## 7 Conclusions  
In this paper, we propose a deep reinforcement learning-based poisoning framework, DRLAttack. In the white-box setting, we optimize the action space via similarity measurement methods and integrate Dueling Networks into the DQN algorithm to significantly enhance its performance. By leveraging the RecBole library, DRLAttack can autonomously generate effective and stealthy fake user interaction data, enabling targeted promotion attacks. For the black-box setting, we enhance DRLAttack by incorporating spy users and an improved reward function that simulates normal user behavior. This allows us to obtain feedback from the recommendation system and adapt to its unpredictability. Moreover, the LSTM network enhances the stealthiness and effectiveness of data poisoning attacks by capturing long-term dependencies in user behaviors and dynamically adjusting attack strategies. Our experiments on real datasets demonstrate that DRLAttack can effectively manipulate recommendation results in both white-box and black-box settings, successfully pushing specific target items to the top of the recommendation list.  
Future research will continue to explore targeted promotion attacks on large datasets and improve attack strategies to effectively use limited resources. These efforts will pose a significant threat to recommendation systems. Additionally, studying the dynamic interaction between recommendation systems and attackers will be a key focus. We will  
\begin{table}
\begin{tabular}{l c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Attack Method**} & \multicolumn{3}{c}{**RDMA Method Not Deployed**} & \multicolumn{3}{c}{**Deploying the RDMA Method**} \\ \cline{3-10}  & & **20** & **30** & **50** & **70** & **20** & **30** & **50** & **70** \\ \hline \multirow{3}{*}{ML-100K} & DRLAttack-White & 0.05 & 0.07 & 0.15 & 0.17 & 0.05 & 0.06 & 0.08 & 0.09 \\  & DRLAttack-DNN & 0.05 & 0.07 & 0.14 & 0.15 & 0.03 & 0.06 & 0.1 & 0.11 \\  & DRLAttack & **0.09** & **0.19** & **0.29** & **0.34** & **0.07** & **0.18** & **0.11** & **0.15** \\ \hline \multirow{3}{*}{ML-1M} & DRLAttack-White & 0.03 & 0.04 & 0.06 & 0.08 & 0.01 & 0.03 & 0.04 & 0.05 \\  & DRLAttack-DNN & 0.05 & 0.05 & 0.06 & 0.09 & 0.03 & 0.03 & 0.02 & 0.07 \\ \cline{1-1}  & DRLAttack & **0.08** & **0.2** & **0.24** & **0.27** & **0.07** & **0.11** & **0.19** & **0.14** \\ \hline \hline \end{tabular}
\end{table}
Table 7: Attack effects before and after deployment of RDMA defense methods (number of spy users).  
Figure 6: Attack effects for different user ratios in two datasets.  
design defense mechanisms that can adapt in real time to changes in attack strategies, which will have practical application value in addressing more complex and diverse attack scenarios.  
Conceptualization, M.L. and Y.S.; methodology, M.L.; validation, J.F.; formal analysis, J.F.; writing--original draft preparation, J.F.; writing--review and editing, P.C.; visualization, P.C.; funding acquisition, M.L. and Y.S. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the National Natural Science Foundation of China (No. 62372126, 62372129, U2436208, U2468204, 62272119, 62072130), the Guangdong Basic and Applied Basic Research Foundation (No. 2023A1515030142), the Key Technologies R&D Program of Guangdong Province (No. 2024B0101010002), the Strategic Research and Consulting Project of the Chinese Academy of Engineering (No. 2023-JB-13), and the Project of Guangdong Key Laboratory of Industrial Control System Security (2024B1212020010).  
Not applicable.  
The data presented in this study are available on request from the corresponding author.  
The authors declare no conflicts of interest.