Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation

Authors: kaike  zhang
qi  cao
yunfan  wu
fei  sun
huawei  shen
xueqi  cheng
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-13 04:37:29

Abstract: Adversarial Collaborative Filtering (ACF), which typically applies adversarial perturbations at user and item embeddings through adversarial training, is widely recognized as an effective strategy for enhancing the robustness of Collaborative Filtering (CF) recommender systems against poisoning attacks. Besides, numerous studies have empirically shown that ACF can also improve recommendation performance compared to traditional CF. Despite these empirical successes, the theoretical understanding of ACF's effectiveness in terms of both performance and robustness remains unclear. To bridge this gap, in this paper, we first theoretically show that ACF can achieve a lower recommendation error compared to traditional CF with the same training epochs in both clean and poisoned data contexts. Furthermore, by establishing bounds for reductions in recommendation error during ACF's optimization process, we find that applying personalized magnitudes of perturbation for different users based on their embedding scales can further improve ACF's effectiveness. Building on these theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF). Extensive experiments demonstrate that PamaCF effectively defends against various types of poisoning attacks while significantly enhancing recommendation performance.

Main paper: 
 introduction: 
 Collaborative Filtering (CF) is widely recognized as a powerful tool for providing personalized recommendations [1, 2, 3] across various domains [4, 5] . However, the inherent openness of recommender systems allows attackers to inject fake users into the training data, aiming to manipulate recommendations, also known as poisoning attacks [6, 7] . Such manipulations can skew the distribution of item exposure, degrading the overall quality of the recommender system, thus harming the user experience and hindering the long-term development of the recommender system [8] .Existing methods for defending against poisoning attacks in CF can be categorized into two types [8] : (1) detecting and mitigating the influence of fake users [9, 10, 11, 12, 13, 14] , and (2) developing robust models via adversarial training, also known as Adversarial Collaborative Filtering (ACF) [15, 16, 17, 18, 19, 20] . The first strategy focuses on detecting and removing fake users from the dataset before training [9, 10, 11, 14] or mitigating their impact during the training phase [12, 13] . These methods often rely on predefined assumptions about attacks [9, 12] or require labeled data related to attacks [10, 11, 12, 13] . Consequently, deviations from predefined attack patterns may lead to misclassification, failing to resist attacks while potentially harming genuine users' experience [13] .In contrast, ACF provides a more general defense paradigm without prior knowledge [15, 16, 17, 18, 19, 20] . Poisoning attacks in recommender systems mainly affect the learned embeddings of users and items, i.e., the system's parameters [6, 7] . Predominant ACF methods, particularly those aligned with Adversarial Personalized Ranking (APR) framework [15] , heuristically incorporate adversarial perturbations at the parameter level during the training phase to mitigate these attacks [15, 17, 19, 20] . This approach employs a "min-max" paradigm, designed to minimize the recommendation error while contending with parameter perturbations aimed at maximizing this error within a specified magnitude [15] , thus enhancing the robustness of CF.It is interesting to note that adversarial training in the Computer Vision (CV) domain [21, 22, 23] has been observed to degrade model performance on clean samples [24, 25] . Several studies have also theoretically demonstrated a trade-off between robustness against evasion attacks and the performance of adversarial training in CV [26] . In contrast, ACF in recommender systems has been shown in numerous studies not only to enhance the robustness against poisoning attacks [8, 13, 18] but also to improve recommendation performance [15, 20, 27] . Despite the empirical evidence highlighting ACF's advantages, it still lacks a comprehensive theoretical understanding, which limits the ability to fully exploit the benefits and potential of ACF. To bridge this gap, in this paper, we propose the following research questions for further investigation: i. Why does ACF enhance both robustness and performance compared to traditional CF?ii. How can we further improve ACF?To answer these questions, we delve into a theoretical analysis of a simplified CF scenario. This analysis confirms that ACF can achieve a lower recommendation error at the same training epoch in both clean and poisoned data contexts, showing better performance and robustness compared to traditional CF. To investigate potential improvements to ACF, we establish upper and lower bounds for reductions in recommendation error during ACF's optimization process. Our findings indicate that (1) Users have varying constraints for perturbation magnitudes, i.e., different maximum perturbation magnitudes; (2) Within these constraints, applying personalized perturbation magnitudes as much as possible for each user can increase the error reduction bounds, further improving ACF's effectiveness.Extending our theoretical results to practical CF scenarios, we establish a positive correlation between users' maximum perturbation magnitudes and their embedding scales. Building on these theoretical understandings, we introduce Personalalized Magnitude Adversarial Collaborative Filtering (PamaCF). PamaCF dynamically and personally assigns perturbation magnitudes based on users' embedding scales. Extensive experiments confirm that PamaCF outperforms baselines in both performance and robustness. Notably, PamaCF increases the average recommendation performance of the backbone model by 13.84% and reduces the average success ratio of attacks by 44.92% compared to the best baseline defense method. The main contributions of our study are summarized as follows:• We provide theoretical evidence that ACF can achieve better performance and robustness compared to traditional CF in both clean and poisoned data contexts.• We further identify upper and lower bounds of reduction in recommendation error for ACF during its optimization and demonstrate that applying personalized magnitudes of perturbation for each user can further improve ACF.• Based on the above theoretical understandings, we propose Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), with extensive experiments confirming that PamaCF further improves both performance and robustness compared to state-of-the-art defense methods.The code of our experiments is available at https://github.com/Kaike-Zhang/PamaCF.Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?Answer: [Yes] Justification: The abstract and introduction clearly articulate the primary contributions and scope of the paper. They accurately summarize the theoretical and experimental findings, explicitly matching the claims made throughout the document. 
preliminary: 
 Collaborative Filtering (CF) methods are widely employed in recommender systems. Following [1] , we define a set of users U = {u} and a set of items V = {v}. Using data from user-item interactions, our objective is to learn latent embeddings U = [u ∈ R d ] u∈U for users and V = [v ∈ R d ] v∈V for items. Then, we employ a preference function f : R d × R d → R, which predicts user-item preference scores, denoted as ru,v = f (u, v).Adversarial Collaborative Filtering (ACF) is acknowledged as an effective approach for enhancing both the performance and the robustness of CF recommender systems in the face of poisoning attacks. ACF methods, particularly within the framework of Adversarial Personalized Ranking (APR) [15] , integrate adversarial perturbations at the parameter level (i.e., the latent embeddings U and V ) during the training phase. Let L(Θ) denote the loss function of the CF recommender system, where Θ = (U , V ) represents the recommender system's parameters. ACF methods apply perturbations ∆ directly to the parameters as: L ACF (Θ) =L(Θ) + λL(Θ + ∆ adv ),where ∆ adv = arg maxEQUATIONwhere ϵ > 0 defines the maximum magnitude of perturbations, and λ is the adversarial training weight. Due to constraints on space, a detailed discussion of related works is provided in Appendix A.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes] Justification: The limitations of our work are discussed in Section 6.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
theoretical understanding of acf: 
 In this section, we provide a theoretical analysis of why ACF achieves superior performance and robustness compared to traditional CF from the perspective of recommendation error. Then, we explore mechanisms to further improve ACF's effectiveness based on its error reduction bounds. For clarity and simplicity, we initially focus on a Gaussian Single-item Recommender System, aligning with the frameworks presented in [18, 28] . It's important to note that the insights and analytical frameworks developed here are also applicable to more practical scenarios, as discussed in Section 4. Definition 1 (Gaussian Recommender System). Given a rating set R = {r 1 , r 2 , . . . , r n } corresponding to n users, where each rating r is randomly selected from {±1}, an average embedding vector ū ∈ R d , and σ > 0, the Gaussian Recommender System initializes each user's embedding u from the normal distribution N (r ū, σ 2 I). The item embedding v is initialized as the average vector derived from these users: (⟨v, u⟩) , where sgn(•) denotes the sign function, returning 1 if ⟨u, v⟩ > 0 and -1 otherwise.v = 1 n n i=1 r i u i . Then, a preference function f : R d × R d → {±1} is employed to predict user preferences: f (u, v) = sgnBased on Definition 1, we obtain I = {(u 1 , r 1 ), . . . , (u n , r n )}, where u represents the systemlearned user embedding. With continued training, both each user embedding u and item embedding v are iteratively updated. Let u (t) and v (t) denote user and item embeddings at the t th epoch, respectively. For analytical simplicity and without loss of generality, we define the standard loss function L(Θ) (as traditional CF) used in the Gaussian Recommender System as follows [18] :EQUATIONwhere the model parameters Θ (t) = v (t) , u 1,(t) , u 2,(t) , . . . , u n,(t) . To integrate ACF into the Gaussian Recommender System, we introduce the adversarial loss [15] , L adv (Θ), defined as:EQUATIONwhere λ is the adversarial training weight. The perturbations ∆ u and ∆ v are applied to the user and item embeddings, respectively, as computed based on Equation 1.To analyze the performance and robustness of traditional CF and ACF within the Gaussian Recommender System, we evaluate them from the perspective of recommendation error during the training process. For each user, both performance and robustness are reflected by the user's recommendation error. Specifically, attacks-whether item promotion attacks [6, 29] or performance damage attacks [8] -inevitably increase the user's recommendation error. Meanwhile, a smaller recommendation error means a higher recommendation performance. For a given user u, the initial item embedding v (0) in the Gaussian Recommender System can be approximately modeled 2 as a sample from N ( ū, σ 2 n-1 I). Here, we provide the definition of recommendation error for user u. 2 The precise form is N ( ū, (n-1)σ 2 n 2 I), but we make this approximation for the sake of clarity and brevity. The approximation does not impact the subsequent theoretical results.Definition 2 (Recommendation Error). Given a Gaussian Recommender System f (t) that has been trained for t epochs, the recommendation error for the user u with rating r at the t th epoch is defined as the probability that the system's prediction does not align with the user's actual rating, as:P v (0) ∼N ( ū, σ 2 n-1 I) f (t) (u, v) ̸ = r | (u, r) := E v (0) ∼N ( ū, σ 2 n-1 I) I f (t) (u, v) ̸ = r | (u, r), v (0), where I(•) is an indicator function that returns 1 if the condition is true and 0 otherwise.Based on the framework of ACF [15, 20] , which includes t epochs of pre-training with standard loss before adversarial training, we derive a theorem that identifies the difference in recommendation error between standard and adversarial loss at the (t + 1) th epoch. To distinguish between the recommendation error of traditional CF and ACF, we defineP v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) as the recommendation error following standard training (Equation 2) at the (t + 1) th epoch, and , and ∥ ū∥ ≫ σ3 , the recommendation error for a user u with rating r at the (t + 1) th epoch follows that:P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u,P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) > P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) .For the proof, please refer to Appendix D.1.1. After the same epochs of pre-training, ACF at the next epoch achieves a lower recommendation error compared to traditional CF, thereby benefiting recommendation performance.Next, our analysis extends to contexts where the recommender system is subject to poisoning attacks. These attacks involve injecting fake users into the system's training dataset to manipulate item exposure. We examine a Gaussian Recommender System with I = {(u 1 , r 1 ), . . . , (u n , r n )}, where each tuple (u, r) ∈ R d × {±1} represents the learned embedding and the rating of a genuine user. A poisoning attack on this system injects a poisoning user set,I ′ = {(u ′ 1 , r ′ 1 ), (u ′ 2 , r ′ 2 ), . . . , (u ′ n ′ , r ′ n ′ )}, with each tuple (u ′ , r ′ ) ∈ R d × {±1}representing a fake user crafted by attackers 4 . The poisoned item embedding v ′ is reinitialized to include both genuine and malicious contributions:v ′ = 1 n + n ′   (u,r)∈I ru + (u ′ ,r ′ )∈I ′ r ′ u ′   ,where n and n ′ represent the number of genuine and fake users, respectively.To evaluate the impact of these attacks, we introduce a formal definition of recommendation error in poisoned data. Definition 3 (α-Poisoned Recommendation Error). Given a boundary α > 0, and a set of fake users injected by attackers within this boundary, i.e.,I ′ ⊆ P(u ′ , α) = {(u ′ , r ′ ) | (u ′ , r ′ ) ∈ R d × {±1} ∧ ∥u ′ ∥ ∞ ≤α}, the α-poisoned recommendation error for the genuine user u with rating r at the t th epoch is defined as the probability:P v (0) ∼N ( ū, σ 2 n-1 I) f (t),α (u, v ′ ) ̸ = r | (u, r) := E v (0) ∼N ( ū, σ 2 n-1 I) I f (t),α (u, v ′ ) ̸ = r | (u, r), v (0), where f (t),α represents the Gaussian Recommender System under the α-poisoned condition, and I(•) is an indicator function that returns 1 if the condition is true and 0 otherwise.For simplicity, we continue using the distribution of v (0) from the definition. This allows us to further analyze the α-poisoned recommendation error based on the distribution of v ′(0) = n n+n ′ v (0) + 1 n+n ′ (u ′ ,r ′ )∈I ′ r ′ u ′ .Then we extend Theorem 1 to α-Poisoned Recommendation Error in the following theorem: Theorem 2. Consider a poisoned Gaussian Recommender System f (t),α , pre-trained for t epochs using the standard loss function (Equation 2). Given a learning rate η, an adversarial training weight λ, and a perturbation magnitude ϵ, when ϵ < min(∥u (t) ∥,∥ ū∥) ηλ, and ∥ ū∥ ≫ σ, the α-poisoned recommendation error for a genuine user u with rating r at the (t + 1) th epoch follows that:P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1),α (u, v ′ ) ̸ = r | (u, r) > P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1),α (u, v ′ ) ̸ = r | (u, r) .For the proof, please refer to Appendix D.1.2. Combining Theorem 1 and Theorem 2, we find that adversarial training, i.e., ACF, lowers recommendation errors compared to traditional CF in both clean and poisoned data contexts. Accordingly, ACF achieves better performance and robustness.To explore mechanisms to further improve the effectiveness of ACF, we subsequently derive upper and lower bounds on the reduction of recommendation error between any two consecutive epochs after t epochs of pre-training. Theorem 3. Consider a Gaussian Recommender System f (t) which has been pre-trained for t epochs using standard loss (Equation 2) and subsequently trained on adversarial loss (Equation 3). For the (t + k + 1) th epoch, let the reduction in recommendation error of user u with rating r relative to the (t + k) th epoch from adversarial loss be denoted by:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] = P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+k) (u, v) ̸ = r | (u, r) -P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+k+1) (u, v) ̸ = r | (u, r) .Given a learning rate η, an adversarial training weight λ, and a perturbation magnitude ϵ, when ϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ, and ∥ ū∥ ≫ σ, it follows that:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] ≥ Φ √ n -1 σ ∥ ū∥ + η(∥ ū∥ 2 + dσ 2 n -1 )Ψ(u, t + k) -Φ √ n -1 σ ∥ ū∥ , ∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] ≤ 2Φ √ n -1η 2σ (∥ ū∥ 2 + dσ 2 n -1 )Ψ(u, t + k) -1,where d is the embedding dimension, and Φ(•) denotes the cumulative distribution function (CDF) of the standard Gaussian distribution, and Ψ(u, t + k) is defined as:Ψ(u, t + k) = (1 + λ)γ u (t+k) C t+k ∥u (t+k) ∥, where γ uEQUATIONwhere C t+k is a constant at the (t + k) th epoch.For the proof, please refer to Appendix D.2.1. In light of Theorem 3, given a learning rate η and an adversarial training weight λ, we can establish the following: (1) When the conditions, i.e., ϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ and ∥ ū∥ ≫ σ, are satisfied, the error reduction for ACF can be both upper and lower bounded. (2) Increasing the perturbation magnitude ϵ under the above conditions can further improve these bounds, thus benefiting ACF's effectiveness.Then, similarly, we extend Theorem 3 to the α-poisoned context. Theorem 4. Consider a poisoned Gaussian Recommender System f (t),α which has been pre-trained for t epochs using standard loss (Equation 2) and subsequently trained on adversarial loss (Equation 3). For the (t + k + 1) th epoch, let the reduction in α-poisoned recommendation error of a genuine user u with rating r relative to the (t + k) th epoch from adversarial loss be denoted by ∆ adv (t+k+1) P advv (0) ∼N ( ū, σ 2 n-1 I) [f α (u, v ′ ) ̸ = r | (u, r)]. Let β = n ′ n √ dα + ∥ ū∥ and τ = 2nn ′ α∥ ū∥ 0 ,where d is the embedding dimension, and given a learning rate η, an adversarial training weight λ, and a perturbation magnitude ϵ, when ϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ, and ∥ ū∥ ≫ σ, it follows that:EQUATIONn 2 ∥ ū∥ 2 + (n ′ ) 2 dα 2 + τ n(n + n ′ ) + ndσ 2 (n -1)(n + n ′ ) Ψ(u, t + k) -1,where Φ() denotes the cumulative distribution function (CDF) of the standard Gaussian distribution, n ′ is the number of fake users, and Ψ(•) is defined in Equation 4.For the proof, please refer to Appendix D.2.2. From Theorem 4, we understand that increasing Ψ(u, t+k) can further improve both the upper and lower bounds of error reduction, thereby mitigating the negative impact of poisons. Specifically, this involves the same mechanism as in the clean data context: increasing the perturbation magnitude ϵ within ϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ .In conclusion, the theorems in this section indicate that for each user u, when the user's perturbation magnitude meets ϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ, we have the following: (1) ACF is theoretically shown to be more effective than traditional CF, and (2) Increasing the user's perturbation magnitude during training as much as possible can further improve both the performance and robustness of ACF. These theoretical understandings can further benefit exploring and fully unleashing the potential of ACF.Figure 1 : NDCG@20 across various perturbation magnitudes for five users (subject to Random Attacks [30] ).To extend theoretical understandings from the simple CF scenario to more practical scenarios, such as multi-item recommendations with Bayesian Personalized Ranking (BPR) [31] , which is a mainstream loss function used in CF recommendations, we first conduct a preliminary experiment shown in Figure 1 . Using Matrix Factorization [2] on the Gowalla dataset [32] , we observe results similar to those in Theorem 3 and Theorem 4: NDCG@20 for users improves within their maximum magnitudes, i.e., constraints, but significantly declines once these constraints are surpassed. Based on the theoretical understandings provided in Section 3, we derive the following corollary to identify the maximum perturbation magnitude for each user in practical CF scenarios. Corollary 1. Given any dot-product-based loss function L(Θ), within the framework of Adversarial Collaborative Filtering as defined in Equation 1, the maximum perturbation magnitude ϵ (u) (t),max for user u at the t th epoch is positively related to ∥u (t) ∥.For the proof of Corollary 1, please refer to Appendix D.3. According to Corollary 1, we observe that for a user u, the larger ∥u∥, the greater the maximum perturbation magnitude. Considering that maximum perturbation magnitudes will be affected by other factors in the actual training process, to ensure training stability, we decompose ϵ (u) (t),max for a user u at epoch t into two components: the uniform perturbation magnitude ρ, applicable to all users, and a user-specific perturbation coefficient c(u, t), expressed as:EQUATIONAccording to Corollary 1, c(u, t) provides coefficients positively related to users' embedding scales.To avoid training instability caused by extreme scale values, we map c(u, t) into the interval (0, 1), defined by:c(u, t) = sig ∥u (t) ∥ -∥u (t) ∥ ∥u (t) ∥ ,where ∥u (t) ∥ represents the average norm of all user embeddings at epoch t, and sig(•) denotes the sigmoid function. Consequently, the loss function for our method, Personalized Magnitude Adversarial Collaborative Filtering (PamaCF), is defined as:L PamaCF (Θ) =L(Θ) + λL(Θ + ∆ PamaCF ),where ∆ PamaCF = arg maxEQUATIONwhere λ is the weight of adversarial training, ρ represents the uniform perturbation magnitude for all users, and ∆ u is the perturbation relative to user u. To maximize the perturbation magnitude for each user within ρc(u, t), we use the perturbation along the gradient direction of the user's adversarial loss with a step length of ρc(u, t) as ∆ u . The specific algorithm process is detailed in Appendix B.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes] Justification: The experimental code and data are provided through an anonymous link in Section 1.Guidelines:• The answer NA means that paper does not include experiments requiring code. Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiments: 
 In this section, we conduct extensive experiments to address the following research questions (RQs):• RQ1: Can PamaCF further improve the performance and robustness of traditional ACF?• RQ2: Why does PamaCF perform better than traditional ACF?• RQ3: How do hyper-parameters affect PamaCF?In this section, we briefly introduce the experimental settings. For detailed information, including dataset preprocessing, comprehensive baseline descriptions, and implementation details, please refer to Appendix C.1.Datasets. We employ three common benchmarks: the Gowalla check-in dataset [32] , the Yelp2018 business dataset, and the MIND news recommendation dataset [33] .Attack Methods. We employ both heuristic (Random Attack [30] , Bandwagon Attack [34] ) and optimization-based (Rev Attack [7] , DP Attack [6] ) attack methods within a black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.Defense Baselines. We incorporate a variety of defense methods, including detection-based approaches (GraphRfi [12] and LLM4Dec [13] ), adversarial collaborative filtering methods (APR [15] and SharpCF [20] ), and a denoise-based strategy (StDenoise [35, 19] ). In our study, we employ three common backbone recommendation models, Matrix Factorization (MF) [2] , LightGCN [3] , and NeurMF [36] .Evaluation Metrics. The primary metrics for assessing recommendation performance are the top-k metrics: Recall@k and NDCG@k, as documented in [3, 8, 37] . To quantify the success ratio of attacks, we utilize T-HR@k and T-NDCG@k to measure the performance of target items within the top-k recommendations [7, 6, 13] , as:EQUATION)where T is the set of target items, U tar denotes the set of genuine users who have interacted with target items tar , L u,1:k represents the top-k list of recommendations for user u, and I(•) is the indicator function that returns 1 if the condition is true. The T-NDCG@k mirrors T-HR@k, serving as the target item-specific version of NDCG@k.In this section, we answer RQ1. We focus on two key aspects: the recommendation performance and the robustness against poisoning attacks. Recommendation Performance. We assess the efficacy of PamaCF in both clean and poisoning data contexts, focusing on the performance of recommender systems, as presented in Table 1 . The denoise-based defense method, which does not directly defend against poisoning attacks but rather purifies noisy interactions, fails to improve recommendation performance in most cases. Detectionbased methods, such as GraphRfi and LLM4Dec, exhibit some misclassifications of fake and genuine users, leading to a decline in recommendation performance.In contrast, we observe a notable enhancement in recommendation quality when ACF methods (APR, SharpCF, and PamaCF) are utilized. This finding is consistent with results from previous studies [15, 20] and aligns with our prior theoretical analysis. Among the defense methods, PamaCF stands out, achieving the most significant improvements in recommendation performance compared to the backbone model and other baseline approaches. Specifically, PamaCF increases Recall@20 and NDCG@20 by 13.84% and 22.04% in average, respectively, compared to the backbone model.Robustness Against Poisoning Attacks. We evaluate the capability of PamaCF in defending against poisoning attacks by examining the attack success ratio. Our experiments specifically target items with notably low popularity, as indicated by T-HR@50 and T-NDCG@50 scores of 0.0 when no attacks are present. Lower scores for T-HR@50 and T-NDCG@50 indicate stronger defense capabilities.Table 2 presents the results, indicating that the purely denoise-based defense method is generally ineffective against most attacks and may even increase the attack's success ratio in some instances. Additionally, PamaCF's defense effectiveness against attacks targeting popular items is further evaluated. The corresponding results for LightGCN [3] and NeuMF [36] , along with the recommendation performance at top-10, are also presented. All supplementary results are in Appendix C.2.In this section, we address RQ2 by exploring why PamaCF can outperform traditional ACF (especially APR [15] ) through embedding visualization and perturbation magnitude comparison.Embedding Visualization. We randomly select a user and project the normalized embeddings of the user, real preference items, the target item given by attacks, and other items in the user's top-10 recommendation list into a two-dimensional space using T-SNE [38] , as shown in Figure 2 (a). We observe that PamaCF can bring real preference items closer, reducing the distance from the farthest real preference item from 0.736 to 0.365, while leading the target item farther away from all the real preference items. PamaCF's personalized perturbation magnitude lowers the ranking of both the target item and other items, thus improving robustness and performance.Perturbation Magnitude Comparison. We compare the maximum perturbation magnitudes of APR and PamaCF, i.e., ϵ in Equation 1for APR and ρ in Equation 6for PamaCF. Both ϵ and ρ are selected through hyper-parameter tuning from {0.1, 0.2, . . . , 1.0}. In the left part of Figure 2 (b), we observe that PamaCF finds a higher perturbation magnitude. Additionally, the right portion of Figure 2 (b) illustrates the distribution of personalized perturbation magnitudes across all users. These varying magnitudes for different users contribute to the improved effectiveness of PamaCF.In this section, we answer RQ3 by exploring the effects of the hyperparameters, magnitude ρ and adversarial training weight λ, as defined in Equation 6. The results are illustrated in Figure 3 .Analysis of Hyper-Parameters ρ. With λ fixed at 1.0, we vary ρ from 0.1 to 1.0 in increments of 0.1. Our findings demonstrate a significant improvement in both robustness and performance as ρ increases. Notably, even when ρ exceeds 0.1, there is an enhancement in recommendation performance compared to that of the backbone model, i.e., MF, with the range between 0.7 and 0.9 yielding the most significant enhancements.Analysis of Hyper-Parameters λ. With ρ set at 0.9, we adjust λ from 0.2 to 2.0 in increments of 0.2. The analysis indicates that the defensive ability becomes stable once λ surpasses 1.0 in most attacks. However, setting λ too high gradually diminishes the recommendation performance of PamaCF. Despite this, the performance of PamaCF remains considerably improved compared to MF. 
conclusion: 
 In this work, we theoretically analyze why Adversarial Collaborative Filtering (ACF) enhances both the performance and robustness of Collaborative Filtering (CF) systems against poisoning attacks. Additionally, by establishing bounds for reductions in recommendation error during ACF's optimization process, we discover that applying personalized perturbation magnitudes for users based on their embedding scales can significantly improve ACF's effectiveness. Leveraging these theoretical understandings, we introduce Personalized Magnitude Adversarial Collaborative Filtering (PamaCF).Comprehensive experiments confirm that PamaCF effectively defends against various attacks and significantly enhances the quality of recommendations.Limitations. Our study identifies several limitations that require further investigation. Firstly, our theoretical analysis is based on certain assumptions, specifically with the Gaussian Recommender System. We intend to relax these assumptions in future work. Secondly, this study only examines adversarial training within CF recommendations. In future research, we plan to extend our analysis to include more recommendation scenarios, such as sequential recommendations.Broader Impacts. Our work focuses on enhancing both the performance and robustness of recommender systems against poisoning attacks, thereby benefiting the overall development of recommender systems. We do not foresee any negative impacts resulting from our work.A Related Work 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes]Justification: The results presented in Section 5 include error bars. The method for calculating these error bars is explained in the implementation details provided in Appendix C.1.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.• The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We provide sufficient information on the computer resources in Appendix C.1.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes]Justification: The robust recommendation algorithm has a positive impact on the field of recommender systems. The impact is discussed in Section 6.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The paper poses no such risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: The original papers that produced the code package or dataset are cited in both Section 5 and Appendix C.1.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.• If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 13. New Assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [Yes] Justification: We provide the code via both an anonymized URL (in Section 1) and an anonymized zip file. Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Collaborative Filtering (CF) has become a cornerstone of modern recommender systems, evidenced by its widespread application in various studies [3, 39, 40] . The fundamental premise of CF is that users with similar preferences are likely to exhibit similar behaviors, which can be leveraged to predict future recommendations [41] . A principal approach within CF is Matrix Factorization, which learns latent embeddings of users and items by decomposing the observed interaction matrix [2] .With the advent of deep learning, neural CF models have emerged, designed to capture more complex patterns in user preferences. For example, CDL [42] merges auxiliary item information through neural networks into CF, addressing challenges associated with data sparsity. Additionally, NCF [36] replaces the traditional dot product with a neural network, enhancing the modeling of user-item interactions. More recently, Graph Neural Networks have prompted the development of graphbased CF models, such as NGCF [37] and LightGCN [3] , which have shown remarkable efficacy in recommender systems. However, despite these technological advances, susceptibility to poisoning attacks remains a significant challenge, compromising the robustness of these systems [8] .Poisoning attacks within recommender systems involve injecting fake users into the training data to manipulate the exposure of certain items. Initial research predominantly focused on rule-based heuristic attacks, where profiles for these fake users were constructed using predetermined heuristic rules [30, 34, 43, 44] . For example, the Random Attack [30] generated fake users interacting with targeted items alongside a random selection of other items. In contrast, the Bandwagon Attack [34] generated fake user interactions to include targeted items and others selected for their high popularity.As the technique of attacks has evolved, recent studies have shifted towards optimization-based methods for generating fake users [7, 6, 29, 45, 46, 47, 48, 49, 50, 51, 52] . For instance, the Rev Attack [7] formalizes the attack as a bi-level optimization problem, addressed using gradient-based techniques. Similarly, the DP Attack [6] specifically targets deep learning-based recommender systems.Mainstream strategies for enhancing the robustness of CF systems against poisoning attacks broadly categorize into two main approaches [8] : (1) detecting and removing fake users [9, 10, 11, 12, 13, 14, 53] , and (2) developing robust models via adversarial training, i.e., Adversarial Collaborative Filtering (ACF) [15, 16, 17, 18, 19, 20, 27] .Detection-based strategies focus either on pre-identifying and removing potential fake users from the dataset [9, 10, 11, 14] or on mitigating their influence during the training phase [12, 13] . These methods often rely on specific assumptions about the attacks [9, 12] or require supervised data regarding attacks [10, 11, 12, 13] . Among these, LoRec [13] utilizes large language models to enhance sequential recommendations, overcoming the limitations associated with specific knowledge in detection-based strategies. However, its scope is limited to sequential recommender systems and may not generalize well across different CF scenarios.Conversely, ACF methodologies, particularly those aligned with the Adversarial Personalized Ranking (APR) framework [15] , integrate adversarial perturbations at the parameter level (i.e., user and item embeddings) during the model training process [15, 17, 19, 20] . This approach follows a "minmax" optimization paradigm, designed to minimize the error in recommendations under parameter perturbations which aim to maximize the error [13] . Besides, numerous studies have demonstrated that ACF not only enhances the model's robustness but also improves its recommendation performance [15, 20, 27] . Nonetheless, despite its benefits in specific contexts through empirical validation, the intrinsic mechanisms of ACF's effectiveness and its universal applicability remain areas for further theoretical exploration. Compute L PamaCF ((u, i, j)|Θ) using Equation 9.end for 8:Update Θ using the aggregated gradients from L PamaCF (Θ) in the batch. 9: end while10: return Θ = [U , V ]For clarity, we present the PamaCF version of the widely used Bayesian Personalized Ranking (BPR) [31] loss function, which optimizes recommender models towards personalized ranking. Given the user set U = {u}, the item set V = {v}, and the training setD = {(u, i, j) | u ∈ U ∧ i ∈ V u ∧ j ∈ V \ V u }, where V u denotes the set of items with which user u has interacted. The objective function (to be minimized) of BPR is formally given by:EQUATIONwhere U and V represent the learned user and item embeddings, respectively.The PamaCF version of the BPR loss function is defined as:L PamaCF (Θ) =L BPR (Θ) + λL BPR (Θ + ∆ PamaCF ),where ∆ PamaCF = arg max ∆, ∥∆ u/i/j ∥≤ρ•c(u,t),(u,i,j)∈DL BPR (Θ + ∆),where λ is the weight of adversarial training, ρ represents the uniform perturbation magnitude for all users, andc(u, t) = sig ∥u (t) ∥ -∥u (t) ∥ ∥u (t) ∥ .The specific handling of a pair (u, i, j) ∈ D is expressed by:EQUATIONwhereEQUATION)The procedure of training with PamaCF is illustrated in Algorithm 1.C.1 Supplements to Experimental Settings Datasets. We employ three common benchmarks: the Gowalla check-in dataset [32] , the Yelp2018 business dataset, and the MIND news recommendation dataset [33] . The Gowalla and Yelp2018 datasets include interactions from all users. For the MIND dataset, we sample a subset of users following [13] . Following [3, 37] , users and items with fewer than 10 interactions are excluded from our analysis. We allocate 80% of each user's historical interactions to the training set and the remainder for testing. Additionally, 10% of the interactions from the training set are randomly selected to form a validation set for hyperparameter tuning. Detailed statistics of the datasets are summarized in Table 3 .Attack Methods. We explore both heuristic (Random Attack [30] , Bandwagon Attack [34] ) and optimization-based (Rev Attack [7] , DP Attack [6] ) attack methods within a black-box context, where the attacker does not have access to the internal architecture or parameters of the target model.• Random Attack (Heuristic Method) [30] : This method entails fake users including interactions with both the targeted items and a set of randomly chosen items.• Bandwagon Attack (Heuristic Method) [34] : Fake users' interactions encompass the targeted items and those selected for their high popularity.• DP Attack (Optimization-based Method) [6] : This approach is specifically designed to compromise deep learning-based recommender systems.• Rev Attack (Optimization-based Method) [7] : The attack is conceptualized as a bi-level optimization problem, addressed through gradient-based methods.Defense Baselines. We incorporate a variety of defense methods, including detection-based approaches (GraphRfi [12] and LLM4Dec [13] ), adversarial collaborative filtering methods (APR [15] and SharpCF [20] ), and a denoise-based strategy (StDenoise [35, 19] ). In our study, we employ three common backbone recommendation models, MF [2] , LightGCN [3] , and NeurMF [36] .• GraphRfi [12] : Employs a combination of Graph Convolutional Networks and Neural Random Forests for identifying fake users.• LLM4Dec [13] : Utilizes an LLM-based framework for fake users detection.• APR [15] : Generates parameter perturbations and integrates these perturbations into training.• SharpCF [20] : Adopts a sharpness-aware minimization approach to refine the adversarial training process proposed by APR.• StDenoise [35, 19] : Applies a structural denoising technique that leverages the similarity between U u and V i for each (u, i) pair, aiding in the removal of noise, as described in [35, 19] .Note that: With the need of item-side information, LLM4Dec is exclusively evaluated on the MIND dataset. Moreover, we observe that SharpCF, initially proposed for the MF model, exhibits unstable training performance when applied to the LightGCN model or the MIND dataset. Consequently, we present SharpCF results solely for the MF model on the Gowalla and Yelp2018 datasets.Implementation Details. In our study, we employ three common backbone recommendation models, Matrix Factorization (MF) [2] , LightGCN [3] , and NeurMF [36] . To quantify the success ratio of attacks, we select k = 50 as the evaluation metric following [6, 7, 18] , while for assessing recommendation performance, we utilize k = 10, 20 following [3, 37] . For each attack setting, we conduct experiments five times, taking the average value as the result and the standard deviation as the error bar. The configuration of both the defense methods and the recommendation models involves selecting a learning rate from {0.1, 0.01, . . . , 1 × 10 -5 }, and a weight decay from {0, 0.1, . . . , 1 × 10 -5 }. The implementation of GraphRfi follows its paper. For the detection-based methods, we employ the Random Attack to generate supervised attack data. The magnitude parameter of adversarial perturbations in both APR and PamaCF is determined from a range of {0.1, 0.2, . . . , 1.0}. In terms of attack methods, we set the attack budget to 1% and target five specific items. The hyperparameters align with those detailed in their original publications. 7); T-HR@50 and T-NDCG@50 of all target items on clean datasets are 0.000. 2 The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics, i.e., (min (T-HRBeslines) -T-HRVAT) / min(T-HRBeslines).Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data. 3 The Rev attack method could not be executed on the dataset due to memory constraints, resulting in an out-of-memory error.Compute Resources. The experiments are conducted using two primary GPU: the RTX 4090 with 24GB of VRAM and the A800 with 80GB of VRAM. For most baseline defense methods applied across all datasets, a single RTX 4090 GPU suffices, requiring several hours per experiment. However, the LLM4Dec method [13] demands an A800 GPU due to its higher resource requirements for processing Large Language Models. In terms of attack generation, heuristic poisoning attacks such as the Random Attack [30] and Bandwagon Attack [34] are generated within seconds and do not require specific GPU resources. Conversely, the time required to generate optimization-based poisoning attacks, such as the DP Attack [6] and Rev Attack [7] , depends on the dataset. For the Gowalla and Yelp datasets, these attacks take hours to execute on an A800 GPU. The DP Attack on the MIND dataset extends to several days, also utilizing an A800 GPU. However, the Rev Attack cannot be completed on a single A800 GPU due to its even greater computational demands.We assess PamaCF's defense capabilities against attacks targeting popular items on Gowalla. According to Figure 4 , PamaCF exhibits strong defensibility, outperforming the best baseline even when attacks specifically promote popular items.We also evaluate PamaCF's defense capabilities and recommendation performance when applied to LightGCN [3] and NeurMF [36] , as shown in Table 4 and Table 5 , which produces consistent results with MF [2] .Additionally, we report PamaCF's recommendation performance on MF for the Gowalla dataset, specifically for k = 10, using Recall@10 and NDCG@10. PamaCF demonstrates significantly greater improvement at k = 10, achieving a 29.59% increase in Recall and a 56.41% increase in NDCG, relative to the baseline model, as shown in Table 6 . Recall@10 NDCG@10 Recall@10 NDCG@10 Recall@10 NDCG@10 Recall@10 NDCG@10 Recall@10 NDCG@10 MF D.1 Proofs for Section 3.1To investigate the recommendation error of each user during the training period, we first analyze how the item embeddings change. We discover a transformation function that accurately measures the change in the item embedding from its initial state to its state after a certain number of training epochs. This insight is formally expressed in the following proposition.Proposition 1. Consider a Gaussian Recommender System f (t) , undergoing training for t epochs using the standard loss function specified in Equation 2. Given a learning rate η, there exists a function M (t, η) : N + × R + → R + that quantify the transformation of the item embedding due to training. Specifically, we have:v (t) = M (t, η)v (0) ,where v (0) denotes the initial item embedding and v (t) represents the item embedding after t epochs of training.Proof of Proposition 1. Consider the training process of the Gaussian Recommender System f (t) over t epochs, with each update through the standard loss outlined in Equation 2. The update mechanism for user and item embeddings at the t th epoch can be described as follows:EQUATION)Considering the sum (u,r) ru (t-1) , we have:(u,r) ru (t-1) = (u,r) ru (t-2) + ηr 2 v (t-2) = (u,r) ru (t-3) + η v (t-2) + v (t-3) • • • = (u,r)   ru (0) + η t-2 j=0 v (j)   =nv (0) + nη t-2 j=0 v (j) ,where n is the number of users. This leads to the recursive update for v (t) :v (t) =v (t-1) + nηv (0) + nη 2 t-2 j=0 v (j) =(1 + nη 2 )v (t-2) + 2nηv (0) + 2nη 2 t-3 j=0 v (j) =(1 + nη 2 + 2nη 2 )v (t-3) + nη • (1 + nη 2 ) + 2nη v (0) + nη 2 • (1 + nη 2 ) + 2nη 2 t-4 j=0 v (j) .To simplify, we introduce a(k), b(k) and c(k) to represent the cumulative scaling factors as:EQUATION)yielding a general form for v (t) :v (t) =a(k)v (t-k) + b(k)v (0) + c(k) t-k-1 j=0 v (j) =a(t -1)v (1) + b(t -1)v (0) + c(t -1)v (0) . Based on v (1) = v (0) + η (u,r)∈I ru (0) = (1 + nη)v (0) , let M (t, η) : N + × R + → R +be the transformation function related to training epochs t and learning rate η, which is defined as:M (t, η) = 1 + nη t = 1 (1 + nη)a(t -1) + b(t -1) + c(t -1) t > 1 .Then we can get:v (t) = M (t, η)v (0) .This proves that the item embedding v (t) after t epochs of training is a scaled version of the initial embedding v (0) , with the scaling factor M (t, η) being a function of the number of epochs t and the learning rate η.Fact 1. Let ε ∈ R d be drawn from N (0, σ 2 I), with σ > 0. Let w ∈ R d represent any unit vector. Then, ⟨ε, w⟩ follows a normal distribution N (0, σ 2 ).Proof of Fact 1.Consider ε = [ε 1 , . . . , ε d ], with each ε i following N (0, σ 2 ). Let w = [w 1 , . . . , w d ], satisfying w 2 1 + • • • + w 2 d = 1.Then ⟨ε, w⟩ is distributed as N (E[⟨ε, w⟩], D[⟨ε, w⟩]), where:E[⟨ε, w⟩] = E[ε 1 w 1 + • • • + ε d w d ] = 0, D[⟨ε, w⟩] = D[ε 1 w 1 + • • • + ε d w d ] = D[ε 1 w 1 ] + • • • + D[ε d w d ] = (w 2 1 + • • • + w 2 d )σ 2 = σ 2 .Hence, Fact 1 is proved.Proof of Theorem 1. By invoking Proposition 1, we establish the basis for evaluating the impact of training on the recommendation error at the (t + 1) th epoch. Proposition 1 specifies the scaling relationship between the initial and trained item embeddings, leading to the following update expressions for user and item embeddings. For the standard loss though Equation 2, we have:u (t+1) = u (t) + ηrM (t, η)v (0) , v (t+1) = M (t + 1, η)v (0) .Considering the above update rules, the recommendation error at the (t + 1) th epoch is given by:EQUATION)For adversarial loss as detailed by Equation 1, we have:∆ adv = arg max ∆,∥∆∥≤ϵ L(Θ + ∆).According to the first-order Taylor expansion, we have:∆ adv ≈ arg max ∆,∥∆∥≤ϵ L(Θ) + ⟨∆, ∇ Θ L(Θ)⟩ = arg max ∆,∥∆∥≤ϵ ⟨∆, ∇ Θ L(Θ)⟩ =ϵ ∇ Θ L(Θ) ∥∇ Θ L(Θ)∥ ,leading to specific perturbations ∆ u and ∆ v in Equation 3:EQUATIONSubsequently, the updated embeddings through adversarial loss are expressed as:EQUATIONGiven ∥ ū∥ ≫ σ, we can approximate ∥v (0) ∥ with E[∥v (0) ∥]. Given ϵ < min(∥u (t) ∥,∥ ū∥) ηλ, according to the expansion of M (t, η) in Proposition 1, it follows thatM (t, η) + nη(1 + λ) 1 + η + η t-1 j=1 M (j, η) -nηλϵ ∥v (0) ∥ > 0.Considering these update rules, the recommendation error at the (t + 1) th epoch is determined by:EQUATION(t) = 1 -ηλϵ ∥u (t) ∥ -1. Given the condition ϵ <min(∥u (t) ∥,∥ ū∥) ηλ , it follows γ (u) (t) > 1.The final form of the recommendation error at the (t + 1) th epoch under adversarial training is:P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) = P v (0) ∼N ( ū, σ 2 n-1 I) r • ⟨u (t) , v (0) ⟩ ≤ -η(1 + λ)γ (u) (t) M (t, η)∥v (0) ∥ 2This leads us to:P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) -P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) = P v (0) ∼N ( ū, σ 2 n-1 I) -η(1 + λ)γ u (t) M (t, η)∥v (0) ∥ 2 < r⟨u (t) , v (0) ⟩ ≤ -ηM (t, η)∥v (0) ∥ 2 = P v (0) ∼N ( ū, σ 2 n-1 I) -η(1 + λ)γ u (t) M (t, η) ∥v (0) ∥ 2 ∥u (t) ∥ < ⟨ ru (t) ∥u (t) ∥ , v (0) ⟩ ≤ -ηM (t, η) ∥v (0) ∥ 2 ∥u (t) ∥ .Given that ∥ ū∥ ≫ σ, we can approximate the ∥v (0) ∥ 2 by using E v (0) ∼N ( ū, σ 2 n-1 I) ∥v (0) ∥ 2 as an estimate. Therefore, we have:P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) -P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) ≈ P v (0) ∼N ( ū, σ 2 n-1 I) -η(1 + λ)γ u (t) M (t, η) ∥ ū∥ 2 + dσ 2 n-1 ∥u (t) ∥ < ⟨ ru (t) ∥u (t) ∥ , v (0) ⟩ ≤ -ηM (t, η) ∥ ū∥ 2 + dσ 2 n-1 ∥u (t) ∥ ,where d is the dimension of v (0) .Let ε ∼ N 0, σ 2 n-1 I , we have v (0) = ū + ε. Thus:EQUATIONAccording to Fact 1, ⟨ ru (t) ∥u (t) ∥ , ε⟩ ∼ N 0, σ 2n-1 , then:P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) -P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) =Φ √ n -1 σ η(1 + λ)γ u (t) M (t, η) ∥ ū∥ 2 + dσ 2 n-1 ∥u (t) ∥ + ⟨ ru (t) ∥u (t) ∥ , ū⟩ -Φ √ n -1 σ ηM (t, η) ∥ ū∥ 2 + dσ 2 n-1 ∥u (t) ∥ + ⟨ ru (t) ∥u (t) ∥ , ū⟩ ,where Φ() is the CDF of standard Gaussian distribution. Given ϵ < min(∥u (t) ∥,∥ ū∥) ηλ, it follows that(1 + λ)γ (u) (t) > 1 + λ > 1.This condition implies a lower recommendation error at the (t + 1) th epoch under adversarial training compared to standard training:P v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) -P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+1) (u, v) ̸ = r | (u, r) > 0.Therefore, Theorem 1 is proved.Proof of Theorem 2. In light of Theorem 1 and the impact of poisoning attacks, our objective is to measure the alteration in the recommendation error within a poisoning attack, i.e., α-poisoned recommendation error.A poisoning attack on Gaussian Recommender System injects a poisoning user setI ′ = {(u ′ 1 , r ′ 1 ), (u ′ 2 , r ′ 2 ), . . . , (u ′ n ′ , r ′ n ′ )}, with each tuple (u ′ , r ′ ) ∈ R d × {±1}representing data maliciously crafted by attackers. Considering the initialized poisoned item embedding vEQUATIONProof of Theorem 3. Given ϵ < ∥ ū∥ ηλ , drawing from Proposition 2 and Theorem 1 (specifically Equation 15), the update rules for user and item embeddings in the ACF at the (t + k + 1) th epoch are presented as:EQUATIONConsidering the above update rules, the recommendation error at the (t + k + 1) th epoch is given by:EQUATIONwhereC t+k = M adv (t+k,η,λ,ϵ) M adv (t,η,λ,ϵ) M (t, η). Let γ (u) (t+k) = 1 -ηλϵ ∥u (t+k) ∥ -1. Given the conditionϵ < min(∥u (t+k) ∥,∥ ū∥) ηλ , it follows γ (u) (t+k) > 1.The recommendation error at (t + 1) th epoch through adversarial loss can be expressed as:P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+k+1) (u, v) ̸ = r | (u, r) = P v (0) ∼N ( ū, σ 2 n-1 I) r • ⟨u (t+k) , v (0) ⟩ ≤ -η(1 + λ)γ (u) (t+k) C t+k ∥v (0) ∥ 2 .WithEQUATION⟩ ≤ 0 , the change in recommendation error can be written as:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] =P v (0) ∼N ( ū, σ 2 n-1 I) -η(1 + λ)γ (u) (t+k) C t+k ∥v (0) ∥ 2 < r • ⟨u (t+k) , v (0) ⟩ ≤ 0 =P v (0) ∼N ( ū, σ 2 n-1 I) -η(1 + λ)γ (u) (t+k) C t+k ∥u (t+k) ∥ ∥v (0) ∥ 2 < r • ⟨ u (t+k) ∥u (t+k) ∥ , v (0) ⟩ ≤ 0 Considering v (0) ∼ N ū, σ 2 n-1 I , let ε ∼ N 0, σ 2 n-1 I , we have v (0) = ū + ε.Then we obtain:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] =P ε∼N 0, σ 2 n-1 I -η(1 + λ)γ (u) (t+k) C t+k ∥u (t+k) ∥ ∥v (0) ∥ 2 < ⟨ ru (t+k) ∥u (t+k) ∥ , ū + ε⟩ ≤ 0 =P ε∼N 0, σ 2 n-1 I -η(1 + λ)γ (u) (t+k) C t+k ∥u (t+k) ∥ ∥v (0) ∥ 2 -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ < ⟨ ru (t+k) ∥u (t+k) ∥ , ε⟩ ≤ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ .Given that ∥ ū∥ ≫ σ, we can approximate the ∥v (0) ∥ 2 by using E v (0) ∼N ( ū, σ 2 n-1 I) ∥v (0) ∥ 2 as an estimate. Thus, we have:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] ≈P ε∼N 0, σ 2 n-1 I -η(1 + λ)γ (u) (t+k) C t+k ∥ ū∥ 2 + dσ 2 n-1 ∥u (t+k) ∥ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ < ⟨ ru (t+k) ∥u (t+k) ∥ , ε⟩ ≤ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ .By Fact 1, we have ⟨ru (t)∥u (t) ∥ , ε⟩ ∼ N 0, σ 2 n-1 , then:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] =Φ √ n -1 σ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ -Φ √ n -1 σ -η(1 + λ)γ (u) (t+k) C t+k ∥ ū∥ 2 + dσ 2 n-1 ∥u (t+k) ∥ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ ,where Φ() is the CDF of standard Gaussian distribution.Obviously,⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ ∈ [-∥ ū∥, ∥ ū∥] . Let Ψ(u, t + k) = (1 + λ)γ u (t+k)C t+k ∥u (t+k) ∥ .Using the CDF properties of the standard normal distribution, we can conclude:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] ≥ Φ √ n -1 σ ∥ ū∥ + η(∥ ū∥ 2 + dσ 2 n -1 )Ψ(u, t + k) -Φ √ n -1 σ (∥ ū∥) ,equality holds when⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ = ∥ ū∥.Furthermore,∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f (u, v) ̸ = r | (u, r)] ≤ 2Φ √ n -1η 2σ (∥ ū∥ 2 + dσ 2 n -1 )Ψ(u, t + k) -1.Equality is achieved when⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ = - 1 2 η(∥ ū∥ 2 + dσ 2 n -1 )Ψ(u, t + k).Therefore, Theorem 3 is proved.Proof of Theorem 4. Given ϵ < ∥ ū∥ ηλ , according to Proposition 2 and Theorem 1 (specifically Equation 15), we have:EQUATIONwhere v ′ (0) is the poisoned item embedding as given by Equation 18.Considering the above update rules, the α-poisoned recommendation error at the (t + k + 1) th epoch is given by:P adv v (0) ∼N ( ū, σ 2 n-1 I) f (t+k+1),α (u, v ′ ) ̸ = r | (u, r) = P v (0) ∼N ( ū, σ 2 n-1 I) r • ⟨u (t+k+1) , v ′ (t+k+1) ⟩ ≤ 0 = P v (0) ∼N ( ū, σ 2 n-1 I) r • ⟨ 1 - ηλϵ ∥u (t+k) ∥ u (t+k) , v ′ (0) ⟩ ≤ -η(1 + λ)C t+k ∥v ′ (0) ∥ 2 , ∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f α (u, v ′ ) ̸ = r | (u, r)] ≈P ε∼N 0, σ 2 n-1 I -η n + n ′ n (1 + λ)γ (u) (t+k) C t+k ∥u (t+k) ∥ E ∥v ′ (0) ∥ 2 - 1 n (u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ < ⟨ ru (t+k) ∥u (t+k) ∥ , ε⟩ ≤ - 1 n (u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ .By Fact 1, we have ⟨ru (t+k) ∥u (t+k) ∥ , ε⟩ ∼ N 0, σ 2 n-1 , then: ∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f α (u, v ′ ) ̸ = r | (u, r)] =Φ   √ n -1 σ   - 1 n (u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩     -Φ   √ n -1 σ   -η n + n ′ n (1 + λ)γ (u) (t+k) C t+k ∥u (t+k) ∥ E ∥v ′ (0) ∥ 2 - 1 n (u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ -⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩     ,where Φ() is the CDF of standard Gaussian distribution.Obviously,(u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ ∈ -n ′ √ dα, n ′ √ dα , ⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ ∈ [-∥ ū∥, ∥ ū∥] , E ∥v ′ (0) ∥ 2 ∈ n 2 ∥ ū∥ 2 -2nn ′ α∥ ū∥ 0 (n + n ′ ) 2 + n 2 dσ 2 (n -1)(n + n ′ ) 2 , n 2 ∥ ū∥ 2 + (n ′ ) 2 dα 2 + 2nn ′ α∥ ū∥ 0 (n + n ′ ) 2 + n 2 dσ 2 (n -1)(n + n ′ ) 2where n ′ is the number of fake users, d is the dimension of u ′ , and α = max(u ′ ,r ′ )∈I ′ ∥u ′ ∥ ∞ . Let Ψ(u, t + k) =(1 + λ)γ u (t+k) C t+k ∥u (t+k) ∥ , β = n ′ n √ dα + ∥ ū∥.According to the CDF properties of the standard normal distribution, we can conclude that:∆ adv (t+k+1) P adv v (0) ∼N ( ū, σ 2 n-1 I) [f α (u, v ′ ) ̸ = r | (u, r)] > Φ √ n -1 σ β + η n 2 ∥ ū∥ 2 -2nn ′ α∥ ū∥ 0 n(n + n ′ ) + ndσ 2 (n -1)(n + n ′ ) Ψ(u, t + k) -Φ √ n -1 σ (β) ,reaches the minimum value when(u ′ ,r ′ )∈I ′ rr ′ ⟨ u (t+k) ∥u (t+k) ∥ , u ′ (0) ⟩ = n ′ √ dα, ⟨ ru (t+k) ∥u (t+k) ∥ , ū⟩ = ∥ ū∥,and E ∥v ′ (0) ∥ 2 reaches the minimum value n 2 ∥ ū∥ 2 -2nn ′ α∥ ū∥0EQUATIONn 2 ∥ ū∥ 2 + (n ′ ) 2 α + 2nn ′ α∥ ū∥ 0 n(n + n ′ ) + ndσ 2 (n -1)(n + n ′ ) Ψ(u, t + k) -1,Following the aforementioned Equation 16and Equation 20, the γ (u) for the user u in the context of multi-item ACF with a dot-product loss function is given by:EQUATIONTherefore, Corollary 2 is proved.Proof of Corollary 1. For any dot-product-based loss function L(u, v|Θ), the coefficient functions in Equation 22 can be given by:∇ u (t) L(u (t) , v (t) |Θ) = ϕ(r, u (t) , v (t) )v (t) , ∇ v (t) L(u (t) , v (t) |Θ) = ψ(r, u (t) , v (t) )u (t) .Building upon Corollary 2, we can express γ (u) (t) as:γ (u) (t) = 1 - ηλϵ ∥u t ∥ v∈Nu |ψ(r, u (t) , v (t) )| -1.Considering the proofs of Theorem 3 and Theorem 4, under 0 < (γ(t) ) -1 < 1, we can guarantee the effectiveness of ACF. Therefore, it implies:0 < ϵ (u) (t) < ∥u (t) ∥ • 1 v∈Nu ηλ|ψ(r, u (t) , v (t) )| .In actual training, the maximum perturbation magnitudes will also be affected by other factors. From the perspective of Corollary 2, we can only conclude that the maximum perturbation magnitude ϵ (u) (t),max for user u at epoch t is positively related to ∥u (t) ∥. Therefore, Corollary 1 is proved.• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.Justification: We conform with the NeurIPS Code of Ethics.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).Unless otherwise specified, ∥ • ∥ denotes the L2 norm ∥ • ∥2 in this paper.To make poisoning attacks effective in single-item recommendation scenarios, attackers can directly inject users' initialized embeddings, which is equivalent to constructing interactions for different items in multi-item scenarios.The Rev attack method could not be executed on the dataset due to memory constraints, resulting in an out-of-memory error.Target Item Hit Ratio (Equation7); T-HR@50 and T-NDCG@50 of all target items on clean datasets are 0.000.The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics, i.e., (min (T-HRBeslines) -T-HRPamaCF) / min(T-HRBeslines). Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data.The relative percentage increase of PamaCF's metrics to the best value of other baselines' metrics. Notably, only three decimal places are presented due to space limitations, though the actual ranking and calculations utilize the full precision of the data. 


Decision: This work offers a theoretical insight into the effectiveness of adversarial collaborative filtering and introduces a practical learning approach applicable to various scenarios. Experiments conducted on three datasets show that the proposed method excels in robustness and recommendation performance. While reviewers generally acknowledge the paper's positive aspects, they have raised concerns about discrepancies between the theoretical results and the proposed methods, as well as the assumptions made in the theoretical analysis.

Reviews: review: paper_summary: paper_summary: Adversarial training has been observed to degrade model performance on clean samples in the CV domain, however, ACF in recommender systems can not only enhance the robustness against poisoning attacks but also improve recommendation performance. This paper provides a comprehensive theoretical understanding of this phenomenon. Specifically, this paper shows the performance with adversarial training is better than without adversarial training in both clean and $\alpha$-poisoned scenarios. In addition, this paper provides the lower and upper bounds for the recommendation error. This paper also proposes a learning approach that can be used in more practice scenarios. Experiments on three datasets demonstrate the effectiveness of the proposed method in terms of robustness and recommendation performance.
strength_weakness: strength_weakness: $\bullet~$ Can authors discuss the feasibility of relaxing the assumption in theorems such as the Gaussian recommendation system? In addition, is the the extension to multiple items natural?

$\bullet~$ It will be better if the magnitude of user latent vectors is provided in Figure 1. Thus we can align the empirical findings and theoretical findings more straightforwardly. Maybe we can observe that the magnitude of the latent vector of user 3 is larger than that of user 2.

 $\bullet~$ Is there a more reasonable way to design the form of $c(\mathbf{u}, t)$ and equation 5? In addition, how can we choose $\rho$ in practice? Is $\rho$ learnable or it is only a hyper-parameter?

 $\bullet~$ Some presentation issues. For example, the $\alpha$ in line 184 should be bolded, and it should be $\Phi(\cdot)$ in line 176. In addition, the results in Table 1 should retain 2 digits instead of 3 digits to enhance the readability. The text in Figures 2 and 3 (such as x-axis and y-axis) should be larger.
questions: questions: See the weaknesses part for the questions.
limitations: limitations: Yes, this author adequately discusses the limitation and broader impact.
paper_summary: paper_summary: This paper targets adversarial collaborative filtering and provides both deeper understanding and improvement. The paper provides a theoretical explanation for the ACF's improvement upon robustness and effectiveness. PamaCF, which is presented in Appendix, can more robustly performs CF, is evaluated on three recommendation datasets.
strength_weakness: strength_weakness: 1. Part of the experiments are missing and incomplete.
2. The loss terms in Section 3 do not fully align with the cited papers.
questions: questions: 1. What's the performance of various ACF methods on LightGCN? It would be more comprehensive to report another Table similar to Table 1 about LightGCN.
2. Why does the paper present the recommendation performance at HR@50 and NDCG@50 in Table 1 and present the performance against attacks in Table 2 with T-HR@50 and T-NDCG@50?
3. Is target item promotions the only attack PamaCF can prevent? 
4. The loss of Gaussian Recsys in Eq 2 does not fully align with [18]. So is the same regarding Eq 3 and [15]. Why does the author make such changes? The loss term is the foundation of all derivity. All previous works are based upon pairwise loss while the paper is based on pointwise loss.
limitations: limitations: Although the paper presents an important theoretical and experimental analysis of ACF, the reviewer feels a strong sense of misalignment between Section 3 and 4, where the theoretical results in Section 3 do not fully motivate PamaCF in Section 4. The result of Section 3 seems to be motivated by pointwise loss, while PamaCF is built upon pairwise loss. Also, part of the experimental setup is not convincing enough. However, the reviewer might be persuaded with further evidence.
paper_summary: paper_summary: This work investigates adversarial collaborative filtering, providing theoretical evidence for the effectiveness of such methods and proposing a novel method based on the personalized magnitude of perturbation.

Overall, this work studies on an interesting problem and offer some theoretical insights. However, this work also has some limitations particularly on the impractical assumptions. As such, I give the score of 5.
strength_weakness: strength_weakness: 1.	My primary concern lies with the assumptions made in the theoretical analysis. There is a noticeable gap between the theoretical analysis and practical applications in several aspects: a) the strategy for initializing embeddings (presented in Definition 1) is seldom adopted in existing RS; b) the optimization in practical RS typically uses BCE, BPR, or softmax loss, rather than the loss function described in equation (2); c) preference prediction usually does not employ the sign function; d) recommendation is often framed as a ranking problem with corresponding metrics or losses, rather than being defined as in ‘Definition 2’ for analyzing recommendation error. 

I understand these impractical assumptions could facilitate theoretical derivation, but they clearly become a limitation of this work.

2.	My other concern is with the theoretical analysis itself. 

2.1	 It is counter-intuitive that the theoretical bound does not depend on the item embeddings, given the symmetric roles of user and item embeddings in recommendation systems. Could you please provide some explanations? Or the relations $v=1/n \sum_i r_i u_i$ are always held? 

2.2	It is interesting to discover that CF has a unique advantage such that the adversarial mechanism works even for clean data, unlike in basic classification tasks. Why is collaborative filtering so special? The problem formulation for collaborative filtering appears similar to basic classification tasks. Could the distinction be due to the inner product? More discussion on which characteristics of collaborative filtering lead to this advantageous property would be highly interesting.

Some minor ones:

3.	The theoretical part is not easy to follow.  This may be due to my unfamiliarity with theories on adversarial learning. Nevertheless, I recommend that the authors provide intuitive explanations for the theorems and a brief outline of the proof procedure. 

4.	The paper should include more experimental details. It is unclear whether the experimental setup (e.g., initialization) follows the problem definition 1 or aligns with previous works like [2][3].
questions: questions: Please refer to weaknesses.
limitations: limitations: the authors have discussed the limitations.
paper_summary: paper_summary: This work investigates the efficacy and robustness of Adversarial Collaborative Filtering (ACF) in recommender systems. The authors present theoretical analyses to demonstrate how ACF enhances traditional collaborative filtering (CF) by mitigating the negative impact of data poisoning attacks. They extend these theoretical insights to further improve existing ACF methods by dynamically and personally assigning perturbation magnitudes based on users’ embedding scales. Experiments based on representative CF backbones and various attack methods strengthen the validity of this work.
strength_weakness: strength_weakness: W1. To extend theoretical understandings from the simple single-item CF scenario to practical multi-item scenarios,  Corollary 1 is restricted to the dot-product-based loss function.

W2. The experiment only involves two CF backbones, namely MF and LightGCN. The results will be more convincing by adding more CF methods.
questions: questions: Please refer to the Weaknesses section.
limitations: limitations: The authors have discussed the limitations of their work.

Comments: title: Summary
Further Clarification
Kindly Reminder
Further Clarification on Initialization, Prediction Functions, and Model Architectures
Follow up
Follow up
Follow up
Follow up
comment: We would like to express our sincere gratitude to all the reviewers for their valuable feedback and for dedicating time to evaluate our work. We are pleased that **all reviewers have given positive scores (7,6,5,5) on this paper**, and we are delighted that **our contributions have been recognized, including**:

- Addressing an important research problem (Reviewers gsZx, 6kCb, MDNE)
- Introducing an interesting and novel idea (Reviewers gsZx, MDNE)
- Providing reasonable motivation (Reviewers gsZx, MDNE)
- Demonstrating sound theoretical results (Reviewers gsZx, svg8, 6kCb, MDNE)
- Presenting rigorous mathematical proofs (Reviewer MDNE)
- Conducting solid and convincing experiments (Reviewers gsZx, 6kCb, MDNE)
- Delivering a well-structured and well-written paper (Reviewers svg8, MDNE)

Our paper **offers a theoretical explanation for why adversarial collaborative filtering (ACF) can outperform traditional collaborative filtering** in terms of performance and robustness. Additionally, we highlight **how to further enhance the benefits of ACF based on recommendation error bounds**. Building on these theoretical insights, we **propose PamaCF and conduct extensive experimental evaluations**. Our experimental results align well with our theoretical findings, as praised by Reviewers gsZx, 6kCb, and MDNE.

During the discussion period, our responses effectively addressed the concerns:

- Clarifying how we relaxed the assumptions and extended our theoretical insights.
- Demonstrating ACF's unique advantages, even with clean data.
- Providing experimental results confirming that PamaCF achieves state-of-the-art performance, even with non-dot-product-based loss functions or under different types of attacks.

We also clarified misunderstandings, including:

- Confirming that we use the same loss function as the cited paper.
- Clarifying that a unified base loss function is shared across all baselines in our experiments.
- Highlighting specific sections in the original paper that introduce evaluation metrics.
- Explaining that the Gaussian-based initialization and sign function do not affect our core findings.

We are encouraged by the positive feedback received from the reviewers.

We are eager and hopeful that this paper will be considered for presentation at the conference. We offer a fresh perspective on existing adversarial collaborative filtering methods. We believe this work could significantly impact the community, sparking discussions and analyses on how to improve the development of adversarial collaborative filtering algorithms.

Once again, we extend our heartfelt gratitude to all the reviewers for their constructive suggestions and for taking the time and effort to evaluate our work.

Best regards,  
The Authors
Thank you very much for taking the time to review our response and for your willingness to increase the score of our paper. We are delighted to hear that our response has addressed your previous misunderstandings.

We would like to clarify that the tables reported in our paper consistently align theory with experiment, a view that has also been recognized by the other three reviewers. We understand your concerns. We have indeed conducted experiments with different @k metrics and have saved the corresponding results. For simplicity, clarity, and due to space limitations, we only presented results with the most common choice of top $k = 20$. We will include the additional experimental results provided during the rebuttal period in the Appendix of subsequent versions.

Thank you once again for your time and effort in reviewing our paper.

Sincerely,  
The Authors
Thanks to the author for consistently providing so many new information. The reviewer still thinks the paper should be improved upon evaluation in the very initial version. Frankly speaking, the reviewer has not seen any experiment added during the rebuttal period does not align with the previous conclusion or the reviewer's expectation. So from a personal perspectives, they does not help me any bit when reevaluting the paper.

However, given most of my misunderaranding has been addressed and the authors actively report different @k metrics, the reviewer will raise the score. But the reviewer strongly encourage the author to redo the experiments by reporting different @k metrics, add the reported tables and make the paper consistent between theory and experiment.
Thank you for your comments. We appreciate your feedback. However, there are still some misunderstandings in your replies.

---

### Regarding the Loss Function

Your understanding of our loss function in the experiments is incorrect. **We indeed use the same base loss function (BPR loss) across all the baselines.** Please refer to our code in the Supplementary Material (line 223 in `./utls/trainer.py`), where all the methods share a unified loss function.

---

### Regarding the Selection of $k$ in Our Evaluation

Our experimental setup involves:

- Two types of backbone models
- Four types of attacks
- Five defense baselines
- Four evaluation metrics
- Three datasets

For simplicity, clarity of experimental results, and due to space limitations, we only presented results with the most common top $k = 20$ choices, as seen in existing collaborative filtering works [1-5]. We also evaluated different $k$ values. Below are partial results for $k = 10$. You can also see from the code in the Supplementary Material (line 41 in `./meta_config.py`) that we set up multiple $k$ values.

|   Bandwagon Atk. Gowalla   | HR@10                    | NDCG@10                    |
|------------------------|----------------------------|----------------------------|
| **MF** (Clean)                 | 7.494 ± 0.080              | 5.846 ± 0.035              |
| **MF**                   | 7.410 ± 0.055              | 5.812 ± 0.044              |
| +**StDenoise**         | 6.954 ± 0.086              | 7.132 ± 0.029              |
| +**GraphRfi**          | 6.860 ± 0.042              | 6.910 ± 0.060              |
| +**APR**               | _9.204 ± 0.046_            | _9.564 ± 0.027_            |
| +**SharpCF**           | 8.705 ± 0.076              | 8.723 ± 0.058              |
| +**PamaCF**            | **9.492 ± 0.021**          | **9.838 ± 0.013**          |
| **Gain**               | +3.13%                     | +2.86%                     |
| **Gain w.r.t. MF**     | +28.10%                    | +69.27%                    |

**We find that our method achieves consistent optimality even with different $k$.**

We believe this selection is reasonable. We are willing to provide results for multiple $k$ values in the final version. We believe that the results under this different $k$, as well as the experiments in multiple scenarios, are sufficient to demonstrate the superiority of the methodology.

[1] Neural graph collaborative filtering. SIGIR'19  
[2] LightGCN - Simplifying and Powering Graph Convolution Network for Recommendation. SIGIR'20  
[3] Empowering collaborative filtering with principled adversarial contrastive loss. NeurIPS'23  
[4] Invariant collaborative filtering to popularity distribution shift. WebConf'23  
[5] Distributionally Robust Graph-based Recommendation System. WebConf'24

---

### Contribution of Our Work on Collaborative Filtering

Adversarial training has been empirically demonstrated to improve both model robustness and recommendation performance. In our work, we have **explained its effectiveness in different scenarios from a theoretical point of view** and **provided ways to further enhance the effectiveness of adversarial training.** We believe that our work is valuable and meaningful for the collaborative filtering field, as also noted by the other three reviewers.

---

For any of the previous replies, if there is anything else that you feel is unclear to you, please let us know. We would be happy to discuss further.

---

Based on these clarifications, we kindly request you to reconsider the overall assessment of our paper. We firmly believe that our work contributes valuable insights and advances the state-of-the-art in robust recommender systems, making a significant contribution to the research community.

Sincerely,   
The Authors
Thanks to the author for the rebuttal. However, the reviewer is still not convinced this paper is meaningful from the perspective of collaborative filtering. The evaluation is not solid based on the recommendation review perspective. At least two k should be adopted for HR@k and NDCG@k to validate that this method is not biased towards specific metrics. Also, adopting different losses between baseline and proposed methods is not convincing enough to demonstrate PamaCF's effectiveness for recommendation tasks. Besides, some of the responses are still not clear to the reviewer.

Hence, the reviewer will keep the score. If other reviewers and AC strongly think this paper is acceptable, the reviewer respect their decision.
We are grateful that our response successfully resolved your concerns. Thank you for your feedback and for positively evaluating our work.

Sincerely,   
The Authors
We are delighted to hear that our response effectively addressed your concerns. We sincerely appreciate your support and the positive evaluation of our work.

Sincerely,   
The Authors
Thanks for the detailed rebuttal, which addresses my concerns. I will keep my rating unchanged.
Thanks for the authors' explanations. I have no further questions.
Thank you once again for dedicating your time and effort to reviewing our paper. We are following up on our message sent yesterday regarding the discussion period between authors and reviewers, which concludes on August 13.

We understand that you may have a busy schedule and truly appreciate the time and effort you have already invested in reviewing our work. We have carefully considered your comments and provided detailed clarifications and support for each concern in our rebuttal.

Specifically:

- **For W1:** Other reviewers (gsZx, 6kCb, MDNE) also praised the thoroughness and persuasiveness of our experiments. We understand your concerns and have provided detailed explanations and additional support in A1-A3, corresponding to Q1-Q3.
- **For W2:** We clarified that the loss terms in Section 3 indeed align with the cited papers, as discussed in A4 corresponding to Q4.

We are eager to learn whether our response has sufficiently addressed your concerns and if there are any further questions or suggestions. Please accept our apologies for reaching out again so soon; however, we are committed to meeting the deadline and ensuring the timely progression of our paper through the discussion process. If you require any additional information or clarification, please do not hesitate to reach out.

Once again, we express our gratitude for your feedback and your continued assistance in this process.

Sincerely,  
The Authors
Thank you for your comments and for acknowledging the theoretical contributions of our work.

We would like to clarify that the initialization (Q1) and prediction functions (Q3) are employed solely to simplify the formulas and aid in defining certain concepts. **These choices do not impact the theoretical results presented in our study**. Furthermore, we use the **widely adopted matrix factorization (MF) model for theoretical derivation** [1][2], which is consistent with existing mainstream architecture.

---

## Gaussian Initialization (Q1,A1)

Regarding Gaussian initialization (Q1), the Gaussian initialization method is chosen to derive more precise and clearer bounds. **Even without introducing Gaussian initialization, we still achieve the following results:**

- ACF outperforms traditional CF.
- User-adaptive magnitude further enhances the effectiveness of ACF.

For instance, as detailed in Appendix D1.1, line 667, we have shown:

$\mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)}  \left[f({u}, {v}) \neq r \mid ({u}, r) \right]$ -  

$~~~~~~\mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)}^{~\mathrm{adv}}  \left[f({u}, {v}) \neq r \mid ({u}, r) \right]$ 

$~~~~= \mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)}\left[-\eta (1+\lambda) \gamma_t^{{u}} M(t, \eta) \frac{\Vert {v}_0\Vert^2}{\Vert {u}_t\Vert} < \langle \frac{r{u}_t}{\Vert {u}_t \Vert}, {v}_0 \rangle \leq -\eta M(t, \eta) \frac{\Vert {v}_0\Vert^2}{\Vert {u}_t\Vert} \right] \ge 0,$

This result already supports Theorem 1. By leveraging the properties of the Gaussian distribution, we are able to derive a more precise and clearer formula:

$\mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)}\left[-\eta (1+\lambda) \gamma_t^{{u}} M(t, \eta) \frac{\Vert {v}_0\Vert^2}{\Vert {u}_t\Vert} < \langle \frac{r{u}_t}{\Vert {u}_t \Vert}, {v}_0 \rangle \leq -\eta M(t, \eta) \frac{\Vert {v}_0\Vert^2}{\Vert {u}_t\Vert} \right]$

$~~~~ = \Phi\left( \frac{\sqrt{n-1}}{\sigma}\left( \eta (1+\lambda) \gamma_t^{{u}} M(t, \eta) \frac{\Vert \bar{{u}} \Vert^2 + \frac{d \sigma^2}{n-1}}{\Vert {u}_t\Vert} + \langle \frac{r{u}_t}{\Vert {u}_t \Vert}, \bar{{u}} \rangle \right)\right)$

$~~~~~~ - \Phi \left( \frac{\sqrt{n-1}}{\sigma} \left(\eta M(t, \eta) \frac{\Vert \bar{{u}} \Vert^2 + \frac{d \sigma^2}{n-1}}{\Vert {u}_t\Vert} + \langle \frac{r{u}_t}{\Vert {u}_t \Vert}, \bar{{u}} \rangle\right) \right) > 0.$

This result also applies to Theorems 2-4, as discussed in A1 of our rebuttal.

---

## Prediction Functions (Q3,A3)

Regarding the prediction functions (Q3), instead of the sign function, we could have used another prediction function. **Even without the sign function, we can still derive the subsequent results**:

- ACF outperforms traditional CF.
- User-adaptive magnitude further enhances the effectiveness of ACF.
  
We only utilized the sign function specifically to define the recommendation error, which aligns with existing publications [3][4]. This choice allows us to express the recommendation error as:

$\mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)}\left[\mathrm{sgn}(\langle{u}_t, {v}_t)\rangle \neq r \mid ({u}, r)\right].$

$~~~~= \mathbb{P}_{{v}_0 \sim \mathcal{N}(\bar{{u}}, \frac{\sigma^2}{n-1}I)} \left[\langle{u}_t, {v}_t\rangle \cdot r < 0 \mid ({u}, r) \right],$

as we elaborated in A3 of our rebuttal.

---

## Model Architectures

In both Theorems in Section 3 and the Corollary in Section 4, we adopt MF as the backbone model, which is consistent with existing mainstream architecture [1][2].

---

It seems there may be some misunderstanding that has led to the perception of a gap between our theoretical analyses and practical applications. We have provided further explanations on the three points you mentioned, and we hope you will reconsider the contributions of our work. Thank you very much!


[1] Adversarial Personalized Ranking for Recommendation. SIGIR'18  
[2] Adversarial Collaborative Filtering for Free. RecSys'23  
[3] Adversarially robust generalization requires more data. NeurIPS'21  
[4] Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training. SIGIR'21
Thank you for the detailed response. My concerns have not been well addressed, particular in the gap between the theoretical analyses and practical applications. The initializing, the prediction functions and the model architectures may not be closely alignment with the pratical. Nevertheless, I acknowledge the theoretical contribution of this work and would like keep the positive score of this work.
Thank you for taking the time and effort to review our paper. We have carefully considered your comments and responded to each point with detailed clarifications and supporting evidence. As the deadline for the discussion period between authors and reviewers is approaching, we kindly ask whether our responses have sufficiently addressed your concerns. Please let us know if there are any further questions or issues that you would like us to address. We look forward to hearing from you soon.

Thank you once again for your time and effort.

Sincerely,   
The Authors
Thank you for taking the time and effort to review our paper. We have carefully considered your comments and responded to each point with detailed clarifications and supporting evidence. As the deadline for the discussion period between authors and reviewers is approaching, we kindly ask whether our responses have sufficiently addressed your concerns. Please let us know if there are any further questions or issues that you would like us to address. We look forward to hearing from you soon.

Thank you once again for your time and effort.

Sincerely,   
The Authors
Thank you for taking the time and effort to review our paper. We have carefully considered your comments and responded to each point with detailed clarifications and supporting evidence. As the deadline for the discussion period between authors and reviewers is approaching, we kindly ask whether our responses have sufficiently addressed your concerns. Please let us know if there are any further questions or issues that you would like us to address. We look forward to hearing from you soon.

Thank you once again for your time and effort.

Sincerely,  
The Authors
Thank you for taking the time and effort to review our paper. We have carefully considered your comments and responded to each point with detailed clarifications and supporting evidence. As the deadline for the discussion period between authors and reviewers is approaching, we kindly ask whether our responses have sufficiently addressed your concerns. Please let us know if there are any further questions or issues that you would like us to address. We look forward to hearing from you soon.

Thank you once again for your time and effort.

Sincerely,   
The Authors