is the adversarial training weight. The perturbations Ay and A. are applied to the user and item embeddings, respectively, as computed based on Equation
3.1 Why Does Adversarial Collaborative Filtering Benefit Recommender Systems?
To analyze the performance and robustness of traditional CF and ACF within the Gaussian Rec- ommender System, we evaluate them from the perspective of recommendation error during the training process. For each user, both performance and robustness are reflected by the user's 's rec- ommendation error. Specifically, attacks-whether item promotion attacks (6 29 or performance damage attacks in increase the user's recommendation error. Mcanwhile, a smaller recommendation error means a higher recommendation performance. For a given user u, the initial item embedding (0) in the Gaussian Recommender System can be approximately modeled as sample from (ū, I). Here, we provide the definition of recommendation error for user u.
"The precise form is ((ū (n=1)=" I). but we make this approximation for the sake of clarity and brevity. The approximation does not impact the subsequent theoretical results.
3

---

Definition 2 (Recommendation Error). Given a Gaussian Recommender System fite) that has been trained for epochs, the recommendaation error for the user u with rating at the thh epoch is defined as the probability that the system's prediction does not align with the user's 's actual rating, as: (f(t (u, v) # r), (()))
IP "N 12,1) (u, v) # (u, == E (a.y~N(a,
where II()) is an indicator function that returns 1 if the condition is true and 0 otherwise.
Based on the framework of ACF 15 20 which includes t epochs of pre-training with standard loss before adversarial training, we derive theorem that identifies the difference in recommendation error between standard and adversarial loss at the (t + 1)th epoch. To distinguish between the recom- mendation error of traditional CF and ACF, define IP "(a) = (f(+)) 1) (u, v) # (u,
as the recommendation error following standard training (Equation at the (t + 1)th epoch, and ( (u, 4) + (u,r) as the recommendation error following adversarial train- ing (Equation 3 the + 1)th epoch.
adv
Theorem Consider a Gaussian Recommender System fay, pre-trained for epochs using the standard loss function (Equation
2) Given a learning rate т}, an adversarial training weight X. and
perturbation magnitude e, when e < min([] lllll and [uu] > the recommendation error for
nd
with rating r at the (t + 1)th epoch follows that:
P (1o "ho)~N(a 1) [f v) # r (u, r)]
P adv
2n [f(tn(u,,) # (u.
1(o)
For the proof, please refer to Appendix D.I.I next epoch achieves a lower recommendation error compared to traditional CF, thereby benefiting recommendation performance.
After the same epochs of pre-training, ACF at the
Next, our analysis extends to contexts where the recommender system is subject to poisoning attacks. These attacks involve injecting fake users into the system's 's training dataset to manipulate item exposure. We examine a Gaussian Recommender System with I = {(u)) ....... (un, rn)), where each tuple (u,r) E RRd {+1} represents the learned embedding and the rating of a genuine user. A poisoning attack on this system injects a poisoning user set, I' = {(u (u2, r2)..... (u )
with each tuple (u',r') E Rd x (+1} representing a fake user crafted by attackers] The poisoned item embedding o' is reinitialized to include both genuine and malicious contributions:
Σ ru ru+
Σ r'u'
Σ
)
n + n
(u.r)ez
(u'r"))Z'
where n and represent the number of genuine and fake users, respectively.
To evaluate the impact of these attacks, we introduce formal definition of recommendation error in poisoned data.
Definition 3 (a-Poisoned Recommendation Error). Given a boundary a > O, and a set of fake
users injected by attackers within this boundary, i.e., I' P(u', {(u,,, ,r") I (w',r') Rd x (+1) A I|u'll at). the a-poisoneed recommendation error for the genuine user with rating r at the th epoch is defined as the probability:
woo (+ [Fcer (u, vo) + (u, r)] = E voo-Nia 2in [T (ui),a 0²) Hrl (u, [(o1)]
where fin)a represents the Gaussian Recommender System under the a-poisoned condition, and I(.) is an indicator function that returns 1 if the condition is true and O otherwise.
For simplicity, we continue using the distribution of v(O) from the definition. This allows us to further analyze the a-poisoned recommendation error based on the distribution of (o) n+. nt ((0)
E(w.r"rr e' r'u'.
Then we extend Theorem D to a- Poisoned Recommendation Error in the following theorem:
Unless otherwise specified, || denotes the L2 norm ||- ||2 in this paper.
'To make poisoning attacks effective in single-item recommendation scenarios, attackers can directly inject users' initialized embeddings, which is equivalent to constructing interactions for different items in multi-item scenarios.

---

Theorem 2. Consider poisoned Gaussian Recommender System f( pre-trained for t epochs using the standard loss function (Equation 2 Given learning rate t, an adversarial training weight X, and perturbation magnitude e, when < min[[][ee all)) and || > the a-poisoned
nd
recommendation error for genuine user u with rating v at the (t+ 1) follows that:
IP "(o)~N(m, ( (U,,)),(u,,')) # (u,
P adv
Dio) Dioy~N(u - [((+1), v') + (u,r)]
For the proof, please refer Appendix D.I.2 Combining Theorem I Jand Theorem we find that adversarial training, i.e., ACF, lowers recommendation errors compared to traditional CF in both clean and poisoned data contexts. Accordingly. ACF achieves better performance and robustness.
3.2 How to Further Enhance Adversarial Collaborative Filtering
To explore mechanisms to further improve the effectiveness of ACF, we subsequently derive upper and lower bounds on the reduction of recommendation error between any two consecutive epochs after / epochs of pre-training.
Theorem 3. Consider Gaussian Recommender System s'a which has been pre-trained for l epochs
using standard loss (Equation D and subsequently trained on adversarial loss (Equation 3. For the (t + k + 1)th epoch, let the reduction in recommendation error of user u with rating relative to the (f + k)th epoch from adversarial loss be denoted by:
A adv (1+k+1) N 22 (f(,, v) # r (u, r),
adv
I adv oio "Ni 1) [(t+k v) Hr (u,r)) adv " 2), [f(+++))(u, v) X (u,
Given a learning rate y, an adversarial training weight X, and a perturbation magnitude when min(|u and ||ū|| >> follows that:
A adv
P.ad adv (1+++1) N1
(f( + (u,r))
22
V n2 Φ
|| n[|[ū|| n
do² V (((
Vn (vn-1 +
||
( [Vn (vn- In
do²
A adv (t+++1)) Mia 22 (l(, v) + (u, r)] S 2Φ
P adv
(1122112
n ) hi) 1,
20
where d is the embedding dimension, and (-) denotes the cumulative distribution function (CDF) of the standard Gaussian distribution, and V (u.L. k) is defined as:
Ce+k [u
where N((+) (1
Wu, = (1 A)7(++))
2 [
where Ci+k is constant at the (t + th epoch.
For the proof, please refer to Appendix D.2.1] In light of Theorem 3 given a learning rate 1) and an adversarial training weight X,
establish the following: (T) When the conditions, i.e.,
6 << m and || || >> a. are satisfied, the error reduction for ACF can be both upper and
n lower bounded. (2) Increasing the perturbation magnitude e under the above conditions can further improve these bounds, thus benefiting ACF's effectiveness.
Then, similarly, we extend Theorem 3 to the a a-poisoeedd context.
Theorem Consider a poisoned Gaussian Recommender System (()) which has been pre-trained for t epochs using standard loss (Equation 2 and subsequently trained adversarial loss (Equa- tion 3). For the (t + + 1)th epoch, let the reduction in a a-poisoned recommendation error of a genuine user with rating r relative to the (t + 13)th epoch from adversarial loss be denoted by edv (1+k+1) p adv Vio 2², 2,,) [a((u, v') # r (u, r)]. Let 3 = x'. vdaa + |[ل|| and T = 2nn' o villzill..
where d is the embedding dimension, and given learning rate n, adversarial training weight X.
5

---

m
and a perturbation magnitude 6, when <
and || o, follows that:
A adv
IP adv
[ 00) t (u,
(++8+1) "[o)
'[o)~~
o² n (1a
n
n n=11 ū T
ndo²
v v(u,t+))))
Vn 3
①
+1 P adv (1+++1)
T1(1 n') +
(n (m (n+)())
A adv
o(o) P(o)~Waa, =² (nnn/laa,, v') xr| (u, S
1n n² 1 (n') +
ndo²
2
v (u +
20
n(n +
(n
1) + n²)
where Φ() denotes the cumulative distributton function (CDF) of the standard Gaussian distribution. n' is the number of fake users, and (-) is defined in Equation
For the proof, please refer to Appendix D.2.2 From Theorem
understand that increasing V (u, k)) can further improve both the upper and lower bounds of error reduction, thereby mitigating the negative impact of poisons. Specifically, this involves the same mechanism as in the clean data
context: increasing the perturbation magnitude e within e < minn{ [l-l
In conclusion, the theorems in this section indicate that for each user u, when the user's perturbation magnitude meets < [=)]l yd
have the following: (1) ACF is theoretically shown to be more effective than traditional CF, and (2) Increasing the user's perturbation magnitude during training as much as possible can further improve both the performance and robustness of ACF. These theoretical understandings can further benefit exploring and fully unleashing the potential of ACF.
4 Methodology
To extend theoretical understandings from the sim- ple CF scenario to more practical scenarios, such as multi-item recommendations with Bayesian Per- sonalized Ranking (BPR) 31], which is a main- stream loss function used in CF recommendations, we first conduct preliminary experiment shown in Figure 1 Using Matrix Factorization (2) on the
User
User2
User
User
Users
Maximum Perturhation Magnitude
NDCG@20 Different Perturbation Magnitude
Normu LAIAA
Narm: 6,7923
NDC00200
Narm: 6,8229
82
Norm: 11.05
Gowalla dataset [32), we observe results similar to those in Theorem
3 and Theorem 4 NDCG @ 20
0.5
for users improves within their maximum magni- tudes, i.e., constraints, but significantly declines once these constraints are surpassed. Based on the theoretical understandings provided in Section 3 we derive the following corollary to identify the maximum perturbation magnitude for each user in practical CF scenarios.
Perturation Mognitude
Figure 1: NDCG@2 20 across various perturba- tion magnitudes for five users (subject to Ran- dom Attacks (30
Corollary 1. Given any cod-product-basse based loss function L(O), within the framework of Adversarial Collaborative Filtering defined in Equation I the maximum perturbation magnitude (u) user u at the tth epoch is positively related to [e)l-
max for
For the proof of Corollary please refer to Appendix D.3 According Corollary D we observe that for a user u. the larger [u]], the greater the maximum perturbation magnitude. Considering that maximum perturbation magnitudes will be affected by other factors in the actual training process, to ensure training stability, we decompose (r). for a user u at epoch t into two components: the uniform perturbation magnitude p, applicable to all users, and user-specific perturbation coefficient c(u, t), expressed as:
mt) p. c(u,t).
(5)
According to Corollary D c(u, 1) provides coefficients positively related to users' embedding scales. To avoid training instability caused by extreme scale values, we map c(u, t) into the interval (0, 1).

---

defined by:
[ (1)
c(u, 1) sig
U (())
where |u || represents the average norm of all user embeddings at epoch 4, and sig(.) denotes the sigmoid function. Consequently, the loss function for our method, Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), is defined as:
CramaC (0) =[( + XC + Pamaa CF)
where
A PamaCF
arg
max pp
C(O + 4),
(6)
where À the weight of adversarial training, p represents the uniform perturbation magnitude for all users, and A, is the perturbation relative to user To maximize the perturbation magnitude for each user within pc(u,, t), we use the perturbation along the gradient direction of the user's adversarial loss with step length of pe(u, t) as Au. The specific algorithm process is detailed in Appendix B
5 Experiments
In this section, we conduct extensive experiments address the following research questions (RQs):
RQ1: Can PamaCF further improve the performance and robustness of traditional ACF?
RQ2: Why does PamaCF perform better than traditional ACF?
RQ3: How do hyper-parameters affect PamaCF?
5.1 Experimental Setup
In this section, we briefly introduce the experimental settings. For detailed information, including dataset preprocessing, comprehensive baseline descriptions, and implementation details, please refer to Appendix C.T
Datasets. We employ three common benchmarks: the Gowalla check-in in dataset 32 the Yelp2018
business dataset, and the MIND news recommendation dataset [33]
Attack Methods. We employ both heuristic (Random Attack 30 Bandwagon Attack 33 and
aptimization-based (Rev Attack (7), DP Attack (6) attack methods within black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.
Defense Baselines. We incorporate a variety of defense methods, including detection-based ap- proaches (GraphRti [12] and LLM4Dec [33), adversarial collaborative filtering methods (APR [I5] and SharpCF 220), and denoise-based strategy (StDenoise [35] 19). In our study, we employ three common backbone recommendation models, Matrix Factorization (MF) 2 LightGCN B. and
NeurMF [36].
Evaluation Metrics. The primary metrics for assessing recommendation performance are the top-k metrics: Recall&k and NDCG @ik, as documented in [ g 37 To quantify the success ratio of attacks, we utilize T-HR@k and T-NDCG@k to measure the performance of target items within the top-k recommendation
13 as:
1
Emetr II [tar I,u
T-HR&k
T
M Mear!
SarET
where is the set target items, Usar denotes the set of genuine users who have interacted with target items for, I,, represents the top-k list of recommendations for user u, and T[-)) is the indicator function that returns the condition true. The T-NDCG@k mirrors T-HR@k, serving as the target item-specific version of NDCG@k.
5.2 Performance Comparison (RQ1)
In this section, we answer RQL. We focus on two key aspects: the recommendation performance and the robustness against poisoning attacks.
7

---

Table 1: Recommendation Performance
Model
Cren (96)
Random Attack (5)
Bandragin Attack
DP Attark (8)
Roy Attack (6)
(Dorasett
20
NDCG
Recolle:20
NDCG
Recall::2
NOUG@20
Recalli:
NBCG
Recallos
NDOG6220
(Govalla)
11:35
4SiDemise
10:41
0.04
+GrapRRG
10.43
7.97
0.06
7,59
0.06
16.30
0.06
10.40
7,54 0.08
0.00
0.07
-AR
13.00 0.06
10.00
000
0.04
10.52
0.00
12.50
10.50
010
12.55
10.59 006
13.15 006
10:71
-ShorpCF
13:20
0.00
10001
000
15119: 0.06
1005
13.05
9.89
15.20
100%
0.100
13:32
0.00
T0,10
010
-PamoCF
13:48
6.02
10:44
0
15.7 2 600
10:4 2 0,65
13:35 2: 0.00
19:32 0.02
13.44 21 0
10:33 21 0.44
13
0:05
11,06 0.00
Grin
+2. 1052
+2.766 1
+1,40% 1
+3.065
+2.536
+3.07%
+1.317% 1
+3.23%6
+2.96%
+3.15%
Guin w.t. MF
+18.75%6 1
-52.6411 1
+18.27%
450.64% 1
+18.5316 1
+52.29%6
+25.39%% 7
+33.76% 1
+22.1886 1
+35.001%
(Y-1c2018)
3.76 0.03
1 0.01
0.03
0.04
3.03 0.08
0.04
0.04
0.0
261
2:50 0.0
0106
2.58 0.00
= 0.10
0.10
-fGraph
0106
APPE
4.09 0.02
3.16 0.00
0.03
3.15
0.02
"ShurpCFF
0.04
3.13
0.00
3,16 0.05
-PamsCF
4.18
0.02
3.29 =: 0.02
4.13 0,81
3.25 2: 0.01
4.19 0.04
3.29 :: 0.03
4.25 0.04
3.33 2: 0.04
4.27 = 0.03
3.37 2: 0.03
Gain
+2.3995
+2.7M% 1
+2.19%
+2.915
+2.09%
+5.01%
+5 3/%
-5.24%
+5.04 T
+5 2716
Guin war. MF
+11.22% 1
+10.6315 7
+10.72%%
+10.34% 1
+11.916 1
+11.00%6
+9.85% 1
+9.34%
+11.19 1
111.361
MP (MINE))
1:20-1 (1:01
0.08 1: 0100
1.19 U11
0.67 0:01
1.19 010
0.64 :: UIM
1.20 0000
0.00 0:01
DOM
00M
.SiDnnsise
1:13 0.01
0.63 0.01
0.01
0.00
1.12= 0.01
1:13 0.01
0.64 0.01
D6N
00M
<GruphRM
1.20 0.01
0.67
0,01
0.67 0.00
1.19 119-000 0.01
0.67 2: 0.01
1.20 0.02
0.67 0.01
00N
0GM
AAPR
1.22 0.00
0.65 0:0
122
1:21
0.0
0,70
PamoCF
1.30 0.01
0.73 :: 0.90
L.77 + 0.81
0.72 0.00
1.27 0.01
0.72 : 0.00
1.30 2: 0.01
0.74 2: 0.01
DON
00M
Guin
17.005
+7.53%
+0.71%
10.09%
15.02%
15.12%
+6.90%
+6.26%
Coin Wir. MF
+8.302 9052
+8.49%
+681 1
+7.00% T
+6.00%
+6 666
+7.99%
-7.49%
The Ray sritcc methrol courdd not be incosted on the datsect duse momoryy conatrinnts routling an out-uuf-memmryy crnn
Table 2: Robustness against target items promotion
Dataset
Model
Random Atlack(S)
Bandwagon Attack( (%)
DP (Stack((S)
Rev Attack(())
T-1RG-50
T-NDCG050
1:11
T-NDCGG50
T-11R:50
T-NDOG850
T-IR
T-NDCG@50
MF
0.148 a: 0.030
0.036 =: 0.008
0.120 = 0.027
0,029 s 0,000
0.201
0.000
0,051 4: 0.005
0.246 a: 0.097
0.61 a: 0.027
-SiDenoise
0.300 + 0.049
0,000 - 0.012
0.165 = 0.054
0.038 0.006
0.292
+ 0.034
0.074 + 0.000
0.355 + +00126
0084 0.030
-GraphRii
0.159 1 0.061
0,42 1 0.015
0.154 1 0.038
0.036
0.009
0,174 1 0.008
0,013 1 0.009
0.206
1.002
0.060
1.010
Gowalla
AAPR
0.201 +: 0.091
0.044
= 0.026
0.184
a: 0.867
0.047
2 0,015
0.0144
0.021
0:006
2: 0.004
01261
+ 0.063
0067
0.018
-SharpCF
0.304 + 0.037
0.40 + 0.010
0.169
0.031
0,041 0 0,008
0,301
0.004
0.077
+ 0.006
0.350
+ +.111
0/87 +.001
-PamaCP
0,870 1: 0.028
0
:: 0.007
0.064 0,026
0.015
0,006
0,021
0.011
0,004 :: 0.002
0,079 :: 0.039
0.019 0.009
Gain"
1
+17
+61.41%
+62,51%
0.035 + 0.007
0.73
0.033
0.020
0.223
0.040
0.009
0.153 0.025
0/40
-StDesolse
0.038
0.111
0.046
0,043
0.011
0.198
0.029
0.331 1.1.45
0.075
-GraphRii
0.009
0.58
0.015
0.003
0.011
1 0.010
0.129
1.027
0.011
Yelp2018
-APK
0.012
0.007
0.04
01802
0187
0.013
0.011
0.185
0.00%
0.040
0.009
0.09H
0.48
0.02
0.011
-ShrpCFF
0.044 : 0.007
0010 0.002
0.022
0.029
0.019
0.008
0.226
0.041
0.050
:: 0.010
0.152
1 0.025
0.40 :: 0.006
-PamaCF
0.000 1 0.006
0,004 :: 0.002
0.028
0.022
0.007
0.005
0.135
0.033
0.027 1 0.007
0,045 1: 0.021
0.010 0.004
Gain
+34,29%
+18.22%
+50.33% 1
+45.73% 1
+27.4116 1
+30.02%
+54.24%
+33.25% 7
MF
0.022 + 00007
0.100
= 0.012
0.169
0.017
0
0,005
0 =: 0.013
0,005 # 00003
00M
O0M
-SiDenoise
0.066 + 0.006
0013 + +00004
0040
0.006
0.020
0.004
0.010 + 0.003
8:000 + 0.001
0OM
0OM
-GraphRB
0.011 1: 0.006
0.100
1 0.002
0,199
0,013
0.059
0,005
0,022
1: 0.009
0,001 1 0.002
00M
OOM
MIND
-LLMMDee
0.00 + 0.001
0 = 0.000
0,833
0.009
0,025
0.003
0.019
0.010
0:004 # 0.062
00M
00M
-APR
01063
= 0.015
0.035
= 0.8866
0.068 0,005
0,023
0,002
0,1005
0.007
0,002
:: 0.001
00M
00M
-PamaCV
0 + 0.002
0.005 = 0.0811
0.016 0,002
0,006
0,001
0.000
0,000
0,000 + 1.000
00M
00M
Gain
+39,800 -39.80%
+60.
15%
+72.10%
+95.02%
-94.32%
Turpet lix Ratio (Tquuaiion
7 T- 50 T-NDOGG
target items dutasees 0.000.
The relative pescentape incresse of PamaC'Fss metrics the best value other busclines' metrics, Le.. (zain (1 (T-HBlssatee T-HBppwacy' / mninfI H-HRRuataan)
Nouably, only three decimul places are presented due to space limitations, though actual ranking and calculations utilize precision of data.
Recommendation Performance. We assess the efficacy of PamaCF in both clean and poisoning data contexts, focusing on the performance of recommender systems, as presented in Table [ The aanoise-base defense method, which does not directly defend against poisoning attacks but rather purifies noisy interactions, fails to improve recommendation performance most cases. Detection- based methods, such as GraphRfi and LLM4Dee, exhibit some misclassifications of fake and genuine users, leading to a decline in recommendation performance.
recommentiin
In contrast, we observe a notable enhancement in recommendation quality when ACF methods (APR, SharpCF, and PamaCF) are utilized. This finding is consistent with results from previous studies [5 20 and aligns with our prior theoretical analysis. Among the defense methods, PamaCF sigmii
stands out, achieving the most significant improvements in recommendation performance compared to the backbonn model and other baseline approaches. Specifically, PamaCF increases Recall and NDCG@20 by 13.84% and 22.04% in average, respectively, compared the backbone model.
Robustness Against Poisoning Attacks. We evaluate the capability of PamaCF in defending against poisoning attacks by examining the attack success ratio. Our experiments specifically target items with notably low popularity, as indicated by T-HR @50 and T-NDCG@50 scores of 0.0 when no attacks are present. Lower scores for T- H-HR550 and T-NDCG@50 indicate stronger defense capabilities.
Table 2 presents the results, indicating that the purely denoise-based defense method is generally ineffective against most attacks and may even increase the attack's 's success ratio in some instances.
8

---

Togel bas
Ol
Fant
Embeliingo T-SNE)
Magshale
Ditaneer
Dodasoo 8.776
Gooall
Tuava
YalaSria
Mihin
Aotalake Mugasak
(a) Embedding Visualization
(b) Perturbation Magnitude Comparison
Figure 2: (a) PamaCF brings real preference items closer; (b) PamaCF achieves larger magnitudes.
TINDDE
NDC
1.0
15
05 11
Figure 3: Left: Analysis of Hyper-Parameters pú Right: Analysis of Hyper- Parametees X.
Detection- based methods, such as GraphRfi and LLM4Dec, show robust defense against attacks similar to their training data, i.c., random attacks. However, the effectiveness of GraphRfi declines against other attack types. In contrast, ACF methods demonstrate stable defense capabilities across various attacks. Specifically, PamaCF significantly reduces the success ratio of attacks, decreasing T-HR@50 and T-NDCG@50 by 49. 99.9%% and 43. 43.73% in average, respectively, compared the best baseline. These results highlight PamaCF's advanced defense capabilities against various attacks.
Additionally, PamaCF's defense effectiveness against attacks targeting popular items is further evalu- ated. The corresponding results for LightGCN [3] and NeuMF [36), along with the recommendation performance top-10, also presented. All supplementary results in Appendix C.2
5.3 Augmentation Analysis (RQ2)
In this section, we address RQ2 by exploring why PamaCF can outperform traditional ACF (especially APR (15)) through embedding visualization and perturbation magnitude comparison.
Embedding Visualization. We randomly select the user, real preference items, the target item given by attacks, and other items in the user's top-10 recommendation list into two-dimensional space using T-SNE (38), as shown in Figure 2(a) We observe that PamaCF can bring real preference items closer, reducing the distance from the farthest real preference item from 0.736 to 0.365, while leading the target item farther away from all the real preference items. PamaCF's personalized perturbation magnitude lowers the ranking of both the target item and other items, thus improving robustness and performance.
and project the normalized embeddings of
Perturbation Magnitude Comparison. We compare the maximum perturbation magnitudes of APR and PamaCF, i.e., in Equation I for APR and p in Equation 6 for PamaCF. Both and p selected through
tuning from {0.1, 0.2. 1.03. In the left part of Figure 2(b) we observe that PamaCF finds higher perturbation magnitude. Additionally, the right portion of Figure 2(b) illustrates the distribution of personalized perturbation magnitudes across all users. These varying magnitudes for different users contribute to the improved effectiveness of PamaCF.
5.4 Hyper-Parametenr Analysis (RQ3)
In this section, answer RQ3 by exploring the effects of the hyperparameters, magnitude p and adversarial training weight X, as defined in Equation 6 The results are illustrated in Figure
Analysis of Hyper-Parameters p. With À fixed at 1.0, we vary from 0.1 to 1.0 in increments of 1. Our findings demonstrate a significant improvement in both robustness and performance p increases. Notably, even when P exceeds 0.1, there is enhancement in recommendation

---

performance compared to that of the backbone model, i.e., MF, with the range between 0.7 and 0.9 yielding the most significant enhancements.
Analysis of Parpee-Parameters X. With set at 0.9, we adjust from 0.2 to 2.0 in increments of 0.2. The analysis indicates that the defensive ability becomes stable once À surpasses 1.0 in most attacks. However, setting À too high gradually diminishes the recommendation performance of PamaCF. Despite this, the performance of PamaCF remains considerably improved compared MF.
Conclusion
In this work, theoretically analyze why Adversarial Collaborative Filtering (ACF) enhances both the performance and robustness of Collaborative Filtering (CF) systems against poisoning attacks. Additionally, by establishing bounds for reductions in recommendation error during ACF's optimization process, we discover that applying personalized perturbation magniuuees for users based on their embedding scales can significantly improve ACF's effectivvness. Leveraging these theoretical understandings, we introduce Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Comprehensive experiments confirm that PamaCF effectively defends against various attacks and significantly enhances the quality of recommendations.
Limitations. Our study identifies several limitations that require further investigation. Firstly, theoretical analysis based on certain assumptions, specifically with the Gaussian Recommender System. We intend relax these assumptions in future work. Secondly, this study only examines adversarial training within CF recommendations. In future research, we plan to extend our analysis include more recommendation scenarios, such sequential recommendations.
Broader Impacts. Our work focuses on enhancing both the performance and robustness of recom- mender systems against poisoning attacks, thereby benefiting the overall development of recommender systems. We do not foresee any negative impacts resulting from our work.
Acknowledgements
This work is funded by the National Key R&D Program of China (2022YFB3103700 2022YFB3103701, the Strategic Priority Research Program of the Chinese Academy of Sciences under Grant No. XDB0680101, and the National Natural Science Foundation of China under Grant Nos. 62102402, 62272125, U21B2046. Huawei Shen is also supported by Beijing Academy of Artificial Intelligence (BAAI).
References
[1] Xiaoyuan Su and Taghi M Khoshgoftaar. A survey of collaborative filtering techniques. Ad- vances in Artificial Intelligence, 2009, 2009.
[2] Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recom- mender systems. Computer, 42(8):30-37, 2009.
[3] Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, YongDong Zhang, and Meng Wang. Lightgen Simplifying and Powering Graph Convolution Network for Recommendation. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 339-648.4 ACM, 2020.
[4] Brent Smith and Greg Linden. Two decades of recommender systems at amazon. com. IEEE Internet Computing. 21 2017.
[5] Carlos Gomez-Uribe and Neil Hunt. The netflix recommender system: Algorithms, business value, and innovation. ACM Transactions Management Information Systems, 6(4):1-19, 2015.
[6] Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data Poisoning Attacks to Deep Learning Based Recommender Systems. In Proceedings 202 Network and Distributed System Security Symposium, 2021.
10

---

[7] Jiaxi Tang, Hongyi Wen, and Ke Wang. Revisiting adversarially learned injection attacks against recommender systems. In Proceedings of the 14th ACM Conference on Recommender Systems, pages 318-327, 2020.
[8] Kaike Zhang. Qi Cao, Fei Sun, Yunfan Wu, Shuchang Tao, Huawei Shen, and Xueqi Cheng. Robust recommender system: A survey and future directions. arXiv preprint arXiv:2309.0005: 2023.
[9] Chen- Cao Chung, Ping- Yu Hsu, and Shih-Hsiang Huang. 5p: A novel approach to filter out malicious rating rrofiles from recommender systems. Decision Support Systems, 55(1):314-325, 2013.
[10] Fuzhi Zhang and Quanqiang Zhou. Hht-SVM: An online method for detecting profile injection attacks in collaborative recommender systems. Knowledge-Basee Systems, 65:96-105, 2014.
[11] Zhihai Yang, Lin Xu, Zhongmin Cai, and Zonghen Xu. Re-scale AdaBoost for attack detection in collaborative filtering recommender systems. Knowledge- Based Systems, 100:74-88, 2016.
[12] Shijie Zhang, Hongzhi Yin, Tong Chen, Quoc Viet Nguyen Hung. Zi Huang, and Lizhen Cui. Gen-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 689-698, 2020.
[13] Kaike Zhang, Qi Cao, Yunfan Wu, Fei Sun, Huawei Shen, and Xueqi Cheng. Lorec: Combating poisons with large language model for robust sequential recommendation. Proceedings of the 47th International ACM SIGIR Conference Research and Development in Information Retrieval, pages 1733-1742, 2024.
[14] Yuli Liu. Recommending Inferior Results: A General and Feature-Free Model for Spam Detection. In Proceedings of the 29th ACM International Conference on Information and Knowledge Management, pages 955 974,, 2020.
[15] Xiangnan He, Zhankui He, Xiaoyu Du, and Tat-Seng Chua. Adversarial Personalized Ranking for Recommendation. The 41st International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 355-364- 2018.
[16] Huiyuan Chen and Jing Li. Adversarial tensor factorization for context-aware recommendation. In Proceedings of the 13th ACM Conference on Recommender Systems, pages 363-367, 2019.
[17] Ruirui Li, Xian Wu, and Wei Wang. Adversarial learning compare: Self-attentive prospective customer recommendation in location based social networks. Proceedings of the 13th International Conference Web Search and Data Mining, pages 349-357, 2020.
[18] Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, Enhong Chen, and Senchao Yuan. Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages (074-1083) 2021.
[19] Haibo Ye, Xinjie Li, Yuan Yao, and Hanghang Tong. Towards robust neural graph collaborative filtering via structure denoising and embedding perturbation. ACM Transactions on Information Systems, 41(3):1-25 2023.
[20] Huiyuan Chen, Xiaoting Li, Vivian Lai, Chin-Chia Michael Yeh, Yujie Fan, Yan Zheng, Mahashweta Das, and Hao Yang. Adversarial Collaborative Filtering for Free. In Proceedings of the 17th ACM Conference on Recommender Systems, pages 245-255. ACM, 2023.
[21] Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. In Advances in Neural Information Processing Systems, volume 36, pages 13931-13955 2024.
[22] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv: 100.::770000044 2017.
11

---

[23] Yian Deng and Tingting Mu. Understanding and improving ensemble adversarial defense. In Advances Neural Information Processing Systems, volume 36, pages 58075-58087, 2023.
[24]
Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems, volume 32, 2019.
[25] Cheng- -sin Weng, Yan-Ting Lee, and Shan-Hung Brandon Wu. On the trade-off between adversarial and backdoor robustness. In Advances in Neural Information Processing Systems, volume 33, pages 11973-11988 11983, 2020.
[26] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pages 7472-7482. PMLR, 2019.
[27] Kaike Zhang. Qi Cao, Yunfan Wu, Fei Sun, Huawei Shen, and Xueqi Cheng. Improving the shortest plank: Vulnerability-awaan adversarial training for robust recommender system. In Proceedings of the 18th ACM Conference on Recommender Systems, pages 680-689, 2024.
(28) Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi and R. Garnett, editors, Advances in Neural Information Pro- cessing Systems, volume 31, 2018.
[29] Haoyang LI, Shimin DI, and Lei Chen. Revisiting Injective Attacks on Recommender Systems. In Conference on Neural Information Processing Systems (NeurIPS), volume 35, pages 29989- 30002, 2022.
[30] Shyong K Lam and John Riedl. Shilling recommender systems for fun and profit. In Proceedings of the 13th International Conference on World Wide Web, pages 393-402, 2004.
[31] Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thiems Bpr: Bayesian personalized ranking from implicit feedback. In Proceedings of the Twenty-Fifth Conference Uncertainty in Artificial Intelligence, pages 452-461, 2009.
[32] Dawen Liang, Laurent Charlin, James McInemny, and David M Blei. Modeling user exposure in recommendation. In Proceedings of the 25th International Conference on World Wide Web, pages 951-961, 2016.
[33] Fangzhao Wu, Ying Qiao, Jiun-Hung Chen, Chuhan Wu, Tao Qi, Jianxun Lian, Danyang Liu, Xing Xie, Jianfeng Gao. Winnie Wu, et al. Mind: A large-scale dataset for news recommendation. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3597-3606, 2020.
[34] Robin Burke, Bamshad Mobasher, and Runa Bhaumik. Limited knowledge shilling attacks in collaborative filtering systems. In Proceedings of 3rd International Workshop on Intelli- gent Techniques for Weh Personalization, 19th International Joint Conference on Artificial Intelligence, pages 17-24, 2005.
[35] Changxin Tian, Yuexiang Xie, Yaliang Li, Nan Yang, and Wayne Xin Zhao. Learning to Denoise Unreliable Interactions for Graph Collaborative Filtering. In Proceedings of the 45th International ACM SIGIR Conference Research and Development in Information Retrieval, pages 122-132, 2022.
[36] Xiangnan He, Lizi Liao, Hanwang Zhang, Ligiang Nie, Xia Hu, and Tat-Seng Chua. Neural collaborative filtering. In Proceedings of the 26th International Conference on World Wide Weh, pages 173-182, 2017.
[37] Xiang Wang. Xiangnan He, Meng Wang, Fuli Feng, and Tat-Seng Chua. Neural graph collabo- rative filtering. In Proceedings of the 42nd international ACM SIGIR Conference on Research and Development in Information Retrieval, pages 165-174, 2019.
[38] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne, Journal of Machine Learning Research, 9(11), 2008
12

---

[39] Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for youtube recommenda- tions. In Proceedings of the 10th ACM Conference on Recommender Systems, pages 191-198, 2016.
[40] Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L Hamilton, and Jure Leskovec. Graph convolutional neural networks for web-scale recommender systems. In Proceedings of the 24th ACM SIGKDD International Conference Knowledge Discovery and Data Mining, pages 974-983, 2018.
[41] Yehuda Koren, Steffen Rendle, and Robert Bell. Advances in collaborative filtering. Recom- mender Systems Handbook, pages 91-142, 2021.
[42] Hao Wang, Naiyan Wang. and Din Yeung. Collaborative deep learning for recommender systems. In Proceedings of the 2/th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 1244,144, 2015.
[43] Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams. Toward trustworthy rec- ommender systems: An analysis of attack models and algorithm robustness, ACM Transactions on Internet Technology, 7(4):23-es, 2007.
[44] Carlos E Seminario and David C Wilson. Attacking item- based recommender systems with power items. In Proceedings of the 8th ACM Conference Recommender Systems, pages 57-64, 2014.
[45] Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-basse collaborative filtering. In Advances Neural Information Processing Systems, volume 29, 2016.
[46] Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. Triple adversarial learning for influence- based poisoning attack in recommender systems. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1830-1840, 2021.
[47] Jingfan Chen, Wenqi Fan, Guanghui Zhu, Xiangyu Zhao, Chunfeng Yuan, Qing Li, and Yihua Huang. Knowledge-enhaneed black-box attacks for recommendations. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 108-117, 2022.
[48] Fulan Qian, Bei Yuan, Hai Chen, Jie Chen, Defu Lian, and Shu Zhao. Enhancing the trans- ferability of adversarial examples based on nesterov momentum for recommendation systems. IEEE Transactions on Big Data, 2023.
[49] Yanling Wang. Yuchen Liu, Qian Wang, Cong Wang, and Chenliang Li. Poisoning self- supervised learning based sequential recommendations. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 300-310, 2023.
[50] Ziheng Chen, Fabrizio Silvestri, Jia Wang, Yongfeng Zhang, and Gabriele Tolomei. The dark side of explanations: Poisoning recommender systems with counterfactual examples. arXiv preprint arXiv:2305.005744 2023.
[51] Chengzhi Huang and Hui Li. Single-use user injection for invisible shilling attack against recom- mender systems. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pages 864-873, 2023.
[52] Yunfan Wu, Qi Cao, Shuchang Tao, Kaike Zhang, Fei Sun, and Huawei Shen. Accelcrating the surrogate retraining for poisoning attacks against recommender systems. Proceedings of the 18th ACM Conference on Recommender Systems, pages 701-711, 2024.
[53] Paul-Alexande Chirita, Wolfgang Nejdl, and Cristian Zamfi.. Preventing shilling attacks in online recommender systems. In Proceedings of the 7th Annual ACM International Workshop on Web Information and Data Management, pages 67-74, 2005.
13

---

A Related Work
A.1 Collaborative Filtering
Collaborative Filtering (CF) has become a cornerstone of modern recommender systems, evidenced by its widespread application various studies 39, 40. The fundamental premise of CF that users with similar preferences are likely to exhibit similar behaviors, which can be leveraged to predict future recommendations [41]. A principal approach within CF is Matrix Factorization, which learns latent embeddings of users and items by decomposing the observed interaction matrix (2).
With the advent of deep learning. neural CF models have emerged, designed to capture more complex patterns in user preferences. For example, CDL 42 merges auxiliary item information through neural networks into CF, addressing challenges associated with data sparsity. Additionally. NCF [66 replaces the traditional dot product with a neural network, enhancing the modeling of user-item interactions. More recently, Graph Neural Networks have prompted the development of graph- based CF models, such as NGCF [37 and LightGCN 3 which have shown remarkable efficacy in recommender systems. However, despite these technological advances, susceptibility to poisoning attacks remains a significant challenge, compromising the robustness of these systems
A.2 Poisoning Attacks against Recommender Systems
Poisoning attacks within recommender systems involve injecting fake users into the training data manipulate the exposure of certain items. Initial research predominantly focused on rule-based heuristic attacks, where profiles for these fake users were constructed using predetermined heuristic For example, the Random Attack (30 generated fake users interacting with targeted items alongside random selection of other items. In contrast, the Bandwagon Attack [34] generated fake user interactions include targeted items and others selected for their high popularity,
rules 30 43 44.
As the technique of attacks has evolved, recent studies have shifted towards optimization-ban based 46 47 48 49] 50, [5 (2). For instance, the Rev Attack (7] formalizes the attack as a bi-level optimization problem, addressed using gradient-based techniques. Similarly, the DP Attack 6 specifically targets deep learning- recommender systems.
methods for generating fake users 7 6. [2 45
A.3 Robust Recommender Systems
Mainstream strategies for enhancing the robustness of CF systems against poisoning attacks broadly categorize into two main approaches (8) (1) detecting and removing fake users [9 10 12 13
14 [3], and (2) developing robust models via adversarial training, i.c., Adversarial Collaborative
Filtering (ACF) [1
18
20 27).
Detection-based strategies focus either on pre-identifying and removing potential fake users from the dataset [9] [10
[1 [4] or on mitigating their influence during the training phase [12 [3]. These methods often rely on specific assumptions about the attacks
or require supervised data regarding attacks I10 12 [3. Among these, LoRec [ utilizes large language models to
9 12
enhance sequential recommendations, overcoming the limitations associated with specific knowledge in detection-based strategies. However, its scope is limited to sequential recommender systems and may not generalize well across different CF scenarios.
Conversely, ACF methodologies, particularly those aligned with the Adversarial Personalized Ranking (APR) framework [13], integrate adversarial perturbations at the parameter level (i.e., user and item embeddings) during the model training process [5] 17
19 20 This approach follows "min- max" optimization paradigm, designed to minimize the error in recommendations under parameter perturbations which aim to maximize the error [13]. Besides, numerous studies have demonstrated that ACF not only enhances the model's 's robustness but also improves its recommendation performance [15] Nonetheless, despite its benefits in specific contexts through empirical validation, the intrinsic mechanisms of ACF's effectiveness and its universal applicability remain areas for further theoretical exploration.
20 27
14

---

Algorithm The Training Procedure of PamaCF-BPR
Input:
Training set D, uniform perturbation magnitude p. adversarial training weight X, pre-training epochs T pre. batch size
Output: Model parameters θ [U.V] Vl.
1: Pre-train θ = (U.V] for pre epochs using Equation
2: while stopping criteria not met do
3: Draw batch of B pairs (u, i, from D.
4: for each (u, i. in the batch do
5: Calculate A PamaCF
4 A.amaCrr and A AamaCT using Equation 10
6: Compute PPaaaC ((u, i, ()) using Equation 9
7: end for
8: Update θ using the aggregated gradients from LPamaCF (9) in the batch.
9:
end while
10: return == [
B
Methodology
For clarity, present the PamaCF version of the widely used Bayesian Personalized Ranking (BPR) [31] loss function, which optimizes recommender models towards personalized ranking. Given the user set U {u}, the item set V (v), and the training D {(u,i,j) u U A
Vu A.j E V V.J. where Vú, denotes the set of items with which user w has interacted. The objective function (to be minimized) of BPR is formally given by:
CBPn(O U. V))
Σ In ((U,, Vi) (Ua, VJ)),
(8)
(MAJ)ED
where and V represent the learned user and item embeddings, respectively,
The PamaCF version of the BPR loss function is defined as:
Cr (0) LBPR ()) ACBrR + A PamaCF), )
whore
PamaCF
arg A, |l IlA (Epp ( + A):
max
where À is the weight of adversarial training, P represents the uniform perturbation magnitude for all users, and
c(u,t) t) =sig
[u(e)]
The specific handling of a pair (u, i,j) E D is expressed by:
Cramacr((u, (,)) = - In ((,,, Vi) (U., Vi))
(9)
-AIno ((Ua + A PamaCF
V A PamaCF) (U, A PamaCF
V, A PamaCF)),
where
where Ta ÖLAPR ( (u, 1, + PamaCF)
A Pa =pc(u, uu t)
[Tlll
0A, r, DLrnn(us i, + PamaCF
I;
A PamaCF =pc(u,t)
where
(10)
||T||
0b, F (CBPR((u,i,,)) + PamaCF) 0A,
I
PamsCF =pc(u,t) t)
where
||>
The procedure of training with PamaCF is illustrated in Algorithm
C
Experiments
C.1 Supplements to Experimental Settings
Datasets. We employ three common benchmarks: the Gowalla check-in dataset [32] the Yelp2018 business dataset, and the MIND news recommendation dataset [33]. The Gowalla and Yelp2018
15

---

Table 3: Dataset statistics
DATASET
#Users
#ltems
#Ratings
Ant.Inter.
Sparsity
Gowalla
29,858
40,981
1,027.370
34.4
99.92%
Yelp2018
31,668
38,048
1,561,406
49.3
99.88%
MIND
141.920
36,214
20,693,122
145.8
99.60%
datasets include interactions from all users. For the MIND dataset, we sample a subset of users following [13]. Following (7), users and items with fewer than 10 interactions are excluded from our analysis. We allocate 80% of cach user's historical interactions to the training set and the remainder for testing. Additionally, 10% of the interactions from the training set are randomly selected to form validation set for hyperparameter tuning. Detailed statistics of the datasets are summarized in Table
Attack Methods. We explore both heuristic (Random Attack [30] Bandwagon Attack [34] and
optimization-basel (Rev Attack (7), DP Attack (6)) attack methods within a black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.
Random Attack (Heuristic Method) [30] This method entails fake users including interactions with both the targeted items and a set of randomly chosen items.
Bandwagon Attack (Heuristic Method) 34 Fake users' interactions encompass the targeted
items and those selected for their high popularity.
DP Attack (Optimization-based Method) [6]: This approach is specifically designed to compromise
deep learning- recommender systems.
The attack is conceptualized as a bi-level optimiza- tion problem, addressed through gradient-base based methods.
Rev Attack (Optimization-basee Method) 7
Defense Baselines. We incorporate a variety of defense methods, including detection-based ap-
proaches (GraphRfi [12] and M.L [13),, adversarial collaborative filtering methods (APR [IS] and SharpCF 20)). and a denoise-based strategy (StDenoise 35 19). . In our study, we employ three
common backbone recommendation models, MF (2) LightGCN 3 and NeurMF [36).
GraphRti [2]
Employs a combination of Graph Convolutional Networks and Neural Random Forests for identifying fake users.
LLM4Dec
13:
Utilizes an LLM-based framework for fake users detection.
APR 15
Generates parameter perturbations and integrates these perturbations into training.
SharpCF 20
Adopts sharpness-awarr minimization approach to refine the adversarial training process proposed by APR.
StDenoise 35
Applies a structural denoising technique that leverages the similarity between Un and Vú for each (u, pair, aiding in the removal of noise, as described in [35]1]
19
Note that: With the need of item-side information, LLM4Dec is exclusively evaluated on the MIND dataset. Moreover, we observe that SharpCF, initially proposed for the MF model, exhibits unstable training performance when applied the LightGCN model or the MIND dataset. Consequently, we present SharpCF results solely for the MF model on the Gowalla and Yelp2018 8 datasets.
Implementation Details. In our study, employ three common backbone recommendation models, Matrix Factorization (MF) 22 LightGCN (3, and NeurMF 33 To quantify the success ratio
[8] while for assessing recommendation performance, we utilize & = 10, 20 following B 37 For each attack setting, we conduct experiments five times, taking the average value as the result and the standard deviation as the error bar. The configuration of both the defense methods and the recommendation models involves selecting a learning rate from 10.1, 0.01. 0.O1.....
of attacks, we select & 50 as the evaluation metric following 6
10 10-5), and weight decay from (0, 0.1, .... 1 x 10-61 }. The implementation of GraphRfi follows its paper. For the detection- methods, we employ the Random Attack to generate supervised attack data. The magnitude parameter of adversarial perturbations in both APR and PamaCF is determined from range of 10 0.2, 1.0). In terms of attack methods, we set the attack budget to 1% and target five specific items. The hyperparameters align with those detailed in their original publications.
16

---

Backbone
Best Basclines
PamzCC
T-DDCG350 (%)
T-IRRg30 (56)
Random PopArk
Bondooggo Popsil
DP PopAAk
Rev PopAik.
Random PopAtk.
Bandwaagon PopAik.
DP
Rev PopAik.
PopAik.
Attock Type
Arack Type
Figure 4: Robustness against popular items promotion.
Table 4: Robustness against target items promotion on Gowalla
Datased
Model
Random Attack(()
Handwagon Attack/S)
Attack/S)
Artack/S)
THRG 50'
T-NDCG050
THIG
T-NDCG050
T:
T-NDCG050
T-NDCG050
LighGEN
0.334 0.16
0.066 + +.0.31
0.639 + 0.000
0.133
0.024
0.31 + 0048
0.48 + -00000
0718 + 00134
0.149 0.026
SSiDenssse
0.118 0068
0.020 + 0.019
0.334 + 0.092
0.099
0.020
0.585 + 0.092
0120 + 000199
1304
+ +0188
02559
0.037
-GraphRti
0.099 1 0023
0.023
1 0.006
0.710 0.250
0.161
1 0.022
0.288
1 0.088
0.0th
1 100010
0.544 1.067
0.11 10013
4APR
0.089 0055
0.211 = 0.015
0.332 4: 0.050
0.099
à: 0.012
0.190
0.057
0.399 a 0.008
00655
: 0.14
0132 0.027
+PamaCVV
0,53 = 0.941
0.013 : 0.011
0.194 = 8J037
0J94
0.009
0.116 0.030
0J023 = 0.006
0.336 + 0.661
0J770 = 0.012
Gra"
+40,45%
+36.92%
+400.12%
Gowalla
NeurMF
0,404 0.19%
0.045
0.887
0626
0.189
0047
0007
0010
0.004
0210 0.077
0142
-SiDemsise
0.366
+Graphitii
0.000
0.103
0017
0011 00013
0.003
0006
0053
0.28
0.006
0.77
0217
0.106
0.066
0.02
0.005
0.92
.PamaCF
0,074
0.0066
0.168
0J838
0.021
Gzin
#20.988
+17.65%
+64.81%
+62.5%%
+22.99% ?
+19.87%
+3.99%
+0.118
Target Item lit Ratio (Equation 7 8- und T NDCGG80 of target iemm un cleum dasasets are 0,000.
The relative percentage of PamaC3's is metris to the best value of other baselline' metrics, (mil (I-HRg Jives) I- I-HB.yr) miamm-HHaaaaaaa
Nousbly, only three decimal places presented duc space limittions, though the sctal ranking and colculations villiz the full precision of the dats. The Rev stack method could execused dasaset due memury constraints, resulting
of
Compute Resources. The experiments are conducted using two primary GPU: the RTX 4090 with 24GB of VRAM and the A800 with 80GB of VRAM. For most baseline defense methods applied across all datasets, a single RTX 4090 GPU suffices, requiring several hours per experiment. However, the LLM4Dec method [13 demands an A800 GPU due to its higher resource requirements for processing Large Language Models. In terms of attack generation, heuristic poisoning attacks such as the Random Attack [30] and Bandwagon Attack [34 are generated within seconds and do not require specific GPU resources. Conversely, the time required to generate optimization- based poisoning attacks, such the DP Attack [6] and Rev Attack (7], depends on the dataset. For the Gowalla and Yelp datasets, these attacks take hours to execute on an A800 GPU. The DP Attack on the MIND dataset extends to several days, also utilizing A800 GPU. However, the Rev Attack cannot be completed on a single A800 GPU due to its even greater computational demands.
C.2 Supplements to Performance Comparison
We assess PamaCF's defense capabilities against attacks targeting popular items on Gowalla. Accord- ing to Figure 4 PamaCF exhibits strong defensibility, outperforming the best baseline even when attacks specifically promote popular items.
We also evaluate PamaCF's defense capabilities and recommendation performance when applied to LightGCN 3 and NeurMF [6], as shown in Table and Table 5 which produces consistent results
with MF 2
Additionally, we report PamaCF's recommendation performance on MF for the Gowalla dataset, specifically for k = 10, using Recall@10 and NDCG@10. PamaCF demonstrates significantly greater improvement at k = 10, achieving a 29. 29.59% increase Recall and 56.41 % increase in NDCG, relative to the baseline model, as shown in Table
17

---

Table 5: Recommendation Performance Gowalla
Model
Clean (8)
Randon Attack (%)
Randwngin Attark (8)
DP Attack (3)
Rov Attack (1R)
(Donsset)
Recalle
NDCG6520
2e
NDCG020
Recalle:20
NDCG620
Recalli:
NDCG6:20
Re
NBCG
LightGNN
0.83
0/02
10.10
10:25
*StDeenotee
942
9.77 0.00
0,05
0.02
+GGraphien
1004
0.02
0.04
0:00
12.78
+PamoCP
1518 0.62
10.28 0.02
0.03
10.15
13,00 9.00
10.13
1309 0.02
10,30
13:24 0.04
10.34 1.0/0
Gom
-3.00%
+2.36%
+2.4216
-2.7816
+2.105
+0.99%
+3.9316
-0.81
Guin W.L. MF
+5.15%
+24.23%
44.55%
+22.91%9
+4.00%
+22.29%0
+1.99%
+0.995
+1,935
-0,31%
NemrMI
M.9 6 0.28
6.74 2: 0.30
9:65 1: 0.16
0.59
2 0.16
9:76 1: 0.19
6:77 0.27
9.65 3 0.57
6.52 0.58
9.58 =: 0.31
6,50 &: 0.36
-SiDheoutse
10.21
0:11
6:92
8 0:33
9.87
1: 0.25
6.71 0.24
10.12 0.23
6.58 0:21
9.82 8 0.55
6,53
0.55
9:75
= 0.50
6.36 0.56
GGeaphiiii
9.82 2: 0.52
6.65 0.41
9.84
22 0.35
6.78
0.44
9.65
2: 0.31
6.50 2: 0.36
9.92 3: 0.18
6.78
0.22
9.77
= 0.39
6.63 0.45
+APR
10.02
0.24
6.92
à 0,24
9.99
d: 0.22
6,90
0.23
9.90
+: 0.29
6.91 a: 0.35
9.55 1. 0.34
6,74
0.42
9.74
0.35
0:67 4 0.41
7.06
0.40
0.44
0.36
+0.53%
+19778
+3.325
+3.50%
+3.5518
+2.19%
+1.249
+2.54%
-2.67%
Thee perornraee inceusse PanaC thrugh the onkking colcelatione unilow precision
metrics Nosahly only
places presented spoce limitations.
Table 6: Recommendation Performance @ 10 on Gowalla
Model
Chan (%)
Rundom Attack (9)
Bandvagun Attack (%)
DP Attack (N)
Rev Attack (%)
(Datneet)
Recalle 10
NDCG@110 10
Recatio1
NDCG310
1ecall::1
NDCG
Recaller 10
NDCG0110
Recallo:
NDCG6 10
MF
7.49 + 0.08
5.85 + 0.03
7.47
0.04
5,89 + 0.05
7.41 + 0.06
5.8 + 0.04
7.34 +:1.1
7:23 + 0.08
7.24 + 0.04
7:26 + 0.02
-SiDenuise
7.00 1 0.08
7.17 1 1.100
6.99 1 0.08
7.16 0.06
6.85 1 0.09
7.13
1: 0.03
7.09 1.1.1
7:22 1 0.09
7,14 0.04
7.29 1 0.05
~Graphina
6.58 +: 0.05
7.03 4: 0.06
6,92
0.06
6,96 = 0.00
6,80 s: 0.34
6.91 0:00 0.06
6.97 0:07
7.02
2: 0.09
7.6
2: 0.00
7.88 à: 0.06
-APR
9.29 2: 0.06
9,69
4: 0.06
9.21
à: 0.04
9.58
a 0.01
9.20
2 0.05
9
0.03
9:24
0.00
9.44
9.41 2: 0.07
9.78 à: 0.09
-SharpCF
8.81 + 0.09
8,3
+ 0.10
8.80
0.09
8.84
+ 0.00
8.7
+ 0.05
6.72+ 0.06
8.91 +:011
8.91
+ 0.0.9
8.92 0.05
8,03 + 0.03
-PamaCF
0.56 + 0.02
9.84 + 0J15
9.46 + 0.83
9,84 + 0.01
9.49 + 0.02
9.84 + 0.01
9.54 +.005
9.83 + 0.04
9.68 + 0.65
10,05 0,10
Ciiin
+2.919
+2.569
+2.695
+2.74%
+3.13%
+2.866
+3.25%
+2.97%
+2,87%
+2.76%
Gsin MF
-27.62%
+70.00%
+26.65%6
+66.97%
+28.10%
-69.27%
-31.78%
+37.34%
+53,80%
+38.68%
The pereentage
PanaCi'ss
value baselines' precision
Notably, three decimal places presented spice
limitaaions, though actual making calculaiion
D Proofs
D.1
Proofs for Section 3.1
D.1.1 Proof of Theorem
To investigate the recommendation error of each user during the training period, first analyze how the item embeddings change. We discover a transformation function that accurately measures the change in the item embedding from its initial state its state after certain number of training epochs. This insight is formally expressed in the following proposition.
Proposition 1. Consider Gaussian Recommender System f() undergoing training for t epochs using the standard loss function specified in Equation 2 Given a learning rate 17. there exists a function (t, 11) N+ x Rt - g that quantify the transformation of the item embedding due to training. Specifically, we have:
(()) = M(,, (0))
where vio) denotes the initial item embedding and U(s)) represents the item embedding after epochs of training.
Proof of Proposition Z Consider the training process of the Gaussian Recommender System f() over t epochs, with each update through the standard loss outlined in Equation 2 The update mechanism for user and item embeddings at the tt epoch can be described as follows:
U(t) ()(-- 1) + (7-r-(--))
2()) =0( + 17 Σ ru(
(11)
(u.rez
18

---

Considering the sum E(u.)) 1), we have:
Σ
1))--1)
(ru()-2) + 11 ((e-2))
uu.r)
(u,r)
(ru(s-3) + 1/ (0(00)))) - 0(c-3))
(ur)
2-2
(u(()) +
Σ
(u,r)
f=0
1-2
(0) +
(())
j=0
where n is the number users. This leads to the recursive update for U(z);
1-2
m()) () + (o) + nnj
(
-(1 + nun )0(22) + 2n1
2n07 2
2-4
=(1+ + nnj² + 2 + (nn- (1 + n²²²) + 2nn) v(0) + (nn² (1+ =mn²) + 2nor²)
Σ
20)
To simplify, introduce akk), b(k) and c(k) to represent the cumulative scaling factors as:
h ==
a(k)
[akk - 1) c(k - 2
(1))
k 1
b(k)
(12)
(nn- a(k: 1) b(k 1) 1)
k 2
rur²"
k=1
c(k)
naj² a(k 1) + clk 1)
k 2
yielding general form for v())=
t-k-1
Vi0 (k) b(k))(() c(k)
Σ v())
j=0
=a(t -1)8(1) + b(t 1) + c(t - 1)
Based on
(1)) (() n
Σ
ru (1 + mn))
(u.
let (l, N+ x IR+ - + be the transformation function related to training epochs and learning
rate 77, which is defined as:
(1 1 (1+1 m
1=1
M(t.n)
(11 mo)aal b(c +(( 1>1
Then we can get:
1()) = ((I,1))
This proves that the item embedding W(x) after t epochs of training is scaled version of the initial
embedding ((), with the scaling factor M(,, 17) being function of the number of epochs and the learning rate 77.
D
19

---

Fact 1. E E RR be drawn from o2) with o > 0. Let w E R represent any unit vector.
Then, (E, w) follows normal distribution (0, o²).
Proof of Fact 1
Consider [E,,..... : Ea]. with each following (O0 0²). Let [.i...., wa).
satisfying w +... + w = Then (E, w) is distributed as N (B[(s, w) D [R, w))). where:
(E w)] = E[ [ + ... Edwa) = 0,
DI(E, w)] D(El + +... Edwal
D[ +... ID [[sawal]
(wf + +.. -.++ w2)
0².
Hence, Fact I iis proved.
Proof of Theorem / By invoking Proposition 1 we establish the basis for evaluating the impact of training on the recommendation error at the (f 1)ah epoch. Proposition I specifies the scaling rela- tionship between the initial and trained item embeddings, leading to the following update expressions for user and item embeddings, For the standard loss though Equation
we have:
((++1) u(I)) + M (t, n))
((++)) M( 10)00
Considering the above update rules, the recommendation error at the (t+ + 1)th epoch given by:
P (a. 22 1) (((+1) u, v) + (u,r)
P
N N -2 [r (u(+1)) B((+1)) $ $0]
= "aa N 22 [r (une + M(, (1, .M(1 + 1,))) s0] (13)
P
d2
[r (u(p) + gr (t, (() 0
Pa (un)) (0) S -
- m1 (
For adversarial loss as detailed by Equation I we have:
A adv aig max L(O + A).
A.
According to the first-order Taylor expansion, we have:
Andy == arg max ((0) + (A, Vel(e))
A.
arg max &.
(A, Vel(e))
VeL(e)
[
leading to specific perturbations Au and A, in Equation 3
r. OC(u, v|0)
A,
r where
= -r,
du
(14)
4, where T. ØL(v, v -
r
dv
20

---

Subsequently, the updated embeddings through adversarial loss are expressed as:
mit) + (rete) + dr (v()) - ru))
" ))
adv (2+1)
(((1)
=(() + 1711 + ()) np>c ||u
(1 qdde
u(0)) + 11(1 - A)r (()
adv (1+1)
(1)) Σ ru(() + + ExEr u(0)
(1
(15)
|o
nnde
U1() 711 + 1) Σ ru(())
|0,01|
v(t))
M((,n) +1 +1)
1 +
M(i.n)
mene |
0(0))
Given
| min(IurrlllT 4A
approximate || || with | II]
Given
[lll according to the expansion of (t, in Proposition
it follows that
(t, + A) () [1+ Σ M(.)) - |
agde
>> 0. Considering these update rules,
the recommendation error at the (t + 1 epoch is determined by:
P adv
~V - (f v) [u,r)]
ady adv adv r. ((+1)) ((++i) S =0]
(u. o²
| 24(1) + + + X)r M(L, (((,)))(o)))) ((o) - 0
n/e
Pi o2
npee
U(()), U(oi) +n(11 +
)(o)) S
|esce
Tjde
(oo N
r
||acces]
((1))2(0))
1 -n-(1 x)M 0
(16)
Let (u) (())
nd [1
Given the condition min( u Il. @l))
follows (())
(())
The final
form of the recommendation error at the (t + 1)th epoch under adversarial training is:
P adv
=2 (u v) o r ru,
110 (o
P 1oo No r (0))))1))) 5 (1(1+ + Ani0 (tt.m))l
This leads us to:
P oo -ي (utz) v) xr rw]
ap adv
"a [futa(u,)) + (u,r)
=P
m1 + A) 2) Mt. m) 1 212 < r(u()) v(n) s -nM(t, n) 10 12
| 1|
) S (t, m) | 11 ru
P
~
(111 + 2) M(, m)
|
|
21

---

Given that | > we can approximate the || by using E P1oy N(a [l) [13] as an estimate. Therefore, we have:
No) (f(+1)(2,, w) xr (u,r) P adv
" . (f(+1)((,,) x (u,r)]
|| 2 o(o;
do²
ru(() "lucoll v(o)) -nM(t.n) | 2 |
do
P "aa 2 1)
(1 (1(1+ A)t
n-1
n-1
|
where d the dimension of v(o)-
Let ~ N 0, - 7). we have 2(0) = ú + E. Thus:
P P(n ~a - (2 v) xr (u, r)] IP adv
(1,+))(1,,) Fr (u,
0 12
do² +
| 12
do
r((()
= =MN
111 ( (t,
n-
u s) 5 (t,
1-1
|u(co
|u(c|l
(u(4)
| 1
do²
ru(()
=P =PaNN (0. -0))))
(1 + 1) ((.
n-
| i1)
|12(())
(1)
|/ 2
+ n-1
((((E)
.) S (1,
|uccoll' ú
|ecce)ll
(17)
According to Fact
mag Piaces
E) N (0, n-T then:
IP
[[(++]] v) x (u, r)] - P adv
[fc-1) 4) fr (1,
vio Nia o2
P (Ma,
((o)
Vn
|// + do?
r((())
1111 2)7(0) M(,,
12)
σ
(Ra(e))l
Vn - +
|| + do
(e(
n)M(t, 7)
|
where @() is the CDF of standard Gaussian distribution. Given e < min( ( aill)
it follows that
(1 + A) (w) > > > 1. This condition implies a lower recommendation error at the (t + 1)th
epoch under adversarial training compared to standard training:
P Po [fti)(u v) * rr r)] - P adv
o (( + (f41) v) # # (l,,)) > 0.
Therefore, Theorem proved.
D.1.2 Proof of Theorem
Proof of Theorem 2 In light of Theorem 1 and the impact of poisoning attacks, our objective is to measure the alteration in the recommendation error within poisoning attack, i.e., a-poisoned recommendation error.
poisoning attack on Gaussian Recommender System injects poisoning user set I' {uu, rí), (u2, re).... (u,,,,,,,,,,,, }. with each tuple (u',r") gd x {+1} representing data mali- ciously crafted by attackers. Considering the initialized poisoned item embedding v':
Σ ru +
Σ (")'"
r'uio)
(18)
(0) 72 + Tt
(u,r)Ez
22

---

by employing Theorem | as a basis (similar to Equations 13 and T6.. we derive:
N(a 1) ((t+1))a v') # r)) P adv Ploy
[it+ (u, 0') # rr (u,r)
Maa
1 11
11%/ 11 |u ||
ru(1
=P 1/0 (
(1 + 1)7()) (t, m)
|u(o 2(O)) S (n, 17)
11((C)) ||
|0/0 112
=P
((o Na, o
(1 + 2)7(0) M(t m
||24(e) ||
1/// 112
ru())
mv + Σ
r'uio) 1 35-510 (t,
|eceell
n n+
(u' ('EE
1 10/ 112
n +
(() ~M
-11
(1 + A) 7)) M (t,
< (u(
U(0)) + 1 Σ
4(0)
12 + n
1 11?
rT'(
u((o) S -11
M ((t,)) 1)
|uoll
(")
n2 + n
|0/0 11?
U(e)
=P
(o Na. =
11(1 + A)
700 M (t, m7
[ |
rt'
|
4(o))
(u' J'e
|1/00] 112
(1)
((oo) S -1 n1 + n'
M(,,
|
1
Σ
rr's
|
U(()
U((o
(u' (e
where (1) (1
gde [(
Given || >> d,
use E
"(o) M(nn 22 n) [1// 12
to approximate the || 1|2 in the above.
Similar to the proof of Theorem specifically Equation 17 and under the precondition < min(Iu all) we have:
7/
2 (a 2 (f, #r ru.r)] - adv No 22 (u, 0') Hr (u, r)] > 0.
Hence, Theorem is proved.
D.2 Proofs for Section
D.2.1 Proof of Theorem
Extending Proposition I to ACF yields the following proposition, which captures the transformation of item embedding due to adversarial loss as defined in Equation 3
Proposition 2. Consider Gaussian Recommender System fio, per-trained on standard loss over t epochs, then trained by the adversarial loss specified Equation 3 Jover epochs. Given learning rate adversarial training weight X, and perturbation magnitude e, when < ||]]|| and [ > a, 7d there exists transformation function Maav(t, JJ, e)e): N+ x R+ x R x R+ - Rt, such that the item embedding at (I + k:)th epoch, (((+k), is related to the initial embedding 1(0) by:
Maav(t + A. E)
M ()
(((+R) Maav (t, 17, X.
where M (1, vi) is the
given by standard loss in Proposition
The proof of Proposition 2 follows reasoning analogous to that of Proposition Due to the similarity, the detailed proof is omitted for brevity.
23

---

Proof of Theorem Given
| drawing from Proposition 2 and Theorem (specifically
Equation 15) the update rules for user and item embeddings the ACF at the (t+ th epoch are presented as:
u((+++1)> (1 (1- | U((+k)) + m1(1 + A)r. Madv(t + k,
M(t, (t)
Madv (1,7,,,,))
(19)
U(++++1)> Madv + h + 1,1. M(t,n))(o)
Madv (t, 1,,,,, 2)
Considering the above update rules, the recommendation error at the (L + k + 1)th epoch is given by:
IP adv
2(o) (( + (F(4441) (u, u) # (u,r)]
= P -4m Ir- (u((+++1) v(+++1)) S [0]
(20)
=P D ( (1- |
ne
u((+k), v(o)) S -n(1 + x)
where Cr+k (....)) M(t, 1))- Let (()) (...(t.....e)
ne [
Given the condition
< min[]u it follows ((+1)) 1. The recommendation error at (t 1)th epoch through
ad
adversarial loss can be expressed
p adv 10 N(a
2 [fo++t)( v) $ (u.r)]
= =P
May No -2 rr (u(c+R), 2(0) --n(1 + 2h 11)
With
P adv
Ni 2) (u v) *r r| (u,r)) = Ma (2n) [r- (u(++)))00) s $O],
the change in recommendation error can be written
A adv
P adv (++++1)
[/ (u, v) # (u, r)]
2)) "a) N 0²
=P Na ا2
(1 + )) Cetalloto) 11 < r- (((()))) ((oo) S <0]
Ci+k 110 <r. (((kk) | v(o)) S
=P 2)) ~a.
-n(1 2)m(et))
Considering ((0) N u, - let N CoNN((o,,) (0) we have ((o) + E. Then we obtain:
A adv (1+++1) Mor o2 (u, v) + (u,
P adv
=P E0,
11(1 + 2)
(w)
Ce+k
|11001112
ru(e+k))
50
=P =0
(w) (1(11 + 2)
Caak ||alccta)ll
|10101112
|[
((((+))))
(.)
ru((+k)
[ || 5
"| 11)
r((++))
Given that ||ū||| >> o, approximate the || by using E
moy - (a. 2" [l [?] as
estimate. Thus, we have:
Ady P adv "o 22 [Su, v) + rr (u,r))
(1+++1)
| + n-I
do?
PP (0
- 7n(1+ ) C++
ru(c+))
1 < r(
| E) $ - ru((+k)
| 4
24

---

By Fact
have ru(e)
E) .V (0. _ー= then:
A adv
"oo [f(u,)) v) *r ru
adv
(++++1)
=$
Vn--
||(+s) n) ) Φb vn 1
(((++)
(-n(l+ 2)(itt) C++h
2 + do?
n-1
ru(ctk) 11)) ([u(c4s)1(a))
)
|
where 2() is the CDF of standard Gaussian distribution. Obviously,
((+++)) (((+a)]l û) E [[,
Let
C++k
V u. t k) = (1 ()+())))
|
Using the CDF properties of the standard normal distribution, we can conclude:
adv (1+++1) Ma o2 .21) (,,,n(((,,,, [s,, 1) # r (u,, r)] 2
P adv
Φ vn 1
|| + nllluel2 + do²
- w((at+k))
( ( (1|x1])
cquality holds when
ru((+h)
( = =||2|||
|
Furthermore,
A adv P adv (1+++1)) Ma 22 (ennn((r (((, *r (u, 5
2Φ
Vn In
(1/aa|
+
do²
vu t ki) -1
20
n
Equality is achieved when
((((+)) [(++))]l
do²
1 (u,, t k).
n
Therefore, Theorem is proved.
D.2.2 Proof of Theorem 4
Proof of Theorem 4 Given
| nd
according to Proposition 2 and Theorem
(specifically
Equation 15 we have:
| (((+k) + 17(1 A)r Madv
T
U(t+k+1> 1
M M(t
Madv (t, 2,)))
(21)
Madv(t (t + 1, c. (l,,
((+k++1=
Madv (1, 71, 2,
where o/o) is the poisoned item embedding given by Equation 18
Considering the above update rules, the a-poisoned recommendation error at the (1 + A + 1)th epoch is given by:
P adv
vioy Nia eát (iCHRti)a w') # r (u,r)]
"1o) -(a o2 = =P
r. (114441)) ((44)+))) 50
p-((1 1-1(1- nde
=P Po) =4
u(eta) v(0)) S snn(1 1)C44alle/o)11
|
25

---

where Cr+k Man M (t,, 17. Let (u)
((t4))
-1-
Given the condition
< min[]aaa1ollllll it follows (u)
((++R) > 1. The recommendation error at the (1 + 1)th epoch under
qA adversarial loss can be expressed as:
P adv
[f(+h+1). (u, (u, # r (u,r)
Ra) Na -2 [r (u(c+))) (())))):(o))) 5 (natt)) C1to
With
P adv P(o) P(o)~N(a + [f(+))).(u 0') *r| (u,r)] = o() Ni 2 [r- (2(ett)) v/o)) s0]
the change in a-poisoned recommendation error can be written as:
A adv
P adv Moy Nu
بي (Fa(u, 0') + r (u,
(++++1)
(1 + M) Cetkll (0)) 112 < r. (u(tt)) 2(o)) so]
(() M(a
P
(1 + A))(())))
(1)
| |1 <r
Ce+k
|[u(eta)]] ((0)) s
U((+k)
1(0) ~(
=P
o2
(1(1 ()(()))) [
(u)
Ci+k
|0000
|
(++2))
n n
1
nv
Σ (F'uio))
50
=P
((a) N(a
n n'
(1 + 2) [
Cr+k
Σ n 11--
1
rr'
|
U((+k)
|| (((o))
n
(u' (')E'
m((+))
Uu(+,)]|'' ((0o) S
Σ
rr'l U((+k)
[Tu(et))] 4(0))
n
(u' ''E'
Considering 2(0) ~ N u, - lete N (0, o" - we have ((0) E. Then we obtain:
A adv
(++++1) ((o) Na شي (a, # r (u.r)
P adv
=P S~ (0.=0
n n (1 x)((())) || (1+
(u) Ci+k 11/00
1
Σ
rT'( ((t-R)
|u(=a))| ((0)
(u' ("
ru(++)
EE - Σ rT'l
((++)
2(0)
|u++,:||
(u (E
=P (0.
11 n
n'
(1 + +))(((())))
(w)
Ci+k
11/00112
Σ
rT' u((=k)
[ Il
2(00))
|u(et)]] ||
ru(++R)
T
(w'r")
((++)
Σ rr' U((+k)
||
udoo) - Fu(ctR)
-11pact20)1 Il (2)
n
Given that |||| > o, approximate ||2% by using:
No n |1 [|]]
1
Σ
r'ue'112
1oo NT n + n (0)
n + n
(uirr)EZ
as estimate. For simplicity, we use E 11/ to represent E we have:
P(o) N(a 2) [110 [P]] Thus,
26

---

Andy
Paay adv (1+k+1)
n- 12 (la((u,))) # (u,r)]
1/0) No
=P
n n n¹
(1 ))((-)))
Ci+k
| 12]
Σ rT'( U(e+R)
U(o)) - ru(e+R)
[[(e+k)]] 4)
|
(u' ''E
|
(1++))
6) S
Σ
rr'(
u((+k) |/(ce
4(00) - ru(ct)) 11
| Il
(u' r))
By Fact 1 we have
E) N (0,
n then:
02
|1ie+ ||
adv
2ي (1 #
rw,r)
(1+k+
((o)
(a
①
TT'
Tuletay]] 2(o)
U(e+k)
"TrrCCtS)]' ii)
ru(et))
(u' .r"EI'
vn - +
1
+ n' (1 ()
(u)
|
C++l
E [1 [P]
1
Σ
rt'
||u (((o)
((++k)
"lugetaall i.)
(((+)))))))
n
(u ("'r)
where (() is the CDF of standard Gaussian distribution. Obviously,
Σ rr'l ((++k)
(())) E nn'v -n'aaaa, n'van
(u' ,')
(((++))
1)) E [-||[u]], |
|u(+z)ll
n22 [n=1|=] u1|
2nn' (n + n²)²
n² l + (n²) + 2nn a a/lūllo
ni² do
| 12]
(n - 1)(n+n()
+ n/)2
(n + n²)²
(n 1)(n + n2)
where n' is the number of fake users, d the dimension of u', and a max(u')))e || (ol
Let
C++k
(u, L k) =(1 ()((++2) [
n' do + ||
n
According to the CDF properties of the standard normal distribution, we can conclude that:
A adv
(144+1)) N(a)~N(a c2 n Inllfa(u (2, o') + r (u,r)
adv
n1 u 2 2nn' annaa:/
1n-1)(n - + n') Vuu +1)) v(u,(+k))
ndo2
Vn
B+ r
(8)
n(n + n')
reaches the minimum value when
Σ
rt'l ((+k))
2/(0)> = nl Vddo.
[
(u' E)
r(l
a ||
[((+))]]]
and E
[|0%)] reaches the minimum value n² a 2 2 2nn'o/
n do
(non')²
(n- 11
Moreover,
(1+++1) NorrN(a o2 g2 v²) Fr (u, r)] S
adv p adv
Vn In
n2 [/|2 12 (n') + 2nn' ||ul/o
(n 1)(n + n²) +().++t)) -1,
ndo2
2Φ
20
nln + n')
27

---

equality holds when
n + (n²)) + 2nn 2ill
n n²
1efo
E
(n + n2)²
(n 1) + n²)2²
Σ rr'(
((++)))
1((0)) +
(e+))))
(1)
2"
1 + n²
R |1/0 v Vue,
(tl (r")E
Hence, Theorem is proved.
D.3 Proofs for Section 4
Given any dot-product-based loss function (()), characterized by its dependency on product of user and item embeddings, the gradients of user and item embeddings the ęth epoch can be expressed as follows:
V Vuye ((u, v (e) = ΦTT, u() 2(0))
(22)
V Voco C(u, (1) = (1 (()) (1t)) )())>
where (6-) and (-) denote coefficient functions derived from ((O), mapping from the embeddings space to the scalar values.
Considering the proofs of Theorem and Theorem there is coefficient ((() for the user u. When
(())
(u)
is satisfied, the effectiveness of ACF can be guaranteed. Here, we derive the coefficient
(u) in multi-item recommendation scenarios with dot-product-based loss through the following
(())
corollary.
Corollary 2. Assuming the incorporation of adversarial training as defined in Equation 7 wwth dot-product-based loss function ((O), and given the learning rate y, the adversarial training weight
X, and the perturbation scale e, the (()) for user u is given by:
(1-
(u) 7(0)
TI Σ
I0(r, uo), m()))
(23)
wENs
where Nu the item set that user u interacts with.
Proof of Corollary 2 Recall Equation
I Given a dot-prroductbbaseee loss function L(9) within the
framework of adversarial training:
LACF (0) =[()) XC(O + adv),
where
A adv
arg max A. ||
L(O + A);
where > defines the magnitude of perturbation, and À is the adversarial training weight. Consid- ering any pair (u, v), the perturbations be computed (similar Equation 14
V Vuc C(u, e (1))
M(e) =
VV may C(u, v (1))
V Vuna v()))
Ao(s)
V C(u, ())))
The update equations for the embedding of user at the tth epoch under adversarial perturbations can be expressed as follows:
Σ (n (n C(u, (()) + AyA may C(u, v (tt)) + Auav))
((++) = ((())
PEN.
where N₂, is the set of items that user interacts with.
28

---

By employing the first-order Taylor expansion on (u()) + Aujo) and (v(()) + Aew) we have:
V Vuro (u, (1) + adv)
V ung v00u,,0010 (A Veco o(0 (urny V Vlun,-uu
+(A (Vuc) V o(, e1)) Aw(s)
Vu ((u, 1/ (e)) + (Vus) Ve (uu, 00 Ap(s) + (Va C(u, (00()) T
Suco.
Subsequently, the update mechanism for the user embedding, incorporating both direct and adversarial gradients, is computed as:
(1- A)V un L(u, v( (1)) + nse (Vuge V Fu,, 2(0, o10())) ((++1) (1) Σ
Fo, v((m))
( Lou x(())))
wENu
( ((u, ((1)))))))) T ( [ flu, v(u,v)(()))
L(u, ((u,
tnide
(1) Σ
ny(1 + X)o(r, uay 210))
v.NN
uno ((1)) (u(o) (r, ((1))) + ,tr,, uno 0(0) w())
Σ nd
Ve v(,,
DENNa
@(r, Uk0)) (i() (Vuro ((). (())
ne
[[V C(u, (1))l
(1)
Σ vENu
1111 + 1)o((, U(t)) (()))))
2 (r. u(t)) (r,, (()))
Σ nAE VV Clu, e 41o
veNi
Σ ne (r, (() ((() 11 veNu
V mn (r, u()) m()))
V V C(u, 2 (1))
We o(r, e aea m
V u or; u()) (()))
ve Vin C(u, O
Considering Equation 22 for loss function ((O) based on dot-produce the coefficients of gradients for user embedding u and item embedding v. denoted qi(-) and Φ(-) respectively, are still functions based on the dot-product of user embedding and item embedding v. Consequently, the gradients of vi(-) and <(-) with respect to user embedding u depend on item embedding v. Specifically, Vuce (r(r, u()) *(0) = E(r, u()) (0)) Vio and Vuce, p(r; u()) (()) = E (r, u(()), (0() (ro)) Thus, the updated expression for the user embedding u((+1) under adversarial training conditions is delincated as follows:
1- 1- Σ
(r u.y. (().
u(e+1) =
nde
| (l,
(()))
vENu
(1+ ugy, ((0) + de (r(r, uay, (rr))((,, u()) v |u)l [V C(u, v (1)]
1 Σ
vEN.
Ø(r; u(e); D(E) D (r, uw) 10))
+de
(1))
| uny C(u, v (6)())
29

---

Following the aforementioned Equation 16 and Equation 20 the 7/()) for the user u in the context of multi-item ACF with a dot-product loss function is given by:
( U()) v())
(2))
1 - E me DENu
7(0)
IV DV C(u, [1)
(trr uas ( (r)), 40) v()l [Voe, f(u, (1))
E me
(24)
DENu
mp
(1)
|
veN.
Therefore, Corollary is proved.
Proof of Corollary For any dot dot-product-based loss function L(u, v(O), the coefficient functions in Equation 22 can be given by:
V uno ((u()) (() (0) = o(r, (()), ((0))
V m/o 0()))) (()) vh(r, (()))))))
(w)
Building upon Corollary
we can express 7(()
(u) ((e)
nd
Σ
(r(r, (() 2(t))l
veNu
Considering the proofs of Theorem and Theorem effectiveness of ACF. Therefore, it implies:
under < <<>(0)))= < 1, we can guarantee the
(1)
||ugo]| EvEN. nl u()) v())
1
actual training, the maximum perturbation magnitudes will also affected by other factors. From
the perspective of Corollary we can only conclude that the maximum perturbation magnitude
(u) ((),max for user u at epoch positively related ||
Therefore, Corollary is proved.
30

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introduction clearly articulate the primary contributions and scope of the paper. They accurately summarize the theoretical and experimental findings, explicitly matching the claims made throughout the document.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of our work are discussed in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-specfiiaatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
31

---

Answer: [Yes]
Justification: The assumptions are presented in Section 3 and the related proofs are found in Appendix D
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Experimental information, including datasets, baselines, and evaluation metrics, is provided in Section 5.1 while implementation details are found in Appendix C.1
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
32

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The experimental code and data are provided through anonymous link in
Section
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.cc
aublic/guudees//ddeetbbi.ss
www.sssinoooiiillo for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/
www.ssssiicggyooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Experimental settings are outlined in Section 5.1 Additional details can be found in Appendix C.I
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The results presented in Section include error bars. The method for calculat- ing these error bars explained in the implementation details provided Appendix C.1
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
33

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide sufficient information on the computer resources in Appendix C.I
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification:
We conform with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- cration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The robust recommendation algorithm has a positive impact on the field of recommender systems. The impact is discussed in Section
Guidelines:
The answer NA means that there is no societal impact of the work performed.
34

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The original papers that produced the code package dataset are cited in both Section and Appendix C.T
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
35

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
batasets.papersstt
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We provide the code via both anonymized URL (in Section I and an anonymized zip file.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
36

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
37


Reviews:
[{"review_id": "0JWgUlgWMH", "reviewer": "Reviewer_gsZx", "summary": "Adversarial training has been observed to degrade model performance on clean samples in the CV domain, however, ACF in recommender systems can not only enhance the robustness against poisoning attacks but also improve recommendation performance. This paper provides a comprehensive theoretical understanding of this phenomenon. Specifically, this paper shows the performance with adversarial training is better than without adversarial training in both clean and $\\alpha$-poisoned scenarios. In addition, this paper provides the lower and upper bounds for the recommendation error. This paper also proposes a learning approach that can be used in more practice scenarios. Experiments on three datasets demonstrate the effectiveness of the proposed method in terms of robustness and recommendation performance.", "questions": "See the weaknesses part for the questions.", "limitations": "Yes, this author adequately discusses the limitation and broader impact.", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "$\\bullet~$ The problem studied is important and relevant.\n\n $\\bullet~$ The idea is interesting and novel.\n\n$\\bullet~$ The motivation is reasonable.\n\n $\\bullet~$ The theoretical results are sound and are verified in Figure 1.\n\n $\\bullet~$ The evaluations are solid and convincing.", "weaknesses": "$\\bullet~$ Can authors discuss the feasibility of relaxing the assumption in theorems such as the Gaussian recommendation system? In addition, is the the extension to multiple items natural?\n\n$\\bullet~$ It will be better if the magnitude of user latent vectors is provided in Figure 1. Thus we can align the empirical findings and theoretical findings more straightforwardly. Maybe we can observe that the magnitude of the latent vector of user 3 is larger than that of user 2.\n\n $\\bullet~$ Is there a more reasonable way to design the form of $c(\\mathbf{u}, t)$ and equation 5? In addition, how can we choose $\\rho$ in practice? Is $\\rho$ learnable or it is only a hyper-parameter?\n\n $\\bullet~$ Some presentation issues. For example, the $\\alpha$ in line 184 should be bolded, and it should be $\\Phi(\\cdot)$ in line 176. In addition, the results in Table 1 should retain 2 digits instead of 3 digits to enhance the readability. The text in Figures 2 and 3 (such as x-axis and y-axis) should be larger.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive feedback. We sincerely appreciate your recognition of the importance, novelty, reasonable motivation, sound theoretical results, and the solid evaluations presented in our work. Below, we address each of your questions to resolve your concerns:\n\n---\n\n**Q1: Can authors discuss the feasibility of relaxing the assumption in theorems such as the Gaussian recommender system? In addition, is the extension to multiple items natural?**\n\n**A1**: We appreciate your question. The assumption in the Gaussian recommender system serves primarily for clarity and simplicity of theoretical results, as also adapted in [1]. To relax this assumption, one approach involves considering more complex loss functions or scenarios involving interactions with multiple items.\n- **We elaborate on these scenarios in Corollary 1**, with detailed derivations available in Appendix D.3.\n- Specifically, for any dot-product-based loss function involving multiple items, we ascertain the range of perturbation magnitude for each user.\n- While the formulations in Appendix D.3 are complex, they are crucial for identifying the relationship between perturbation magnitudes and user embeddings.\n\n---\n\n**Q2: It will be better if the magnitude of user latent vectors is provided in Figure 1. Thus we can align the empirical findings and theoretical findings more straightforwardly.**\n\n**A2**: Thank you for this excellent suggestion. We will incorporate the magnitude of user latent vectors into Figure 1. This addition will enhance the alignment between empirical findings and theoretical insights. The table below presents $\\Vert u \\Vert^2$ for the five users in Figure 1, which will be included in the revised paper. **The revised image can be seen in the pdf (Figure 1) in the global response**.\n\n|UserID|user 1|user 2|user 3|user 4|user 5|\n|--|------|------|------|------|------|\n|$\\Vert u \\Vert^2$|3.7333|2.0926|11.895|6.7923|6.8239|\n\n---\n\n**Q3: How can we choose $\\rho$ in practice? Is $\\rho$ learnable or is it only a hyper-parameter?**\n\n**A3**: $\\rho$ is considered a hyper-parameter used to adjust the overall magnitude in practical applications. In Experiment 5.4, we extensively studied the impact of $\\rho$ on method performance, revealing that:\n- Even with a small $\\rho$, noticeable improvements are observed.\n- Optimal values for $\\rho$ typically fall within the range of 0.1 to 1.0 across diverse datasets. In practice, we typically search for $\\rho$ within this range at intervals of 0.1.\n\n---\n\n**Q4: Is there a more reasonable way to design the form of $c(u,t)$ and equation 5?**\n\n**A4**: Our paper introduces a specific design pattern for $c(u,t)$ that aligns with the criteria outlined in Corollary 1. The term $\\rho \\cdot c(u,t)$ allows for flexible adjustment of overall magnitude. Moving forward, we aim to explore more intricate design patterns aimed at better leveraging the properties identified in Corollary 1. For instance, we will investigate alternative mapping functions to replace the sigmoid function, which may better capture the relationships outlined in Corollary 1. These efforts are aimed at enhancing the effectiveness and adaptability of our approach in practical applications.\n\n---\n\n**Q5: Some presentation issues.**\n\n**A5**: Thank you for your valuable suggestions aimed at enhancing the presentation of our paper. We will take the following actions to address these concerns:\n- Ensure accurate representation by verifying the correct usage of bold symbols.\n- Improve readability by reducing the number of digits in the tables.\n- Enhance visibility by increasing the text size in Figures 2 and 3.\n\n---\n\nWe appreciate your detailed comments and constructive feedback, as well as your recognition of the importance of our work. We believe these clarifications will effectively address your concerns. We eagerly await your reconsideration and reevaluation of our work.\n\n\n[1] Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. SIGIR'21", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VNOVYBnMxU", "reviewer": "Reviewer_svg8", "summary": "This paper targets adversarial collaborative filtering and provides both deeper understanding and improvement. The paper provides a theoretical explanation for the ACF's improvement upon robustness and effectiveness. PamaCF, which is presented in Appendix, can more robustly performs CF, is evaluated on three recommendation datasets.", "questions": "1. What's the performance of various ACF methods on LightGCN? It would be more comprehensive to report another Table similar to Table 1 about LightGCN.\n2. Why does the paper present the recommendation performance at HR@50 and NDCG@50 in Table 1 and present the performance against attacks in Table 2 with T-HR@50 and T-NDCG@50?\n3. Is target item promotions the only attack PamaCF can prevent? \n4. The loss of Gaussian Recsys in Eq 2 does not fully align with [18]. So is the same regarding Eq 3 and [15]. Why does the author make such changes? The loss term is the foundation of all derivity. All previous works are based upon pairwise loss while the paper is based on pointwise loss.", "limitations": "Although the paper presents an important theoretical and experimental analysis of ACF, the reviewer feels a strong sense of misalignment between Section 3 and 4, where the theoretical results in Section 3 do not fully motivate PamaCF in Section 4. The result of Section 3 seems to be motivated by pointwise loss, while PamaCF is built upon pairwise loss. Also, part of the experimental setup is not convincing enough. However, the reviewer might be persuaded with further evidence.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "1. The paper is generally well-written and easy to follow.\n2. The paper provides a theoretical explanation for the ACF's improvement in robustness and effectiveness.", "weaknesses": "1. Part of the experiments are missing and incomplete.\n2. The loss terms in Section 3 do not fully align with the cited papers.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your detailed feedback and for acknowledging the readability and theoretical clarity of our paper. Below, we address each of your questions to clarify misunderstandings and address concerns. We hope this clarifies the contributions of our work and look forward your reconsideration.\n\n---\n\n**W1: Part of the experiments are missing and incomplete.**\n\n**W-A1**: Due to space constraints of main text, we focused on presenting results that strongly support our claims. Other reviewers also praised the thoroughness and persuasiveness of our experiments. To address your concerns comprehensively, detailed explanations and additional support will be provided in A1-A3, corresponding to Q1-Q3.\n\n---\n\n**Q1: What is the performance of different ACF methods on LightGCN?**\n\n**A1**: Thanks for your suggestion. In response, experimental results for LightGCN will be included. Our findings show improved recommendation performance for PamaCF integrated with LightGCN. **Refer to Table 1 in the PDF in global response for details.**\n\n\n\n---\n\n**Q2: Why does the paper use HR@50 and NDCG@50 in Table 1 to present recommendation performance, while Table 2 uses T-HR@50 and T-NDCG@50 to evaluate performance against attacks?**\n\n**A2:** Thanks for your question. In Table 1, we **actually used HR@20 and NDCG@20**, not HR@50 and NDCG@50. Your query addresses two points: (1) the choice of metrics and (2) the difference in k values. Here are our responses:\n\n1. HR@k and NDCG@k evaluate recommendation performance, while T-HR@k and T-NDCG@k assess system robustness against attacks. We provide detailed explanations in the **Evaluation Metrics section** (lines 256-269).\n2. Our selection of k values follows standard practices in the field, detailed in the **Implementation Details section** (lines 589-592). This approach ensures consistency with research that distinguishes between metrics for recommendation and defense strategies [1], underscoring the reliability of our defense methods.\n   - HR@20 and NDCG@20 focus on the top 20 recommendations, typical in collaborative filtering assessments [2].\n   - T-HR@50 and T-NDCG@50 evaluate defense effectiveness against attacks, commonly using a top 50 ranking [3][4].\n\n\n---\n\n\n**Q3: Is preventing target item promotions the only attack PamaCF can mitigate?**\n\n**A3**: **PamaCF is capable of defending against various poisoning attacks**. These attacks typically aim to promote specific items or degrade system performance. Item promotion attacks are well-documented [3][4], while performance degradation attacks involve harmful item embeddings mainly in federated recommender systems [5].\n\n- Theoretical analysis (Section 3) of ACF considers the impact of poisoning attacks on recommendation errors, without restricting attack objectives. **Theoretically, PamaCF can mitigate poisoning attacks aimed at different objectives.**\n- Empirical validation shows PamaCF not only counters item promotion attacks but also enhances overall recommendation performance.\n  - To further validate PamaCF's robustness, we simulate performance degradation attacks with random user behaviors, confirming its effectiveness.\n  - PamaCF demonstrates strong defense capabilities even against performance degradation attacks.\n  - **Refer to Table 2 in the PDF in global response for details.**\n\n\n---\n\n\n**Q4 (W2): The loss function of Gaussian Recsys in Eq. 2 does not fully correspond to [6]. So is the same regarding Eq. 3 and [7]**\n\n**A4**: **The loss function used in Gaussian Recsys does correspond to [6]**. [6] covers various loss functions, addressing any confusion about the specific one referenced. We refer to the loss function detailed in [6]'s \"DETAILED PROOFS\" section. The mention of \"introducing the adversarial loss [7]\" (line 112) in our paper refers to adopting the adversarial training paradigm (as described in Eq. 1 in the Preliminary section), where **adversarial perturbations are added to the original loss (Eq. 2), rather than using the APR loss function from [7]**. \n\n- For instance, the adversarial component discussed in [6] involves $\\Delta_{v} = \\arg\\min_{\\Delta, \\Vert \\Delta \\Vert \\le \\epsilon} \\langle ru, v + \\Delta_{v} \\rangle$, where the original loss is $\\mathcal{L}(\\Theta+\\Delta) = \\langle r(u+ \\Delta_{u}), v + \\Delta_{v} \\rangle$. This aligns precisely with our employed loss function in Section 3.\n\n\n---\n\n**Q5: All previous works are based on pairwise loss, whereas the paper is based on pointwise loss.**\n\n**A5**: It's worth noting that many methods also adopt pointwise loss [8][9]. Besides, in Section 3, our theoretical results leverage pointwise loss for clarity and simplicity.  Section 4's Corollary 1 **extends the discussed pointwise loss to encompass more complex functions**, detailed in Appendix D.3.\n\n---\n\nThanks sincerely for your thorough review of our paper. We have addressed each of your concerns and clarified misunderstandings. Based on these clarifications, we kindly request your reconsideration of the overall assessment of this paper. We firmly believe that our work contributes valuable insights and advances the state-of-the-art in robust recommender systems, making a significant contribution to the research community.\n\n\n[1] LoRec: Combating Poisons with Large Language Model for Robust Sequential Recommendation. SIGIR'24  \n[2] LightGCN - Simplifying and Powering Graph Convolution Network for Recommendation. SIGIR'20   \n[3] Revisiting Injective Attacks on Recommender Systems. NeurIPS'22  \n[4] Revisiting Adversarially Learned Injection Attacks Against Recommender Systems. RecSys'20   \n[5] UA-FedRec: untargeted attack on federated news recommendation. SIGKDD'23  \n[6] Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. SIGIR'21  \n[7] Adversarial Personalized Ranking for Recommendation. SIGIR'18    \n[8] Denoising Implicit Feedback for Recommendation. WSDM'21   \n[9] BSL: Understanding and improving softmax loss for recommendation. ICDE'24", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4Y1NqMdDIi", "reviewer": "Reviewer_6kCb", "summary": "This work investigates adversarial collaborative filtering, providing theoretical evidence for the effectiveness of such methods and proposing a novel method based on the personalized magnitude of perturbation.\n\nOverall, this work studies on an interesting problem and offer some theoretical insights. However, this work also has some limitations particularly on the impractical assumptions. As such, I give the score of 5.", "questions": "Please refer to weaknesses.", "limitations": "the authors have discussed the limitations.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.\tThis work studies on an interesting and important problem.\n\n2.\tThis work provides a theoretical understanding of the effectiveness of the adversarial collaborative filtering, and introduces a new method based on this understanding.\n\n3.  Extensive experiments are conducted to validate the effectiveness of the proposal.", "weaknesses": "1.\tMy primary concern lies with the assumptions made in the theoretical analysis. There is a noticeable gap between the theoretical analysis and practical applications in several aspects: a) the strategy for initializing embeddings (presented in Definition 1) is seldom adopted in existing RS; b) the optimization in practical RS typically uses BCE, BPR, or softmax loss, rather than the loss function described in equation (2); c) preference prediction usually does not employ the sign function; d) recommendation is often framed as a ranking problem with corresponding metrics or losses, rather than being defined as in ‘Definition 2’ for analyzing recommendation error. \n\nI understand these impractical assumptions could facilitate theoretical derivation, but they clearly become a limitation of this work.\n\n2.\tMy other concern is with the theoretical analysis itself. \n\n2.1\t It is counter-intuitive that the theoretical bound does not depend on the item embeddings, given the symmetric roles of user and item embeddings in recommendation systems. Could you please provide some explanations? Or the relations $v=1/n \\sum_i r_i u_i$ are always held? \n\n2.2\tIt is interesting to discover that CF has a unique advantage such that the adversarial mechanism works even for clean data, unlike in basic classification tasks. Why is collaborative filtering so special? The problem formulation for collaborative filtering appears similar to basic classification tasks. Could the distinction be due to the inner product? More discussion on which characteristics of collaborative filtering lead to this advantageous property would be highly interesting.\n\nSome minor ones:\n\n3.\tThe theoretical part is not easy to follow.  This may be due to my unfamiliarity with theories on adversarial learning. Nevertheless, I recommend that the authors provide intuitive explanations for the theorems and a brief outline of the proof procedure. \n\n4.\tThe paper should include more experimental details. It is unclear whether the experimental setup (e.g., initialization) follows the problem definition 1 or aligns with previous works like [2][3].", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your positive comments and recognition of the significance of our paper, including its theoretical contributions, novel methodology, and comprehensive experiments. In response to your feedback, we address your concerns and clarify some misunderstandings as follows:\n\n---\n\n**Q1: The strategy for initializing embeddings is seldom adopted in existing RS**.\n\n**A1**: Thanks for your feedback. The Gaussian-based initialization method is chosen to derive upper and lower bounds and **does not alter our core findings**: (1) ACF outperforms traditional CF; (2) User-adaptive magnitude further enhances the effectiveness of ACF.\n- For instance, the conclusion in Theorem 1 is already demonstrated in Appendix D1.1 at line 667, but incorporating the properties of Gaussian distribution allows for a more accurate formulation. \n- In Appendix D2.1 at line 706, the expression already indicates the need for different magnitudes; introducing Gaussian distribution properties results in more accurate and readable upper and lower bounds.\n\n---\n\n\n**Q2: The optimization in practical RS typically uses BCE, BPR, or softmax loss, rather than the loss function described in Eq. 2.**\n\n**A2**: Section 3's simplified pointwise loss ensures derivation clarity and simplicity, as in [1].\n- To broaden the applicability of our findings, Corollary 1 in Section 4 **extends this to complex losses** (Appendix D.3).\n- Moreover, in the implementation of PamaCF (Eq. 6 in the main text), we adopt the extended and widely used pairwise loss, i.e., PamaCF-BPR loss, detailed in Appendix B.\n\n---\n\n**Q3: Preference prediction usually does not employ the sign function.**\n\n**A3**: The sign function aids recommendation error definition **without affecting our derivations**. In Appendices D.1, D.2, and D.3, we demonstrate that $\\mathbb{P}[\\mathrm{sgn}(\\langle u, v \\rangle) \\neq r] = \\mathbb{P}[r \\cdot \\langle u, v \\rangle < 0]$, effectively addressing any potential impact of the sign function on our results.\n\n---\n\n**Q4: Recommendation is often framed as a ranking problem, rather than being defined as in 'Definition 2' for analyzing recommendation error.**\n\n**A4**: Thanks for your question. Our approach in Section 3 simplifies analysis by focusing on item impact via a pointwise framework. This approach provides theoretical clarity by avoiding the complexities introduced by ranking tasks. Section 4's Corollary 1 **extends these insights beyond the constraints of Definitions 1-3**, as detailed in Appendix D.3.\n\n---\n\n**Q5: It is counter-intuitive that the theoretical bound does not depend on the item embeddings.**\n\n**A5**: **Theoretical bounds indeed depends on the item embeddings**.\n- When fixing a particular user, the item embeddings $v_{(0)}$ is equivalent to sampling from $\\mathcal{N}(\\bar{u}, \\frac{\\sigma^2}{n-1}I)$ (as mentioned in lines 120-123).\n- When deriving upper and lower bounds, we map $v_{(t)}$ to $v_{(0)}$ and then take expectations, which is why $v_{(t)}$ does not explicitly appear in the expressions. For details, refer to lines 710 or 733 in Appendix D.2.\n\n---\n\n**Q6: Are the relations $v = \\frac{1}{n} \\sum_i r_i u_i$ always held?**\n\n**A6**: No, this relation holds at epoch = 0. However, with a given learning rate $\\eta$, our derivation shows that $v_{(t)} = M(t, \\eta) \\frac{1}{n} \\sum r u_{(0)}$, where $M(t, \\eta)$ is a mapping function detailed in Proposition 1 (lines 625-630).\n\n---\n\n**Q7: It is interesting to discover that CF has a unique advantage such that the adversarial mechanism works even for clean data, unlike in basic classification tasks. Why is collaborative filtering so special?**\n\n**A7**: Thanks for acknowledging our work. The key distinction may lie in the nature of the tasks, particularly in the parameter search space. Consider the following simplification (one-layer classifier and MF):\n\n- Traditional classification tasks are typically formulated as follows:\n  - Given a set of samples $(x_i, y_i)_{i=0}^n$, where $x \\in \\mathbb{R}^{d_1}$ and $y \\in \\mathbb{R}^{d_2}$, the goal is to train a classifier $f(x_i) = w^Tx_i + b$.\n  - The trainable component is the classifier $w \\in \\mathbb{R}^{d_1 \\times d_2}$, and adversarial perturbations compel $w$ to locate a decision boundary within $\\mathbb{R}^{d_1 \\times d_2}$ that satisfies adversarial losses.\n\n- For recommender systems, where $f(u_i, v_i) = u_i^T v_i$, involving $M$ users and $N$ items:\n  - The application of adversarial perturbations allows for a broader parameter search space, specifically $MN \\times \\mathbb{R}^d \\times \\mathbb{R}^d$.\n\nTraditional classification tasks **require $w$ to satisfy all instances and their adversarial counterparts**, whereas in recommendation tasks, **adjustments to user and item representations can satisfy each other's adversarial counterparts**.\n\n---\n\n**Q8: I recommend that the authors provide intuitive explanations for the theorems and a brief outline of the proof procedure.**\n\n**A8**: Thank you for your suggestion. We will enhance the clarity by providing intuitive explanations and outlining the proofs. Due to space constraints on the responses, we will further supplement these in subsequent versions.\n\n---\n\n**Q9: The paper should include more experimental details.**\n\n**A9**: Thanks for your suggestion. To address the need for additional experimental details, we have included them in Appendix C.1:\n- Detailed discussions on attack and defense setups are provided from lines 589 to 600.\n- As you mentioned, our backbone model follows LightGCN. We will emphasize this aspect more prominently in future revisions.\n\n\n---\n\nWe appreciate your thorough feedback and recognition of the significance of our research. We believe these clarifications adequately address your concerns and look forward to your reconsideration and reevaluation of our work.\n\n\n[1] Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. SIGIR'21", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uCDv3rCTDr", "reviewer": "Reviewer_MDNE", "summary": "This work investigates the efficacy and robustness of Adversarial Collaborative Filtering (ACF) in recommender systems. The authors present theoretical analyses to demonstrate how ACF enhances traditional collaborative filtering (CF) by mitigating the negative impact of data poisoning attacks. They extend these theoretical insights to further improve existing ACF methods by dynamically and personally assigning perturbation magnitudes based on users’ embedding scales. Experiments based on representative CF backbones and various attack methods strengthen the validity of this work.", "questions": "Please refer to the Weaknesses section.", "limitations": "The authors have discussed the limitations of their work.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "S1. The work addresses a critical issue in recommender systems—robustness against attacks. The paper introduces novel theoretical insights into the benefits of ACF over traditional CF, particularly in mitigating data poisoning attacks. The combination of theoretical and empirical analyses enhances the originality of the work.\n\nS2. The authors provide rigorous mathematical proofs and extensive experimental evaluations to support their claims. The inclusion of multiple datasets and various attack methods strengthens the validity of their findings.\n\nS3. The paper is well-structured, with clear explanations of theoretical concepts and experimental methodologies. The use of figures and tables helps in comprehensively presenting the results.", "weaknesses": "W1. To extend theoretical understandings from the simple single-item CF scenario to practical multi-item scenarios,  Corollary 1 is restricted to the dot-product-based loss function.\n\nW2. The experiment only involves two CF backbones, namely MF and LightGCN. The results will be more convincing by adding more CF methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive feedback. We deeply value your recognition of our work's contributions, particularly its importance, clear explanations, novel theoretical insights, rigorous mathematical proofs, extensive experimental evaluations, and the effective combination of theoretical and empirical analyses. Below, we provide detailed responses to each of your questions, offering clarification and additional support.\n\n---\n\n**Q1: To extend theoretical understandings from the simple single-item CF scenario to practical multi-item scenarios, Corollary 1 is restricted to the dot-product-based loss function.**\n\n**A1**: Thank you for your question. The core of our recommendation scenario centers on the dot-product interaction between users and items. While Corollary 1 focuses on this foundational setup, exploring general formulations rather than specific modeling approaches can enhance theoretical applicability.\n- To assess the robustness of Corollary 1 beyond dot-product scenarios, we will include experimental results using NeurMF with non-dot-product-based loss functions.\n- We have found that PamaCF **achieves state-of-the-art performance, even in non-dot-product-based loss functions**.\n\n- **Recommendation Performance**: The table can be seen in the pdf (Table 3) in the global response.\n- **Robustness against target items promotion**: The table can be seen in the pdf (Table 4) in the global response.\n\n---\n\n**Q2: The experiment only involves two CF backbones, namely MF and LightGCN. The results will be more convincing by adding more CF methods.**\n\n**A2**: Thank you for your suggestion. We appreciate your feedback, and in response, we have expanded our experimental evaluation to include results from NeurMF, as shown in the tables referenced in Q1. We have found that **Our findings demonstrate that PamaCF achieves state-of-the-art performance within the NeurMF**. This addition broadens the scope of collaborative filtering methods examined in our study.\n\n---\n\nWe sincerely appreciate your time, effort, and valuable suggestions during the review process. We trust that these clarifications adequately address your concerns.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We would like to express our sincere gratitude to all reviewers for your valuable feedback and for taking the time to evaluate our work. We are very encouraged that our main contributions have been acknowledged by all reviewers. We have taken great care to address any concerns or misunderstandings raised by the reviewers by providing detailed clarifications and additional support. We believe that our efforts have been worthwhile and are looking forward to your continued attention to our paper.

To facilitate the assessment of our contributions, let us summarize the strengths recognized by reviewers:

- Important research problem (Reviewers gsZx, 6kCb, MDNE)
- Interesting and novel idea (Reviewers gsZx, MDNE)
- Reasonable motivation (Reviewers gsZx, MDNE)
- Sound theoretical results (Reviewers gsZx, svg8, 6kCb, MDNE)
- Rigorous mathematical proofs (Reviewer MDNE)
- Solid and convincing experiments (Reviewers gsZx, 6kCb, MDNE)
- Well-structured and well-written paper (Reviewers svg8, MDNE)

In our responses, we have diligently analyzed concerns and provided comprehensive evidence and justifications. Where there were misunderstandings, we offered detailed clarifications with references to specific sections of the paper. Additional figures and tables can be found in the attached PDF.

In conclusion, we believe that our paper makes meaningful contributions to the field of robust recommender system and will benefit the research community. We would like to thank all the reviewers for your valuable and constructive comments for improving our paper. We kindly request that the reviewers reevaluate our work based on our responses. If there are any further concerns that would prevent the reviewer from increasing the score, please let us know, and we would be happy to address these concerns during the discussion phase. We look forward to hearing from you.

Best regards,   
Authors of paper 5740

Meta-review: This work offers a theoretical insight into the effectiveness of adversarial collaborative filtering and introduces a practical learning approach applicable to various scenarios. Experiments conducted on three datasets show that the proposed method excels in robustness and recommendation performance. While reviewers generally acknowledge the paper's positive aspects, they have raised concerns about discrepancies between the theoretical results and the proposed methods, as well as the assumptions made in the theoretical analysis.
Decision: Accept (poster)