## 6 Experiment
### Experimental Setup
#### 6.1.2 Baseline Attack Method  
We compared DRLAttack with various representative heuristic-based attack strategies, where each attacker injects \(N\) fake user into the target recommendation system. Different attacks utilize different strategies to select items for the fake users to interact with:  
**Random attack [34]:** The attacker creates a unique set of items for each fake user by mixing the target item with a series of randomly picked other items. During the attack, each fake user randomly selects an item from their assigned set for interaction, ensuring each selection is non-repetitive. The key to this method lies in its randomness, intended to simulate the unpredictability of ordinary user behavior.  
**Random-similarity attack:** This strategy combines the precision of similarity measurements with the unpredictability of random selection. The attack execution comprises three main steps: Initially, a set of items highly similar to the target item is identified from the original dataset using the Jaccard coefficient for implicit datasets or the cosine similarity method for explicit datasets. Subsequently, these similar items are combined with randomly selected ordinary items to form the final attack item set. Lastly, items are randomly chosen from this set for each fake user to interact with, thereby effectively simulating real user behavior patterns.  
**Popular attack [35]:** The attacker focuses on creating false associations between the target item and currently popular items. The popularity of an item in explicit datasets is generally represented by its average rating, and in implicit datasets by its interaction frequency. The _top_ n popular items are then combined with other ordinary items to form the attack item set, with items being randomly selected for interaction.  
In the black-box setting, adjustments are made to the reward function and the network structure of the DQN algorithm for the DRLAttack method. Therefore, we added two ablation methods based on the three baseline attack methods to serve as baseline comparison methods for the DRLAttack strategy in the black-box setting:  
**DRLAttack-White:** The reward function and the network structure of the DQN algorithm remain as they were designed for the white-box setting in Section 4. The reward function does not integrate information about the position of the target item in the recom  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Dataset** & **User** & **Item** & **Interaction** & **Density** \\ \hline ML-100K & 943 & 1682 & 100,000 & 93.70\% \\ ML-1M & 6040 & 3706 & 1,000,209 & 95.53\% \\ Last.fm & 1892 & 17,632 & 92,834 & 99.72\% \\ \hline \hline \end{tabular}
\end{table}
Table 2: Data poisoning attack experimental datasets.  
mendation list and does not incorporate LSTM to handle the sequence of interactions by the fake users.  
**DRLAttack-DNN:** Based on the DRLAttack method in the white-box setting, this version uses the improved reward function from this chapter, which combines the hit rate of the target item and its position information in the recommendation list. The DQN algorithm employs a deep neural network (DNN) as its network structure design.