## 3 Problem Definition  
For a normal user \(u\), a recommendation system generates a _top_-k recommendation list \(L_{u}=\{v_{1},v_{2},v_{3},v_{4},\cdots v_{k}\}\). This list represents the user's preference ranking for items, where the first element \(v_{1}\) indicates the item that user \(u\) is most likely to click on next. This paper focuses on designing attack methods for targeted attacks. Generally, by precisely manipulating the input training data, attackers can ensure that the target item appears in as many users' recommendation lists as possible, potentially achieving a higher ranking. The key action of the target attack consists of the following three steps:  
1. **Create fake user accounts:** These accounts are used to simulate the rating behaviors of real users by rating specific items and other items, thereby influencing the output of the recommendation system. Assume \(N\) represents the number of fake user accounts created by the attacker. Each fake account \(u_{i}\) will perform a series of actions aimed at elevating the recommendation ranking of a specific item. The creation of fake user accounts can be denoted as \(U_{fake}=\{u_{1},u_{2},\ldots,u_{N}\}\), where \(U_{fake}\) represents the collection of all fake user accounts. 2. **Rating item selection:** The primary goal is to manipulate the recommendation algorithm by having fake users rate a carefully selected set of items, thus ensuring the target item is recommended to more users. This process requires meticulous planning to ensure the attack activities are not easily detected by the system while maximizing the impact on the recommendation results. Our strategy in this step \begin{table}
\begin{tabular}{l l} \hline \hline
**The Type of Algorithm** & **The Limitations of Attack Methods** \\ \hline Neighborhood-based & Understanding rating data before attacking is easily detectable [12] \\  & Accessing rating data is resource-intensive [13] \\ \hline Association Rule-based & Easily detected by the system as label anomalies [14] \\  & Causes system instability and is easily identified as anomalous data [15] \\ \hline Graph-based & The added junk nodes are easily detectable and removable [16; 17] \\  & Critical nodes are hard to pinpoint and easily trigger system anomalies. [18] \\  & The computational complexity is high, and it demands substantial resources [19] \\ \hline Latent Factor Model-based & Collecting sample data on social networking sites is easily detectable [20; 21; 22; 23] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of attack methods and limitations for different collaborative filtering algorithms. begins with mixing the target item with ordinary items to simulate the interaction behavior of real users. Assume \(T\) is the maximum number of items each fake user interacts with. By mixing the target item set \(I_{f}\) with ordinary items, attackers can more effectively conceal their actions. These items are numbered as a sequence of behaviors \(\tau=\{v_{1},v_{2},\cdots,v_{T}\}\), and attackers adjust this sequence to ensure they can disrupt the true recommendation outcomes. 3. **Rating manipulation:** To further simulate the rating behavior of real users, attackers use different rating patterns on selected items. This means not only giving high scores to the target items but also assigning medium or low scores to some ordinary items, as well as incorporating implicit feedback (such as clicking or not clicking) to increase the diversity and credibility of the rating behavior. For each fake user \(u_{i}\in U_{fake}\) and item \(v_{j}\), rating manipulation can be represented through function \(F(u_{i},v_{j})\). Explicit rating manipulation can be represented as \(F(u_{i},v_{j})=s\), where \(s\) is the score assigned to item \(v_{j}\). Generally, \(s\in[1,5]\), for target items, tends to be higher scores, while for ordinary items, appropriate scores are chosen according to the manipulation strategy to simulate real user behavior. Implicit rating manipulation mainly relies on user-item interaction behaviors.