Data-Free Model Extraction for Black-box Recommender Systems via Graph Convolutions
Authors: Zeyu Wang
Yidan Song
Shihao Qin
Yu Shanqing
Yujin Huang
Qi Xuan
Xin Zheng
Venue: NeurIPS 2025 poster ()
Keywords: Recommender System
Model Security
Model Extraction Attack
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: A black-box model extraction method under data-free settings for recommender system.

Abstract: Privacy and security concerns are becoming increasingly critical for recommender systems, as model extraction attack provides an effective way to probe system robustness by replicating the model’s recommendation logic — potentially exposing sensitive user preferences and proprietary algorithmic knowledge. Despite the promising performance of existing model extraction methods, they still face two key challenges: unrealistic assumptions on the requirement of accessible member or surrogate data and generalization problem where surrogate model architecture constraints lead to overfitting on generated data. To tackle these challenges, in this paper, we first thoroughly analyze how the architecture of surrogate models influences extraction attack performance, highlighting the superior effectiveness of the graph convolution architecture. Based on this, we propose a novel Data-free Black-box Graph convolution-based Recommender Model Extraction method, dubbed DBGRME. Specifically, DBGRME contains: (1) an interaction generator to alleviate the need for member data requirements in a data-free scenario; and (2) a generalization-aware graph convolution-based surrogate model to capture diverse and complex recommender interaction patterns for mitigating the overfitting issue. Experimental results on various datasets and victim models demonstrate the superiority of our attack in data-free scenarios (e.g., surpassing PTQ data-require methods with 17.4% improvement on LightGCN). Code is available: \url{https://github.com/Vencent-Won/DBGRME.git}.

Date-Free Model Extraction for Black-box Recommender Systems via Graph Convolutions
Zeyu Wang 223 Yidan Songl: 1.3, Shihao Qin 1.3, Shanqing Y.1.3 Yujin Huang',
Qi Xuan 1.3 Xin Zheng
ZZejjaang University of Technology Griffith University
Binjiang Institute of Artificial Intelligence "The University of Melbourne
wencent_wwan@outlle com, yushangingozjut. edu. en, xin thengggrifffir edu.au
Abstract
Privacy and security concerns becoming increasingly critical for recommender systems, as model extraction attack provides an effective way to probe system robustness by replicating the model's recommendation logic potentially expos- ing sensitive user preferences and proprietary algorithmic knowledge. Despite the promising performance of existing model extraction methods, they still face key challenges: unrealistic assumplions on the requirement of accessible member or surrogate data and generalization problem where surrogate model architecture constraints lead to overfitting generated data. To tackle these challenges, in this paper, we first thoroughly analyze how the architecture of surrogate models influences extraction attack performance, highlighting the superior effectiveness of the graph convolution architecture. Based on this, we propose a novel Data-free Black-box Graph convolution-be based Recommender Model Extraction method, dubbed DBGRME. Specifically, DBGRME contains: (1) an interaction gener- ator to alleviate the need for member data requirements in a data-free scenario; and (2) a generalization-awal graph convolution-bas based surrogate model capture diverse and complex recommender interaction patterns for mitigating the overfitting issue. Experimental results on various datasets and victim models demonstrate the superiority of attack in data-free scenarios (c.g.. surpass- ing PTQ data-require methods with 4%% improvement on LightGCNN. Code git
available: httts:///githut www.bb/c////enneettooo..
1 Introduction
Recently, as society shifts toward an information-driven paradigm, recommender systems have become crucial solutions to information overload issues [ 2. with extensive applications in e-commerce 5,, social media 6
7 g etc. However, with the popularization of recommender systems, concerns regarding privacy and security have also surfaced 9 J0 [[] One of the most pressing challenges is the model extraction attack, in which attackers try to reconstruct the victim recommender model or extract its underlying mechanisms. By doing so, attackers can not only gain access to the core technologies of the platform and its commercial value, but also manipulate recom- mendations [12] [3] by simulating data on user behavior based on the extracted model, potentially affecting user interests and violating their rights. Hence, there is increasing urgency for in in-depth research on recommendation system model extraction attacks to explore the robustness of existing recommendation models.
*Corresponding author: Shanqing Yu Xin Zheng.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Model extraction attacks have long been a critical component of the model security field 14
13
16 17,, with extensive research conducted in areas such as computer vision [
T9
20]
However, research on recommender model extraction attack is still in its early stages. For ex- ample, 21 [2 investigate model extraction under white-box settings using the victim model's member data, and [23] explored black-box attacks based on surrogate data drawn from a dis- tribution similar to that of the victim's member data, along with model querying. However, these approaches rely on unrealistic assumptions about having complete knowledge of either the member data or high-quality surrogate data, which rarely holds in real-world scenarios.
Therefore, this paper aims to explore model extrac- tion attack on recommender systems under more realistic assumptions: black-box settings, no access to member data, and query limitations. Given these constraints, straightforward approach is to gen- erate synthetic user-item interactions, use them to query the victim model, and then train a surrogate model using the query responses. However, this leads key challenge: the generalization prob- lem. In previous member data accessible attack algorithms, attackers can access the victim model's member data and only need to select surrogate model with generalization ability for attack. However, as shown in Figure I when applied in data- free settings, these surrogate models exhibit clear performance gap between synthetic queries and real-world data. This is mainly because they rely solely on user and item identifiers as input features. Lacking real member data, they are forced to resort to synthetic user features, which easily causes overfitting and limits their ability to capture the victim model's true recommendation mechanism.
Basiom Systhess Data Traning
Set Real world Ditaeet
Mr-100K
Yelp
0.5
0.5
044
04
03
0.2
02
GCMC
MGCP
LighnENN
GCMC
NGCP
LaghSCN
Figure I: Agr 50 on ML-100K and Yelp with GCMC as the victim model and random data generation. The horizontal axis indicates surro- gate models: GCMC, NGCF, and LightGCN.
To address these challenges, this paper begins with a comprehensive study of model extraction attack against recommender systems from multiple dimensions, including attacker knowledge, query budget, attack strategies, and model architectures. Interestingly, we find that surrogate models with architectures identical the victim model do not always achieve optimal extraction performance. Instead, graph convolution- based surrogate models are well-suited for extraction tasks, thanks to their ability to capture complex interaction patterns within user-item networks. Building on this insight, we introduce novel Data-free Black-box Graph convolution- based Recommender Model Extraction method, dubbed DBGRME, consisting of an interaction generator and generalization-awe convolution-base surrogate model. DBGRME mainly generates query data through the generator, obtains feedback from the victim model, and uses this feedback to train a fine-grained surrogate model. Specifically, to overcome the data-free limitation, we introduce an interaction generator that simulates implicit user-item feedback. Its objective is to maximize the disagreement between the surrogate and victim models, thereby driving the surrogate model to explore diverse interaction patterns. Building on this, the generator strategically produces query data that optimizes information extraction from the victim model. Morcover, to achieve efficient model extraction, we develop generalization-awarl graph convolution-ban based surrogate model for capturing the diverse and complex recommendation interaction, as well the recommendation pattern of the victim model. Through the collaborative optimization of the generator and the surrogate, DBGRME achieves excellent model extraction performance. In summary, our main contributions are:
graph
We provide a comprehensive analysis of recommender system model extraction attack from multiple perspectives, including attacker knowledge, query budget, and model types, emphasizing the superiority of graph convolution-bact models in extraction performance.
This paper proposes DBGRME, a novel data-free black-box recommender model extraction method. It develops graph convolution- -baed surrogate model that mitigates the overfitting problem, combined with a generator to achieve effective model extraction.
Extensive experiments on four datasets and five victim models show that our method achieves superior performance in data-free scenarios, even surpassing some that use member data.
2

---

2 Background
2.1 Problem Definition
Recommendation is the process of automatically selecting and presenting relevant items to users based on their preferences, behaviors, and contextual information. Formally, given a recommendation interaction dataset D = {(u,2) a) with a user set U = {u}" and an item set I = {i}m where M denotes the amount of interaction in the dataset, denotes the number of users, and denotes the number of items. The recommender system then aims to learn function fo U x I + S that predicts the scores S E R=*m of items I for users U. Recommender system model extraction attack refers to the process of extracting the victim model fe by querying its API and using the obtained outputs, or by training a surrogate model fs with target domain data to replicate its functionality. Formally, given victim model Jo, one can visit it to obtain the top-k recommendation list for user
To = TopK (So,K(S,.a.a kival),
(1)
where heval is the output length of the victim model. The objective function of surrogate model fa is:
arg max
Agreement Te,u);
(2)
NEU
where the Agreement (Agr) function is defined as:
Agreement (Ta,m To,,) Ta n To.u
(3)
(To.
Agr@ihieval represents the top-kieval agreement between the victim model and the surrogate model.
2.2 Attack Overview
Attacker's Knowledge.
From the data perspective, according to the attacker's access to member data, we classify scenarios into full data, partial data, and data-free settings, where the partial data is divided based on the user set of the whole dataset. From the model perspective, depending on the attacker's s access the victim model, we categorize scenarios into black-box and white-bos settings. In the black-box setting, the attacker can only visit the model API and obtain the final output (i.e., the top-k recommendation list). In contrast, the white-box setting grants the attacker access to both the outputs and model architecture, etc. Additionally, we define a query as the input of user along with their historical interactions. If either the user or the interaction history changes, it is considered a new query; otherwise, is not counted
new query.
Attack Mode. As shown in Table 1 according both mem- ber data accessibility and query capabilities, model extraction attack can be categorized into three modes: 1) Partial target data (PTD): The attacker holds subset of the target domain data but cannot query the vietim model. The surrogate model is trained solely on the available data to approximate the vic- tim's 's behavior. 2) Partial Target Data with Query (PTQ): The attacker not only accesses partial data but is also allowed to query the victim model. The surrogate model is initially trained on the available data and further refined through query feedback, achieving closer replication of the victim's 's behavior. 3) Data-free: The most challenging setting, where the attacker has no access to the target domain/surrogate data and operates under a limited query budget. In this case, the attacker must generate data to extract knowledge from the victim model.
Table 1: Attacker's s knowledge and ability across different attack modes.
Mode Partial Target Data Query
PTD
PTQ
Data-Free
In this paper, all experiments are conducted under black-box settings. Unlike previous works that assume access to full data, partial data, or surrogate datasets, we target a more challenging and realistic scenario: performing model extraction in a data-free setting with limited query budgets.
3 Comprehensive Investigation of Recommender System Model Extraction
In this section, we conduct comprehensive investigation of the recommender model extraction from multiple perspectives, including the knowledge and capabilities of the attackers. Specifically, the data level, analyze how accessible member data rate and query budget impact the effectiveness
3

---

ML-1NK
NC-IM
70.0%
65.%%
53.0%
54.0%
00.0%
000hs
20.3%
50.05
94.0%
62.0%
BEUPS
100%
55.%%
500%
SAUPS
10%
30%
30%
65%
50%
59%
205
38%
40%
50%
Mannberr Thate Slate
Nimborr Tlata Raate
Quacy Badget
Quxcy Budget
90
(h)
(3)
BPR
II NCF
NGOF
II LIMAGEN
Figure 2: The Agr@ of PTD and PTQ with varying member data rates and query budgets across four victim models. Among them, (a-b) show the PTD results on ML-100K and ML-IM, (c-d) show the PTQ results on ML-100K and ML-IM.
of model extraction; at the model level, we investigate the influence of model architectures on the model extraction task. Based on the above investigation, we identify the superiority of graph convolution-based recommender models in model extraction tasks.
3.1 The Analysis of Data Perspective
To investigate the impact of accessible member data rate and query budget on model extraction performance, conduct experiments under the PTD and PTQ attack mode using BPR [24), NCF [25] NGCF [25], and LightGCN 266 as victim and surrogate models. Specifically, in the member data rate experiments, we analyze the extraction effectiveness under accessible data rate of {10% 20%, 30%, 40%, 50%}: J: in the query budget experiments, based on accessible member data rate 10%, explore the impact of query budget of (20%, 40%, 60%, 80%, 100%} on extraction effectiveness. Moreover, for consistency, all victim and surrogate models are configured according to their papers. Figure p the experimental results MI--100S and MI-1M datasets. For each victim model, we report the extraction results corresponding to the pesstperforming surrogate model. As shown in Figure the extraction performance consistently improves with an increasing member data rate. Similarly, Figure 2 demonstrates that a larger query budget leads to better extraction outcomes. Notably, attackers with access only 10% of member data and sufficient query budget eventually outperform those with 50% of member data but no querying capability, Based on these observations, we can draw the following conclusions: 1) Extraction performance is positively correlated with the attacker's 's knowledge (i.e., the accessible member data rate) and capabilities (i.c., query budget); 2) Querying the victim model significantly enhances attack performance.
3.2 The Analysis of Model Perspective
To explore the model extraction capabilities across different model architectures, we conduct cross- extraction experiments under the PTD attack mode using three classical recommender models: BPR, NCF, and LightGCN, which represent matrix factor- ization, deep learning, and graph convolution- based architectures, respectively. Experiments are per- formed on the ML-100K with accessible member data rates of 10% and 50%. To ensure fair compari- son, all surrogate and victim models are configured identically. The experimental results presented in Figure 3 where the horizontal axis denotes the surrogate models, the vertical axis denotes the vic- tim models, and darker cells indicate better extraction member data rates, increasing the accessible member data leads to consistently improved surrogate performance across different victim models, Furthermore, by examining the heatmaps horizontally, we observe that LightGCN, when used as the surrogate model, consistently achieves the best ex- traction performance-even when the victim and surrogate architectures are identical. This finding highlights the superiority of graph convolution-base recommender models in model extraction tasks.
Momber data Rate 10%
Member data Rate 50%
0.12
0.27
0.50
0,27
0.38
0.61
LAMOGIN NFF
LXAENN NEP
0.66
0.29
0.40
LighIGN
LighIGCN
Figure 3: Agr@ 50 of cross model extraction with member data rate (10%, 50%). Horizon- tal/vertical denotes the surrogate/victin model. effectiveness. From the perspective of varying

---

Than Embodding
Use Randen Intiadlration
4 Encader
1)
G Generator 6.
Layer Narm
(o)) ot
Messagg Panding Layer
Surrogate /
fa
Layer
Frocen
Learnable
Item Projection
Layer
Projection Layer
gr greement?
Concalmate
User/itere
Product
Itm Embeddingg
User Embeddiag
Repowentation
Layer
Layer
The framework of DBGRME. Among them, the left part depicts the workflow of the surrogate model, the middle part depicts the workflow of the model extraction and the right part depicts the workflow of the generator.
Figure 4:
Table 2: The ablation results about graph con-
Moreover, further explore the role and neces- sity of graph convolution in the model extraction task, we conducted an ablation study by removing the convolution layers of the surrogate during the testing phase for different victim models. The com- parison results under PTD setting are shown in Table 2 where w/o Conv represents the LightGCN without the graph convolution layers. Surprisingly, tion layers exhibits sharp decline across victim models, highlighting the superiority of the graph convolution mechanism in recommendation model extraction.
volution mechanism on ML-100k.
victim model
BPR
NCF
NGCF
LighTGCN
w/o Conv
0.0458
0.0383
0.0453
0.0481
LightGCN
0.5034
0.5766
0.5497
0.5330
performance models without convolu-
Data-free Black-box Graph Convolution-based Recommender Model Extraction
To effectively extract a black-box recommender model in the data sceneries, we propose a novel Data-free Black-box Graph convolution-based Recommender Model Extraction method, dubbed DBGRME,, consisting of an interaction generator based on user-item implicit feedback modeling, and surrogate model composed of generalization-awal module and a graph convolution module. DBGRME utilizes the generator to synthesize virtual user-item interactions,
As Tigure/4describee which are then applied to query the victim model. Subsequently, the surrogate model is trained by aligning its outputs with those of the victim model, thereby approximating its behavior. In this section, we provide detailed introduction of the generator and surrogate model within the attack framework. The algorithm description of the entire training process is in Appendix A
4.1 Generator
In data-free scenarios, attackers must generate query data and access the victim model to obtain feedback for training the surrogate model. A straightforward approach under the data-free black-box setting is to randomly create interaction data for querying. However, feedback from such random data carries limited information, requiring a larger query budget to achieve effective extraction. Moreover, in real-world scenarios, queries often face strict limitations. To address these challenges, inspired by classical graph generative models, design interaction generator that synthesizes user-item embeddings to simulate implicit feedback and generate interaction data for model extraction.
As illustrated in Figure 4 given the synthesized user number n' and the generator G3 with parameters Ç, we first initialize item embeddings X, IR mx using the Embodding layer, and initialize user with random distribution X N 1), X E RRn'xd The embeddings can be input into the encoder of items and users to get the representations of users X items X where the encoder consists of LG layers MLP. Then, can get the rate matrix St with the inner product of the
5

---

representations of users and items, where St.u denotes the generated rate vector of user u E U". And acquire the synthesized quer data Dquery- (a ) by sampling the top-higen items for each user, where the kigen is a hyperparameter.
Inspired by the adversarial dynamics in GANs, we design the generator to maximize the disagreement between the surrogate and victim models, encouraging it to produce samples near decision boundaries where the models differ most. To achieve efficient model extraction, the synthesized queries should maximize useful information for training the surrogate model. Therefore, we train the generator by maximizing the Bayesian Personalized Ranking (BPR) Loss, which captures the disagreement between the victim and surrogate predictions:
Egenerator = Σ E
E
EEEE
E
- In (Ss.ui - S8,u8):
NEU iE.o.u JETs."
where Sa,ui denotes the prediction score of user u to item with surrogate fo based on input Qquery-
4.2 Surrogate Model
In attacks where member data is accessible, attackers can simply adopt generalizable recommender architecture as a surrogate model, relying solely on user identifiers for representation learning. However, under the data-free scenario, such surrogate models-wild specific embeddings- often fall into the overfitting trap: while the surrogate may perform well on synthetic data, ultimately fails capture the true member data distribution and the underlying recommendation logic of the victim model.
independently learned user-
Building the above analysis and the findings from Section 3 propose a novel generalization- aware graph convolution based surrogate model architecture. As illustrated in Figure 4 our surrogate model consists of two main components: the generalization-awve module. Specifically, considering the ineffcctiveness of individualized training for synthesized user embeddings, the generalization-aware module enhances model generalization by freezing user embeddings and introducing a feature projection layer. This design transforms the previous user- specific learning paradigm into capturing platform-level latent recommendation patterns. Formally, given synthesized query data Dquery with synthesized
module and the graph convolution
set U' {u)"', the embeddings of synthesized users and items can be denoted as Eu and Σ₁ with corresponding weights v., E "g"' and 2b, E mxd where n' denotes the number of synthesized users, d denotes the embedding dimension and the user embedding weights are frozen, bhy <- constant. Then, can apply the user and item embeddings to the feature projection layer and get the projection representation E"":
E FeedForward Ran
Ej FeedForward (Er) mxd
(5)
E FeedForward( (E)))) Raxxd
E FeedForward(((E)) R
(6)
= LayerNorm Eiir + E E R((n+m)xxd
(7)
where E' and E" represent the process variables, the @ denotes the concatenate operation, x(-) denotes the nonlinearity function, FoedForward(-) denotes feed forward layer, and LayerNorm( denotes layer normalization. This approach replaces the individualized optimization of user embed- dings with the feature projection mechanism, effectively capturing the underlying behavior patterns of users and items. Then, the surrogate model utilizes the graph convolution backbone to capture the user-item interactions. For training stability, the representations update with symmetrie normalization:
(1) 24
Σ (EN(w) VW(w))
h ( + ee"
z (1)
Σ VIN(I) VEN(()
1
h + ee"", (8)
(1+1) LayerNorm(z!"))
(1+1) LayerNorm(z
where "" E E" represents the projection representation of user or item, and simultaneously (!) and z are the process variables of graph convolution,
utilized the initial hidden state (0)), zi (u) denotes the set of items that are interacted by user u, (() denotes the set of users that interact with item i. After L layers update,
(L) acquire the final representation of user h item h

---

Table 3: Comparison of Ag and @@ obtained from various attack. Among them, the "black- box" " corresponds the recommendation performance 50 of victim models, the bolden highlights the best extraction performance, and the underline indicates the sub-optimal performance.
Black box
Partial Data
Unto-late
Unmseets
Victim Models
PTQ
Randons
Random DBORME
Generioor Amtai
DFME
DBGKME
R
R.050
Agr1.50
Agr
R4050
A.r0:50
R.050
Auri
BPR
0.3499
0.3360
0.9034
0.3425
0.5936
0. 1169
0.2734
0.2136
0.2045
0.1974
0.2735
0.1447
0.2181
0.2172
0.297%
NCF
0.3586
0.3260
0.5766
0.347]
0.6856
0.2115
0,3074
02166
03:95
0.2129
0.3076
0.3191
0.3134
0.2182
0.3197
ML 100K
OOMC
0.3815
0.3200
0.5188
0.368
0,521
0.2155
0.323
0.7799
0.3465
0.3477
0.1867
0.2879
0.1173
1L4707
NOCP
0.3812
0.3260
0.549)
0.3594
0.645
01206
0.300
0.2867
0.788
0.166
0.788
0 0.1867
0.337
0.294
1L4891
LighGEN
0.3921
0.3360
0.5330
0.3534
0.5378
0.3417
0.645
0.535
07514
0.349
0.6322
0.3380
0.5805
0.359
0L7727
RPW
0.3719
02681
0.3161
0.3614
0.563
0/025
00008
0.2607
0.2675
00541
0.647
0.987
0.000
0.312
02511
0.3647
0.3555
0.758
02023
0,277
0,225
03174
0.021
0.3021
0.200
0.2911
0.2034
IM
GCMC
02581
0.5417
0201
03:31
02022
0.200
0
LighGCN
0.258
0.3647
04179
0.3044
0.
0.35%
RPR
0.0835
0.704
0.2387
0.961
0.4088
00239
00655
0.0115
0,0899
0.0258
0.090
NCF
0,0777
0.0744
0.2175
00945
0,3288
00188
03145
0.221
0.004
0.0S5
0.345
0.036
0.1470
0.2934
Yelp
GOMC
0,1059
0.0794
0,3423
01965
0.468
00437
00097
00371
01131
00423
0,099
00009
0.500
00615
0.144
NOCY
0,1055
0.0794
0.2597
01976
0.8815
00225
6,558
01975
00513
0.1097
00855
0.062
09682
0.3872
LighIEN
0.1286
0,2850
0.007
0.4571
00927
0.4788
1100%
05011
0.051
0.4854
0,707
0.2810
0.167
ILA622
UPK
0.1857
0.1854
0.334
02167
0.108
[167]
00042
0,6775
0U719
0009
0,0877
0.077
0,097
LONN
0.1853
0.1864
0,3331
02106
0.3599
0,626
0.7388
0.0677
0.0731
0.581
0.0739
0.0473
0.0844
0.053
018633
Govalla
GCMC
0.1864
0.5489
0,4897
60707
0.1336
01679
0.702
0.1277
0.1006
0.1528
01380
LigH0CN
0.3665
and compute the user-item rate Saai. To align the output of the surrogate model and victim model to achieve model extraction, we apply the BPR loss as the loss function of the surrogate model:
LBPR -E
In (Ss,ui Ss,uj) + A |
(10)
NEt VET az J4T
where À is the regularization constant. Moreover, to balance the model architecture and prevent the aggressive optimization of item embeddings, we add constraint to limit the magnitude of item embedding weight updates:
Cconstraint
Σ
(W/ viee?
(LI)
NET t=1
where vi. E R denotes the t-th dimensional value of a/2-
5 Experiments
In this section, we conduct a comprehensive experimental evaluation of the proposed DBGRME to validate its effectiveness in black-box recommender model extraction and its generalization performance in a data-free scenario. The experiments consist of four key aspects: First, we perform a comparative study to assess the extraction performance of DBGRME across different victim models and datasets, comparing it with existing methods. Second, we conduct a query budget analysis to investigate the impact of query limitations on the performance of the surrogate model. Third, we performed an ablation study to analyze the contribution of each key module. Finally, we further analyze the behavior of the generator to gain deeper insights into its role model extraction.
5.1 Experimental Setup
Datasets. We use four popular recommendation datasets to evaluate our methods: ML-100K, MI.- IM (27]. Yelp (28) and Gowalla (29]. We follow the preprocessing in [26] process the rating data into implicit feedbacks, and split them into 8:2 as training set and testing set for victim model training.
Also, the testing set will be used to test the model extraction attack performance.
Victim Model. We choose five classical recommender models BPR (24), NCF (2), GCMC (30 NGCF (25, and LightGCN (26] to verify the performance of different attack algoritms. In particular, they are all trained with the settings that their paper recommended.
Baselines. We compare DBGR ME against six baselines: PTD, PTQ, Random-Attack, Random- DBGRME, GeeneaatorAttack and DFME [3I. Regarding the surrogate model, PTD, PTQ, Random- Attack, Generator-Atter Attack, and DFME all use traditional surrogate models (BPR, NCF, GCMC, NGCF,
7

---

and LightGCN) for model extraction, while Gandom-DBGRMMl employs the surrogate of DBGRME. In terms of member data rate, PTD and PTQ utilize 10% of member data, whereas Candom-DBGRMF Generator-Attack, and DFME operate under a data-free setting. As for querying. PTQ can leverage member data to query victim models, Handom-Attace and Eandom-DBGRe rely on random generation, fieneratorAAttce uses the generator we developed, and DFME utilizes its autoregressive generation method. Notably, we record the best results of PTD, PTQ. Hondom-AAtache Generator-Attact and DFME across different surrogate models. Moreover, the detailed experimental settings are provided in the Appendix
5.2 Main Results
To validate the effectiveness of DBGRME, we conduct extensive experiments under two attack scenarios using six model extraction methods across four publicly available datasets and five victim models. For comprehensive evaluation, we adopt Recall @ 50 @R@ 50) and Agr@ 50 as the primary metrics. Specifically, Recall assesses the similarity in recommendation performance between the surrogate model and the victim model, while Agr quantifies the effectiveness of the surrogate model in capturing the victim model's recommendation mechanism. The experimental results are presented in 3 where the Black-box denotes the performance of the black-box victim model, and the bolden/ underlined values indicate the best/subooptmml results under the data-free setting.
Based on the observations, we can derive the following insights: First, in terms of overall extraction performance, DBGRME exhibits exceptional effectiveness in data-free scenarios and consistently achieves the best results. Notably, it is capable of approaching or even supassing attacks conducted under the PTD and PTQ assumptions, particularly, averaging 17.4% improvement over the PTQ with the victim model LightGCN. Second, from the perspective of surrogate model architectures, both Random- DBGR ME and DBGRME, which are based on the surrogate we proposed, consistently outperform traditional surrogate models, emphasizing the strong generalization capabilities of the surrogate mddel of DBGRME, Additionally, generator-based methods outperform those relying on randomly generated query data, confirming the effectiveness of our proposed training framework. However, BPR and NCF present exceptions due to the constraints imposed by their query mechanisms when bandling new data. The overfitting issue is particularly severe for traditional surrogate models on these two victim models, whereas our surrogate model architecture alleviates this problem to a certain extent, further highlighting the superiority of our approach.
5.3
The Analysis of Querying Budget
To investigate the impact of query budget on extraction performance, we conduct extrac- tion experiments under varying query budgets for both Mandom-DBGRME. and DBGRME. The experimental results on ML-100K, ML- 1M, and victim model LightGCN are presented in Figure 5 First, from an overall perspective, DBGRME consistently outperforms Random- DBGRME, and DBGRME is more sensitive to changes in the query budget, further demon- strating the superiority of our proposed method. Interestingly, we find that increasing the query budget does not always lead to continuous improve- ment in extraction performance. Instead, after reaching a certain threshold, the performance tends to plateau. Additionally, the results indicate that different victim models exhibit varying sensitivities to query budget changes, implying that model-specific characteristics play a role in determining the effectiveness of query-based extraction. These findings highlight the importance of balancing query efficiency and extraction performance when performing black-box model extraction.
ML-100K
ML-1M
0.60
0.74
0.55
0.50
0.60
0.45
0.33
10k:
50k 100k 15lk 200 250k
Query Budget
Query Rudget
DBGRME
Figure 5: Agr@50 on ML-100K and ML-IM across different query budgets.
5.4 Ablation Study
To clarify the contributions of each module in DBGRME, we conducted ablation studies on the generalization-awar (GA) module and the constraint loss. The experimental results, summarized in Table 4 show the performance the ML-100k and ML- IM datasets across five victim models
8

---

Table 4: The ablation results ML-100k and ML-IM. The bolden is the best performance.
Black box
w/o GA
wlo constraint
wio GA&constraint
DBGRME
Dataseta
Victim Models
R-500
R@:00
Agri:
R@50
Ag
R@50
Agr@
R@:50
Agr 50
BPR
0.3499
0.1795
0.2805
0818877
0.2923
0.1749
0.2768
0.2172
0.2976
NCF
0.3586
0.2091
0.3119
0.2166
0.3168
0.21155
0.3047
0.2182
0.3197
M0.K100K
GCMC
0.3815
0.3035
0.4652
0.3097
0.4726
0.3036
0.4628
0.3173
0.4894
NGCF
0.3832
0.2508
0,3849
0.2890
0.4686
0.2177
0.3506
0.2946
0.,8891
LightGCN
0,3921
0.3340
0.7657
0.7400
0.3599
BPR
0.3739
0.1434
0.1767
D. 0.1980
0.2534
0.0671
0.1049
0.2022
0,2664
NCF
0.3779
0.1965
0.2903
0.1983
0.2966
0.1935
0.2877
0.2034
0.3185
ML-IM
GCMC
0.4156
0.2053
0.3120
0.2289
0.3296
0.2033
0.3106
0.2347
0.3467
NGCF
0.4253
0.1008
0.1277
0.2015
0.2657
0.0993
0.1266
0.2034
0.2773
LightGCN
0.3219
0.5616
0.5464
0.35%
embber Data
0L00175
0.0006
Member
0.0006
Member Date
0.00125
0.00100
0.00130
0.00775
Generabor
0.00125
[.00100
0.00075
LLU0150
0.0003
Genarator
0.0095
0.0001
0.0003
Randon
ILONGG
0.0002
0.0002
0L0N233
ILUNE23
0.0001
0.00000
1,00000
1990
1000
2000
3000
1000
3000
Index
(A) The reullts M1.100K
dataset.
The nealts on ML-IM datave..
Figure 6: The visualization of data distribution of member data and generated data with different generation methods.
(BPR. NCF, GCMC, NGCF, and LightGCNN. In Table 4 w/o GA indicates the removal of the generalization-awarr module, where the model instead uses the Embedding Layer for user and item encoding and learning; w/o constraint refers to the removal of constraints updates, and w/o GA &constraint means both the GA module and the constraint on item parameter updates are ablated. The results show a significant drop in performance for all variants of DBGRME, indicating that both the GA module and the constraint loss contribute positively to the performance of DBGRME, further validating the effectiveness of our method. Specifically, the "w/o GA&constrain"" variant has the greatest impact on model performance, followed by "w/o GA," while "w/o constraint" shows the least impact. This phenomenon makes sense because the GA module is designed to address the overfitting issue that may arise in prior extraction attacks, and the constraint loss helps the GA module by restricting aggressive updates item parameters while enhancing the optimization of feature mapping layers within the GA module. The synergistic effect of both components achieves optimal extraction performance.
item parameter
5.5
The Analysis of Generator
To deeply analyze the role of the generator in the model extraction experiments, we conducted a visual analysis of the data distribution of virtual query data and the member data of the victim model. Figure presents the experimental results on the ML-100K and MI-IMM datasets using LightGCN as the victim model. where the horizontal axis represents the item index and the vertical axis represents the item interaction frequency. It is evident that, compared to the randomly generated data, the distribution of the data generated by the generator more concentrated and aligns more closely with the member data. It exhibits similar peak variations and trends in multiple key regions, indicating that the generator can produce data that is more informative for training the surrogate model, which aligns with our training objective.
6 Related Work
Model extraction attack [15] aim to reconstruct or approximate a target model by visiting its API, often under black-box conditions. Although extensive research has been conducted on model extraction domains such as computer vision 18), the exploration of model extraction attack in recommender systems remains relatively limited and underdeveloped. Early research on model extraction recommender systems typically assumes access to either the full data/partial member surrogate dataset 23 that shares similar distribution. However, such assumptions
data [2 22

---

are often impractical in real-world scenarios due to data privacy and platform restrictions. DFME [3 proposes an autoregressive data synthesis strategy tailored for sequential recommender systems under data-free and black-box settings. While effective in the data-free regime, autoregressive data generation typically suffers from low diversity and limited generalizability. Moreover, design inherently more compatible with sequence- based models, and may not generalize well to general interaction- recommender systems, such as collaborative filtering, etc.
7 Potential Defense
Here, we discuss the future extension of potential countermeasures from three perspectives: detection- based defense, model-level defense, and legal & ethical considerations.
Detection-based defense. Recent attacks B1 32
often rely on autoregressive querying or generator- driven interaction synthesis. Monitoring query frequency, interaction entropy, and behavioral anoma- lies can help detect suspicious users. Platforms may then apply query rate limiting or introduce noise to hinder extraction.
Model-level defense. This approach involves injecting perturbations into the model's representation or output space to mislead attackers. However, in hard-label recommendation settings, such defenses require careful calibration to maintain model accuracy while degrading extraction effectiveness.
Legal& & ethical considerations. In addition to technical defenses, platform operators should implement responsible deployment practices such strict API access control, policy enforcement and legal safeguards. Raising public awareness and establishing regulatory frameworks can further mitigate the misuse of recommendation models.
In addition, this study is conducted on benchmark datasets with the aim of improving the robustness of the system and promoting awareness of potential vulnerabilities.
8 Conclusion
In this paper, We begin with a comprehensive investigation of recommender model extraction and identify the superiority of the graph convolution layer in recommender model extraction. Inspired by these key insights, we propose novel data-frea free black-box graph convolution-based recommender model extraction method, termed DBGRME. Specifically, our approach introduces two key com- ponents: (1) to handle the data-free challenge, we introduce user-item implicit feedback-basee interaction generator with the training objective that generates data to maximize the disagreement be- tween the surrogate model and victim model, and (2) to mitigate the overfitting problem. we develop surrogate model, consisting of a generalization aware
generalization- aware graph convolution-base module and the graph convolution backbone. Based the collaboration of these two components, DBGRME can effectively capture the recommendation mechanism of the victim model. Extensive experiments four datasets with five victim models demonstrated that DBGRME achieves superior model extraction performance in data-free scenarios. Specifically, our method achieved an Agr@ 50 0.7727 and R 50 0.3599 (the victim model 0.3921) ML-100K with the victim model LightGCN, surpassing the performance of traditional extraction methods based on the member data accessible assumption. Moreover, a limitation of this work that we have not yet explored defense strategies against recommender model extraction attack, an important avenue for future research. Introducing differential privacy presents promising direction: however, primarily suited for soft-label settings. In hard-label scenarios, its application necessitates careful balance between preserving the recommendation and robustness.
Acknowledgements. This work is supported in part by the Key R&D Program of Zhejiang Province under Grant 2024C01025, by the Zhejiang Province Natural Science Foundation under Grant LBMHH225F02000, by Key Technology Research and Development Program Project of Hangzhou under Grant 2024S7Di A045
References
[1] Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. Deep learning based recommender system: survey and new perspectives. ACM computing surveys (CSUR), 52(1): 2019.
10

---

[2] Muhammad Aljukhadar, Sylvain Senecal, and Charles-Etienme Daoust. Information overload and usage of recommendations. In Proceedings of the ACM RecSys 2010 Workshop on User- Centric Evaluation of Recommender Systems and Their Interfaces (UCERSTT), Barcelona, Spain, pages 26-33, 2010.
[3] Yating Liu, Xin Zheng, Yi Li, and Yanqing Guo. Test-time adaptation on recommender system with data-centric graph transformation. International Joint Conference on Artificial Intelligence (IJCAI), 2025.
[4] Brent Smith and Greg Linden. Two decades of recommender systems at amazon. com. leee internet computing, 21(3): 2017.
[5] Badrul Sarwar, George Karypis, Joseph Konstan, and John Riedl. Analysis of recommenda- tion algorithms for e-commerce. In Proceedings of the 2nd ACM Conference on Electronic Commerce, pages 158-167, 2000.
[6] Minghao Zhao, Qilin Deng, Kai Wang, Runze Wu, Jianrong Tao, Changjie Fan, Liang Chen, and Peng Cui. Bilateral filtering graph convolutional network for multi-relational social recom- mendation in the power-law networks. ACM Trans. Inf. Syst. 40(2), September 2021.
[7] Flora Amato, Vincenzo Moscato, Antonio Picariello, and Giancarlo Sperlí. Recommendation in social media networks. In 2017 IEEE Third International Conference on Multimedia Big Data (BigMM), pages 213-216. IEEE, 2017.
[8] Xin Zheng, Miao Zhang, Chunyang Chen, Quoe Viet Hung Nguyen, Xingquan Zhu, and Shirui Pan. Structure-free graph condensation: From large-scale graphs condensed graph-free data. Advances in Neural Information Processing Systems, 36, 2024.
[9] Yujin Huang, Han Hu, and Chunyang Chen, Robustness of on-device models: Adversarial attack to deep learning models on android apps. In 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Pructice (ICSE-SEIP), pages 101-110. IEEE, 2021.
[10] Yujin Huang and Chunyang Chen. Smart app attack: hacking deep learning models android apps. IEEE Transactions on Information Forensics and Security, 17: 17:1827-1840, 2022.
[11] Shanqing Yu, Jintao Zhou, Meng Zhou, Yidan Song, Jiaxiang Li, Zeyu Wang, Qi Xuan, Silu Mu, and Xiaolei Qian. Fine-grained mutation operators for community hiding using genetic algorithms. Applied Soft Computing, page 113767, 2025.
[12] Haoyang Li, Shimin Di, and Lei Chen. Revisiting injective attacks recommender systems. Advances in Neural Information Processing Systems, 35:29989-30002, 2022.
[13] Yang Yu, Qi Liu, Likang Wu, Runlong Yu, Sanshi Lei Yu, and Zaixi Zhang. Untargeted attack against federated recommendation systems via poisonous item embeddings and the defense. In P Proceedings of the AAAI Conference on Arlificial Intelligence, volume 37, pages 4854-4863, 2023.
[14] Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys, 55(14s):1- 41, 2023.
[15] Maria Rigaki and Sebastian Garcia. A survey of privacy attacks in machine learning. ACM Computing Surveys, 56(4):1-34, 2023.
[16] Yujin Huang, Zhi Zhang, Qingchuan Zhao, Xingliang Yuan, and Chunyang Chen. Themis: Towards practical intellectual property protection for post-deployment on-device deep learning models. In 34th USENIX Security Symposium ( (USENIX Security 25), 2025.
[17] Yujin Huang, Terry Yue Zhuo, Qiongkai Xu, Han Hu, Xingliang Yuan, and Chunyang Chen. Training- free lexical backdoor attacks on language models. In Proceedings of the ACM Web Conference 2023, pages 2198-2208. 2023.

---

[18] Sunandini Sanyal, Sravanti Addepalli, and R Venkatesh Babu. Towards data-free model stealing in hard label setting. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15284-15222 15293, 2022.
[19] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4954-4963, 2019.
[20] Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. Maze: Data-free model stealing attack using zeroth-order gradient estimation. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 13814-13823, 2021.
[21] Konstantina Christakopoulou and Arindam Banerjee. Adversarial attacks on oblivious recommender. In Proceedings of the 13th ACM Conference on Recommender Systems, pages 322-330, 2019.
[22] Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. Influence function based data poisoning attacks to top-n recommender systems. In Proceedings of The Web Conference 2020, pages 2020.
[23] Zhihao Zhu, Rui Fan, Chenwang Wu, Yi Yang. Defu Lian, and Enhong Chen. Model stealing attack against recommender system. arXiv preprint 2rXiv:2312.11571, 2022
[24] Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thiemas Bpr: Bayesian personalized ranking from implicit feedback. In Proceedings of the Twenty-Fifth Conference on Uncertainty in Artificial Intelligence, UAI '09, page 452-461, Arlington, Virginia,
USA, 2009. AUAI Press.
[25] Xiang Wang, Xiangnan He, Meng Wang, Fuli Feng, and Tat-Seng Chua. Neural graph collabo- rative filtering. In Proceedings of the 42nd International ACM SIGIR Conference Research and Development in Information Retrieval, SIGIR 2019, Paris, France, July 21-25, 2019., pages 165-174, 2019.
[26] Xiangnan He, Kuan Deng, Xiang Wang. Yan Li, Yongdong Zhang, and Meng Wang. Lightgnn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages 639 648, 2020.
[27] F. Maxwell Harper and Joseph A. Konstan. The movielens datasets: History and context. ACM Trans. Interact. Intell. Syst. 5(4), December 2015.
[28] Xiangnan He, Hanwang Zhang, Min-Yer Kan, and Tat-Seng Chua. Fast matrix factorization for online recommendation with implicit feedback. In Proceedings of the 39th International ACM SIGIR conference on Research and Development in Information Retrieval, pages 549-558, 2016.
[29] Eunjoon Cho. Seth A Myers, and Jure Leskovec. Friendship and mobility: user movement in location-based social networks. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 1082-1090, 2011.
[30] Rianne Van Den Berg. N Kipf Thomas, and Max Welling. Graph convolutional matrix comple- tion. arXiv preprint arXiv:1706. 02666.2226..222 2(8):9, 2017.
[31] Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. Black-box attacks on sequential recommenders via data- free model extraction. In Proceedings of the 15th ACM conference on recommender systems, pages 44 54, 2021.
[32] Yihao Wang, Jiajie Su, Chaochao Chen, Meng Han, Chi Zhang, and Jun Wang. Sim4rec: Data-free model extraction attack on sequential recommendation. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 12766-12774, 2025.
[33] Zechun Liu, Kwang-Ting Cheng, Dong Huang, Eric P. Xing, and Zhiqiang Shen. Nonuniforn-to.. uniform quantization: Towards accurate quantization via generalized straight-through estimation. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4942-4952, June 2022.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction in this paper accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: See the Section g
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
13

---

Justification:
The paper focuses on empirical studies.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: In Section S and Appendix B we listed all the necessary information for the reproduction of the main experiment results. Moreover, we have listed the url of the anonymized code repository in the abstract.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
14

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Our data and code are available in https://gittheee http:/ggchub..cmmm/eneenettt Won/ DBGRME. git We also provide sufficient instructions, which are listed in the readme file of the repository, Section 3nd and Appendix B to reproduce the main experiment results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please the NeurlPS code and data submission guidelines (https://nips.cc
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
spllccy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In Section 5 and Appendix
B we specified all the experiment details.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Improvement percentages (>10%) over PTQ mode discussed in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
Discussions are Appendix B
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics htttpp/:///rrpp..cc/plbltt//////
Answer: [Yes]
Justification:
The research conforms the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have discussed it in Section
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
16

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: In Section 1 Section 7 and Section we discuss the importance and potential ways to safeguard recommender models against our attack.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All data sources and baseline models are open-sourced. They have been properly credited and mentioned, as outlined in Section 5 and Appendix
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version the asset used and, possible, include URI
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperswithcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
17

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer:
[NA]
Justification:
No new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
18

---

16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /ttpp/////euips..... wwwparippsscccoooeeeeeee cc/Conferencess///////e for what should or should be described.
19

---

A Algorithm of DBGRME
Algorithm 1 Alogrithm of DBGRME
Input:
Query budget Q, iteration times of generator (ier_G, iteration times of surrogate model iter_ the synthesized user number n', victim model fo
Output: surrogate model fs Initialize surrogate model fa. generator Ge. budget count q f- 0 while q < Q do
for iter 1, ittr do X ~ ((, 1),11") = n2
Dquery Gg
Acquire the To (To.u JuEo by querying fo with D Dquery
Acquire the Sx (Ss.hheet by querying Ss with Qquery
Calculate Lgenerator by Equation (4)
Update the generator parameter by Equation
12
end for
for iter = 1,... -iter_C do
Dquery (X())) Xe (O, 1),1))) n''
Acquire the To
by querying fo with Dquery
Acquire the Sg- (Ss,ulued) by querying fa with Dquery
Calculate Laurrogate by Equation (15)
Update the surrogate model parameter by Equation
end for
Update budget count q with Equation (16)
end while
A.1 Optimization
As is illustrated Algorithm T the attack algorithm trained based on the alternating optimization framework, which involves two phases: generator training and surrogate model training. In the generator training phase, we perform iter_G rounds the gradient descent for G, which trained to produce query data D that maximize the BPR loss. The generation loss will be used to update the parameters generator Gę:
5 Ir generator V E.generrttr,
(12)
where Ir generattor is the learning rate of the generator, and the V gemerattor can be decomposed into several components:
OL öegenerator dL
d query
C generator
(13)
aD Qquer
Among them, considering that the discretized sampling operation in the generator may lead to gradient loss, we employ the reparameterization technique [33] to enable effective gradient propagation and achieve end-to-end optimization. This followed by the surrogate model training phase, where we perform iter C rounds of gradient descent for fa. The parameters of the surrogate model fs updated using the BPR loss and the constraint loss:
8 イ 8 Ir surrogate VaLaurrostte
(14)
where lr Inrrogatte is the learning rate of the surrogate model. And the Lsurrogate can be denoted as: Laurrogate = LBPR + aLConstraint,
(15)
where is the constraint constant. At each end of iteration, the query budget can be updated as:
+ n' * (iter_C + iter_G).
(16)
A.2 Time Complexity
Clearly, for each main loop, the generator training phase incurs time complexity of Oiter G x n'), while the surrogate model training phase has a complexity Oiter-C x n'), where n' the number of synthesized users, and iter_ and iter denote the iteration numbers for the generator and surrogate model, respectively. Therefore, the overall time complexity per cycle is On (iter_G- iter_ C)), consistent with the query budget update rule described in Equation [6
20

---

Table 5: Statistics of datasets. The #User represents the number of users, #item represents the number of items, #Interaction represents the number of interactions, Density quantifies the density of interactions, and Q represents the query budget.
Dataset
#User
#ltem
#Interaction
Density
Q
ML-100K
944
1,683
100,000
0.0630
200k
ML-IM
6,040
3,416
1,000,209
0.0447
400k
Yelp
31,668
38,048
1,561.406
0.0013
9M
Gowalla
29,858
40,981
1,027,370
0.0008
4M
Table 6: The comparison of different model extraction algorithms.
Partial Target
Methods
Query
Surrogate
Generator
Data
PTD PTQ Random-Attack Random-DBBRR
BPR, NCF, GCMC, NGCF, LightGCN BPR, NCE, GCMC, NGCF, LightGCN
BPR, NCF, GCMC, NGCF, LighIGCN Surrogate model of DEGRME BPR. NCE. GCMC. NGCE, LightGCN BPR, NCF, GCMC, NGCF, LightGCN Surrogate model of DBGRME
Random
Random
Generator-Attan Attack
Generator of DBGRME
DFME DBGRME
Autoregressive
Generator of DBGRME
B Experiment Settings
All experiments are implemented in PyTorct on Ubuntu Server equipped with Intel(R)
Core(TM))94 17-8700K CPU, and NVIDIA GeForce GTX 1080 Ti (with 11GB memory each).
B.1
Datasets
In Table 5 summarize the four widely used recommendation datasets considered in Section where Q represents the query budget used the extraction attack.
B.2 Baselines
To verify the effectiveness of DBGRME, we compared it with five baselines. According to the assumption difference, we can divide them into the partial data setting and the data-free setting. The two partial data setting methods
follows:
Partial Target Data (PTD): recommender model extraction attack method with partial target data accessibility assumption. PTQ directly trains surrogate model with the accessible partial target data.
Partial Target Data and Query (PTQ): Similar to PTD, PTQ also assumes partial access to target data but introduces an additional query mechanism to refine the surrogate model.
Regarding the implementation of PTD and PTQ, we the partial data rate as 10%. The others data-free setting methods:
recommender model extraction attack method with the random data generation and traditional surrogate model selecting from victim model pools.
Random-Attack:
Aettrator-Attack: a variation of DBGRME which replaces our surrogate model with a traditional surrogate model selected from victim model pools.
Random-DBGRME: variation of DBGRME which replaces our generator with random data generation.
DFME 31 generation.
data-free black-box model extraction method with autoregressive data
hhtpss//pytorch.orr/
21

---

Among them, PTD, PTQ. Random- Attack, Senerator-Attack, and DFME do not have definite surrogate model architecture and can select model from the victim model pools (BPR, NCF, GCMC, NGCF, LightGCN). As for the settings of DFME, we refer to [31 Particularly, we reported the optimal surrogate model (LightGCN) results for these methods, which are presented in Table 1, Also,
to clearly compare the baselines, we provide detailed comparison in Table 6
Table 7: Hyperparameter of victim models.
Model
BPR
NCF
GCMC
NGCF
LighTGCN
hidden dim/factors
64
64
64
64
64
num layer
/
/
3
optimizer
Adam
learning rate batch size dropout epoch
[0.0001, 0.0005, 0.001, 0.005)
{1024, 4096)
{0. 0.1. 0.2)
{600, 1000}
Table 8: Hyperparameters space considered for the DBGRME selection.
Hyperparameter
Values
Generator
Hidden dim Number of hidden layers LG
{128, 256} (2,4)
Surrogate
Hidden dim
(64, 128, 256) [2.3) (0,0.13
Number of hidden layers Lg
Dropout rate
Training
Learning rate of surrogate (Fsurrogate
{le - 4, 5e - 4, 1e 1.e-3,50 3, 3, le 2}
Optimizer of surrogate
Adam
Coefficient of constraint loss a
{0.5, 13
Iteration of surrogate iter_ C
Learning rate of generator by "'generator
(1c 4,5c Adam
4, le 33
Optimizer of generator
Iteration of generator iter G
The interactions of each generated user kgen
(1. 10, 50, 100)
The number of generated user in one epoch n
300,900, 2000, 6000)
Batch size
1096, 8192)
B.3 Patameter Setting
The parameters of recommender model extraction involve four parts: victim model, generator, sur- rogate model, and training. We report the detailed parameter space in Table 6 1) As described in Table regarding the victim model, we selected five popular recommender models (BPR, NCF, GCMC, NGCF, LightGCN), and pre-trained them with the configuration that their paper recom- mended. We set black-box API returns to be top- 10p-100 recommended items. 2) The generator consists of the initialization of items, users, and the encoder layer. The initialization of items and users utilize the Embedding layer and random initialization, respectively. Both the encoder layers of items and users are the fully-connected neural network, consisting of LG layers. 3) For the surrogate model in PTD, PTQ, Handom-Attade and Generator-Altack, the surrogate models are selected from the model pools (BPR, NCF, GCMC, NGCF, LightGCN) with the same configuration as victim models. And our proposed surrogate model consists of generalization-awan aware module with Lş layers graph convolution backbone. Among them, the generalization-awel -wwaee module includes the Embedding layer of items, users, and the Nem/Userr Projection layers. Both the Item/User Projection layers are the fully-connected Neural Network, consisting of two layers with unit 4) The parameters of training mainly involve the learning rate, optimizer, batch size, dropout, query budget, etc. One of the most important parameters is the query budget, which limits the attacker's operation. And we have conducted query budget analysis experiments in Section 5.3
22

---

Target MMC
Target Mode:: LghhGGN
0.80
0/1117
0/H15
0/E08
04700
07791
07307
0.7622
0,727
0.70
Nee
M
0.50
0.7390
0.40
0.30
GCMC
0.3008
0,4277
0.030
0L133
06001
0.7197
0.7206
0.7257
LighTGN
0.20
1
2
5
10
20
50
100
200
iter_
C
Rg
gen
T/Thresutt across different Iter Canditar GonML-100K dataset.
(b) yyex ML-10KK dalaeet.
Figure 7: Effects of the hyper-parameters.
C Hyper-parameters Experiments
To systematically explore the optimal configuration of the hyperparameters iter C, iter G, and kgen. this study selects two representative models, GCMC and LightGCN, as the research subjects. Multiple comparative experiments conducted based the public MovieLens- 100K dataset. During the hyperparameter tuning process, all possible combinations of iter_ and iter within the model performance, shown in Figure aa) Figure (bb) further presents a quantitative analysis of the dynamic influence of kgen on the consistency evaluation metric under the values 21, 2, 5, 10, 20, 50, 100, 200). Experimental results reveal that model performance is highly sensitive to these hyperparameters, underscoring the critical role of these hyperparameters in model extraction attack. Based on empirical observations and performance comparisons, iter_ C = 4 and iter_ G = are selected as the default configuration for subsequent experiments. As for the gen parameter, the optimal value is selected individually for each model from the candidate set (1, 20, 50, 100).
set (1, 2, 3, 4] evaluated assess their impact
Table 9: Ablation Study
Black-box
w/o GA
wlo constraint
w/o GA&constraint
DBGRME
Datasets
R@:50
R@00
Agr@
R@:50
Agr
R@:50
Agr@:50
R:8:0
Agr@
BPR
0.0234
0.0242
0.0676
0.0231
0.0653
NCF
0.0777
0.0228
0.1257
0.0200
0.1952
0.0217
0.1637
0.0232
0.2004
Yelp
GCMC
0.1059
0.0389
0.1201
0.0401
0.1422
0.0361
0.1084
0.0618
0.1942
NGCF
0,1065
0.0408
0.1233
0.6424
0.1552
0.0394
0.1168
0.0652
0.2872
LightGCN
0.1266
0.0814
0.1046
0.5855
0.3216
0.1037
0.6062
BPR
0,1857
0.9616
0.0646
0.0632
0.0580
NCF
0.1853
0.0415
0.0518
0.0636
0.0744
0.0414
0.0510
0.0659
0.0763
Gowalla
GCMC
0.2079
0.0894
0.1319
0.1329
0.2162
0.0799
0.1165
0.1350
0.2252
NGCF
0.2408
0.1504
0.2412
0.1609
0.2694
0.1413
0.2201
0.1662
0.2828
LightGCN
0.2758
0.1770
0.4529
0.1874
0.5389
0.1716
0.4395
0.2177
0.6154
Velp
Gowalla
0.65
0.60
3M 5M
7M
9M
IIM
13M 15M
1M
2M
3M
4M SM
6M
7M
Query
Query Budget
Ranfom-DRGRME
Figure 8: Agr@50 on Yelp and Gowalla across different query budgets.
23

---

D Supplementary Experiment
Due to space limitations, here we present additional results on Yelp and Gowalla further verify the effectiveness of DBGRME. Specifically, SableS the results of ablation experiments, which
clearly exhibit similar trends those observed on ML-100K and ML-IM Section 5 further confirm that each module in DBGRME contributes positively.
These findings
Furthermore, Figure 8 reports the query budget experiments Yelp and Gowalla using LightGCN as the victim model. We observe that DBGRME achieves consistent performance improvements as the query budget increases. However, the gains gradually diminish once the budget reaches certain scale, which is consistent with the phenomena observed on ML-100K and ML- 1M in Section 5.3
Table 10: Agr@ results of different methods across ML-I00K and ML- IM datasets.
Dataset
Method
BPR
NCF
GCMC
NGCF
LightGCN
DBGRME
0.1546
0.1395
0.5965
ML-100K
DRME
0.1370
0.1189
0.1372
0.2159
0.3353
DBGRME
0.1895
0.1672
0.2584
0.2854
0.6285
random- DBGRME
0.0874
0.2090
0.1690
0.1477
0.4378
ML-IM
DIME
0.0410
0.1210
0.1506
0,2109
DEGRME
0.1424
0.2176
0.1896
0.1675
0,4725
E
High-rank Performance Analysis
Considering that in real-world recommendation scenarios, users are typically more concerned with items ranked at the top of the recommendation list, we further evaluate the high-rank agreement (Agr@ 10) between the surrogate model trained by DBGRME and the victim model. This evaluation provides a finer- greer-granedd perspective whether the surrogate model can accurately capture the most critical recommendation positions. Table presents the Agr@ 10 results of DBGRME, DFME, and random-DBGRME across five different victim models (BPR, NCF, GCMC, NGCF, and LightGCN) on ML-100K and ML- M. These results further confirm that DBGRME overall agreement but also excels in top-ranked recommendations most relevant to user experience.
only effective in
75.0%
68.0%
08.0%
45.0%
300%
15.0%
15.0%
15.0%
8.8%
8.8%
BPR
NCF
GCMC
NGCF
LiJaGEN
BPR
NCT
GCMC
NGCF LighGCN
BPR
NCT
GCMC
NGCF
LighGCN
Guraalaa
60.0%
Steom
45.0%
45.0%
30.0%
15.0%
150%
LightGCN
NCF
Figure 9: Comparison results with Sim4Rec five datasets.
F Contemporary Baseline and Large-scale Dataset
To further validate the effectiveness and robustness of our method, we incorporate the contemporary state-of-the-art baseline, Sim4Rec [32]. into comparisons. addition, to examine the scalability of our approach in more practical scenarios, we extend the evaluation to large-scale dataset, Steam, which contains 334,730 users and 13,047 items. Figure presents the comparison results of DBGRME with DFME and Sim4Rec across five victim models on five datascts. We observe that DBGRME

---

consistently outperforms both DFME and Sim4Rec in all settings, demonstrating its superiority over the sfate-of-the-ar baselines. More importantly, the results on Steam highlight the strong scalability of DBGRME, showing that our approach remains effective even when facing extremely sparse and large-scale datasets. These findings further confirm the broad applicability of DBGRME in realistic recommendation environments.
25


Reviews:
[{"review_id": "G9Yu1IfRei", "reviewer": "Reviewer_Veyw", "summary": "The paper focuses on the issue of data-free, black-box model extraction in recommender systems. It presents a novel approach, DBGRME (Data-free Black-box Graph Convolution-based Recommender Model Extraction), to overcome limitations in previous methods. DBGRME utilizes two key components: an interaction generator that alleviates the need for member data and a graph convolution-based surrogate model that improves generalization and mitigates overfitting. The method is validated through experiments on multiple datasets and various victim models.", "questions": "Please see the weaknesses.", "limitations": "NA", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength:\n\n1. The introduction of the surrogate model and the interaction generator addresses the key challenge of model extraction in data-free black-box settings.\n2. The paper includes experiments demonstrating DBGRME’s superior performance.\n\nWeakness:\n1. My concern is the lack of comparison with some SOTA works [1]][2][3].  \n2. Is the query budget set too large compared to the existing works? \n3. Some common dataset settings (Steam and Beauty) are missing.\n4. I suggest the authors add some discussions about the possible defense methods.\n\n[1] Wang Y, Su J, Chen C, et al. Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(12): 12766-12774.\n\n[2] Wang C, Sun J, Dong Z, et al. Data-free knowledge distillation for reusing recommendation models[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 386-395.\n\n[3] Lin Z, Xu K, Fang C, et al. Quda: Query-limited data-free model extraction[C]//Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security. 2023: 913-924.", "was_revised": true, "final_justification": "The authors have addressed all of my concerns. I hope the authors can include the relevant experimental details and definitions in the revised version.", "rebuttal": "Thank you for your thoughtful review and constructive suggestions. We appreciate your recognition of our method's motivation. We have carefully addressed each of them in our point-by-point response below.\n\nQ1: More comparison works:\\\nA1: \n__[Paper Review]__ We analyzed the three suggested papers from multiple perspectives, including task type and research domain, as shown in the table below. Among them, Sim4Rec is the most recent and closely related to our work; therefore, we included it in our comparative experiments. \n| Method | Task Type| Domain |\n|-|-|-|\n| DBGRME(ours) | Model Extraction | Recommendation | \n| Sim4Rec[1] | Model Extraction | Recommendation | \n| DFKD[2] | Model Distillation | Recommendation | \n| Quda[3] | Model Extraction | Computer Vision | \n\n__[Comparison experiments]__ Based on the comparison results, it can be observed that Sim4Rec performs between DFME and DBGRME, further highlighting the superiority of DBGRME. Moreover, although the Sim4Rec (published in Apirl 11th, 2025) belongs to the official NeurIPS (March 1st, 2025) defined “Contemporaneous Work”, we consider its topical relevance and plan to include the comparison results in the final Appendix for completeness.\n| Dataset | Victim | DFME   | Sim4Rec | DBGRME |\n|-|-|-|-|-|\n| ML-100K | BPR    | 0.2181 | 0.2292  | **0.2976** |\n|         | NCF    | 0.3034 | 0.3161  | **0.3197** |\n|         | GCMC   | 0.2579 | 0.2725  | **0.4707** |\n|         | NGCF   | 0.3373 | 0.3938  | **0.4891** |\n|         | LGN    | 0.5803 | 0.4388  | **0.7727** |\n| ML-1M   | BPR    | 0.0609 | 0.2618  | **0.2664** |\n|         | NCF    | 0.2911 | 0.2520  | **0.3185** |\n|         | GCMC   | 0.2982 | 0.2787  | **0.3467** |\n|         | NGCF   | 0.2626 | 0.2401  | **0.2773** |\n|         | LGN    | 0.2775 | 0.2845  | **0.6047** |\n| Yelp    | BPR    | 0.0593 | 0.0446  | **0.0703** |\n|         | NCF    | 0.1470 | 0.1108  | **0.2004** |\n|         | GCMC   | 0.1504 | 0.1054  | **0.1942** |\n|         | NGCF   | 0.1462 | 0.1898  | **0.2872** |\n|         | LGN    | 0.2830 | 0.2653  | **0.6062** |\n| Gowalla | BPR    | 0.0697 | 0.0677  | **0.0704** |\n|         | NCF    | 0.0584 | 0.0487  | **0.0763** |\n|         | GCMC   | 0.1528 | 0.2034  | **0.2252** |\n|         | NGCF   | 0.1237 | 0.1395  | **0.2828** |\n|         | LGN    | 0.3665 | 0.3998  | **0.6154** |\n\n\nQ2: Query budget setting comparison:\\\nA2:Thank you for your question. Compared to existing works, our query budget is actually relatively modest. Specifically:\\\n__[Budget definition]__ Firstly, we would like to clarify that there exists a difference between the query budget definitions in prior work (e.g., [1,4]) and ours (“per user/history interaction query”). Specifically, prior works typically count each user as one query, regardless of the update of interaction lists (refer to the description in Sec 4.1.1 of [4]). In contrast, we adopt a stricter definition: each new interaction list, even from the same user, is counted as a separate query. This leads to a more conservative and realistic budget estimation.\\\n__[Comparison with existing work]__ Under our strict definition, recommendation model extraction methods such as [4] incur a budget of up to 1M on ML-1M (refer to the description in Sec 4.1.1 and Sec 5.2.1 of [4], i.e., 5000 budgets × 200 sequence length), which significantly exceeds our defined budget of 400k.\n\n\nQ3: Other common datasets \\\nA3: \nThanks for your advice. To further strengthen the evaluation, we compared various public datasets by interaction scale and sparsity. Based on this comparison and time permitting, we conduct experiments on the Steam dataset, which contains significantly more users and interactions. And the results of another dataset will be post in the discussion stage. We will include the corresponding results in the final Appendix.\n| Dataset   | #Users  | #Items  | #Interactions | Density  |\n|-|-|-|-|-|\n| ML-100K | 944     | 1,683   | 100,000 | 0.0630   |\n| ML-1M    | 6,040   | 3,416   | 1,000,209 | 0.0447   |\n| Yelp        | 31,668  | 38,048  | 1,561,406 | 0.0013   |\n| Gowalla  | 29,858  | 40,981  | 1,027,370 | 0.0008   |\n| Beauty    | 40,226  | 54,542  | 400,000  | 0.0002   |\n| Steam     | 334,730 | 13,047  | 3,700,000 | 0.0008   |\n\n\n| Dataset | Victim | DFME   | Sim4Rec | DBGRME |\n|-|-|-|-|-|\n|Steam| BPR    | 0.0600 | 0.0916  | **0.2553** |\n|          | NCF    | 0.1296 | 0.1599 | **0.2201** |\n|          | GCMC   | 0.3401 | 0.3037  | **0.3552** |\n|          | NGCF   | 0.1098 | 0.1142  | **0.3265** |\n|          | LGN      | 0.3649 | 0.3903  | **0.5662** |\n\n\nQ4: Discussions about possible defense:\\\nA4: \nThank you for the suggestion. Due to space constraints, we briefly discussed potential defense strategies on Page 9, Lines 360–364. Following your valuable feedback, we will expand this discussion from three perspectives (detection, model-level defense, and legal & ethical considerations), and include a more comprehensive analysis in the Appendix.\n\nHere, we discuss the future extension of potential countermeasures from three perspectives: detection-based defense, model-level defense, and legal & ethical considerations.\\\n__[Detection-based defense]__ Recent attacks [1,4] often rely on autoregressive querying or generator-driven interaction synthesis. Monitoring query frequency, interaction entropy, and behavioral anomalies can help detect suspicious users. Platforms may then apply query rate limiting or introduce noise to hinder extraction.\\\n__[Model-level defense]__ This approach involves injecting perturbations into the model's representation or output space to mislead attackers. However, in hard-label recommendation settings, such defenses require careful calibration to maintain model accuracy while degrading extraction effectiveness.\\\n__[Legal & ethical considerations]__ In addition to technical defenses, platform operators should implement responsible deployment practices such as strict API access control, policy enforcement, and legal safeguards. Raising public awareness and establishing regulatory frameworks can further mitigate the misuse of recommendation models.\\\nMoreover, this study is conducted on benchmark datasets with the aim of improving system robustness and promoting awareness of potential vulnerabilities.\n\n[1] Wang Y, Su J, Chen C, et al. Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(12): 12766-12774.\\\n[2] Wang C, Sun J, Dong Z, et al. Data-free knowledge distillation for reusing recommendation models[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 386-395.\\\n[3] Lin Z, Xu K, Fang C, et al. Quda: Query-limited data-free model extraction[C]//Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security. 2023: 913-924.\\\n[4] Yue Z, He Z, Zeng H, McAuley J. \"Black-box attacks on sequential recommenders via data-free model extraction.\" Proceedings of the 15th ACM conference on recommender systems. 2021.4."}, {"review_id": "d2JYWqhJ8P", "reviewer": "Reviewer_yJjD", "summary": "The paper tackles model-extraction attacks on recommender systems under the strictest data-free black-box setting: the adversary sees only top-k outputs and must generate all queries. The authors first run a careful diagnostic and observe that graph-convolution surrogates generalise better than architecture-matched ones. Guided by that insight they build DBGRME, which couples : 1) an interaction generator that synthesises user–item pairs and, GAN-style, maximises disagreement with the victim and 2) a generalisation-aware LightGCN-like surrogate with frozen user embeddings and an ℓ2 constraint on item updates to curb over-fitting\n\nOn four public datasets, DBGRME outperforms prior data-free baselines and, on average, even beats partial-data+query (PTQ) by 17 % Agr@50 on LightGCN. An ablation verifies that both the GA module and the constraint are useful. Overall, the attack pipeline is novel, and empirical gains are convincing.", "questions": "- Would be good to provide some wall clock time or compute utilisation for generator cost\n- The primary metric (Agr@50) treats all items equally, whereas practical scenarios prioritize high-rank agreement. Additional metrics such as", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths \n- Data-free is the worst case for defenders and mirrors scenarios where member data are protected by privacy law.\n- The initial cross-architecture study motivates the choice of graph surrogates instead of blindly copying the victim architecture, an idea that may transfer to other domains.\n- Provides an end-to-end view; gradients through discrete sampling are handled via re-parameterisation  \n- Comprehensive ablations and evaluation : Five victims spanning MF, deep MLP and GCN families, four datasets of varying sparsity, plus budget sweeps give a robust empirical picture.  \n- Ablations and hyper-params show thoughtful tuning. Code is to be released, aiding reproducibility .\n\n### Weaknesses\n\n- Query efficiency Budgets of 4-9 M queries (Gowalla/Yelp) are two orders of magnitude above typical commercial rate limits. Unsure how significant these dataset results are applicable\n- The interaction generator requires extensive training (100 iterations with 1,000 synthetic users per loop), implying over 10^8 forward passes. Is that quite expensive? \n- The paper lacks discussion of attack detectability and potential countermeasures.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your positive and encouraging feedback on our work. We truly appreciate your recognition of our scenario design, methodology, and experimental setting. Below, we would like to respond to your comments point by point.\n\nQ1: Query budgets discussion.\\\nA1:\n__[Comparison to existing work and discussions]__ Firstly, prior studies typically count each user as one query, regardless of how many times their interaction list changes (see Sec 4.1.1 of [1]). In contrast, we adopt a stricter and more realistic approach: each new interaction list, even from the same user, is treated as a separate query. Under this definition, methods like [1] incur a budget up to 1M on ML-1M (5000 users × 200 interactions), which is significantly larger than our setting of 400k. Moreover, as the first attempt to explore data-free model extraction for recommender systems based on user-item free embeddings,  while our current setup may not fully match industrial-scale deployment, we believe it provides a solid and conservative foundation for understanding query efficiency in data-free recommendation model extraction.\n\nQ2: Lacks discussion of attack detectability and potential countermeasures:\\\nA2: \nThank you for the suggestion. Due to space constraints, we briefly discussed potential defense strategies on Page 9, Lines 360–364. Following your valuable feedback, we will expand this discussion from three perspectives (detection, model-level defense, and legal & ethical considerations), and include a more comprehensive analysis in the Appendix.\n\nHere, we discuss the future extension of potential countermeasures from three perspectives: detection-based defense, model-level defense, and legal & ethical considerations.\\\n__[Detection-based defense]__ Recent attacks [1,2] often rely on autoregressive querying or generator-driven interaction synthesis. Monitoring query frequency, interaction entropy, and behavioral anomalies can help detect suspicious users. Platforms may then apply query rate limiting or introduce noise to hinder extraction.\\\n__[Model-level defense]__ This approach involves injecting perturbations into the model's representation or output space to mislead attackers. However, in hard-label recommendation settings, such defenses require careful calibration to maintain model accuracy while degrading extraction effectiveness.\\\n__[Legal & ethical considerations]__ In addition to technical defenses, platform operators should implement responsible deployment practices such as strict API access control, policy enforcement, and legal safeguards. Raising public awareness and establishing regulatory frameworks can further mitigate the misuse of recommendation models.\\\nMoreover, this study is conducted on benchmark datasets with the aim of improving system robustness and promoting awareness of potential vulnerabilities.\n\nQ3: Computation cost about generator:\\\nA3: Thank you for raising this point. Regarding mentioned “100 iterations with 1,000 synthetic users per loop”., in our setting, the total budget is at most 10^5 forward passes, not 10^8. While if each full batch of 1,000 synthetic users is considered as one forward pass, then the total number is only 100 forward passes. Therefore, we believe the overall computational cost of the generator remains manageable in practice.\n\nQ4: High-rank agreement: \\\nA4: Thanks for your advice. We have re-evaluated the high-rank agreement (Agr@10) between the trained surrogate model and the victim model. The results further confirm the effectiveness of DBGRME. We would like to add this to the final Appendix.\n| Dataset | Victim | bpr    | ncf    | gcmc   | ngcf   | lgn    |\n|-|-|-|-|-|-|-|\n| ML-100K | random-DBGRME    | 0.1546 | 0.1128 | 0.2177 | 0.1395 | 0.5965 |\n|         | DFME          | 0.1370 | 0.1189 | 0.1372 | 0.2159 | 0.3353 |\n|         | DBGRME    | **0.1895** | **0.1672** | **0.2584** | **0.2854** | **0.6285** |\n| ML-1M | random-DBGRME    | 0.0874 | 0.2090 | 0.1690 | 0.1477 | 0.4378 |\n|             | DFME       | 0.0410 | 0.1989 | 0.1210 | 0.1506 | 0.2109 |\n|             | DBGRME| **0.1424** | **0.2176** | **0.1896** | **0.1675** | **0.4725** |\n\n\n[1] Yue Z, He Z, Zeng H, McAuley J. \"Black-box attacks on sequential recommenders via data-free model extraction.\" Proceedings of the 15th ACM conference on recommender systems. 2021.4.\\\n[2] Wang Y, Su J, Chen C, et al. Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(12): 12766-12774."}, {"review_id": "OnWSOoN8gT", "reviewer": "Reviewer_vTDn", "summary": "This paper focuses on model extraction attacks in recommender systems. Considering that existing methods often rely on unrealistic assumptions about data accessibility, a Data-free Black-box Graph convolution-based Recommender Model Extraction (DBGRME) is proposed. The core of DBGRME is to make up for the need for member data through an interaction generator, and propose a Generalization-Aware Graph Convolution-based Surrogate Model to capture complex recommendation interaction patterns. Finally, the effectiveness of the proposed strategy is demonstrated on multiple datasets and recommendation models.", "questions": "Please refer to \"Strengths And Weaknesses\".", "limitations": "More discussion on limitation is needed.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The data accessibility and generalization that this work focuses on are two core issues of model extraction.\n2. The proposed interaction generator avoids dependence on sensitive member data.\n3. The experimental results show that the proposed method seems to be effective.\n\nWeaknesses:\n1. The superiority of graph convolution-based recommender models in the empirical experiments on three recommendation models is unconvincing. Are there similar findings on more models? Or analyze its advantages theoretically?\n2. Although the paper claims to attack under the \"black box\" setting and limited queries, it is usually difficult to obtain the top-k recommendation list in the strict real world, which limits the applicability of the proposed attack. The paper should discuss the performance of the attack under more stringent query responses.\n3. How is the query budget selected by default? From Table 6, this choice is strange.\n4. Minor: Yelp in Line 321 should be ML-1M?\n5. Are the conclusions of the ablation experiments and sensitivity analysis on the Yelp and Gowalla datasets similar? I understand the space limit, but it is recommended to add it in the appendix.\n6. Although the baseline methods in the experiments are related, it would be more convincing if they could be compared with the recent model stealing method [1].\n\n[1] Wang, Yihao, et al. \"Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 39. No. 12. 2025.", "was_revised": true, "final_justification": "The authors' response addresses my major concerns regarding the experimental setup and evaluation.", "rebuttal": "Thank you very much for your thoughtful and constructive feedback. We appreciate your recognition of our method's motivation and technical design. We have carefully responsed to each of them in point-by-point.\n\nQ1: More investigation study experiments:\\\nA1: Thank you for your suggestion. We have reached this conclusion after extensive experiments and combined with theory. Specifically:\\\n__[Empirical Evidence]__ We have conducted comprehensive cross-model extraction experiments on BPR, NCF, GCMC, NGCF, and LightGCN across several datasets. Due to the char limitation, wo provide the PTD results with 50% member data rate on ML-100K. The results clearly show that graph convolution-based models demonstrate superior performance. \\\n__[Theoretical Analysis]__ As discussed on Page 4, Lines 150–156, BPR, NCF, and LightGCN represent a progressively enhanced modeling hierarchy. BPR is a classical matrix factorization model; NCF builds on it by incorporating MLPs to capture nonlinear user-item interactions; and LightGCN further introduces graph convolutional layers, enabling the model to better exploit high-order collaborative signals. This progression not only reflects increasing modeling capacity but also empirically supports the superiority of graph convolution-based recommender models in model extraction tasks.\n\n|Target/Surrogate|BPR|NCF|GCMC|NGCF|LightGCN|\n|-|-|-|-|-|-|\n|BPR|0.2718|0.3822|0.5504|0.4480|0.6073|\n|NCF|0.2740|0.4558|0.5806|0.5000|0.6617|\n|GCMC|0.2628|0.3452|0.5199|0.4553|0.5462|\n|NGCF|0.2893|0.4109|0.5772|0.4970|0.6723|\n|LightGCN|0.2875|0.4032|0.5835|0.4882|0.6714|\n\n\nQ2: Why top-k recommendation list: \\\nA2: For this important point, our setting is both theoretically grounded and practically feasible:\\\n__[Theoretical basis]__ The top-k feedback setting is consistent with existing model extraction studies [1,2].\\\n__[Pratical case analysis]__ In real-world recommendation platforms, such as social recommendation systems (e.g., X) or multimedia platforms like YouTube, users can easily access hundreds or even thousands of recommendation items, whether by entering a search query or browsing the homepage. Therefore, obtaining top-k recommendation lists is both practical and realistic in real deployment scenarios.\n\nQ3: How is the query budget selected:\\\nA3: As this work is the first to study data-free black-box model extraction in recommender systems that rely solely on user and item identifiers as input features, we adopt a stringent and practical definition: each new user history interaction list (not each new user) submitted to the victim model is counted as a separate query. Correspondingly, we empirically select a query budget that balances extraction performance and budgets. Detailed analysis is provided in our Sec 5.3.\n\nQ4: Minor: Yelp in Line 321 should be ML-1M?\\\nA4: Thanks you for pointing it. It is a typo.\n\nQ5: More experiments on other datasets. \\\nA5:Thank you for the suggestion.\\\n__[Experiment results]__  Due to page limits, we presents part of representative results on additional datasets. It is easy to observed that the conclusions of the ablation studies and sensitivity analyses on the remaining datasets are consistent with those reported in the main paper.\\\n__[Revision plan]__ Considering the paper length and readability during submission, we included results on a subset of datasets in the main text. We will incorporate the necessary experimental results for the remaining datasets into the final Appendix to to provide a more comprehensive presentation.\n\n__[Ablation Study]__\n| Dataset | Victim    | Black-box R@50 | w/o GA R@50 | w/o GA Agr@50 | w/o constraint R@50 | w/o constraint Agr@50 | w/o GA&constraint R@50 | w/o GA&constraint Agr@50 | DBGRME R@50 | DBGRME Agr@50 |\n|---------|-----------|----------------|-------------|----------------|----------------------|------------------------|--------------------------|---------------------------|--------------|----------------|\n| Yelp    | BPR       | 0.0833         | 0.0234      | 0.0656         | 0.0242               | 0.0676                 | 0.0231                   | 0.0653                    | 0.0235       | 0.0703         |\n|     | NCF       | 0.0777         | 0.0228      | 0.1757         | 0.0200               | 0.1952                 | 0.0217                   | 0.1637                    | 0.0232       | 0.2004         |\n|     | GCMC      | 0.1059         | 0.0389      | 0.1201         | 0.0401               | 0.1422                 | 0.0361                   | 0.1084                    | 0.0618       | 0.1942         |\n|     | NGCF      | 0.1065         | 0.0408      | 0.1233         | 0.0424               | 0.1552                 | 0.0394                   | 0.1168                    | 0.0652       | 0.2872         |\n|     | LightGCN  | 0.1266         | 0.0814      | 0.3426         | 0.1046               | 0.5855                 | 0.0731                   | 0.3216                    | 0.1037       | 0.6062         |\n| Gowalla | BPR       | 0.1857         | 0.0616      | 0.0587         | 0.0646               | 0.0673                 | 0.0632                   | 0.0580                    | 0.0654       | 0.0704         |\n|  | NCF       | 0.1853         | 0.0415      | 0.0518         | 0.0636               | 0.0744                 | 0.0414                   | 0.0510                    | 0.0659       | 0.0763         |\n|  | GCMC      | 0.2079         | 0.0894      | 0.1319         | 0.1329               | 0.2162                 | 0.0799                   | 0.1165                    | 0.1350       | 0.2252         |\n|  | NGCF      | 0.2408         | 0.1504      | 0.2412         | 0.1609               | 0.2694                 | 0.1413                   | 0.2201                    | 0.1662       | 0.2828         |\n|  | LightGCN  | 0.2758         | 0.1770      | 0.4529         | 0.1874               | 0.5389                 | 0.1716                   | 0.4395                    | 0.2177       | 0.6154         |\n\n\n__[Budget Analysis]__\nYelp: \n| Budget       | 3M     | 5M     | 7M     | 9M     | 11M    | 13M    | 15M    |\n|--------------|--------|--------|--------|--------|--------|--------|--------|\n| DBGRME       | 0.5448 | 0.5674 | 0.5803 | 0.6062 | 0.6108 | 0.6131 | 0.6168 |\n| Random-DBGRME| 0.4903 | 0.5375 | 0.5397 | 0.5751 | 0.5792 | 0.5823 | 0.5854 |\n\nGowalla:\n| Budget        | 1M     | 2M     | 3M     | 4M     | 5M     | 6M     | 7M     |\n|---------------|--------|--------|--------|--------|--------|--------|--------|\n| DBGRME        | 0.4476 | 0.5365 | 0.5703 | 0.6154 | 0.6176 | 0.6209 | 0.6228 |\n| Random-DBGRME | 0.4425 | 0.4957 | 0.5077 | 0.5871 | 0.5874 | 0.5987 | 0.6023 |\n\n\nQ6: Comparison with Sim4Rec(AAAI2025)\\\nA6: Thank you for the suggestion. We have conducted a comparison with Sim4Rec. The results further demonstrate the effectiveness of DBGRME. Although the Sim4Rec (published in Apirl 11th, 2025) belongs to the official NeurIPS (March 1st, 2025) defined “Contemporaneous Work”, we consider its topical relev7ance and plan to include the comparison results in the final Appendix for completeness.\n\n| Dataset | Victim | DFME   | Sim4Rec | DBGRME |\n|-|-|-|-|-|\n| ML-100K | BPR    | 0.2181 | 0.2292  | **0.2976** |\n|         | NCF    | 0.3034 | 0.3161  | **0.3197** |\n|         | GCMC   | 0.2579 | 0.2725  | **0.4707** |\n|         | NGCF   | 0.3373 | 0.3938  | **0.4891** |\n|         | LGN    | 0.5803 | 0.4388  | **0.7727** |\n| ML-1M   | BPR    | 0.0609 | 0.2618  | **0.2664** |\n|         | NCF    | 0.2911 | 0.2520  | **0.3185** |\n|         | GCMC   | 0.2982 | 0.2787  | **0.3467** |\n|         | NGCF   | 0.2626 | 0.2401  | **0.2773** |\n|         | LGN    | 0.2775 | 0.2845  | **0.6047** |\n| Yelp    | BPR    | 0.0593 | 0.0446  | **0.0703** |\n|         | NCF    | 0.1470 | 0.1108  | **0.2004** |\n|         | GCMC   | 0.1504 | 0.1054  | **0.1942** |\n|         | NGCF   | 0.1462 | 0.1898  | **0.2872** |\n|         | LGN    | 0.2830 | 0.2653  | **0.6062** |\n| Gowalla | BPR    | 0.0697 | 0.0677  | **0.0704** |\n|         | NCF    | 0.0584 | 0.0487  | **0.0763** |\n|         | GCMC   | 0.1528 | 0.2034  | **0.2252** |\n|         | NGCF   | 0.1237 | 0.1395  | **0.2828** |\n|         | LGN    | 0.3665 | 0.3998  | **0.6154** |\n\n\n\n[1] Yue Z, He Z, Zeng H, McAuley J. \"Black-box attacks on sequential recommenders via data-free model extraction.\" Proceedings of the 15th ACM conference on recommender systems. 2021.4.\\\n[2] Wang Y, Su J, Chen C, et al. Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation. Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(12): 12766-1277."}, {"review_id": "oDszRGyNxe", "reviewer": "Reviewer_uP1M", "summary": "This paper proposes a new method for data-free model extraction via graph convolutions. This is an adversarial attack setting in which an adversary wants to extract the model or parameters of a recommender system via system queries.", "questions": "-- Naive question, but what is meant by \"member data rate\" in what's a \"data free\" setting? I would have thought only queries were impossible and that data is not available, though I assume this is a misunderstanding on my part.\n\n-- The member data and query rates seem not realistic from an attack perspective. Can you describe a realistic attack setting in which the rates presented here are reasonable? How does the method work for very small rates?\n\n-- The datasets look fairly small. What is the scalability profile of the method on larger datasets?", "limitations": "yes", "rating": 4, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "-- New approach to the problem and results that seem positive.\n\n-- This topic, while relevant enough to the venue, is fairly niche. There have only been a few papers on the problem across several years. I'm not totally convinced as to how realistic of an attack setting this is, which may be related to the obscurity of the topic.\n\n-- Relatively small datasets, not certain about the scalability of the approach.\n\n-- The member data rates and query rates seem to be unrealistic in an attack setting.", "was_revised": true, "final_justification": "The authors addressed my clarification questions to some extent, and calibrating based on the other reviewers I've increased my score slightly", "rebuttal": "Thank you for your review and for acknowledging the novelty and relevance of our work. Below, we provide detailed responses to clarify our method and address your questions:\n\nQ1: What is meant by \"member data rate\" in what's a \"data free\" setting? I would have thought only queries were impossible and that data is not available, though I assume this is a misunderstanding on my part\\\nA1: __Member data__, i.e., the data used by companies to train their recommender models, is typically inaccessible, as it is considered proprietary and commercially sensitive. The \"data-free\" setting refers to the assumption that attackers do not have access to such internal training data. Correspondingly, we haven't use the any member data in our method.\n\nQ2: The member data and query rates seem not realistic from an attack perspective. Can you describe a realistic attack setting in which the rates presented here are reasonable? How does the method work for very small rates?\\\nA2: Thank you for raising this concern. We provide the following clarifications:\\\n__[Clarification on member data and query rates]__ We believe this question refers to the investigation study section. In that part, we perform a systematic analysis to examine how varying the member data rate (when accessible) and the query budget affect the performance of model extraction. At the data level, this helps to understand the dependency of extraction effectiveness on information availability; at the model level, we also study how different model architectures respond to these factors.\\\n__[which the reasonable rates]__ Accessing to member data is generally unrealistic in real-world attack settings. That’s why our proposed method focuses on the data-free scenario. The member data/query rate is used purely for comparative and analytical purposes. \n\nQ3: The datasets look fairly small. What is the scalability profile of the method on larger datasets?\\\nA3: Thank you for the suggestion. We have added a large datasets Steam (with 334730 users and 13047 items) to our experiments. The results further demonstrate the effectiveness and robustness of our proposed method.\n\n| Dataset | Victim | DFME   | Sim4Rec | DBGRME |\n|-|-|-|-|-|\n|Steam| BPR    | 0.0600 | 0.0916  | **0.2553** |\n|          | NCF    | 0.1296 | 0.1599 | **0.2201** |\n|          | GCMC   | 0.3401 | 0.3037  | **0.3552** |\n|          | NGCF   | 0.1098 | 0.1142  | **0.3265** |\n|          | LGN      | 0.3649 | 0.3903  | **0.5662** |\n\n\n[1] Wang Y, Su J, Chen C, et al. Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(12): 12766-1277.\\\n[2] Yue Z, He Z, Zeng H, McAuley J. \"Black-box attacks on sequential recommenders via data-free model extraction.\" Proceedings of the 15th ACM conference on recommender systems. 2021.4."}]

Author rebuttal:

Meta-review: This submission proposes DBGRME, a data-free black-box model extraction method for recommender systems using graph convolutions. The paper received consistently positive reviews.

The work addresses two fundamental limitations in existing model extraction research: unrealistic data accessibility assumptions and generalization problems with architecture-constrained surrogate models. The key insight that graph convolution-based surrogates outperform architecture-matched ones is novel and well-validated across multiple victim models and datasets.

The authors demonstrated exceptional responsiveness during the rebuttal period, addressing all major reviewer concerns including SOTA comparisons (adding Sim4Rec), scalability (adding Steam dataset), and query budget realism (providing detailed comparative analysis). Multiple reviewers explicitly stated that their concerns were satisfied and increased their scores accordingly.

While the attack scenario may seem niche, the problem is important for understanding recommender system security, and the work establishes a new research direction with both theoretical insights and practical techniques.

I recommend **ACCEPT**.
Decision: Accept (poster)