Title: Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation
Venue: NeurIPS 2024
Accepted: yes
Keywords: Adversarial Collaborative Filtering

Robust Recommender System

Poisoning Attacks
Abstract: Adversarial Collaborative Filtering (ACF), which typically applies adversarial perturbations at user and item embeddings through adversarial training, is widely recognized as an effective strategy for enhancing the robustness of Collaborative Filtering (CF) recommender systems against poisoning attacks. Besides, numerous studies have empirically shown that ACF can also improve recommendation performance compared to traditional CF. Despite these empirical successes, the theoretical understanding of ACF's effectiveness in terms of both performance and robustness remains unclear. To bridge this gap, in this paper, we first theoretically show that ACF can achieve a lower recommendation error compared to traditional CF with the same training epochs in both clean and poisoned data contexts. Furthermore, by establishing bounds for reductions in recommendation error during ACF's optimization process, we find that applying personalized magnitudes of perturbation for different users based on their embedding scales can further improve ACF's effectiveness. Building on these theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Extensive experiments demonstrate that PamaCF effectively defends against various types of poisoning attacks while significantly enhancing recommendation performance.

Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation

Abstract

Adversarial Collaborative Filtering (ACF), which typically applies adversarial perturbations at user and item embeddings through adversarial training, is widely recognized as an effective strategy for enhancing the robustness of Collaborative Filtering (CF) recommender systems against poisoning attacks. Besides, numerous studies have empirically shown that ACF can also improve recommendation performance compared to traditional CF. Despite these empirical successes, the theoretical understanding of ACF's effectiveness in terms of both performance and robustness remains unclear. To bridge this gap, in this paper, we first theoretically show that ACF can achieve a lower recommendation error compared to traditional CF with the same training epochs in both clean and poisoned data contexts. Furthermore, by establishing bounds for reductions in recommendation error during ACF's optimization process, we find that applying personalized magnitudes of perturbation for different users based on their embedding scales can further improve ACF's effectiveness. Building on these theoretical understandings, we propose P erson a lized M agnitude A dversarial C ollaborative F iltering ( PamaCF ). Extensive experiments demonstrate that PamaCF effectively defends against various types of poisoning attacks while significantly enhancing recommendation performance.

1 Introduction

Collaborative Filtering (CF) is widely recognized as a powerful tool for providing personalized recommendations [1, 2, 3] across various domains [4, 5]. However, the inherent openness of recommender systems allows attackers to inject fake users into the training data, aiming to manipulate recommendations, also known as poisoning attacks [6, 7]. Such manipulations can skew the distribution of item exposure, degrading the overall quality of the recommender system, thus harming the user experience and hindering the long-term development of the recommender system [8].

Existing methods for defending against poisoning attacks in CF can be categorized into two types [8]: (1) detecting and mitigating the influence of fake users [9, 10, 11, 12, 13, 14], and (2) developing robust models via adversarial training, also known as Adversarial Collaborative Filtering (ACF) [15, 16, 17, 18, 19, 20]. The first strategy focuses on detecting and removing fake users from the dataset before training [9, 10, 11, 14] or mitigating their impact during the training phase [12, 13]. These methods often rely on predefined assumptions about attacks [9, 12] or require labeled data related to attacks [10, 11, 12, 13]. Consequently, deviations from predefined attack patterns may lead to misclassification, failing to resist attacks while potentially harming genuine users' experience [13].

In contrast, ACF provides a more general defense paradigm without prior knowledge [15, 16, 17, 18, 19, 20]. Poisoning attacks in recommender systems mainly affect the learned embeddings of users and items, i.e., the system's parameters [6, 7]. Predominant ACF methods, particularly those aligned with Adversarial Personalized Ranking (APR) framework [15], heuristically incorporate adversarial perturbations at the parameter level during the training phase to mitigate these attacks [15, 17, 19, 20]. This approach employs a 'min-max' paradigm, designed to minimize the recommendation error while contending with parameter perturbations aimed at maximizing this error within a specified magnitude [15], thus enhancing the robustness of CF.

It is interesting to note that adversarial training in the Computer Vision (CV) domain [21, 22, 23] has been observed to degrade model performance on clean samples [24, 25]. Several studies have also theoretically demonstrated a trade-off between robustness against evasion attacks and the performance of adversarial training in CV [26]. In contrast, ACF in recommender systems has been shown in numerous studies not only to enhance the robustness against poisoning attacks [8, 13, 18] but also to improve recommendation performance [15, 20, 27]. Despite the empirical evidence highlighting ACF's advantages, it still lacks a comprehensive theoretical understanding, which limits the ability to fully exploit the benefits and potential of ACF. To bridge this gap, in this paper, we propose the following research questions for further investigation:

Why does ACF enhance both robustness and performance compared to traditional CF?

How can we further improve ACF?

To answer these questions, we delve into a theoretical analysis of a simplified CF scenario. This analysis confirms that ACF can achieve a lower recommendation error at the same training epoch in both clean and poisoned data contexts, showing better performance and robustness compared to traditional CF. To investigate potential improvements to ACF, we establish upper and lower bounds for reductions in recommendation error during ACF's optimization process. Our findings indicate that (1) Users have varying constraints for perturbation magnitudes, i.e., different maximum perturbation magnitudes; (2) Within these constraints, applying personalized perturbation magnitudes as much as possible for each user can increase the error reduction bounds, further improving ACF's effectiveness.

Extending our theoretical results to practical CF scenarios, we establish a positive correlation between users' maximum perturbation magnitudes and their embedding scales. Building on these theoretical understandings, we introduce P ersonal a lized M agnitude A dversarial C ollaborative F iltering ( PamaCF ). PamaCF dynamically and personally assigns perturbation magnitudes based on users' embedding scales. Extensive experiments confirm that PamaCF outperforms baselines in both performance and robustness. Notably, PamaCF increases the average recommendation performance of the backbone model by 13.84% and reduces the average success ratio of attacks by 44.92% compared to the best baseline defense method. The main contributions of our study are summarized as follows:

We provide theoretical evidence that ACF can achieve better performance and robustness compared to traditional CF in both clean and poisoned data contexts.

We further identify upper and lower bounds of reduction in recommendation error for ACF during its optimization and demonstrate that applying personalized magnitudes of perturbation for each user can further improve ACF.

Based on the above theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), with extensive experiments confirming that PamaCF further improves both performance and robustness compared to state-of-the-art defense methods.

The code of our experiments is available at https://github.com/Kaike-Zhang/PamaCF .

2 Preliminary

Collaborative Filtering (CF) methods are widely employed in recommender systems. Following [1], we define a set of users U = { u } and a set of items V = { v } . Using data from user-item interactions, our objective is to learn latent embeddings U = [ u ∈ R d ] u ∈U for users and V = [ v ∈ R d ] v ∈V for items. Then, we employ a preference function f : R d × R d → R , which predicts user-item preference scores, denoted as ˆ r u,v = f ( u , v ) .

Adversarial Collaborative Filtering (ACF) is acknowledged as an effective approach for enhancing both the performance and the robustness of CF recommender systems in the face of poisoning attacks. ACF methods, particularly within the framework of Adversarial Personalized Ranking (APR) [15], integrate adversarial perturbations at the parameter level (i.e., the latent embeddings U and V ) during the training phase. Let L (Θ) denote the loss function of the CF recommender system, where Θ = ( U , V ) represents the recommender system's parameters. ACF methods apply perturbations ∆ directly to the parameters as:

where ϵ > 0 defines the maximum magnitude of perturbations, and λ is the adversarial training weight. Due to constraints on space, a detailed discussion of related works is provided in Appendix A.

3 Theoretical Understanding of ACF

In this section, we provide a theoretical analysis of why ACF achieves superior performance and robustness compared to traditional CF from the perspective of recommendation error. Then, we explore mechanisms to further improve ACF's effectiveness based on its error reduction bounds. For clarity and simplicity, we initially focus on a Gaussian Single-item Recommender System, aligning with the frameworks presented in [18, 28]. It's important to note that the insights and analytical frameworks developed here are also applicable to more practical scenarios, as discussed in Section 4.

Definition 1 (Gaussian Recommender System) . Given a rating set R = { r 1 , r 2 , . . . , r n } corresponding to n users, where each rating r is randomly selected from {± 1 } , an average embedding vector ¯ u ∈ R d , and σ > 0 , the Gaussian Recommender System initializes each user's embedding u from the normal distribution N ( r ¯ u , σ 2 I ) . The item embedding v is initialized as the average vector derived from these users: v = 1 n ∑ n i =1 r i u i . Then, a preference function f : R d × R d →{± 1 } is employed to predict user preferences: f ( u , v ) = sgn( ⟨ v , u ⟩ ) , where sgn( · ) denotes the sign function, returning 1 if ⟨ u , v ⟩ > 0 and -1 otherwise.

Based on Definition 1, we obtain I = { ( u 1 , r 1 ) , . . . , ( u n , r n ) } , where u represents the systemlearned user embedding. With continued training, both each user embedding u and item embedding v are iteratively updated. Let u ( t ) and v ( t ) denote user and item embeddings at the t th epoch, respectively. For analytical simplicity and without loss of generality, we define the standard loss function L (Θ) (as traditional CF) used in the Gaussian Recommender System as follows [18]:

where the model parameters Θ ( t ) = ( v ( t ) , [ u 1 , ( t ) , u 2 , ( t ) , . . . , u n, ( t ) ]) . To integrate ACF into the Gaussian Recommender System, we introduce the adversarial loss [15], L adv (Θ) , defined as:

where λ is the adversarial training weight. The perturbations ∆ u and ∆ v are applied to the user and item embeddings, respectively, as computed based on Equation 1.

3.1 Why Does Adversarial Collaborative Filtering Benefit Recommender Systems?

To analyze the performance and robustness of traditional CF and ACF within the Gaussian Recommender System, we evaluate them from the perspective of recommendation error during the training process. For each user, both performance and robustness are reflected by the user's recommendation error. Specifically, attacks-whether item promotion attacks [6, 29] or performance damage attacks [8]-inevitably increase the user's recommendation error. Meanwhile, a smaller recommendation error means a higher recommendation performance. For a given user u , the initial item embedding v (0) in the Gaussian Recommender System can be approximately modeled 2 as a sample from N (¯ u , σ 2 n -1 I ) . Here, we provide the definition of recommendation error for user u .

Definition 2 (Recommendation Error) . Given a Gaussian Recommender System f ( t ) that has been trained for t epochs, the recommendation error for the user u with rating r at the t th epoch is defined as the probability that the system's prediction does not align with the user's actual rating, as:

̸

̸

where I ( · ) is an indicator function that returns 1 if the condition is true and 0 otherwise.

̸

Based on the framework of ACF [15, 20], which includes t epochs of pre-training with standard loss before adversarial training, we derive a theorem that identifies the difference in recommendation error between standard and adversarial loss at the ( t +1) th epoch. To distinguish between the recommendation error of traditional CF and ACF, we define P v (0) ∼N (¯ u , σ 2 I ) [ f ( t +1) ( u , v ) = r | ( u , r ) ]

̸

n

-

1

as the recommendation error following standard training (Equation 2) at the ( t +1) th epoch, and P adv v (0) ∼N (¯ u , σ 2 n -1 I ) [ f ( t +1) ( u , v ) = r | ( u , r ) ] as the recommendation error following adversarial train- ing (Equation 3) at the ( t +1) th epoch.

Theorem 1. Consider a Gaussian Recommender System f ( t ) , pre-trained for t epochs using the standard loss function (Equation 2). Given a learning rate η , an adversarial training weight λ , and a perturbation magnitude ϵ , when ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , and ∥ ¯ u ∥ ≫ σ 3 , the recommendation error for a user u with rating r at the ( t +1) th epoch follows that:

̸

̸

For the proof, please refer to Appendix D.1.1. After the same epochs of pre-training, ACF at the next epoch achieves a lower recommendation error compared to traditional CF, thereby benefiting recommendation performance.

Next, our analysis extends to contexts where the recommender system is subject to poisoning attacks. These attacks involve injecting fake users into the system's training dataset to manipulate item exposure. We examine a Gaussian Recommender System with I = { ( u 1 , r 1 ) , . . . , ( u n , r n ) } , where each tuple ( u , r ) ∈ R d ×{± 1 } represents the learned embedding and the rating of a genuine user. A poisoning attack on this system injects a poisoning user set , I ′ = { ( u ′ 1 , r ′ 1 ) , ( u ′ 2 , r ′ 2 ) , . . . , ( u ′ n ′ , r ′ n ′ ) } , with each tuple ( u ′ , r ′ ) ∈ R d ×{± 1 } representing a fake user crafted by attackers 4 . The poisoned item embedding v ′ is reinitialized to include both genuine and malicious contributions:

where n and n ′ represent the number of genuine and fake users, respectively.

To evaluate the impact of these attacks, we introduce a formal definition of recommendation error in poisoned data.

Definition 3 ( α -Poisoned Recommendation Error) . Given a boundary α > 0 , and a set of fake users injected by attackers within this boundary, i.e., I ′ ⊆ P ( u ′ , α ) = { ( u ′ , r ′ ) | ( u ′ , r ′ ) ∈ R d ×{± 1 }∧∥ u ′ ∥ ∞ ≤ α } , the α -poisoned recommendation error for the genuine user u with rating r at the t th epoch is defined as the probability:

̸

̸

where f ( t ) ,α represents the Gaussian Recommender System under the α -poisoned condition, and I ( · ) is an indicator function that returns 1 if the condition is true and 0 otherwise.

For simplicity, we continue using the distribution of v (0) from the definition. This allows us to further analyze the α -poisoned recommendation error based on the distribution of v ′ (0) = n n + n ′ v (0) + 1 n + n ′ ∑ ( u ′ ,r ′ ) ∈I ′ r ′ u ′ .

Then we extend Theorem 1 to α -Poisoned Recommendation Error in the following theorem:

Theorem 2. Consider a poisoned Gaussian Recommender System f ( t ) ,α , pre-trained for t epochs using the standard loss function (Equation 2). Given a learning rate η , an adversarial training weight λ , and a perturbation magnitude ϵ , when ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , and ∥ ¯ u ∥ ≫ σ , the α -poisoned recommendation error for a genuine user u with rating r at the ( t +1) th epoch follows that:

̸

̸

For the proof, please refer to Appendix D.1.2. Combining Theorem 1 and Theorem 2, we find that adversarial training, i.e., ACF, lowers recommendation errors compared to traditional CF in both clean and poisoned data contexts. Accordingly, ACF achieves better performance and robustness.

3.2 How to Further Enhance Adversarial Collaborative Filtering

To explore mechanisms to further improve the effectiveness of ACF, we subsequently derive upper and lower bounds on the reduction of recommendation error between any two consecutive epochs after t epochs of pre-training.

Theorem 3. Consider a Gaussian Recommender System f ( t ) which has been pre-trained for t epochs using standard loss (Equation 2) and subsequently trained on adversarial loss (Equation 3). For the ( t + k +1) th epoch, let the reduction in recommendation error of user u with rating r relative to the ( t + k ) th epoch from adversarial loss be denoted by:

̸

̸

̸

Given a learning rate η , an adversarial training weight λ , and a perturbation magnitude ϵ , when ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ , and ∥ ¯ u ∥ ≫ σ , it follows that:

̸

̸

where d is the embedding dimension, and Φ( · ) denotes the cumulative distribution function (CDF) of the standard Gaussian distribution, and Ψ( u , t + k ) is defined as:

where C t + k is a constant at the ( t + k ) th epoch.

For the proof, please refer to Appendix D.2.1. In light of Theorem 3, given a learning rate η and an adversarial training weight λ , we can establish the following: (1) When the conditions, i.e., ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ and ∥ ¯ u ∥ ≫ σ , are satisfied, the error reduction for ACF can be both upper and lower bounded. (2) Increasing the perturbation magnitude ϵ under the above conditions can further improve these bounds, thus benefiting ACF's effectiveness.

Then, similarly, we extend Theorem 3 to the α -poisoned context.

̸

Theorem 4. Consider a poisoned Gaussian Recommender System f ( t ) ,α which has been pre-trained for t epochs using standard loss (Equation 2) and subsequently trained on adversarial loss (Equation 3). For the ( t + k +1) th epoch, let the reduction in α -poisoned recommendation error of a genuine user u with rating r relative to the ( t + k ) th epoch from adversarial loss be denoted by ∆ adv ( t + k +1) P adv v (0) ∼N (¯ u , σ 2 n -1 I ) [ f α ( u , v ′ ) = r | ( u , r )] . Let β = n ′ n √ dα + ∥ ¯ u ∥ and τ = 2 nn ′ α ∥ ¯ u ∥ 0 , where d is the embedding dimension, and given a learning rate η , an adversarial training weight λ ,

and a perturbation magnitude ϵ , when ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ , and ∥ ¯ u ∥ ≫ σ , it follows that:

̸

̸

where Φ() denotes the cumulative distribution function (CDF) of the standard Gaussian distribution, n ′ is the number of fake users, and Ψ( · ) is defined in Equation 4.

For the proof, please refer to Appendix D.2.2. From Theorem 4, we understand that increasing Ψ( u , t + k ) can further improve both the upper and lower bounds of error reduction, thereby mitigating the negative impact of poisons. Specifically, this involves the same mechanism as in the clean data context: increasing the perturbation magnitude ϵ within ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ .

In conclusion, the theorems in this section indicate that for each user u , when the user's perturbation magnitude meets ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ , we have the following: (1) ACF is theoretically shown to be more effective than traditional CF, and (2) Increasing the user's perturbation magnitude during training as much as possible can further improve both the performance and robustness of ACF. These theoretical understandings can further benefit exploring and fully unleashing the potential of ACF.

4 Methodology

To extend theoretical understandings from the simple CF scenario to more practical scenarios, such as multi-item recommendations with Bayesian Personalized Ranking (BPR) [31], which is a mainstream loss function used in CF recommendations, we first conduct a preliminary experiment shown in Figure 1. Using Matrix Factorization [2] on the Gowalla dataset [32], we observe results similar to those in Theorem 3 and Theorem 4: NDCG@20 for users improves within their maximum magnitudes, i.e., constraints, but significantly declines once these constraints are surpassed. Based on the theoretical understandings provided in Section 3, we derive the following corollary to identify the maximum perturbation magnitude for each user in practical CF scenarios.

Norm: 3.7333

Norm: 2.0926

Norm: 6.7923

Norm: 6.8239

Norm: 11.895

User 1

User 2

User 3

User 4

口

MaximumPerturbationMagnitude

NDCG@20overDifferentPerturbationMagnitude

0.4

NDCG@20

0.3

0.2

0.1

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

Perturbation Magnitude

Corollary 1. Given any dot-product-based loss function L (Θ) , within the framework of Adversarial Collaborative Filtering as defined in Equation 1, the maximum perturbation magnitude ϵ ( u ) ( t ) , max for user u at the t th epoch is positively related to ∥ u ( t ) ∥ .

For the proof of Corollary 1, please refer to Appendix D.3. According to Corollary 1, we observe that for a user u , the larger ∥ u ∥ , the greater the maximum perturbation magnitude. Considering that maximum perturbation magnitudes will be affected by other factors in the actual training process, to ensure training stability, we decompose ϵ ( u ) ( t ) , max for a user u at epoch t into two components: the uniform perturbation magnitude ρ , applicable to all users, and a user-specific perturbation coefficient c ( u , t ) , expressed as:

According to Corollary 1, c ( u , t ) provides coefficients positively related to users' embedding scales. To avoid training instability caused by extreme scale values, we map c ( u , t ) into the interval (0 , 1) ,

defined by:

where ∥ u ( t ) ∥ represents the average norm of all user embeddings at epoch t , and sig( · ) denotes the sigmoid function. Consequently, the loss function for our method, Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), is defined as:

where λ is the weight of adversarial training, ρ represents the uniform perturbation magnitude for all users, and ∆ u is the perturbation relative to user u . To maximize the perturbation magnitude for each user within ρc ( u , t ) , we use the perturbation along the gradient direction of the user's adversarial loss with a step length of ρc ( u , t ) as ∆ u . The specific algorithm process is detailed in Appendix B.

5 Experiments

In this section, we conduct extensive experiments to address the following research questions ( RQs ):

RQ1: Can PamaCF further improve the performance and robustness of traditional ACF?

RQ2: Why does PamaCF perform better than traditional ACF?

RQ3: How do hyper-parameters affect PamaCF?

5.1 Experimental Setup

In this section, we briefly introduce the experimental settings. For detailed information, including dataset preprocessing, comprehensive baseline descriptions, and implementation details, please refer to Appendix C.1.

Datasets . We employ three common benchmarks: the Gowalla check-in dataset [32], the Yelp2018 business dataset, and the MIND news recommendation dataset [33].

Attack Methods . We employ both heuristic (Random Attack [30], Bandwagon Attack [34]) and optimization-based (Rev Attack [7], DP Attack [6]) attack methods within a black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.

Defense Baselines . We incorporate a variety of defense methods, including detection-based approaches (GraphRfi [12] and LLM4Dec [13]), adversarial collaborative filtering methods (APR [15] and SharpCF [20]), and a denoise-based strategy (StDenoise [35, 19]). In our study, we employ three common backbone recommendation models, Matrix Factorization (MF) [2], LightGCN [3], and NeurMF [36].

Evaluation Metrics . The primary metrics for assessing recommendation performance are the topk metrics: Recall@ k and NDCG@ k , as documented in [3, 8, 37]. To quantify the success ratio of attacks, we utilize T -HR@ k and T -NDCG@ k to measure the performance of target items within the topk recommendations [7, 6, 13], as:

where T is the set of target items, U tar denotes the set of genuine users who have interacted with target items tar , L u, 1: k represents the topk list of recommendations for user u , and I ( · ) is the indicator function that returns 1 if the condition is true. The T -NDCG@ k mirrors T -HR@ k , serving as the target item-specific version of NDCG@ k .

5.2 Performance Comparison (RQ1)

In this section, we answer RQ1 . We focus on two key aspects: the recommendation performance and the robustness against poisoning attacks.

1 The Rev attack method could not be executed on the dataset due to memory constraints, resulting in an out-of-memory error.

1 Target Item Hit Ratio (Equation 7); T-HR@50 and T-NDCG@50 of all target items on clean datasets are 0.000.

2 The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics, i.e., (min(T -HR Beslines ) -T -HR PamaCF ) / min(T -HR Beslines ) . Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data.

Recommendation Performance . We assess the efficacy of PamaCF in both clean and poisoning data contexts, focusing on the performance of recommender systems, as presented in Table 1. The denoise-based defense method, which does not directly defend against poisoning attacks but rather purifies noisy interactions, fails to improve recommendation performance in most cases. Detectionbased methods, such as GraphRfi and LLM4Dec, exhibit some misclassifications of fake and genuine users, leading to a decline in recommendation performance.

In contrast, we observe a notable enhancement in recommendation quality when ACF methods (APR, SharpCF, and PamaCF) are utilized. This finding is consistent with results from previous studies [15, 20] and aligns with our prior theoretical analysis. Among the defense methods, PamaCF stands out, achieving the most significant improvements in recommendation performance compared to the backbone model and other baseline approaches. Specifically, PamaCF increases Recall@20 and NDCG@20 by 13.84% and 22.04% in average, respectively, compared to the backbone model.

Robustness Against Poisoning Attacks . We evaluate the capability of PamaCF in defending against poisoning attacks by examining the attack success ratio. Our experiments specifically target items with notably low popularity, as indicated by T -HR@50 and T -NDCG@50 scores of 0.0 when no attacks are present. Lower scores for T -HR@50 and T -NDCG@50 indicate stronger defense capabilities.

Table 2 presents the results, indicating that the purely denoise-based defense method is generally ineffective against most attacks and may even increase the attack's success ratio in some instances.

Distance: 0.736

Distance: 0.365

(a) Embedding Visualization

Distance: 0.736

Distance: 0.365

(b) Perturbation Magnitude Comparison

User

Real Peference Items

Target Item

Other Item

APR

PamaCF

"-APR

PamaCF

APR - Embeddings (by T-SNE)

PamaCF-Embeddings (by T-SNE)

Max.Perturbation Magnitude

Magnitude Distribition

0.6

Max. Perturbation Magnitude

0.4

0.4

0.8

Number of Users

00

0.2

02

600

00

00

-0.2

70

200

-0.4

0

0.4

0.2

-0.4

0.0

0.2

00

Gowalla

Dataset

Yelp2018

MIND

0.0

0.2

Perturbation Magnitude

0.8

Clean

Bandwagon Atk.

★DP Atk.

MF on Clean

T-NDCG@ 50 over Different pValues

NDCG @20 over Different p Values

T-NDCG@50 over Different  Values

NDCG@20 over Different  Values

0.150

0.05

T-NDCG@50

NDCG@20

NDCG@20

10

0.025

0.000

0.2

p Value

Z'0

p Value

0.6

0.8

0.25

0.50

0.75

Value

1.00

1.25

1.50

2.00

0.25

0.50

0.75

1.001.25

Value

2.00

Detection-based methods, such as GraphRfi and LLM4Dec, show robust defense against attacks similar to their training data, i.e., random attacks. However, the effectiveness of GraphRfi declines against other attack types. In contrast, ACF methods demonstrate stable defense capabilities across various attacks. Specifically, PamaCF significantly reduces the success ratio of attacks, decreasing T -HR@50 and T -NDCG@50 by 49.92% and 43.73% in average, respectively, compared to the best baseline. These results highlight PamaCF's advanced defense capabilities against various attacks.

Additionally, PamaCF's defense effectiveness against attacks targeting popular items is further evaluated. The corresponding results for LightGCN [3] and NeuMF [36], along with the recommendation performance at top-10, are also presented. All supplementary results are in Appendix C.2.

5.3 Augmentation Analysis (RQ2)

In this section, we address RQ2 by exploring why PamaCF can outperform traditional ACF (especially APR [15]) through embedding visualization and perturbation magnitude comparison.

Embedding Visualization . We randomly select a user and project the normalized embeddings of the user, real preference items, the target item given by attacks, and other items in the user's top-10 recommendation list into a two-dimensional space using T-SNE [38], as shown in Figure 2(a). We observe that PamaCF can bring real preference items closer, reducing the distance from the farthest real preference item from 0.736 to 0.365, while leading the target item farther away from all the real preference items. PamaCF's personalized perturbation magnitude lowers the ranking of both the target item and other items, thus improving robustness and performance.

Perturbation Magnitude Comparison . We compare the maximum perturbation magnitudes of APR and PamaCF, i.e., ϵ in Equation 1 for APR and ρ in Equation 6 for PamaCF. Both ϵ and ρ are selected through hyper-parameter tuning from { 0 . 1 , 0 . 2 , . . . , 1 . 0 } . In the left part of Figure 2(b), we observe that PamaCF finds a higher perturbation magnitude. Additionally, the right portion of Figure 2(b) illustrates the distribution of personalized perturbation magnitudes across all users. These varying magnitudes for different users contribute to the improved effectiveness of PamaCF.

5.4 Hyper-Parameters Analysis (RQ3)

In this section, we answer RQ3 by exploring the effects of the hyperparameters, magnitude ρ and adversarial training weight λ , as defined in Equation 6. The results are illustrated in Figure 3.

Analysis of Hyper-Parameters ρ . With λ fixed at 1.0, we vary ρ from 0.1 to 1.0 in increments of 0.1. Our findings demonstrate a significant improvement in both robustness and performance as ρ increases. Notably, even when ρ exceeds 0.1, there is an enhancement in recommendation

performance compared to that of the backbone model, i.e., MF, with the range between 0.7 and 0.9 yielding the most significant enhancements.

Analysis of Hyper-Parameters λ . With ρ set at 0.9, we adjust λ from 0.2 to 2.0 in increments of 0.2. The analysis indicates that the defensive ability becomes stable once λ surpasses 1.0 in most attacks. However, setting λ too high gradually diminishes the recommendation performance of PamaCF. Despite this, the performance of PamaCF remains considerably improved compared to MF.

6 Conclusion

In this work, we theoretically analyze why Adversarial Collaborative Filtering (ACF) enhances both the performance and robustness of Collaborative Filtering (CF) systems against poisoning attacks. Additionally, by establishing bounds for reductions in recommendation error during ACF's optimization process, we discover that applying personalized perturbation magnitudes for users based on their embedding scales can significantly improve ACF's effectiveness. Leveraging these theoretical understandings, we introduce Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Comprehensive experiments confirm that PamaCF effectively defends against various attacks and significantly enhances the quality of recommendations.

Limitations . Our study identifies several limitations that require further investigation. Firstly, our theoretical analysis is based on certain assumptions, specifically with the Gaussian Recommender System. We intend to relax these assumptions in future work. Secondly, this study only examines adversarial training within CF recommendations. In future research, we plan to extend our analysis to include more recommendation scenarios, such as sequential recommendations.

Broader Impacts . Our work focuses on enhancing both the performance and robustness of recommender systems against poisoning attacks, thereby benefiting the overall development of recommender systems. We do not foresee any negative impacts resulting from our work.

References

Xiaoyuan Su and Taghi M Khoshgoftaar. A survey of collaborative filtering techniques. Advances in Artificial Intelligence , 2009, 2009.

Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recommender systems. Computer , 42(8):30-37, 2009.

Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, YongDong Zhang, and Meng Wang. Lightgcn - Simplifying and Powering Graph Convolution Network for Recommendation. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 639-648. ACM, 2020.

Brent Smith and Greg Linden. Two decades of recommender systems at amazon.com. IEEE Internet Computing , 21(3):12-18, 2017.

Carlos A Gomez-Uribe and Neil Hunt. The netflix recommender system: Algorithms, business value, and innovation. ACM Transactions on Management Information Systems , 6(4):1-19, 2015.

Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data Poisoning Attacks to Deep Learning Based Recommender Systems. In Proceedings 2021 Network and Distributed System Security Symposium , 2021.

Jiaxi Tang, Hongyi Wen, and Ke Wang. Revisiting adversarially learned injection attacks against recommender systems. In Proceedings of the 14th ACM Conference on Recommender Systems , pages 318-327, 2020.

Kaike Zhang, Qi Cao, Fei Sun, Yunfan Wu, Shuchang Tao, Huawei Shen, and Xueqi Cheng. Robust recommender system: A survey and future directions. arXiv preprint arXiv:2309.02057 , 2023.

Chen-Yao Chung, Ping-Yu Hsu, and Shih-Hsiang Huang. βp : A novel approach to filter out malicious rating rrofiles from recommender systems. Decision Support Systems , 55(1):314-325, 2013.

Fuzhi Zhang and Quanqiang Zhou. Hht-SVM: An online method for detecting profile injection attacks in collaborative recommender systems. Knowledge-Based Systems , 65:96-105, 2014.

Zhihai Yang, Lin Xu, Zhongmin Cai, and Zongben Xu. Re-scale AdaBoost for attack detection in collaborative filtering recommender systems. Knowledge-Based Systems , 100:74-88, 2016.

Shijie Zhang, Hongzhi Yin, Tong Chen, Quoc Viet Nguyen Hung, Zi Huang, and Lizhen Cui. Gcn-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 689-698, 2020.

Kaike Zhang, Qi Cao, Yunfan Wu, Fei Sun, Huawei Shen, and Xueqi Cheng. Lorec: Combating poisons with large language model for robust sequential recommendation. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 1733-1742, 2024.

Yuli Liu. Recommending Inferior Results: A General and Feature-Free Model for Spam Detection. In Proceedings of the 29th ACM International Conference on Information and Knowledge Management , pages 955-974, 2020.

Xiangnan He, Zhankui He, Xiaoyu Du, and Tat-Seng Chua. Adversarial Personalized Ranking for Recommendation. In The 41st International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 355-364, 2018.

Huiyuan Chen and Jing Li. Adversarial tensor factorization for context-aware recommendation. In Proceedings of the 13th ACM Conference on Recommender Systems , pages 363-367, 2019.

Ruirui Li, Xian Wu, and Wei Wang. Adversarial learning to compare: Self-attentive prospective customer recommendation in location based social networks. In Proceedings of the 13th International Conference on Web Search and Data Mining , pages 349-357, 2020.

Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, Enhong Chen, and Senchao Yuan. Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 1074-1083, 2021.

Haibo Ye, Xinjie Li, Yuan Yao, and Hanghang Tong. Towards robust neural graph collaborative filtering via structure denoising and embedding perturbation. ACM Transactions on Information Systems , 41(3):1-28, 2023.

Huiyuan Chen, Xiaoting Li, Vivian Lai, Chin-Chia Michael Yeh, Yujie Fan, Yan Zheng, Mahashweta Das, and Hao Yang. Adversarial Collaborative Filtering for Free. In Proceedings of the 17th ACM Conference on Recommender Systems , pages 245-255. ACM, 2023.

Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. In Advances in Neural Information Processing Systems , volume 36, pages 13931-13955, 2024.

Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 , 2017.

Yian Deng and Tingting Mu. Understanding and improving ensemble adversarial defense. In Advances in Neural Information Processing Systems , volume 36, pages 58075-58087, 2023.

Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems , volume 32, 2019.

Cheng-Hsin Weng, Yan-Ting Lee, and Shan-Hung Brandon Wu. On the trade-off between adversarial and backdoor robustness. In Advances in Neural Information Processing Systems , volume 33, pages 11973-11983, 2020.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning , pages 7472-7482. PMLR, 2019.

Kaike Zhang, Qi Cao, Yunfan Wu, Fei Sun, Huawei Shen, and Xueqi Cheng. Improving the shortest plank: Vulnerability-aware adversarial training for robust recommender system. In Proceedings of the 18th ACM Conference on Recommender Systems , pages 680-689, 2024.

Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 31, 2018.

Haoyang LI, Shimin DI, and Lei Chen. Revisiting Injective Attacks on Recommender Systems. In Conference on Neural Information Processing Systems (NeurIPS) , volume 35, pages 2998930002, 2022.

Shyong K Lam and John Riedl. Shilling recommender systems for fun and profit. In Proceedings of the 13th International Conference on World Wide Web , pages 393-402, 2004.

Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. Bpr: Bayesian personalized ranking from implicit feedback. In Proceedings of the Twenty-Fifth Conference on Uncertainty in Artificial Intelligence , pages 452-461, 2009.

Dawen Liang, Laurent Charlin, James McInerney, and David M Blei. Modeling user exposure in recommendation. In Proceedings of the 25th International Conference on World Wide Web , pages 951-961, 2016.

Fangzhao Wu, Ying Qiao, Jiun-Hung Chen, Chuhan Wu, Tao Qi, Jianxun Lian, Danyang Liu, Xing Xie, Jianfeng Gao, Winnie Wu, et al. Mind: A large-scale dataset for news recommendation. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics , pages 3597-3606, 2020.

Robin Burke, Bamshad Mobasher, and Runa Bhaumik. Limited knowledge shilling attacks in collaborative filtering systems. In Proceedings of 3rd International Workshop on Intelligent Techniques for Web Personalization, 19th International Joint Conference on Artificial Intelligence , pages 17-24, 2005.

Changxin Tian, Yuexiang Xie, Yaliang Li, Nan Yang, and Wayne Xin Zhao. Learning to Denoise Unreliable Interactions for Graph Collaborative Filtering. In Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval , pages 122-132, 2022.

Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. Neural collaborative filtering. In Proceedings of the 26th International Conference on World Wide Web , pages 173-182, 2017.

Xiang Wang, Xiangnan He, Meng Wang, Fuli Feng, and Tat-Seng Chua. Neural graph collaborative filtering. In Proceedings of the 42nd international ACM SIGIR Conference on Research and Development in Information Retrieval , pages 165-174, 2019.

Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research , 9(11), 2008.

Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for youtube recommendations. In Proceedings of the 10th ACM Conference on Recommender Systems , pages 191-198, 2016.

Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L Hamilton, and Jure Leskovec. Graph convolutional neural networks for web-scale recommender systems. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages 974-983, 2018.

Yehuda Koren, Steffen Rendle, and Robert Bell. Advances in collaborative filtering. Recommender Systems Handbook , pages 91-142, 2021.

Hao Wang, Naiyan Wang, and Dit-Yan Yeung. Collaborative deep learning for recommender systems. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages 1235-1244, 2015.

Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams. Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness. ACM Transactions on Internet Technology , 7(4):23-es, 2007.

Carlos E Seminario and David C Wilson. Attacking item-based recommender systems with power items. In Proceedings of the 8th ACM Conference on Recommender Systems , pages 57-64, 2014.

Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-based collaborative filtering. In Advances in Neural Information Processing Systems , volume 29, 2016.

Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. Triple adversarial learning for influence-based poisoning attack in recommender systems. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 1830-1840, 2021.

Jingfan Chen, Wenqi Fan, Guanghui Zhu, Xiangyu Zhao, Chunfeng Yuan, Qing Li, and Yihua Huang. Knowledge-enhanced black-box attacks for recommendations. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 108-117, 2022.

Fulan Qian, Bei Yuan, Hai Chen, Jie Chen, Defu Lian, and Shu Zhao. Enhancing the transferability of adversarial examples based on nesterov momentum for recommendation systems. IEEE Transactions on Big Data , 2023.

Yanling Wang, Yuchen Liu, Qian Wang, Cong Wang, and Chenliang Li. Poisoning selfsupervised learning based sequential recommendations. In Proceedings of the 46th International ACMSIGIR Conference on Research and Development in Information Retrieval , pages 300-310, 2023.

Ziheng Chen, Fabrizio Silvestri, Jia Wang, Yongfeng Zhang, and Gabriele Tolomei. The dark side of explanations: Poisoning recommender systems with counterfactual examples. arXiv preprint arXiv:2305.00574 , 2023.

Chengzhi Huang and Hui Li. Single-user injection for invisible shilling attack against recommender systems. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management , pages 864-873, 2023.

Yunfan Wu, Qi Cao, Shuchang Tao, Kaike Zhang, Fei Sun, and Huawei Shen. Accelerating the surrogate retraining for poisoning attacks against recommender systems. In Proceedings of the 18th ACM Conference on Recommender Systems , pages 701-711, 2024.

Paul-Alexandru Chirita, Wolfgang Nejdl, and Cristian Zamfir. Preventing shilling attacks in online recommender systems. In Proceedings of the 7th Annual ACM International Workshop on Web Information and Data Management , pages 67-74, 2005.

A Related Work

A.1 Collaborative Filtering

Collaborative Filtering (CF) has become a cornerstone of modern recommender systems, evidenced by its widespread application in various studies [3, 39, 40]. The fundamental premise of CF is that users with similar preferences are likely to exhibit similar behaviors, which can be leveraged to predict future recommendations [41]. A principal approach within CF is Matrix Factorization, which learns latent embeddings of users and items by decomposing the observed interaction matrix [2].

With the advent of deep learning, neural CF models have emerged, designed to capture more complex patterns in user preferences. For example, CDL [42] merges auxiliary item information through neural networks into CF, addressing challenges associated with data sparsity. Additionally, NCF [36] replaces the traditional dot product with a neural network, enhancing the modeling of user-item interactions. More recently, Graph Neural Networks have prompted the development of graphbased CF models, such as NGCF [37] and LightGCN [3], which have shown remarkable efficacy in recommender systems. However, despite these technological advances, susceptibility to poisoning attacks remains a significant challenge, compromising the robustness of these systems [8].

A.2 Poisoning Attacks against Recommender Systems

Poisoning attacks within recommender systems involve injecting fake users into the training data to manipulate the exposure of certain items. Initial research predominantly focused on rule-based heuristic attacks, where profiles for these fake users were constructed using predetermined heuristic rules [30, 34, 43, 44]. For example, the Random Attack [30] generated fake users interacting with targeted items alongside a random selection of other items. In contrast, the Bandwagon Attack [34] generated fake user interactions to include targeted items and others selected for their high popularity.

As the technique of attacks has evolved, recent studies have shifted towards optimization-based methods for generating fake users [7, 6, 29, 45, 46, 47, 48, 49, 50, 51, 52]. For instance, the Rev Attack [7] formalizes the attack as a bi-level optimization problem, addressed using gradient-based techniques. Similarly, the DP Attack [6] specifically targets deep learning-based recommender systems.

A.3 Robust Recommender Systems

Mainstream strategies for enhancing the robustness of CF systems against poisoning attacks broadly categorize into two main approaches [8]: (1) detecting and removing fake users [9, 10, 11, 12, 13, 14, 53], and (2) developing robust models via adversarial training, i.e., Adversarial Collaborative Filtering (ACF) [15, 16, 17, 18, 19, 20, 27].

Detection-based strategies focus either on pre-identifying and removing potential fake users from the dataset [9, 10, 11, 14] or on mitigating their influence during the training phase [12, 13]. These methods often rely on specific assumptions about the attacks [9, 12] or require supervised data regarding attacks [10, 11, 12, 13]. Among these, LoRec [13] utilizes large language models to enhance sequential recommendations, overcoming the limitations associated with specific knowledge in detection-based strategies. However, its scope is limited to sequential recommender systems and may not generalize well across different CF scenarios.

Conversely, ACF methodologies, particularly those aligned with the Adversarial Personalized Ranking (APR) framework [15], integrate adversarial perturbations at the parameter level (i.e., user and item embeddings) during the model training process [15, 17, 19, 20]. This approach follows a 'minmax' optimization paradigm, designed to minimize the error in recommendations under parameter perturbations which aim to maximize the error [13]. Besides, numerous studies have demonstrated that ACFnot only enhances the model's robustness but also improves its recommendation performance [15, 20, 27]. Nonetheless, despite its benefits in specific contexts through empirical validation, the intrinsic mechanisms of ACF's effectiveness and its universal applicability remain areas for further theoretical exploration.

Algorithm 1 The Training Procedure of PamaCF-BPR

Input: Training set D , uniform perturbation magnitude ρ , adversarial training weight λ , pre-training epochs T pre , batch size B

Output: Model parameters Θ = [ U , V ] .

1: Pre-train Θ = [ U , V ] for T pre epochs using Equation 8.

2: while stopping criteria not met do

3: Draw batch of B pairs ( u, i, j ) from D .

4: for each ( u, i, j ) in the batch do

5: Calculate ∆ PamaCF u , ∆ PamaCF i , and ∆ PamaCF j using Equation 10.

6: Compute L PamaCF (( u, i, j ) | Θ) using Equation 9.

7: end for

8: Update Θ using the aggregated gradients from L PamaCF (Θ) in the batch.

9: end while

10: return Θ = [ U , V ]

B Methodology

For clarity, we present the PamaCF version of the widely used Bayesian Personalized Ranking (BPR) [31] loss function, which optimizes recommender models towards personalized ranking. Given the user set U = { u } , the item set V = { v } , and the training set D = { ( u, i, j ) | u ∈ U ∧ i ∈ V u ∧ j ∈ V \ V u } , where V u denotes the set of items with which user u has interacted. The objective function (to be minimized) of BPR is formally given by:

where U and V represent the learned user and item embeddings, respectively.

The PamaCF version of the BPR loss function is defined as:

where λ is the weight of adversarial training, ρ represents the uniform perturbation magnitude for all users, and

The specific handling of a pair ( u, i, j ) ∈ D is expressed by:

where

The procedure of training with PamaCF is illustrated in Algorithm 1.

C Experiments

C.1 Supplements to Experimental Settings

Datasets . We employ three common benchmarks: the Gowalla check-in dataset [32], the Yelp2018 business dataset, and the MIND news recommendation dataset [33]. The Gowalla and Yelp2018

datasets include interactions from all users. For the MIND dataset, we sample a subset of users following [13]. Following [3, 37], users and items with fewer than 10 interactions are excluded from our analysis. We allocate 80% of each user's historical interactions to the training set and the remainder for testing. Additionally, 10% of the interactions from the training set are randomly selected to form a validation set for hyperparameter tuning. Detailed statistics of the datasets are summarized in Table 3.

Attack Methods . We explore both heuristic (Random Attack [30], Bandwagon Attack [34]) and optimization-based (Rev Attack [7], DP Attack [6]) attack methods within a black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.

Random Attack (Heuristic Method) [30]: This method entails fake users including interactions with both the targeted items and a set of randomly chosen items.

Bandwagon Attack (Heuristic Method) [34]: Fake users' interactions encompass the targeted items and those selected for their high popularity.

DPAttack (Optimization-based Method) [6]: This approach is specifically designed to compromise deep learning-based recommender systems.

Rev Attack (Optimization-based Method) [7]: The attack is conceptualized as a bi-level optimization problem, addressed through gradient-based methods.

Defense Baselines . We incorporate a variety of defense methods, including detection-based approaches (GraphRfi [12] and LLM4Dec [13]), adversarial collaborative filtering methods (APR [15] and SharpCF [20]), and a denoise-based strategy (StDenoise [35, 19]). In our study, we employ three common backbone recommendation models, MF [2], LightGCN [3], and NeurMF [36].

GraphRfi [12]: Employs a combination of Graph Convolutional Networks and Neural Random Forests for identifying fake users.

LLM4Dec [13]: Utilizes an LLM-based framework for fake users detection.

APR [15]: Generates parameter perturbations and integrates these perturbations into training.

SharpCF [20]: Adopts a sharpness-aware minimization approach to refine the adversarial training process proposed by APR.

StDenoise [35, 19]: Applies a structural denoising technique that leverages the similarity between U u and V i for each ( u, i ) pair, aiding in the removal of noise, as described in [35, 19].

Note that: With the need of item-side information, LLM4Dec is exclusively evaluated on the MIND dataset. Moreover, we observe that SharpCF, initially proposed for the MF model, exhibits unstable training performance when applied to the LightGCN model or the MIND dataset. Consequently, we present SharpCF results solely for the MF model on the Gowalla and Yelp2018 datasets.

Implementation Details . In our study, we employ three common backbone recommendation models, Matrix Factorization (MF) [2], LightGCN [3], and NeurMF [36]. To quantify the success ratio of attacks, we select k = 50 as the evaluation metric following [6, 7, 18], while for assessing recommendation performance, we utilize k = 10 , 20 following [3, 37]. For each attack setting, we conduct experiments five times, taking the average value as the result and the standard deviation as the error bar. The configuration of both the defense methods and the recommendation models involves selecting a learning rate from {0.1, 0.01, . . . , 1 × 10 -5 }, and a weight decay from {0, 0.1, . . . , 1 × 10 -5 }. The implementation of GraphRfi follows its paper. For the detection-based methods, we employ the Random Attack to generate supervised attack data. The magnitude parameter of adversarial perturbations in both APR and PamaCF is determined from a range of {0.1, 0.2, . . . , 1.0}. In terms of attack methods, we set the attack budget to 1% and target five specific items. The hyperparameters align with those detailed in their original publications.

Backbone

+BestBaselines

+PamaCF

2.0

0.5

T-HR@50 (%)

1.6

T-NDCG@50(%)

0.4

12

0.2

0.4

0.

0.0

0.0

Random

Bandwagon

DP

Rev

Random

Bandwagon

DP

Rev

PopAtk.

PopAtk.

PopAtk.

PopAtk.

PopAtk.

PopAtk.

PopAtk.

PopAtk.

Attack Type

AttackType

Compute Resources . The experiments are conducted using two primary GPU: the RTX 4090 with 24GB of VRAM and the A800 with 80GB of VRAM. For most baseline defense methods applied across all datasets, a single RTX 4090 GPU suffices, requiring several hours per experiment. However, the LLM4Dec method [13] demands an A800 GPU due to its higher resource requirements for processing Large Language Models. In terms of attack generation, heuristic poisoning attacks such as the Random Attack [30] and Bandwagon Attack [34] are generated within seconds and do not require specific GPU resources. Conversely, the time required to generate optimization-based poisoning attacks, such as the DP Attack [6] and Rev Attack [7], depends on the dataset. For the Gowalla and Yelp datasets, these attacks take hours to execute on an A800 GPU. The DP Attack on the MIND dataset extends to several days, also utilizing an A800 GPU. However, the Rev Attack cannot be completed on a single A800 GPU due to its even greater computational demands.

C.2 Supplements to Performance Comparison

We assess PamaCF's defense capabilities against attacks targeting popular items on Gowalla. According to Figure 4, PamaCF exhibits strong defensibility, outperforming the best baseline even when attacks specifically promote popular items.

We also evaluate PamaCF's defense capabilities and recommendation performance when applied to LightGCN [3] and NeurMF [36], as shown in Table 4 and Table 5, which produces consistent results with MF [2].

Additionally, we report PamaCF's recommendation performance on MF for the Gowalla dataset, specifically for k = 10 , using Recall@10 and NDCG@10 . PamaCF demonstrates significantly greater improvement at k = 10 , achieving a 29.59% increase in Recall and a 56.41% increase in NDCG, relative to the baseline model, as shown in Table 6.

1 The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics. Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data.

1 The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics. Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data.

D Proofs

D.1 Proofs for Section 3.1

D.1.1 Proof of Theorem 1

To investigate the recommendation error of each user during the training period, we first analyze how the item embeddings change. We discover a transformation function that accurately measures the change in the item embedding from its initial state to its state after a certain number of training epochs. This insight is formally expressed in the following proposition.

Proposition 1. Consider a Gaussian Recommender System f ( t ) , undergoing training for t epochs using the standard loss function specified in Equation 2. Given a learning rate η , there exists a function M ( t, η ) : N + × R + → R + that quantify the transformation of the item embedding due to training. Specifically, we have:

where v (0) denotes the initial item embedding and v ( t ) represents the item embedding after t epochs of training.

Proof of Proposition 1 . Consider the training process of the Gaussian Recommender System f ( t ) over t epochs, with each update through the standard loss outlined in Equation 2. The update mechanism for user and item embeddings at the t th epoch can be described as follows:

Considering the sum ∑ ( u ,r ) r u ( t -1)

where n is the number of users. This leads to the recursive update for v ( t ) :

To simplify, we introduce a ( k ) , b ( k ) and c ( k ) to represent the cumulative scaling factors as:

yielding a general form for v ( t ) :

Based on let M ( t, η ) : N + × R + → R + be the transformation function related to training epochs t and learning rate η , which is defined as:

Then we can get:

This proves that the item embedding v ( t ) after t epochs of training is a scaled version of the initial embedding v (0) , with the scaling factor M ( t, η ) being a function of the number of epochs t and the learning rate η .

Fact 1. Let ε ∈ R d be drawn from N ( 0 , σ 2 I ) , with σ > 0 . Let w ∈ R d represent any unit vector. Then, ⟨ ε , w ⟩ follows a normal distribution N (0 , σ 2 ) .

Proof of Fact 1 . Consider ε = [ ε 1 , . . . , ε d ] , with each ε i following N (0 , σ 2 ) . Let w = [ w 1 , . . . , w d ] , satisfying w 2 1 + · · · + w 2 d = 1 . Then ⟨ ε , w ⟩ is distributed as N ( E [ ⟨ ε , w ⟩ ] , D [ ⟨ ε , w ⟩ ]) , where:

Hence, Fact 1 is proved.

Proof of Theorem 1 . By invoking Proposition 1, we establish the basis for evaluating the impact of training on the recommendation error at the ( t +1) th epoch. Proposition 1 specifies the scaling relationship between the initial and trained item embeddings, leading to the following update expressions for user and item embeddings. For the standard loss though Equation 2, we have:

Considering the above update rules, the recommendation error at the ( t +1) th epoch is given by:

̸

For adversarial loss as detailed by Equation 1, we have:

According to the first-order Taylor expansion, we have:

leading to specific perturbations ∆ u and ∆ v in Equation 3:

Subsequently, the updated embeddings through adversarial loss are expressed as:

Given ∥ ¯ u ∥ ≫ σ , we can approximate ∥ v (0) ∥ with E [ ∥ v (0) ∥ ] . Given ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , according to the expansion of M ( t, η ) in Proposition 1, it follows that ( M ( t, η ) + nη (1 + λ ) ( 1 + η + η ∑ t -1 j =1 M ( j, η ) ) -nηλϵ ∥ v (0) ∥ ) > 0 . Considering these update rules, the recommendation error at the ( t +1) th epoch is determined by:

̸

Let γ ( u ) ( t ) = ( 1 -ηλϵ ∥ u ( t ) ∥ ) -1 . Given the condition ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , it follows γ ( u ) ( t ) > 1 . The final form of the recommendation error at the ( t +1) th epoch under adversarial training is:

̸

This leads us to:

̸

̸

Given that ∥ ¯ u ∥ ≫ σ , we can approximate the ∥ v (0) ∥ 2 by using E v (0) ∼N (¯ u , σ 2 n -1 I ) [ ∥ v (0) ∥ 2 ] as an estimate. Therefore, we have:

̸

where d is the dimension of v (0) .

Let ε ∼ N ( 0 , σ 2 n -1 I ) , we have v (0) = ¯ u + ε . Thus:

̸

According to Fact 1, ⟨ r u ( t ) ∥ u ( t ) ∥ , ε ⟩ ∼ N ( 0 , σ 2 n -1 ) , then:

̸

̸

where Φ() is the CDF of standard Gaussian distribution. Given ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , it follows that (1 + λ ) γ ( u ) ( t ) > 1 + λ > 1 . This condition implies a lower recommendation error at the ( t +1) th epoch under adversarial training compared to standard training:

̸

̸

Therefore, Theorem 1 is proved.

D.1.2 Proof of Theorem 2

Proof of Theorem 2 . In light of Theorem 1 and the impact of poisoning attacks, our objective is to measure the alteration in the recommendation error within a poisoning attack, i.e., α -poisoned recommendation error.

A poisoning attack on Gaussian Recommender System injects a poisoning user set I ′ = { ( u ′ 1 , r ′ 1 ) , ( u ′ 2 , r ′ 2 ) , . . . , ( u ′ n ′ , r ′ n ′ ) } , with each tuple ( u ′ , r ′ ) ∈ R d ×{± 1 } representing data maliciously crafted by attackers. Considering the initialized poisoned item embedding v ′ :

̸

̸

by employing Theorem 1 as a basis (similar to Equations 13 and 16), we derive:

̸

Given ∥ ¯ u ∥ ≫ σ , we can use E v (0) ∼N (¯ u , σ 2 n -1 I ) [ ∥ v ′ (0) ∥ 2 ] to approximate the ∥ v ′ (0) ∥ 2 in the above. Similar to the proof of Theorem 1, specifically Equation 17, and under the precondition ϵ < min( ∥ u ( t ) ∥ , ∥ ¯ u ∥ ) ηλ , we have:

̸

̸

Hence, Theorem 2 is proved.

D.2

Proofs for Section 3.2

D.2.1 Proof of Theorem 3

Extending Proposition 1 to ACF yields the following proposition, which captures the transformation of item embedding due to adversarial loss as defined in Equation 3.

Proposition 2. Consider a Gaussian Recommender System f ( t ) , per-trained on standard loss over t epochs, then trained by the adversarial loss specified in Equation 3 over k epochs. Given learning rate η , adversarial training weight λ , and perturbation magnitude ϵ , when ϵ < ∥ ¯ u ∥ ηλ , and ∥ ¯ u ∥ ≫ σ , there exists a transformation function M adv ( t, η, λ, ϵ ) : N + × R + × R + × R + → R + , such that the item embedding at ( t + k ) th epoch, v ( t + k ) , is related to the initial embedding v (0) by:

where M ( t, η ) is the transformation function given by standard loss in Proposition 1.

The proof of Proposition 2 follows a reasoning analogous to that of Proposition 1. Due to the similarity, the detailed proof is omitted for brevity.

̸

Proof of Theorem 3 . Given ϵ < ∥ ¯ u ∥ ηλ , drawing from Proposition 2 and Theorem 1 (specifically Equation 15), the update rules for user and item embeddings in the ACF at the ( t + k +1) th epoch are presented as:

Considering the above update rules, the recommendation error at the ( t + k +1) th epoch is given by:

̸

where C t + k = M adv ( t + k,η,λ,ϵ ) M adv ( t,η,λ,ϵ ) M ( t, η ) . Let γ ( u ) ( t + k ) = ( 1 -ηλϵ ∥ u ( t + k ) ∥ ) -1 . Given the condition ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ , it follows γ ( u ) ( t + k ) > 1 . The recommendation error at ( t +1) th epoch through adversarial loss can be expressed as:

̸

With

̸

the change in recommendation error can be written as:

̸

̸

Given that ∥ ¯ u ∥ ≫ σ , we can approximate the ∥ v (0) ∥ 2 by using E v (0) ∼N (¯ u , σ 2 n -1 I ) [ ∥ v (0) ∥ 2 ] as an estimate. Thus, we have:

̸

By Fact 1, we have ⟨ r u ( t ) ∥ u ( t ) ∥ , ε ⟩ ∼ N ( 0 , σ 2 n -1 ) , then:

̸

where Φ() is the CDF of standard Gaussian distribution. Obviously,

Let

Using the CDF properties of the standard normal distribution, we can conclude:

̸

equality holds when

Furthermore,

Equality is achieved when

Therefore, Theorem 3 is proved.

D.2.2 Proof of Theorem 4

Proof of Theorem 4 . Given ϵ < ∥ ¯ u ∥ ηλ , according to Proposition 2 and Theorem 1 (specifically Equation 15), we have:

where v ′ (0) is the poisoned item embedding as given by Equation 18.

Considering the above update rules, the α -poisoned recommendation error at the ( t + k +1) th epoch is given by:

̸

̸

where C t + k = M adv ( t + k +1 ,η,λ,ϵ ) M adv ( t,η,λ,ϵ ) M ( t, η ) . Let γ ( u ) ( t + k ) = ( 1 -ηλϵ ∥ u ( t + k ) ∥ ) -1 . Given the condition ϵ < min( ∥ u ( t + k ) ∥ , ∥ ¯ u ∥ ) ηλ , it follows γ ( u ) ( t + k ) > 1 . The recommendation error at the ( t +1) th epoch under adversarial loss can be expressed as:

̸

With

̸

the change in α -poisoned recommendation error can be written as:

̸

̸

Given that ∥ ¯ u ∥ ≫ σ , we can approximate ∥ v ′ (0) ∥ 2 by using:

as an estimate. For simplicity, we use E [ ∥ v ′ (0) ∥ 2 ] to represent E v (0) ∼N (¯ u , σ 2 n -1 I ) [ ∥ v ′ (0) ∥ 2 ] . Thus, we have:

E

(

u

′

nn

2

-

2

∥

(

√

dα, n

′

n

[

-

-∥

[

2

∥

u

¯

¯

u

∥

∥

2

u

,

¯

∥

′

]

∥

+(

n

′

,

)

(

2

n

dα

+

√

dα

2

n

′

]

,

+2

)

2

∥

v

′

(0)

∥

∈

n

+

n

′

)

α

2

̸

By Fact 1, we have ⟨ r u ( t + k ) ∥ u ( t + k ) ∥ , ε ⟩ ∼ N ( 0 , σ 2 n -1 ) , then:

̸

where Φ() is the CDF of standard Gaussian distribution. Obviously,

∑

′

,r

)

∈I

′

∥

¯

∥

u

rr

′

0

+

(

⟨

′

n

-

+

k

+

(

t

(

t

u

u

⟨

r

k

u

∥

)

)

(

∥

t

+

(

+

t

u

n

dσ

2

1)(

n

,

k

k

u

′

(0)

)

,

)

2

+

∥

n

′

u

¯

)

2

⟩ ∈

⟩ ∈

,

where n ′ is the number of fake users, d is the dimension of u ′ , and α = max ( u ′ ,r ′ ) ∈I ′ ∥ u ′ ∥ ∞ . Let

According to the CDF properties of the standard normal distribution, we can conclude that:

̸

and E [ ∥ v ′ (0) ∥ 2 ] reaches the minimum value n 2 ∥ ¯ u ∥ 2 -2 nn ′ α ∥ ¯ u ∥ 0 ( n + n ′ ) 2 + n 2 dσ 2 ( n -1)( n + n ′ ) 2 .

Moreover,

n

[

2

]

(

n

2

∥

¯

u

̸

∥

nn

′

α

∥

¯

u

∥

0

+

(

n

-

n

dσ

2

1)(

2

n

+

′

n

)

2

]

equality holds when

Hence, Theorem 4 is proved.

D.3 Proofs for Section 4

Given any dot-product-based loss function L (Θ) , characterized by its dependency on the product of user and item embeddings, the gradients of user and item embeddings at the t th epoch can be expressed as follows:

where ϕ ( · ) and ψ ( · ) denote coefficient functions derived from L (Θ) , mapping from the embeddings' space to the scalar values.

Considering the proofs of Theorem 3 and Theorem 4, there is a coefficient γ ( u ) ( t ) for the user u . When γ ( u ) ( t ) > 1 is satisfied, the effectiveness of ACF can be guaranteed. Here, we derive the coefficient γ ( u ) ( t ) in multi-item recommendation scenarios with dot-product-based loss through the following corollary.

Corollary 2. Assuming the incorporation of adversarial training as defined in Equation 1 with dot-product-based loss function L (Θ) , and given the learning rate η , the adversarial training weight λ , and the perturbation scale ϵ , the γ ( u ) ( t ) for user u is given by:

where N u is the item set that user u interacts with.

Proof of Corollary 2 . Recall Equation 1. Given a dot-product-based loss function L (Θ) within the framework of adversarial training:

where ϵ > 0 defines the magnitude of perturbation, and λ is the adversarial training weight. Considering any pair ( u , v ) , the perturbations can be computed as (similar to Equation 14):

The update equations for the embedding of user u at the t th epoch under adversarial perturbations can be expressed as follows:

where N u is the set of items that user u interacts with.

By employing the first-order Taylor expansion on ( u ( t ) +∆ u ( t ) ) and ( v ( t ) +∆ v ( t ) ) , we have:

Subsequently, the update mechanism for the user embedding, incorporating both direct and adversarial gradients, is computed as:

Considering Equation 22, for a loss function L (Θ) based on dot-products, the coefficients of gradients for user embedding u and item embedding v , denoted as ψ ( · ) and ϕ ( · ) respectively, are still functions based on the dot-product of user embedding u and item embedding v . Consequently, the gradients of ψ ( · ) and ϕ ( · ) with respect to user embedding u depend on item embedding v . Specifically, ∇ u ( t ) ψ ( r, u ( t ) , v ( t ) ) = ξ ( r, u ( t ) , v ( t ) ) v ( t ) and ∇ u ( t ) ϕ ( r, u ( t ) , v ( t ) ) = ξ ′ ( r, u ( t ) , v ( t ) ) v ( t ) . Thus, the updated expression for the user embedding u ( t +1) under adversarial training conditions is delineated as follows:

Following the aforementioned Equation 16 and Equation 20, the γ ( u ) for the user u in the context of multi-item ACF with a dot-product loss function is given by:

Proof of Corollary 1 . For any dot-product-based loss function L ( u , v | Θ) , the coefficient functions in Equation 22 can be given by:

Building upon Corollary 2, we can express γ ( u ) ( t ) as:

Considering the proofs of Theorem 3 and Theorem 4, under 0 < ( γ ( u ) ( t ) ) -1 < 1 , we can guarantee the effectiveness of ACF. Therefore, it implies:

In actual training, the maximum perturbation magnitudes will also be affected by other factors. From the perspective of Corollary 2, we can only conclude that the maximum perturbation magnitude ϵ ( u ) ( t ) , max for user u at epoch t is positively related to ∥ u ( t ) ∥ .

Therefore, Corollary 1 is proved.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The abstract and introduction clearly articulate the primary contributions and scope of the paper. They accurately summarize the theoretical and experimental findings, explicitly matching the claims made throughout the document.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations of our work are discussed in Section 6.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The assumptions are presented in Section 3, and the related proofs are found in Appendix D.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: Experimental information, including datasets, baselines, and evaluation metrics, is provided in Section 5.1, while implementation details are found in Appendix C.1.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The experimental code and data are provided through an anonymous link in Section 1.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: Experimental settings are outlined in Section 5.1. Additional details can be found in Appendix C.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: The results presented in Section 5 include error bars. The method for calculating these error bars is explained in the implementation details provided in Appendix C.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We provide sufficient information on the computer resources in Appendix C.1. Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We conform with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: The robust recommendation algorithm has a positive impact on the field of recommender systems. The impact is discussed in Section 6.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The original papers that produced the code package or dataset are cited in both Section 5 and Appendix C.1.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We provide the code via both an anonymized URL (in Section 1) and an anonymized zip file.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
This work investigates the efficacy and robustness of Adversarial Collaborative Filtering (ACF) in recommender systems. The authors present theoretical analyses to demonstrate how ACF enhances traditional collaborative filtering (CF) by mitigating the negative impact of data poisoning attacks. They extend these theoretical insights to further improve existing ACF methods by dynamically and personally assigning perturbation magnitudes based on users’ embedding scales. Experiments based on representative CF backbones and various attack methods strengthen the validity of this work.

STRENGTHS:
S1. The work addresses a critical issue in recommender systems—robustness against attacks. The paper introduces novel theoretical insights into the benefits of ACF over traditional CF, particularly in mitigating data poisoning attacks. The combination of theoretical and empirical analyses enhances the originality of the work.

S2. The authors provide rigorous mathematical proofs and extensive experimental evaluations to support their claims. The inclusion of multiple datasets and various attack methods strengthens the validity of their findings.

S3. The paper is well-structured, with clear explanations of theoretical concepts and experimental methodologies. The use of figures and tables helps in comprehensively presenting the results.

WEAKNESSES:
W1. To extend theoretical understandings from the simple single-item CF scenario to practical multi-item scenarios,  Corollary 1 is restricted to the dot-product-based loss function.

W2. The experiment only involves two CF backbones, namely MF and LightGCN. The results will be more convincing by adding more CF methods.

QUESTIONS:
Please refer to the Weaknesses section.

LIMITATIONS:
The authors have discussed the limitations of their work.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work investigates adversarial collaborative filtering, providing theoretical evidence for the effectiveness of such methods and proposing a novel method based on the personalized magnitude of perturbation.\n\nOverall, this work studies on an interesting problem and offer some theoretical insights. However, this work also has some limitations particularly on the impractical assumptions. As such, I give the score of 5.\n\nSTRENGTHS:\n1.\tThis work studies on an interesting and important problem.\n\n2.\tThis work provides a theoretical understanding of the effectiveness of the adversarial collaborative filtering, and introduces a new method based on this understanding.\n\n3.  Extensive experiments are conducted to validate the effectiveness of the proposal.\n\nWEAKNESSES:\n1.\tMy primary concern lies with the assumptions made in the theoretical analysis. There is a noticeable gap between the theoretical analysis and practical applications in several aspects: a) the strategy for initializing embeddings (presented in Definition 1) is seldom adopted in existing RS; b) the optimization in practical RS typically uses BCE, BPR, or softmax loss, rather than the loss function described in equation (2); c) preference prediction usually does not employ the sign function; d) recommendation is often framed as a ranking problem with corresponding metrics or losses, rather than being defined as in ‘Definition 2’ for analyzing recommendation error. \n\nI understand these impractical assumptions could facilitate theoretical derivation, but they clearly become a limitation of this work.\n\n2.\tMy other concern is with the theoretical analysis itself. \n\n2.1\t It is counter-intuitive that the theoretical bound does not depend on the item embeddings, given the symmetric roles of user and item embeddings in recommendation systems. Could you please provide some explanations? Or the relations $v=1/n \\sum_i r_i u_i$ are always held? \n\n2.2\tIt is interesting to discover that CF has a unique advantage such that the adversarial mechanism works even for clean data, unlike in basic classification tasks. Why is collaborative filtering so special? The problem formulation for collaborative filtering appears similar to basic classification tasks. Could the distinction be due to the inner product? More discussion on which characteristics of collaborative filtering lead to this advantageous property would be highly interesting.\n\nSome minor ones:\n\n3.\tThe theoretical part is not easy to follow.  This may be due to my unfamiliarity with theories on adversarial learning. Nevertheless, I recommend that the authors provide intuitive explanations for the theorems and a brief outline of the proof procedure. \n\n4.\tThe paper should include more experimental details. It is unclear whether the experimental setup (e.g., initialization) follows the problem definition 1 or aligns with previous works like [2][3].\n\nQUESTIONS:\nPlease refer to weaknesses.\n\nLIMITATIONS:\nthe authors have discussed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper targets adversarial collaborative filtering and provides both deeper understanding and improvement. The paper provides a theoretical explanation for the ACF's improvement upon robustness and effectiveness. PamaCF, which is presented in Appendix, can more robustly performs CF, is evaluated on three recommendation datasets.\n\nSTRENGTHS:\n1. The paper is generally well-written and easy to follow.\n2. The paper provides a theoretical explanation for the ACF's improvement in robustness and effectiveness.\n\nWEAKNESSES:\n1. Part of the experiments are missing and incomplete.\n2. The loss terms in Section 3 do not fully align with the cited papers.\n\nQUESTIONS:\n1. What's the performance of various ACF methods on LightGCN? It would be more comprehensive to report another Table similar to Table 1 about LightGCN.\n2. Why does the paper present the recommendation performance at HR@50 and NDCG@50 in Table 1 and present the performance against attacks in Table 2 with T-HR@50 and T-NDCG@50?\n3. Is target item promotions the only attack PamaCF can prevent? \n4. The loss of Gaussian Recsys in Eq 2 does not fully align with [18]. So is the same regarding Eq 3 and [15]. Why does the author make such changes? The loss term is the foundation of all derivity. All previous works are based upon pairwise loss while the paper is based on pointwise loss.\n\nLIMITATIONS:\nAlthough the paper presents an important theoretical and experimental analysis of ACF, the reviewer feels a strong sense of misalignment between Section 3 and 4, where the theoretical results in Section 3 do not fully motivate PamaCF in Section 4. The result of Section 3 seems to be motivated by pointwise loss, while PamaCF is built upon pairwise loss. Also, part of the experimental setup is not convincing enough. However, the reviewer might be persuaded with further evidence.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-17"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nAdversarial training has been observed to degrade model performance on clean samples in the CV domain, however, ACF in recommender systems can not only enhance the robustness against poisoning attacks but also improve recommendation performance. This paper provides a comprehensive theoretical understanding of this phenomenon. Specifically, this paper shows the performance with adversarial training is better than without adversarial training in both clean and $\\alpha$-poisoned scenarios. In addition, this paper provides the lower and upper bounds for the recommendation error. This paper also proposes a learning approach that can be used in more practice scenarios. Experiments on three datasets demonstrate the effectiveness of the proposed method in terms of robustness and recommendation performance.\n\nSTRENGTHS:\n$\\bullet~$ The problem studied is important and relevant.\n\n $\\bullet~$ The idea is interesting and novel.\n\n$\\bullet~$ The motivation is reasonable.\n\n $\\bullet~$ The theoretical results are sound and are verified in Figure 1.\n\n $\\bullet~$ The evaluations are solid and convincing.\n\nWEAKNESSES:\n$\\bullet~$ Can authors discuss the feasibility of relaxing the assumption in theorems such as the Gaussian recommendation system? In addition, is the the extension to multiple items natural?\n\n$\\bullet~$ It will be better if the magnitude of user latent vectors is provided in Figure 1. Thus we can align the empirical findings and theoretical findings more straightforwardly. Maybe we can observe that the magnitude of the latent vector of user 3 is larger than that of user 2.\n\n $\\bullet~$ Is there a more reasonable way to design the form of $c(\\mathbf{u}, t)$ and equation 5? In addition, how can we choose $\\rho$ in practice? Is $\\rho$ learnable or it is only a hyper-parameter?\n\n $\\bullet~$ Some presentation issues. For example, the $\\alpha$ in line 184 should be bolded, and it should be $\\Phi(\\cdot)$ in line 176. In addition, the results in Table 1 should retain 2 digits instead of 3 digits to enhance the readability. The text in Figures 2 and 3 (such as x-axis and y-axis) should be larger.\n\nQUESTIONS:\nSee the weaknesses part for the questions.\n\nLIMITATIONS:\nYes, this author adequately discusses the limitation and broader impact.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-17"}