# DIFshilling: A Diffusion Model for Shilling Attacks
## 1 Introduction  
Recommender systems play a crucial role in recommending popular and personalized items to users, which successfully addresses the issue of information explosion. These systems effectively cater to user preferences and provide tailored recommendations. For instance, YouTube, one of the world's largest video platforms, leverages recommender systems [1] to offer users personalized video content. Recommender systems not onlyenhance user experiences but also increase merchants' profits. Notably, Netflix, an American subscription video streaming service, has a recommender system that accounts for approximately 80% of the total streaming hours, resulting in annual savings of over USD 1 billion [2]. Given the importance of RSs, there is a natural motivation for attackers to corrupt it in pursuit of profits [3]. Many efforts have been devoted to studying how to deceive RS for promoting (or demoting) the targeted item's ranking, such as unorganized malicious attacks (i.e., several attackers individually attack RS without an organizer) [4] and Sybil attacks (i.e., illegally infer a user's preference) [5]. Among these attacks, the **shilling attack** is a widely employed and persistent attack against recommender systems [6]. The shilling attack is also known as the data poisoning attack [7] or the profile injection attack [8]. It involves the injection of unscrupulous \"fake user profiles\" into the ratings database with the aim of manipulating the system's recommendations. For example, a random attack assigns random ratings to victim items selected arbitrarily in fake user profiles. Similarly, AUSH [9] utilizes specialized objective functions for generators and discriminators to generate fake user profiles. Understanding these attacks is crucial for improving defenses and ensuring the trustworthiness of RSs. However, these existing shilling attack models suffer from certain drawbacks. Existing shilling attack methods have notable drawbacks that hinder their effectiveness. One major limitation is the lack of attack invisibility, as many of these methods fail to consider personalization, resulting in the generation of fake user profiles that do not exhibit the behavioral characteristics of actual users in RS. Consequently, these fake users are easily detectable and filtered out before they can significantly impact the ranking of targeted items. Another drawback is the limited transferability of targeted models, as some kinds of shilling attacks are designed for specific RSs. For instance, average attacks and bandwagon attacks are more effective for user-based KNN recommendation algorithms in collaborative filtering but less effective for item-based KNNs [10]. Thus, these tailored attack methods cannot achieve satisfactory results in scenarios where the targeted RS are unavailable or differ in their underlying algorithms. To address the above challenges, we propose DIFshilling, a novel shilling attack method based on the diffusion model [11]. Originating in physics, the diffusion model has demonstrated great potential in image generation [12] when combined with neural networks. Leveraging the diffusion model's ability to fit actual data distributions accurately, DIFshilling generates fake user profiles that closely resemble real users. This approach enhances the invisibility of the shilling attack, making it challenging to identify and filter out fake user profiles. The training process of DIFshilling is independent of the specific RS but on the real user dataset, so it can enhance the transferability of the shilling attack for many different victimized RS. To ensure that the generated fake user profiles contain the features of real users and improve the stealthiness of the shilling attack, we add unique designs in DIFshilling. First, we filter out inactive real users and utilize their enriched characteristics as templates. Then, we gradually introduce Gaussian noise to the user-item interaction matrix at each step during the noising phase, resulting in a noised matrix.