## 1 Introduction  
Recommendation systems are crucial in personalizing applications, combining user attributes and historical behavior data to predict and meet users' personalized preferences. As one of the core algorithms, collaborative filtering technology mines similarities between users by analyzing their historical interactions, thereby providing accurate personalized recommendations and enhancing user experience. Data poisoning attacks are one of the primary threats to recommendation systems [1, 2]. These attacks aim to subtly alter training data and typically occur during the initial phase of the machine learning life cycle (the training phase). During data collection, attackers can inject carefully crafted malicious data into clean datasets, thereby misleading the subsequent model training process [3]. Once the poisoned model is deployed, its outputs will be skewed according to the attacker's intentions, leading to recommendations that do not accurately reflect users' preferences. The openness of recommendation systems, where models are often trained on public data, creates opportunities for malicious actors. Additionally, the significant influence of these systems on online users provides incentives for such attacks [4]. Attackers can inject fake data into the training set through controlled fake user accounts, causing the model to behave abnormally and manipulate the scores and rankings of certain items [5]. The goal is to manipulate the scores and rankings of certain items, making them appear more or less aligned with the interests of typical users. This manipulation can result in these items being recommended more frequently or suppressed in users' recommendation lists, thereby influencing their visibility and promotion [6]. With ongoing updates and improvements to collaborative filtering recommendation algorithms by service providers, data poisoning attacks must continually adapt to face two significant challenges. First, the fake user interaction data generated by attackers often perform poorly and are easily detected. Previous studies have shown that attackers manually create fake data using heuristic methods [7; 8], typically following simple attack strategies. For instance, a common approach involves frequently clicking on the target item and a few popular items, which may mislead the recommendation system into associating the target item with those popular items. However, such simplistic rules often fail to achieve high attack success rates against complex recommendation systems. Second, attackers generally lack prior knowledge of the recommendation algorithms and models in use. Most service providers now keep users' recommendation lists private, visible only to the users themselves, which complicates the attackers' ability to execute informed attacks. Furthermore, the robust performance and complex structures of modern recommendation systems make it challenging for attackers to access specific model parameters, limiting their ability to conduct targeted and effective attacks. To address these challenges, we developed a deep reinforcement learning-based framework for poisoning attacks, named DRLATack. This framework utilizes a Deep Q-Network (DQN) and its variants, employing similarity measurement techniques to identify items similar to the target while designing novel action spaces and reward functions. Additionally, we integrated the Dueling Network architecture to enhance the optimization of the agent's attack strategies. By leveraging the RecBole recommendation system library, we enable DRLATack to autonomously generate high-quality fake user interaction data, allowing it to dynamically simulate real user behaviors for promotional attacks on target items. Furthermore, to address reward feedback in the black-box setting, we introduce spy users that mimic the behavior patterns of real users to indirectly gather information on the promotion status of target items. We refine the reward function to include a weighted sum of the target item's hit rate and its ranking position in the recommendation list.