## 6 Experiment
### Results in the White-Box Setting  
#### 6.2.1 Effectiveness of Poisoning Attack  
We utilized the Bayesian Personalized Ranking (BPR) recommendation algorithm to train on three different datasets. Due to the varying sizes of these datasets, the number of fake users inserted during the attack process also varied. By default, the experimental settings involve setting the fake user count to 3% of all users, with \(T=30\). Table 3 shows the results (The bold numbers are the best performance between the methods (including our method); The underlined numbers are the best performance between the methods (excluding our method).) of the poisoning attacks at different fake user ratios and the impact of the maximum interaction sequence length of fake users on the effectiveness of the attack.  
\begin{table}
\begin{tabular}{l c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Attack Method**} & \multicolumn{6}{c}{**Proportion of Fake Users**} & \multicolumn{6}{c}{**Maximum Interaction Sequence \(T\)**} \\ \cline{3-10}  & & **1\%** & **3\%** & **5\%** & **10\%** & **10** & **20** & **30** & **50** \\ \hline \multirow{4}{*}{ML-100K} & Random & 0.002 & 0.003 & 0.004 & 0.005 & 0.001 & 0.002 & 0.003 & 0.001 \\  & Random-Similarity & 0.003 & 0.005 & 0.007 & 0.008 & 0.003 & 0.004 & 0.005 & 0.004 \\  & Popular & 0.002 & 0.004 & 0.005 & 0.006 & 0.002 & 0.003 & 0.004 & 0.003 \\  & DRL Attack & **0.009** & **0.011** & **0.013** & **0.02** & **0.004** & **0.008** & **0.011** & **0.01** \\ \hline \multirow{4}{*}{ML-1M} & Random & 0.001 & 0.002 & 0.003 & 0.004 & 0.001 & 0.001 & 0.002 & 0.001 \\  & Random-Similarity & 0.003 & 0.005 & 0.006 & 0.007 & 0.003 & 0.004 & 0.005 & 0.004 \\  & Popular & 0.002 & 0.003 & 0.005 & 0.006 & 0.002 & 0.003 & 0.003 & 0.002 \\  & DRL Attack & **0.006** & **0.009** & **0.011** & **0.017** & **0.003** & **0.006** & **0.009** & **0.008** \\ \hline \multirow{4}{*}{Last.fm} & Random & 0.003 & 0.005 & 0.006 & 0.007 & 0.002 & 0.004 & 0.005 & 0.003 \\  & Random-Similarity & 0.005 & 0.006 & 0.008 & 0.011 & 0.003 & 0.005 & 0.006 & 0.005 \\ \cline{1-1}  & Popular & 0.001 & 0.002 & 0.003 & 0.005 & 0.001 & 0.001 & 0.002 & 0.001 \\ \cline{1-1}  & DRL Attack & **0.012** & **0.017** & **0.025** & **0.03** & **0.006** & **0.011** & **0.017** & **0.016** \\ \hline \hline \end{tabular}
\end{table}
Table 3: HR@10 for different attack methods at different attack sizes in White-Box Setting.  
For the ML-100K dataset, item number 200 was targeted in an attack involving 943 users, of whom 737 had not rated the item. Out of these, 100 users were randomly selected as target users to receive feedback rewards, and the rest were used as evaluation users to calculate the HR@10 metric for the top 10 recommendation lists. In all cases, DRLATack significantly outperformed the baseline attacks. In particular, when 1% of fake users were inserted, DRLATack's hit rate was approximately three times higher than the best hit rate of other attack methods. Additionally, the experiment found that an overly large \(T\) value could actually decrease the hit rate of the poisoning attack. For instance, the random attack method saw a 66.7% decrease in hit rate at \(T=50\) compared to \(T=30\), while the decline in DRLATack was relatively stable. The attack on the ML-1M dataset yielded similar effects.  
For the Last.fm music dataset, the popular attack utilized the recommendation system's tendency to recommend popular items, but due to the high user-item sparsity in Last.fm, the popular attack performed worst in this dataset. DRLATack remained the most effective in all cases, with the random attack based on similarity measures achieving the best performance among baseline attacks. It managed to increase the hit rate to 0.010, but this was only 38% of the hit rate achieved by DRLATack.