# DIFshilling: A Diffusion Model for Shilling Attacks
## 5 Experiments
### Experimental Setup  
The benchmark datasets used in our experiments are as follows: ML100K ([[https://grouplens.org/datasets/movielens/100k/](https://grouplens.org/datasets/movielens/100k/)]([https://grouplens.org/datasets/movielens/100k/](https://grouplens.org/datasets/movielens/100k/)) (accessed on 21 February 2025)), FilmTrust ([[https://github.com/guoguibing/librec/tree/3.0.0/data/filmtrust](https://github.com/guoguibing/librec/tree/3.0.0/data/filmtrust)]([https://github.com/guoguibing/librec/tree/3.0.0/data/filmtrust](https://github.com/guoguibing/librec/tree/3.0.0/data/filmtrust)) (accessed on 21 February 2025)), Amazon Automotive, Amazon Fashion ([[https://nijianmo.github.io/amazon/index.html](https://nijianmo.github.io/amazon/index.html)]([https://nijianmo.github.io/amazon/index.html](https://nijianmo.github.io/amazon/index.html)) (accessed on 21 February 2025)) and Book-crossing ([[https://www.kaggle.com/datasets/somnambowl/bookcrossing-dataset](https://www.kaggle.com/datasets/somnambowl/bookcrossing-dataset)]([https://www.kaggle.com/datasets/somnambowl/bookcrossing-dataset](https://www.kaggle.com/datasets/somnambowl/bookcrossing-dataset))) (accessed on 21 February 2025). To ensure a comprehensive evaluation, we selected datasets with diverse characteristics. While ML100K and FilmTrust are popular benchmarks, their small and dense nature makes them less representative of real-world recommender system scenarios. Therefore, we included Amazon Fashion and Book-crossing datasets, which are significantly larger and sparser, to better assess the practicality of DIFshilling. The dataset statistics are provided in Table 2. To filter out cold-start and inactive users, thresholds based on user activity were applied, as shown in Table 2. Each dataset was randomly split into training and testing sets in a 9:1 ratio. Targeted items for shilling attacks were randomly selected, with a default attack size of approximately 1% of each dataset's real users. The victim RS models evaluated in our experiments include BPR [36], DGCF [37], DMF [38], GCMC [39], NCL [40], NeuMF [41], and NGCF [42]. These models have been widely adopted in both research and engineering for their effectiveness in various recommendation tasks. A brief summary of their key features is provided below. BPR introduces a maximum posterior estimator derived from Bayesian analysis for personalized ranking optimization, utilizing stochastic gradient descent with bootstrap sampling. DGCF enhances collaborative filtering by disentangling user intents within user-item interactions, thereby refining intent-aware interaction graphs and representations to achieve superior performance. DMF integrates a neural network architecture with a user-item matrix composed of explicit ratings and non-preference implicit feedback to learn a unified low-dimensional \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Users** & **Items** & **Ratings** & **Sparsity** & **Threshold** & **Attack Size** \\ \hline ML100K & 943 & 1682 & 100,000 & 93.70\% & 36 & 10 \\ FilmTrust & 780 & 721 & 28,799 & 94.88\% & 15 & 8 \\ Automotive & 2928 & 1835 & 20,473 & 99.62\% & 12 & 30 \\ Fashion & 749,232 & 186,189 & 883,636 & 99.99\% & 4 & 7500 \\ Book-crossing & 278,858 & 271,379 & 1,149,780 & 99.99\% & 10 & 2800 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Statistics, thresholds, and attack sizes of the datasets. space for user and item representations, utilizing a binary cross-entropy-based loss function for enhanced optimization. GCMC employs a graph auto-encoder framework with differentiable message passing on a bipartite user-item graph for matrix completion in recommender systems, effectively utilizing additional structured data such as social networks.