## 6 Experiment
### Results in the Black-Box Setting  
#### 6.3.1 Effectiveness of Poisoning Attack  
For each dataset, we randomly selected 50 active and 50 inactive users, fabricating their interaction records to form an evaluation user set (totaling 100 users) for assessing the effectiveness of the attack. We then calculated evaluation metrics based on the recommendation lists generated for each user in this set. The BPR recommendation algorithm was used to train on three datasets, with the experimental parameters set as in Section 6.2. Additionally, 30 spy users were created (15 simulating active users and 15 simulating inactive users) to receive feedback from the recommendation system for reward calculation. Table 6 shows the results of the poisoning attacks with different attack scales, including the proportion of fake users and the maximum sequence length of user behaviors. In the white-box settings, the three baseline methods still underperformed in the black-box setting; even when the proportion of fake users reached 10%, the best hit rate was only 0.07, significantly lower than the 0.16 hit rate of DRLAttack at 1% fake users. Across the three datasets, the DRLAttack method outperformed DRLAttack-DNN, achieving a hit rate up to three times better than DRLAttack-DNN, primarily due to the introduction of LSTM. While DRLAttack-White and DRLAttack-DNN also utilized some improvements, their lack of capability to process time series data restricted their performance. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Attack Method**} & \multicolumn{4}{c}{**Proportion of Fake Users**} & \multicolumn{4}{c}{**Maximum Interaction Sequence \(T\)**} \\ \cline{3-10}  & & **1\%** & **3\%** & **5\%** & **10\%** & **10** & **20** & **30** & **50** \\ \hline \multirow{6}{*}{ML-100K} & Random & 0.02 & 0.03 & 0.03 & 0.02 & 0.01 & 0.02 & 0.03 & 0.01 \\  & Random–Similarity & 0.03 & 0.06 & 0.07 & 0.07 & 0.03 & 0.03 & 0.06 & 0.05 \\  & Popular & 0.02 & 0.02 & 0.03 & 0.04 & 0.02 & 0.01 & 0.02 & 0.01 \\  & DRLAttack-White & 0.05 & 0.07 & 0.09 & 0.15 & 0.02 & 0.06 & 0.07 & 0.11 \\  & DRLAttack-DNN & 0.06 & 0.07 & 0.08 & 0.12 & 0.03 & 0.07 & 0.07 & 0.1 \\  & DRLAttack & **0.16** & **0.19** & **0.29** & **0.37** & **0.04** & **0.08** & **0.19** & **0.2** \\ \hline \multirow{6}{*}{ML-1M} & Random & 0.01 & 0 & 0.02 & 0.01 & 0.02 & 0.01 & 0 & 0.03 \\  & Random–Similarity & 0.03 & 0.04 & 0.05 & 0.07 & 0.03 & 0.05 & 0.04 & 0.04 \\  & Popular & 0.01 & 0.03 & 0.02 & 0.03 & 0.02 & 0.01 & 0.03 & 0.02 \\  & DRLAttack-White & 0.06 & 0.09 & 0.1 & 0.11 & 0.03 & 0.07 & 0.09 & 0.08 \\  & DRLAttack & 0.05 & 0.1 & 0.11 & 0.13 & 0.04 & 0.05 & 0.1 & 0.13 \\  & DRLAttack & **0.08** & **0.2** & **0.24** & **0.27** & **0.05** & **0.11** & **0.2** & **0.22** \\ \hline \multirow{6}{*}{Last.fm} & Random & 0.02 & 0.03 & 0.04 & 0.05 & 0.02 & 0.05 & 0.03 & 0.02 \\  & Random–Similarity & 0.03 & 0.06 & 0.08 & 0.12 & 0.06 & 0.08 & 0.06 & 0.07 \\ \cline{1-1}  & Popular & 0.01 & 0.03 & 0.07 & 0.06 & 0.01 & 0.01 & 0.03 & 0.03 \\ \cline{1-1}  & DRLAttack-White & 0.09 & 0.13 & 0.17 & 0.2 & 0.05 & 0.09 & 0.13 & 0.11 \\ \cline{1-1}  & DRLAttack-DNN & 0.08 & 0.11 & 0.14 & 0.19 & 0.07 & 0.08 & 0.14 & 0.14 \\ \cline{1-1}  & DRLAttack & **0.18** & **0.24** & **0.31** & **0.44** & **0.1** & **0.17** & **0.24** & **0.32** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: HR@10 for different attack methods at different attack sizes in Black-Box Setting.