Original: Revisiting Injective Attacks on Recommender Systems
Revised: Revisiting Injective Attacks on Recommender Systems

Original: Anonymous Author(s)

Original: AfﬁliationAddress

Original: Abstract
Revised: Abstract

Original: Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks.
Revised: Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks.

Original: Given a limited fake user budget, attackers can inject fakeusers with carefully designed behaviors into the open platforms, making RecSysrecommend a target item to more real users for proﬁts.
Revised: Given a limited fake user budget, attackers can inject fakeusers with carefully designed behaviors into the open platforms, making RecSysrecommend a target item to more real users for proﬁts.

Original: In this paper, we ﬁrstrevisit existing attackers and reveal that they suffer from the difﬁculty-agnostic anddiversity-deﬁcit issues.
Revised: In this paper, we ﬁrstrevisit existing attackers and reveal that they suffer from the difﬁculty-agnostic anddiversity-deﬁcit issues.

Original: Existing attackers concentrate their efforts on difﬁcult userswho have low tendencies toward the target item, thus reducing their effectiveness.
Revised: Existing attackers concentrate their efforts on difﬁcult userswho have low tendencies toward the target item, thus reducing their effectiveness.

Original: Moreover, they are incapable of affecting the target RecSys to recommend thetarget item to real users in a diverse manner, because their generated fake userbehaviors are dominated by large communities.
Revised: Moreover, they are incapable of affecting the target RecSys to recommend thetarget item to real users in a diverse manner, because their generated fake userbehaviors are dominated by large communities.

Original: To alleviate these two issues, wepropose a difﬁculty and diversity aware attacker, namely DADA.
Revised: To alleviate these two issues, wepropose a difﬁculty and diversity aware attacker, namely DADA.

Original: We design thedifﬁculty-aware and diversity-aware objectives to enable easy users from variouscommunities to contribute more weights when optimizing attackers.
Revised: We design thedifﬁculty-aware and diversity-aware objectives to enable easy users from variouscommunities to contribute more weights when optimizing attackers.

Original: By incorporating these two objectives, the proposed attacker DADA can concentrate on easyusers while also affecting a broader range of real users simultaneously, therebyboosting the effectiveness.
Revised: By incorporating these two objectives, the proposed attacker DADA can concentrate on easyusers while also affecting a broader range of real users simultaneously, therebyboosting the effectiveness.

Original: Extensive experiments on three real-world datasetsdemonstrate the effectiveness of our proposed attacker.
Revised: Extensive experiments on three real-world datasetsdemonstrate the effectiveness of our proposed attacker.

Original:  introduction
Revised:  introduction

Original: In the era of big data, recommender systems (RecSys) [36, 24] are a key component to help users 19 locate items that they may be interested in.
Revised: In the era of big data, recommender systems (RecSys) [37, 25] are a key component to help userslocate items that they may be interested in.

Original: Generally, given the user behaviors, such as item purchasehistory and movie viewing history, RecSys learn the latent tendency of users regarding each item, and 21 then recommend the top-N matched items for each user.
Revised: Generally, given the user behaviors, such as item purchasehistory and movie viewing history, RecSys learn the latent tendency of users regarding each item andthen recommend the top-N matched items for each user.

Original: Over the past decade, various RecSys havebeen proposed to provide services for users.
Revised: Over the past decade, various RecSys havebeen proposed to provide services for users.

Original: Recent studies [21, 34, 29, 12] demonstrate that RecSys 23 are vulnerable to adversarial attacks, e.g., fake user behaviors.
Revised: Recent studies [22, 35, 30, 13] demonstrate that RecSysare vulnerable to adversarial attacks, e.g., fake user behaviors.

Original: It is because the training of RecSysrelies on user behaviors and attackers can easily inject fake users into open-world web platforms.
Revised: It is because the training of RecSysrelies on user behaviors and attackers can easily inject fake users into open-world web platforms.

Original: 25 Speciﬁcally, attackers want to promote an item to real users, which can increase the opportunity thatusers purchase this target item and thus bring economic proﬁts.
Revised: Speciﬁcally, attackers want to promote an item to real users, which can increase the opportunity thatusers purchase this target item and thus bring economic proﬁts.

Original: To achieve such goals, attackers 27 generally inject a limited number of fake users with designed behaviors, i.e., injective attacks .
Revised: To achieve such goals, attackersgenerally inject a limited number of fake users with designed behaviors, i.e., injective attacks .

Original: Then,the target RecSys may be affected with these injected fake users, and then recommends the target 29 item into the top-N item list of real users.
Revised: Then,the target RecSys may be affected with these injected fake users, and then recommends the targetitem into the top-N item list of real users.

Original: Based on the techniques that are employed to design the behaviors of injected fake users, existing 31 attackers [27, 34, 29, 15, 32, 8, 5, 35,  7,18, 6, 3] can be classiﬁed into three types: heuristicsbased [32, 18, 3], neural network-based [29, 25, 35, 6], and gradient-based attackers [29, 25, 35, 6].
Revised: Based on the techniques that are employed to design the behaviors of injected fake users, existingattackers [28, 35, 30, 16, 33, 9, 5, 36, 8, 19, 7, 3] can be classiﬁed into three types: heuristicsbased [33, 19, 3], neural network-based [30, 26, 36, 7], and gradient-based attackers [30, 26, 36, 7].

Original: 33 Heuristics-based attackers [32, 18, 3] sample popular items together with the target item as thebehaviors of each fake user to increase the co-occurrence between popular items and the target35 item, i.e., trying to increase the popularity of the target item.
Revised: Heuristics-based attackers [33, 19, 3] sample popular items together with the target item as thebehaviors of each fake user to increase the co-occurrence between popular items and the target item, i.e., trying to increase the popularity of the target item.

Original: Then, RecSys can be affected, andwill recommend the target item to more users.
Revised: Then, RecSys can be affected, andwill recommend the target item to more users.

Original: However, such way does not directly optimize the 37 attack objective, reducing the effectiveness of attackers [27, 35].
Revised: However, such way does not directly optimize theattack objective, reducing the effectiveness of attackers [28, 36].

Original: Instead, neural network-based attackers [29, 25, 35, 6] utilize neural networks to generate inﬂuential fake user behaviors.
Revised: Instead, neural network-based attackers [30, 26, 36, 7] utilize neural networks to generate inﬂuential fake user behaviors.

Original: They 39 maximize the attack objective by optimizing the parameters of neural networks.
Revised: Theymaximize the attack objective by optimizing the parameters of neural networks.

Original: Gradient-basedattackers [15, 7, 34, 5, 8, 27] adopt the continuous relaxation to project user behaviors from the 41 discrete space into the continuous space.
Revised: Gradient-basedattackers [16, 8, 35, 5, 9, 28] adopt the continuous relaxation to project user behaviors from thediscrete space into the continuous space.

Original: This enables attackers to parameterize the fake userbehaviors and maximize the attack objective by optimizing them with gradients.
Revised: This enables attackers to parameterize the fake userbehaviors and maximize the attack objective by optimizing them with gradients.

Original: Though existing attackers can achieve reasonably good attacking performance, they still suffer from 44 two crucial issues from the local and global views: difﬁculty-agnostic and diversity-deﬁcit .
Revised: Though existing attackers can achieve reasonably good attacking performance, they still suffer fromtwo crucial issues from the local and global views: difﬁculty-agnostic and diversity-deﬁcit .

Original: First,existing attackers do not consider the promotion difﬁculty of each user regarding the target item.
Revised: First,existing attackers do not consider the promotion difﬁculty of each user regarding the target item.

Original: 46 Particularly, users who have a higher (resp.
Revised: Particularly, users who have a higher (resp.

Original: lower) tendency toward the target item are referred toeasier (resp.
Revised: lower) tendency toward the target item are referred toeasier (resp.

Original: more difﬁcult) users.
Revised: more difﬁcult) users.

Original: According to the formulated attack objective of existing attackers, 48 difﬁcult users will contribute more gradients to optimize attackers’ parameters, e.g., neural networkparameters for generating fake users.
Revised: According to the formulated attack objective of existing attackers,difﬁcult users will contribute more weights to optimize attackers’ parameters, e.g., neural networkparameters for generating fake users.

Original: It makes attackers put more efforts to recommend the target 50 item to difﬁcult users.
Revised: It makes attackers put more efforts to recommend the targetitem to difﬁcult users.

Original: However, the RecSys platforms will usually monitor the user registration, i.e.,attackers only have a very limited budget for generating fake users.
Revised: However, the RecSys platforms will usually monitor the user registration, i.e.,attackers only have a very limited budget for generating fake users.

Original: Thus, attackers that focus on 52 difﬁcult users may only achieve small attacking gain, i.e., the target item can only be recommendedto a small number of users.
Revised: Thus, attackers that focus ondifﬁcult users may only achieve small attacking gain, i.e., the target item can only be recommendedto a small number of users.

Original: Second, the generated fake behaviors of existing attackers cannot 54 inﬂuence real users diversely.
Revised: Second, the generated fake behaviors of existing attackers cannotinﬂuence real users diversely.

Original: Speciﬁcally, real users with different preferences are dispersed intodifferent communities.
Revised: Speciﬁcally, real users with different preferences are dispersed intodifferent communities.

Original: Communities with more users may dominate the optimization of attackers.
Revised: Communities with more users may dominate the optimization of attackers.

Original: Consequently, the generated fake users cannot affect RecSys to promote the target item to variouscommunities, decreasing the effectiveness of attackers.
Revised: Consequently, the generated fake users cannot affect RecSys to promote the target item to variouscommunities, decreasing the effectiveness of attackers.

Original: To address difﬁculty-agnostic and diversity-deﬁcit issues, we propose a Difﬁculty-Aware and59 Diversity-Aware attacker, namely DADA, which takes the promotion difﬁculty and diversity intoconsideration simultaneously.
Revised: To address difﬁculty-agnostic and diversity-deﬁcit issues, we propose a Difﬁculty-Aware and Diversity-Aware attacker, namely DADA, which takes the promotion difﬁculty and diversity intoconsideration simultaneously.

Original: First, to handle the difﬁculty-agnostic issue, we propose a novel 61 difﬁculty-aware objective thatenables easy users to contribute more gradients to the attacker optimization process than difﬁcult users.
Revised: First, to handle the difﬁculty-agnostic issue, we propose a noveldifﬁculty-aware objective that more emphasizes easier users than difﬁcult users when optimizingattack parameters.

Original: Moreover, we propose a diversity-aware attack objective63 that allows the generated fake user behaviors to affect the target RecSys to recommend the targetitem to real users diversely, thereby avoiding the diversity-deﬁcit issue.
Revised: Moreover, we propose a diversity-aware attack objective that allows the generatedfake user behaviors to affect the target RecSys to recommend the target item to real users diversely,thereby avoiding the diversity-deﬁcit issue.

Original: By incorporating both65 attack objectives, our proposed attacker DADA can concentrate on easy users and generate fake userbehaviors that are capable of affecting real users in a diverse manner.
Revised: By incorporating both attack objectives, our proposedattacker DADA can concentrate on easy users and generate fake user behaviors that are capable ofaffecting real users in a diverse manner.

Original: Overall, our contributions are67 summarized as follows:
Revised: Overall, our contributions are summarized as follows:

Original: • We revisit attackers on RecSys and reveal that existing attackers suffer from difﬁculty-agnosticand diversity-deﬁcit issues.
Revised: • We revisit attackers on RecSys and reveal that existing attackers suffer from difﬁculty-agnosticand diversity-deﬁcit issues.

Original: More speciﬁcally, the objective designs in existing attackers makethem more focus on promoting the target item to those difﬁcult users in the dominant community.
Revised: More speciﬁcally, the objective designs in existing attackers makethem more focus on promoting the target item to those difﬁcult users in the dominant community.

Original: However, it is hard to handle difﬁcult users with only a limited number of generated fake users.
Revised: However, it is hard to handle difﬁcult users with only a limited number of generated fake users.

Original: Besides, the generated fake users tend to fall into the dominant community, which is not helpful toaffect real users in other communities.•
Revised: Besides, the generated fake users tend to fall into the dominant community, which is not helpful to affect real users in other communities.

Original:  We propose two novel attack objectives (difﬁculty-aware and diversity-aware objectives) thatforce the RecSys attacker to attack easy users distributed in various communities.
Revised: • We propose two novel attack objectives (difﬁculty-aware and diversity-aware objectives) thatforce the RecSys attacker to attack easy users distributed in various communities.

Original: Generally,the proposed objectives could enable the easy users and unaffected real users to contribute moregradients when optimizing the parameters of the RecSys attacker.• Experiments on three real-world datasets demonstrate that the proposed attacker DADA achievessuperior performance compared with state-of-the-art attackers.
Revised: Generally,the proposed objectives could enable the easy users and unaffected real users to contribute moreweights when optimizing the parameters of the RecSys attacker.• Experiments on three real-world datasets demonstrate that the proposed attacker DADA achievessuperior performance compared with state-of-the-art attackers.

Original: Besides, extensive experimentsshow that the generated fake users indeed focus on easy users in a diverse way.
Revised: Besides, extensive experiments show that the generated fake users indeed focus on easy users in a diverse way.

Original:  Related Work
Revised:  Related Work

Original: Formally, let U and I denote users and items, respectively.
Revised: Formally, let U and I denote users and items, respectively.

Original: R 2 { 0 , 1 } | U | ⇥ | I | denotes the records of 83 user-item interactions.
Revised: R 2 { 0 , 1 } | U | ⇥ | I | denotes the records ofuser-item interactions.

Original: Speciﬁcally, each entry R [ u ][ i ] denotes whether the user u 2 U interacts with 84 the item i 2 I , and I u
Revised: Speciﬁcally, each entry R [ u ][ i ] denotes whether the user u 2 U interacts withthe item i 2 I , and I u

Original: = { i : R [ u ][ i ] = 1 } denotes the interacted item set of each user
Revised: = { i : R [ u ][ i ] = 1 } denotes the interacted item set of each user

Original: u 2 U .
Revised: u 2 U .

Original: 2.1 Recommender System
Revised: 2.1 Recommender System

Original: Recently, various RecSys [31, 30] have been proposed and deployed in the website applications, 87 which recommend the items for users that match the preference of users.
Revised: Recently, various RecSys [32, 31] have been proposed and deployed in the website applications,which recommend the items for users that match the preference of users.

Original: Formally, given users
Revised: Formally, given users

Original: U , items I , and user behaviors R 2 { 0 , 1 } | U | ⇥ | I | , RecSys M ✓ learns the latent tendency score
Revised: U , items I , and user behaviors R 2 { 0 , 1 } | U | ⇥ | I | , RecSys M ✓ learns the latent tendency score

Original: S =
Revised: S =

Original: M ✓ ( R ) 2 R | U | ⇥ | I | between users and items.
Revised: M ✓ ( R ) 2 R | U | ⇥ | I | between users and items.

Original: The parameters ✓ can be optimized as follows:
Revised: The parameters ✓ can be optimized as follows:

Original: [Equation]
Revised: [Equation]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table]
Revised: [ t ]) P i 2 I exp( S [ u ][ i ]) ) ⇥ ⇥ DADA (Ours) P u 2 Ur ^ t/ 2  u  log(1  b 1 · S [ u ][ t ]) +  ·  ( b 2 ⇤ ( S [ u ][ t ]  S 0 [ u ][ t ]  c ))

Original: X
Revised: X

Original: X where L tra ( M ✓ ⇤ ( R ) , R ) measures the training loss of RecSys model M ✓ based on latent tendency 91 S and user behaviors R .
Revised: X where L tra ( M ✓ ⇤ ( R ) , R ) measures the training loss of RecSys model M ✓ based on latent tendency 90 S and user behaviors R .

Original: Then, based on the learned tendency S , the RecSys
Revised: Then, based on the learned tendency S , the RecSys

Original: M ✓ recommends the 92 top-N un-interacted items  u with the highest tendency scores for each user u 2 U , i.e.,  u ⇢ I \ I uand |  u | = N .
Revised: M ✓ recommends the 91 top-N un-interacted items  u with the highest tendency scores for each user u 2 U , i.e.,  u ⇢ I \ I uand |  u | = N .

Original: Generally, current RecSys can be classiﬁed into three categories, i.e., neighborhood- 94 based [23, 16], matrix-factorization-based [13, 20], and neural-network-based [33, 10].
Revised: Generally, current RecSys can be classiﬁed into three categories, i.e., neighborhoodbased [24, 17], matrix-factorization-based [14, 21], and neural-network-based [34, 11].

Original: Take thefundamental matrix-factorization RecSys WRMF [13] as an example, it maps users U and items Iinto latent representations U 2 R | U | ⇥
Revised: Take thefundamental matrix-factorization RecSys WRMF [14] as an example, it maps users U and items Iinto latent representations U 2 R | U | ⇥

Original: d x and I 2 R | I | ⇥
Revised: d x and I 2 R | I | ⇥

Original: d x , respectively.
Revised: d x , respectively.

Original: Then, it predicts the tendency97 S
Revised: Then, it predicts the tendency

Original:  = UI T between users and items.
Revised: S = UI T between users and items.

Original: Particularly, WRMF takes ✓ =
Revised: Particularly, WRMF takes ✓ =

Original: { U , I } as the parameter and refor- 98 mulates Eq.
Revised: { U , I } as the parameter and reformulates Eq.

Original: (1) into arg min ✓ = { U , I }
Revised: (1) into arg min ✓ = { U , I }

Original: P u 2 U,i 2 I w ui ( S [ u ][ i ]  R [ u ][ i ]) 2 + ⌘ ( k U k 

Revised: P u 2 U,i 2 I w ui ( S [ u ][ i ]  R [ u ][ i ]) 2 + ⌘ ( k U k

Original: + k I k 22 ) .
Revised: + k I k 22 ) .

Original: wherek · k 2 is the l 2 norm distance, w ui is the weight hyperparamter to differentiate the existing and 100 un-existing interactions, and ⌘ is a regularization hyperparameter.
Revised: wherek · k 2 is the l 2 norm distance, w ui is the weight hyperparamter to differentiate the existing and 99 un-existing interactions, and ⌘ is a regularization hyperparameter.

Original: More details of recommendersystems can be referred to comprehensive surveys [31, 30].
Revised: More details of recommendersystems can be referred to comprehensive surveys [32, 31].

Original: 2.2 Injective Attacks on Recommender System
Revised: 2.2 Injective Attacks on Recommender System

Original: Given a target item that attackers are interested in, attackers can inject fake users with carefully 104 crafted behaviors into platforms.
Revised: Given a target item that attackers are interested in, attackers can inject fake users with carefullycrafted behaviors into platforms.

Original: The attacker’s goal is to affect the RecSys to promote the target iteminto
Revised: The attacker’s goal is to affect the RecSys to promote the target iteminto

Original: the top-N recommendation item list of as many real users as possible.
Revised: the top-N recommendation item list of as many real users as possible.

Original: Note that attackers can also 106 demote a target item, i.e., maximizing the number of real users whose Top-N recommendation listdoes not include the target item.
Revised: Note that attackers can alsodemote a target item, i.e., maximizing the number of real users whose Top-N recommendation listdoes not include the target item.

Original: In this paper, we focus on promotion, because attacks for demotion 108 can be constructed by a similar technique as promotion [8, 25, 6, 35, 32].
Revised: In this paper, we focus on promotion, because attacks for demotioncan be constructed by a similar technique as promotion [9, 26, 7, 36, 33].

Original: Formally, let U r and U f denote real users and fake users, respectively.
Revised: Formally, let U r and U f denote real users and fake users, respectively.

Original: Given the real user behaviors
Revised: Given the real user behaviors

Original: R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the target RecSys model M ✓ , the goal is to generate thefake user data R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget
Revised: R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the target RecSys model M ✓ , the goal is to generate thefake user data R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget

Original: | U f |   and the maximumnumber k R f
Revised: | U f |   and the maximumnumber k R f

Original: [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attack 113 objective as follows:[Equation] any u 2 U
Revised: [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attackobjective as follows:

Original: [Equation]
Revised: [Equation]

Original: where O atk ( · ) is the attack objective, L tra ( · ) is the training loss of RecSys M ✓ as Eq.
Revised: where O atk ( · ) is the attack objective, L tra ( · ) is the training loss of RecSys M ✓ as Eq.

Original: (1), and
Revised: (1), and

Original: R = 
Revised: R = 

Original: R r
Revised: R r

Original: R f  2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | is matrix concatenation.
Revised: R f  2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | is matrix concatenation.

Original: Based on this formulation, variousattackers against RecSys are mainly different from three aspects: (1).
Revised: Based on this formulation, variousattackers against RecSys are mainly different from three aspects: (1).

Original: The formulation of the attack 117 objective O atk ; (2).
Revised: The formulation of the attackobjective O atk ; (2).

Original: Technique used to optimize Eq.
Revised: Technique used to optimize Eq.

Original: Knowledge accessed by attackers.
Revised: Knowledge accessed by attackers.

Original: Formulation of O atk .
Revised: Formulation of O atk .

Original: Hit ratio [25, 6] is a common formulation, i.e., O atk ( · ) =
Revised: Hit ratio [26, 7] is a common formulation, i.e., O atk ( · ) =

Original: | U r |
Revised: | U r |

Original: P u 2 U r I ( t,  u ) , where indicator I ( t,  u ) = 1 if t is recommended in the Top-N item listof u , i.e., t 2  u .
Revised: P u 2 U r I ( t,  u ) , where indicator I ( t,  u ) = 1 if t is recommended in the Top-N item listof u , i.e., t 2  u .

Original: Also, several attackers [27, 34, 29, 35, 7, 8, 15] try to maximize the latent tendency 121 between real users and the target item, and propose several attack objective variants.
Revised: Also, several attackers [28, 35, 30, 36, 8, 9, 16] try to maximize the latent tendencybetween real users and the target item, and propose several attack objective variants.

Original: The objective details of these attackers are listed in Tab. 1.
Revised: The objective details of these attackers are listed in Tab. 1.

Original: Note that several attackers [34, 7, 27] try to minimize the 123 attack loss L atk .
Revised: Note that several attackers [35, 8, 28] try to minimize theattack loss L atk .

Original: For generality, we set their attack objective O atk =
Revised: For generality, we set their attack objective O atk =

Original:  L atk and use two notations 124 interchangeably in this paper.
Revised:  L atk and use two notations 123 interchangeably in this paper.

Original: Technique.
Revised: Technique.

Original: It is a non-trivial task to generate the exact optimal fake user behaviors R f that canachieve the maximum attack objective due to the exponential candidate search space, i.e., O ( | I | ⌧ ·| U f | ) .
Revised: It is a non-trivial task to generate the exact optimal fake user behaviors R f that canachieve the maximum attack objective due to the exponential candidate search space, i.e., O ( | I | ⌧ ·| U f | ) .

Original: 127 As shown in Tab. 1, regarding the technique that generates behaviors for injected fake users, there arethree types of attackers: heuristics-based [32, 18, 17], neural network-based [29, 25, 6], and gradient- 129 based attackers [15, 7, 34, 8, 27] .
Revised: As shown in Tab. 1, regarding the technique that generates behaviors for injected fake users, there arethree types of attackers: heuristics-based [33, 19, 18], neural network-based [30, 26, 7], and gradientbased attackers [16, 8, 35, 9, 28] .

Original: As introduced in Sec. 1, heuristics-based attackers [32, 18, 3]cannot cover various behavior patterns and do not directly optimize the attack objective, leading to un- 131 satisﬁed performance [35, 27].
Revised: As introduced in Sec. 1, heuristics-based attackers [33, 19, 3]cannot cover various behavior patterns and do not directly optimize the attack objective, leading to unsatisﬁed performance [36, 28].

Original: Instead, neural network-based attackers [29, 25, 6] propose neural networks A ' parameterized with ' to learn probability distributions of selected items for each fake user.
Revised: Instead, neural network-based attackers [30, 26, 7] propose neural networks A ' parameterized with ' to learn probability distributions of selected items for each fake user.

Original: Then, they sample fake user behaviors R f ⇠ A ' ( R r ) accordingly.
Revised: Then, they sample fake user behaviors R f ⇠ A ' ( R r ) accordingly.

Original: Formally, the parameter ' can 134 be optimized by maximizing the attack objective as max ' , ✓ E R f ⇠ A ' ( R r )
Revised: Formally, the parameter ' canbe optimized by maximizing the attack objective as max ' , ✓ E R f ⇠ A ' ( R r )

Original: [ O atk ( M ✓ ⇤ ( R ); U r , t )] .
Revised: [ O atk ( M ✓ ⇤ ( R ); U r , t )] .

Original:  Besides, gradient-based attackers
Revised: 134 Besides, gradient-based attackers

Original: A [15, 7, 34, 8, 27] relax the discrete fake user behaviors intocontinuous ˜R f 2 R | U f | ⇥ | I | .
Revised: A [16, 8, 35, 9, 28] relax the discrete fake user behaviors intocontinuous ˜R f 2 R | U f | ⇥ | I | .

Original: Then, they directly parameterize ˜R f and maximize attack objective asmax ˜ R f , ✓ O atk ( M ✓ ⇤ ( ˜ R ); U r , t ) .
Revised: Then, they directly parameterize ˜R f and maximize attack objective asmax ˜ R f , ✓ O atk ( M ✓ ⇤ ( ˜ R ); U r , t ) .

Original: After ﬁnishing the optimization of ˜R f , they use a projector functionto project the continuous user behaviors ˜R f into discrete fake behaviors R f .
Revised: After ﬁnishing the optimization of ˜R f , they use a projector functionto project the continuous user behaviors ˜R f into discrete fake behaviors R f .

Original: In this paper, we design a gradient-based attacker to generate fake user behaviors.
Revised: In this paper, we design a gradient-based attacker to generate fake user behaviors.

Original: For generality, weuse ' to denote the parameterized ˜ R f .
Revised: For generality, weuse ' to denote the parameterized ˜ R f .

Original: Speciﬁcally, existing gradient-based attackers A use gradient 141 ascent approach [22] to optimize ' by maximizing the attack objective O atk ( · ) as follows
Revised: Speciﬁcally, existing gradient-based attackers A use gradientascent approach [23] to optimize ' by maximizing the attack objective O atk ( · ) as follows

Original: [Equation]
Revised: [Equation]

Original: where ↵ is the learning rate, and O atk ( M ✓ ⇤ ( R ); u, t ) denotes the objective value of user u regardingthe target item t .
Revised: where ↵ is the learning rate, and O atk ( M ✓ ⇤ ( R ); u, t ) denotes the objective value of user u regardingthe target item t .

Original: Particularly, when a user u contributes more gradients @
Revised: Particularly, when a user u provides more gradients @

Original: O atk ( M ✓ ⇤ ( R ); u,t ) @' to optimizeparameter ' , the attacker will prioritize maximizing the user’s objective.
Revised: O atk ( M ✓ ⇤ ( R ); u,t ) @' to optimizeparameter ' , the attacker will prioritize maximizing the user’s objective.

Original: For simplicity, we use
Revised: For simplicity, we use

Original: O atk ( U r , t ) and O atk ( u, t ) to denote O atk ( M ✓ ⇤ ( R ); U r , t ) and O atk ( M ✓ ⇤ ( R ); u, t ) , respectively.
Revised: O atk ( U r , t ) and O atk ( u, t ) to denote O atk ( M ✓ ⇤ ( R ); U r , t ) and O atk ( M ✓ ⇤ ( R ); u, t ) , respectively.

Original: Knowledge.
Revised: Knowledge.

Original: Regarding the knowledge accessed by attackers, existing attackers can be classiﬁed into 147 two categories.
Revised: Regarding the knowledge accessed by attackers, existing attackers can be classiﬁed intotwo categories.

Original: White-box attackers attackers [15, 8, 7] take real user behaviors and the target RecSysparameters as inputs to generate fake user behaviors.
Revised: White-box attackers attackers [16, 9, 8] take real user behaviors and the target RecSysparameters as inputs to generate fake user behaviors.

Original: Unlike white-box attackers [15, 8, 7], gray-box 149 attackers [27, 34, 29, 35, 25, 6] assume that the target RecSys parameters are inaccessible.
Revised: Unlike white-box attackers [16, 9, 8], gray-boxattackers [28, 35, 30, 36, 26, 7] assume that the target RecSys parameters are inaccessible.

Original: Instead,the ﬁrst type of gray-box attackers [25, 6] assume that the top-N item lists of real users recommended 151 by the target RecSys are available.
Revised: Instead,the ﬁrst type of gray-box attackers [26, 7] assume that the top-N item lists of real users recommendedby the target RecSys are available.

Original: Also, the second type of gray-box attackers [27, 34, 29, 35] onlyaccess user behaviors and use a surrogate RecSys ˆ M ˆ ✓ to replace the target RecSys M ✓ in Eq.
Revised: Also, the second type of gray-box attackers [28, 35, 30, 36] onlyaccess user behaviors and use a surrogate RecSys ˆ M ˆ ✓ to replace the target RecSys M ✓ in Eq.

Original: (2), 153 which is expected to mimic the target RecSys.
Revised: (2),which is expected to mimic the target RecSys.

Original: In summary, the second type of gray-box attackersare more realistic than white-box and the ﬁrst type of gray-box.
Revised: In summary, the second type of gray-box attackersare more realistic than white-box and the ﬁrst type of gray-box.

Original: The reason is that the target RecSys 155 parameters and the recommendation lists of real users are difﬁcult to obtain.
Revised: The reason is that the target RecSysparameters and the recommendation lists of real users are difﬁcult to obtain.

Original: Instead, due to theopenness of web platforms, it is easy to collect real user behaviors [34, 27], such as movie viewing 157 history.
Revised: Instead, due to theopenness of web platforms, it is easy to collect real user behaviors [35, 28], such as movie viewinghistory.

Revised: More discussions on user behavior collection can be referred to Appx.

Revised: B.5.

Original: Thus, we focus on the second type of gray-box attacks on RecSys in this paper.
Revised: Thus, we focuson the second type of gray-box attacks on RecSys in this paper.

Original:  DADA Attacker
Revised:  DADA Attacker

Original: In this section, we introduce our attacker DADA.
Revised: In this section, we introduce our attacker DADA.

Original: We ﬁrst propose two attack objectives that consider 160 the promotion difﬁculty and the diversity of users, respectively.
Revised: We ﬁrst propose two attack objectives that considerthe promotion difﬁculty and the diversity of users, respectively.

Original: Then, we formulate a novel difﬁcultyand diversity-aware attack objective that enables our attacker DADA to simultaneously focus on easy 162 users and affect real users diversely, and propose an efﬁcient greedy-based algorithm to optimize it.
Revised: Then, we formulate a novel difﬁcultyand diversity-aware attack objective that enables our attacker DADA to simultaneously focus on easyusers and affect real users diversely, and propose an efﬁcient greedy-based algorithm to optimize it.

Original: 3.1 Difﬁculty-aware Attack Objective
Revised: 3.1 Difﬁculty-aware Attack Objective

Original: 3.1.1 Motivational Observations of Difﬁculty-agnostic
Revised: 3.1.1 Motivational Observations of Difﬁculty-agnostic

Original: As discussed in Sec. 1, given a target item and a set of real users, existing RecSys attackers more 166 focus on promoting the target item to difﬁcult users when designing fake user behaviors.
Revised: As discussed in Sec. 1, given a target item and a set of real users, existing RecSys attackers morefocus on promoting the target item to difﬁcult users when designing fake user behaviors.

Original: We ﬁrstdemonstrate several motivational observations in existing works.
Revised: Weﬁrst demonstrate several motivational observations in existing works.

Original: Without loss of generality, we 168 employ the representative and state-of-the-art gradient-based attackers, including RevAdv [27], TNA [7], and PAPU [34], to inject fake users into the ML-100K dataset [9], where fake user budget170  = 0 .|
Revised: Speciﬁcally, we employthe representative and state-of-the-art gradient-based attackers, including RevAdv [28], TNA [8],and PAPU [35], to inject fake users into the ML-100K dataset [10], where fake user budget  = [Figure]

Original:  U r | .
Revised: | U r | .

Original: Speciﬁcally, we use the representative RecSys WRMF [13] as the target RecSys M ✓ [Figure] for evaluation.
Revised: Speciﬁcally, we use the representative RecSys WRMF [14] as the target RecSys M ✓for evaluation.

Original: We ﬁrst train WRMF on ML-100K without attacks, and output the latent tendency172 S between each user u 2 U r and each item i 2 I .
Revised: We ﬁrst train WRMF on ML-100K without attacks, and output the latent tendency S between each user u 2 U r and each item i 2 I .

Original: We then randomly select an item t 2 I as the 173 target item.
Revised: We then randomly select an item t 2 I asthe target item.

Original: For simplicity and without loss of generality, we separate real users into three groupsas an example.
Revised: For simplicity and clariﬁcation, we separate real users into three groups as anexample.

Original: Speciﬁcally, if the latent tendency of a user u toward the target item S [ u ][ t ] is at thetop of { 33 . 3% , 33 . 3% ⇠ 66 .
Revised: Speciﬁcally, if the latent tendency of a user u toward the target item S [ u ][ t ] is at thetop of { 33 . 3% , 33 . 3% ⇠ 66 .

Original: 7% ⇠ 100% } largest among all items
Revised: 7% ⇠ 100% } largest among all items

Original: I , it will be regarded as{ easy, medium, difficult } users, respectively.
Revised: I , it will be regarded as{ easy, medium, difficult } users, respectively.

Original: Then, we can obtain three groups { U e , U m , U d } .
Revised: Then, we can obtain three groups { U e , U m , U d } .

Original: For simplicity and clariﬁcation, we show the result of RevAdv in Fig.
Revised: For simplicity and clariﬁcation, we show the result of RevAdv in Fig.

Original: 1 and similar results of TNA 178 and PAPU in Appx.
Revised: 1 and similar results of TNAand PAPU in Appx.

Original: A.1.1.
Revised: A.1.1.

Original: For each group U g 2 { U e , U m , U d } , we show its average gradient foroptimizing the attacker parameter ' in Fig.
Revised: For each group U g 2 { U e , U m , U d } , we show its average gradient foroptimizing the attacker parameter ' in Fig.

Original: 1 (a), i.e., 
Revised: 1 (a), i.e., P

Revised: [Equation]

Revised: [Equation]

Revised: ) k| U

Revised: [Equation]

Revised: |

Original: [Figure]
Revised: [Equation]

Revised: | U f |·| I | ) .

Original: We can easily observethat the loss and gradient are directly proportional to the degree of difﬁculty.
Revised: We can easily observethat the loss and gradient are directly proportional to the degree of difﬁculty.

Original: In other words, the 181 more difﬁcult it is, the greater loss or gradient it is.
Revised: In other words, themore difﬁcult it is, the greater loss or gradient it is.

Original: It indicates that RevAdv puts more efforts topromote the target item to difﬁcult and medium users than easy users.
Revised: It indicates that RevAdv puts more efforts topromote the target item to difﬁcult and medium users than easy users.

Original: Then, we investigate the hit 183 ratio of 50 (HR@50) performance on three different user groups.
Revised: Then, we investigate the hitratio of 50 (HR@50) performance on three different user groups.

Original: As illustrated in Fig.
Revised: As illustrated in Fig.

Original: 1 (b), despitethat RevAdv puts more effort on medium and difﬁcult users, the HR@50 of them is only marginally 185 improved.
Revised: 1 (b), despitethat RevAdv puts more effort on medium and difﬁcult users, the HR@50 of them is only marginallyimproved.

Original: Moreover, putting more effort on medium and difﬁcult users leads that the HR@50 ofeasy users increases unstably.
Revised: Moreover, putting more effort on medium and difﬁcult users leads that the HR@50 ofeasy users increases unstably.

Original: Therefore, with a limited budget for fake users, it is preferable to 187 concentrate on easy users, as it is easier to promote the target item for them.
Revised: Therefore, with a limited budget for fake users, it is preferable toconcentrate on easy users, as it is easier to promote the target item for them.

Original: 3.1.2 Insights on Difﬁculty-agnostic Issue
Revised: 3.1.2 Insights on Difﬁculty-agnostic Issue

Original: Motivated by the observations, we plan to design a new difﬁculty-aware attack objective, which 190 enables attackers to focus on easy users primarily and achieve more recommendation gain.
Revised: Motivated by the observations, we plan to design a new difﬁculty-aware attack objective, whichenables attackers to focus on easy users primarily and achieve more recommendation gain.

Original: Thebasic idea is to enable easier users to contribute more gradients when optimizing the attacker’s192 parameter ' .
Revised: The basicidea is to let easier users outweigh difﬁcult users when optimizing the attacker’s parameter ' .

Original: As introduced in Eq.
Revised: Asintroduced in Eq.

Original: (3), the gradients for optimizing attack parameter ' that eachuser can contribute are related to the attack objective O atk .
Revised: (3), the gradients for optimizing attack parameter ' that each user provides arerelated to the attack objective O atk .

Original: Particularly, due to the chain rule, thegradients @
Revised: Particularly, due to the chain rule, the gradients @

Original: O 
Revised: O atk ( u,t ) @' ofeach user u 2 U r can be formulated as @

Original: [Equation] ( u,t 
Revised: O atk ( u,t ) @'

Original: [Equation]
Revised: = @

Original: @' of each user u 2 U r can be formulated as [Equation] where @
Revised: O atk ( u,t ) @ S [ u ][ t ] · @ S [ u ][ t ] @' , where @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] only relates attacker objective design.
Revised: S [ u ][ t ] onlyrelates attacker objective design.

Original: S [ u ][ t ] @' only relies on the attacker parameters,which is ﬁxed and unrelated to attack objective O atk ( · ) .
Revised: S [ u ][ t ] @' only relies on the attacker parameters, which is ﬁxed andunrelated to attack objective O atk ( · ) .

Original: Thus, we can increase the @
Revised: Thus, we can increase the @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] ofeasier user to let them contribute more gradients.
Revised: S [ u ][ t ] of easier user to let themmore determine the optimization direction of attacker parameters.

Original: Besides, if a user has received the target item in the198 Top-N recommendationitem list, it indicates that the RecSys has promoted the target item to thisuser successfully.
Revised: Besides, if a user has received thetarget item in the Top-N recommendation list, it indicates that the RecSys has promoted the targetitem to this user successfully.

Original: Thus, this user should not contribute any gradient, because increasing its tendency 200 toward the target item will not have any improvement on the recommendation gain.
Revised: Thus, this user should not provide any gradient, because increasing itstendency toward the target item will not have any improvement on the recommendation gain.

Original: Based on the above analysis, the difﬁculty-aware attack objective should satisfy two difﬁculty 202 properties : (1) given two users u
Revised: Based on the above analysis, the difﬁculty-aware attack objective should satisfy two difﬁcultyproperties : (1) given two users u

Original: and v ,
Revised: and v ,

Original: if the tendency score S [ v ][ t ] < S
Revised: if the tendency score S [ v ][ t ] < S

Original: [ u ][ t ] and t / 2  u ,
Revised: [ u ][ t ] and t / 2  u ,@

Original: [Equation] S [ [Equation]
Revised: O atk ( v,t ) @

Original: [Equation] ] < @
Revised: S [ v ][ t ] < @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] .
Revised: S [ u ][ t ] .

Original: (2) if the target item t 2  u , @
Revised: (2) if the target item t 2  u , @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] = 0 .
Revised: S [ u ][ t ] = 0 .

Original: As shown in Tab. 1, the attackobjectives of existing attackers do not satisfy both properties simultaneously.
Revised: As shown in Tab. 1, the attackobjectives of existing attackers do not satisfy both properties simultaneously.

Original: In this paper, based onthe two properties, we formulate a difﬁculty-aware attack objective.
Revised: In this paper, based onthe two properties, we formulate a difﬁculty-aware attack objective.

Original: Formally, given the tendency ˆ Slearned by the surrogate RecSys ˆ M ˆ ✓ , the target item t , the difﬁculty-aware attack objective regarding 207 each real user u 2 U r is formulated as follows:
Revised: Formally, given the tendency ˆ Slearned by the surrogate RecSys ˆ M ˆ ✓ , the target item t , the difﬁculty-aware attack objective regardingeach real user u 2 U r is formulated as follows:

Original: [Equation]
Revised: [Equation]

Original: where b 1 is a positive hyperparameter.
Revised: where b 1 is a positive hyperparameter.

Original: Furthermore, we use the following Proposition 1 to show that209 Eq.
Revised: Furthermore, we use the following Proposition 1 to show that Eq.

Original: (4) enables easier users tocontribute more gradients to the attack parameter optimization.
Revised: (4) enables easier users to more dominate the the attack parameter optimization than difﬁcultusers.

Original: Due tospace limit, we put the proof in Appx.
Revised: Due to space limit, we put the proof in Appx.

Original: A.2.1.
Revised: A.2.1.

Original: Proposition 1.
Revised: Proposition 1.

Original: Our difﬁculty-aware attack objective satisﬁes difﬁculty property 1 and property 2.
Revised: Our difﬁculty-aware attack objective satisﬁes difﬁculty property 1 and property 2.

Original: 3.2 Diversity-aware Attack Objective3.2.1 Motivational Observations of Diversity-deﬁcit
Revised: 3.2 Diversity-aware Attack Objective

Revised: 3.2.1 Motivational Observations of Diversity-deﬁcit

Original: As introduced in Sec. 1, existing attackers have the diversity-deﬁcit issue that the generated fake be- 215 haviors are dominated by large communities, where users in each community have similar preferences. 
Revised: As introduced in Sec. 1, existing attackers have the diversity-deﬁcit issue that the generated fakebehaviors are dominated by large communities, where users in each community have similar preferences. Speciﬁcally, as introduced in Eq.

Revised: (3), each real user u 2 U r will provide gradients to optimizethe attackers’ parameters ' .

Revised: Since similar real users have similar preferences on items, real users canform several communities { C j } n c j =1 , where each community C j has n j real users.

Revised: Thus, from thecommunity perspective, the optimization process of the attacker parameter ' via maximizing the attack objective O atk ( · ) can be reformulated as follows:

Original: Similar to Sec.
Revised: [Equation] Intuitively, users in the same community who are similar will give the gradients in similar directions. Thus, there is a potential risk that the large communities C k will dominate the optimization directionof attacker parameter ' via [Equation]

Revised: Consequently, this community will dominate the generated fake user behaviors.

Revised: The generated fake user behaviors can only manipulate thetarget RecSys to promote the target item to the dominated communities.

Revised: In another words, the target

Revised: RecSys is incapable of promoting the target item to more users in other communities diversely.

Revised: Similar to Sec.

Original: 3.1.1, we demonstrate several motivational observations.
Revised: 3.1.1, we demonstrate several motivational observations.

Original: We use state-of-the-art 217 gradient-based attackers RevAdv [27], TNA [7], and PAPU [34], and neural network-based attacker
Revised: We use state-of-the-artgradient-based attackers RevAdv [28], TNA [8], and PAPU [35], and neural network-based attacker

Original: TrialAttack [29], to generate 0 . 

Revised: TrialAttack [30], to generate 0 .

Original: | U r | fake users and inject them into the ML-100k dataset [9].
Revised: | U r | fake users and inject them into the ML-100k dataset [10].

Original: Then, 219 we train the target RecSys WRMF and study the attacking results.
Revised: Then,we train the target RecSys WRMF and study the attacking results.

Original: For simplicity and clariﬁcation, we put the result of RevAdv in Fig.
Revised: For simplicity and clariﬁcation, weput the result of RevAdv in Fig.

Original: 1 and similar results of TNA,221 PAPU, and TrialAttack in Appx.
Revised: 1 and similar results of TNA, PAPU, and TrialAttack in Appx.

Original: A.1.2.
Revised: A.1.2.

Original: Following [27], we extract the representations of real andfake users learned by WRMF, and use PCA [1] to visualize them.
Revised: Following [28], we extract the representations of real and fake users learned by WRMF, and use PCA [1] to visualize them.

Original: Without loss of generality, based 223 on the result of PCA, we separate real users into three communities by KMeans [14].
Revised: Based on the result of PCA, we separate real users into three communitiesby KMeans [15].

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 1 (a), the fake users (blue points) tend to form a cluster that is distributed in the community 1225 (yellow points).
Revised: 1 (a), the fake users (blue points) tend to form a cluster that isdistributed in the community 1 (yellow points).

Original: It indicates that community 1 dominates the generated fake users.
Revised: It indicates that community 1 dominates the generatedfake users.

Original: It is because usersin the same community will generate gradients with similar directions.
Revised: It is because users in the same community will generate gradients with similar directions.

Original: Thus, large communities227 with more users are more likely to dominate the optimization directions of the attacker parameter.
Revised: Thus, large communities with more users are more likely to dominate the optimization directionsof the attacker parameter.

Original: Consequently, RecSys can only be affected by the generated fake user behaviors to recommend the229 target item to more users in the community 1.
Revised: Consequently, RecSys can only be affected by the generated fake userbehaviors to recommend the target item to more users in the community 1.

Original: To verify this, we list the hit ratio 50 (HR@50) of each community before and after injecting fake 231 users in Fig.
Revised: To verify this, we list the hit ratio 50 (HR@50) of each community before and after injecting fakeusers in Fig.

Original: 1 (d).
Revised: 1 (d).

Original: It shows that the generated fake users improve the HR@50 of the community 1signiﬁcantly, while maintaining similar HR@50 in the other two communities.
Revised: It shows that the generated fake users improve the HR@50 of the community 1signiﬁcantly, while maintaining similar HR@50 in the other two communities.

Original: To enable RevAdv to 233 affect users diversely, we add our formulated diversity-aware attack objective (see Sec. 3.2.2) into
Revised: To enable RevAdv toaffect users diversely, we add our formulated diversity-aware attack objective (see Sec. 3.2.2) into

Original: RevAdv’s objective.
Revised: RevAdv’s objective.

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 1 (d), RevAdv+Diverse improves HR@50 of community 2 235 and 3.
Revised: 1 (d), RevAdv+Diverse improves HR@50 of community 2and 3.

Original: Particularly, HR@50 on community 1 increases as well.
Revised: Particularly, HR@50 on community 1 increases as well.

Original: As described in Sec.
Revised: As described in Sec.

Original: 3.1.1, RevAdvmore focuses on difﬁcult users, thus the generated fake user behaviors may not be able to affect the 237 target RecSys to recommend the target item to other less difﬁcult users in community 1.
Revised: 3.1.1, RevAdvmore focuses on difﬁcult users, thus the generated fake user behaviors may not be able to affect thetarget RecSys to recommend the target item to other less difﬁcult users in community 1.

Original: Fortunately,the diverse-aware objective allows RevAdv to put more efforts on these users, thereby improving the 239 performance of community 1.
Revised: Fortunately,the diverse-aware objective allows RevAdv to put more efforts on these users, thereby improving theperformance of community 1.

Original: 3.2.2 Insights on Diversity-deﬁcit Issue
Revised: 3.2.2 Insights on Diversity-deﬁcit Issue

Original: Motivated by these observations, we propose a diversity-aware attack objective that enables fake 242 user behaviors to affect real users diversely.
Revised: Motivated by these observations, we propose a diversity-aware attack objective that enables fake userbehaviors to affect real users diversely.

Revised: The basic idea is that if the real users are less affected by fakeuser behavior, the diversity-aware objective will concentrate on these real users in the subsequentgradient computation process.

Revised: Then, the attacker will be optimized to generate fake user behaviorsthat can affect these users.

Revised: In such a way, users in different communities can be affected diversely.

Original: Speciﬁcally, the inﬂuence of fake user behaviors oneach user regarding the target item can be measured by the difference between tendencies before244 and after attacks.
Revised: Speciﬁcally, the inﬂuence of fake user behaviors on each user regarding the target item can bemeasured by the difference between tendencies before and after attacks.

Original: Formally, let S 0 and S denote the tendencies learned by RecSys{+
+}
Revised: Formally, let S {+
+}

Original:  M before and245 after attacks, the inﬂuence of fake user behaviors R f on user u regarding the target item t iscomputed by 4 S [ u ][ t ] =
Revised: and S denotethe tendencies learned by RecSys M before and after attacks, the inﬂuence of fake user behaviors R f on user u regarding the target item t is computed by 4 S [ u ][ t ] =

Original: S [ u ][ t ]  S 

Revised: S [ u ][ t ]  S

Original: [ u ][ t ] .
Revised: [ u ][ t ] .

Original: To enable attackers to inﬂuence more real users, the247 attack objective should enable users with a smaller 4 S [ u ][ t ] to contribute more gradients to theoptimization of attacker parameter ' .
Revised: To enableattackers to affect more real users, the attack objective should focus on users with a smaller 4 S [ u ][ t ]when optimizing the attacker parameter ' .

Original: Speciﬁcally, according to the chain rule and @ 4 S [ u ][ t ] @
Revised: Speciﬁcally, according to the chain rule and @ 4 S [ u ][ t ] @

Original: S [ u ][ t ] = 1 ,the gradients @
Revised: S [ u ][ t ] = 1 ,the gradients @

Original: O atk ( u,t ) @' regarding the attacker parameter ' in Eq.
Revised: O atk ( u,t ) @' regarding the attacker parameter ' in Eq.

Original: (3) of each user u 2 U r can beformulated as @
Revised: (3) of each user u 2 U r can beformulated as @

Original: O atk ( u,t ) @' 
Revised: O atk ( u,t ) @' =

Original: = @
Revised: [Equation] O [Equation]

Original: O atk ( u,t ) @ 4 S [ u ][ t ] · @ S [ u ][ t ] @' .
Revised: ( u,t ) [Equation] 4 S [ u ][ t ] · @ S [ u ][ t ] @' .

Original: Thus, we can increase the @
Revised: Thus, we can increase the @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] of real userswith smaller inﬂuence 4 S [ u ][ t ] , which lets themcontribute more gradients.
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] of real userswith smaller inﬂuence 4 S [ u ][ t ] to let them more determine the attacker parameter optimizationdirection.

Original: Similar to Sec.
Revised: Similar to Sec.

Original: 3.1.2,252 the diversity-aware attacker objective should satisfy two diversity properties : (1) given two users uand v , if 4 S [ v ][ t ] > 4 S [ u ][ t ] , and t / 2  u , @
Revised: 3.1.2, the diversity-aware attacker objective should satisfy two diversity properties : (1) given two users u and v , if 4 S [ v ][ t ] > 4 S [ u ][ t ] , and t / 2  u , @

Original: O atk ( v,t ) @ 4 S [ v ][ t ] < @
Revised: O atk ( v,t ) @ 4 S [ v ][ t ] < @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] ; (2) if the target item t has beenrecommended to a user u , the user u should have no effect on the attackers’ parameter optimization,i.e., if t 2  u , @
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] ;(2) if the target item t has been recommended to a user u , the user u should have no effect on theattackers’ parameter optimization, i.e., if t 2  u , @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] = 0 .
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] = 0 .

Original: Obviously, existing attackers do not satisfy both properties because they do not consider the difference 257 of tendency between before and after attacks.
Revised: Obviously, existing attackers do not satisfy both properties because they do not consider the differenceof tendency between before and after attacks.

Original: Based on the two properties, we formulate a diversityaware attack objective.
Revised: Based on the two properties, we formulate a diversityaware attack objective.

Original: Formally, given the target item t , and the real user u 2 U r , let ˆ S 0 and ˆS denotethe tendencies learned by the surrogate RecSys ˆ M ˆ ✓ before and after injecting fake user behaviors
Revised: Formally, given the target item t , and the real user u 2 U r , let ˆ S 0 and ˆS denotethe tendencies learned by the surrogate RecSys ˆ M ˆ ✓ before and after injecting fake user behaviors

Original: R f , the diversity-aware objective on each user u 2 U r regarding the target item t is computed as:
Revised: R f , the diversity-aware objective on each user u 2 U r regarding the target item t is computed as:

Original: [Equation]
Revised: [Equation]

Original: where c = min v 2 U r ( ˆS [ v ][ t ]  ˆS 

Revised: where c = min v 2 U r ( ˆS [ v ][ t ]  ˆS

Original: [ v ][ t ]) is a constant for normalization, and b 2 is a positive hyperpa- 262 rameter to scale the tendency difference.
Revised: [ v ][ t ]) is a constant for normalization, and b 2 is a positive hyperparameter to scale the tendency difference.

Original:  ( x ) = 1 1+exp(  x ) is the Sigmoid function.
Revised:  ( x ) = 1 1+exp(  x ) is the Sigmoid function.

Original: Additionally,we use Proposition 2 to show that Eq.
Revised: Additionally,we use Proposition 2 to show that Eq.

Original: (5) enables users with a smaller 4 ˆS [ u ][ t ] to contribute more 264 gradients to the attack parameter optimization.
Revised: (5) enables users with a smaller 4 ˆS [ u ][ t ] to contribute moreweights to the attack parameter optimization.

Original: Due to space limit, we put the proof in Appx.
Revised: Due to space limit, we put the proof in Appx.

Original: A.2.2.
Revised: A.2.2.

Original: Proposition 2.
Revised: Proposition 2.

Original: Our diversity-aware attack objective satisﬁes diversity property 1 and property 2.
Revised: Our diversity-aware attack objective satisﬁes diversity property 1 and property 2.

Original: 3.3 Difﬁculty and Diversity Aware Attacker
Revised: 3.3 Difﬁculty and Diversity Aware Attacker

Original: 3.3.1 Problem Formulation
Revised: 3.3.1 Problem Formulation

Original: Based on two measurements proposed in Eq.
Revised: Based on two measurements proposed in Eq.

Original: (4) and Eq.
Revised: (4) and Eq.

Original: (5), we formally formulate the Difﬁculty- 269 Aware and Diversity-Aware (DADA) RecSys attacking problem as follows.
Revised: (5), we formally formulate the DifﬁcultyAware and Diversity-Aware (DADA) RecSys attacking problem as follows.

Original: Deﬁnition 1 (DADA Problem) .
Revised: Deﬁnition 1 (DADA Problem) .

Original: Given the real user behaviors R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t ,and the surrogate RecSys ˆ M ˆ ✓ , the goal is to generate the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I |with the constraints, injection budget | U f |   and the maximum number k R f
Revised: Given the real user behaviors R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t ,and the surrogate RecSys ˆ M ˆ ✓ , the goal is to generate the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I |with the constraints, injection budget | U f |   and the maximum number k R f

Original: [ u ] k 0  ⌧ of items 273 that each fake user can interact with, which can maximize the attack objective as follows:[Equation]
Revised: [ u ] k 0  ⌧ of items 286 that each fake user can interact with, which can maximize the attack objective as follows:

Original: [Equation]
Revised: [Equation]

Original: where  is a trade-off hyperparamter, R 2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | concatenates the real and fake userrepresentations, ˆS and ˆS 0 are the learned latent tendencies of the surrogate RecSys
Revised: where  is a trade-off hyperparamter, R 2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | concatenates the real and fake userrepresentations, ˆS and ˆS 0 are the learned latent tendencies of the surrogate RecSys

Original: ˆ M ˆ ✓ on R and
Revised: ˆ M ˆ ✓ on R and

Original: R r , respectively.
Revised: R r , respectively.

Original: L tra ( · ) is the training loss of ˆ M ˆ ✓ as in Eq.
Revised: L tra ( · ) is the training loss of ˆ M ˆ ✓ as in Eq.

Original: 3.3.2 Greedy Algorithm
Revised: 3.3.2 Greedy Algorithm

Original: Input: Real user behaviors R r , the surrogate RecSys ˆ M ˆ ✓ , the target item t , fake user budget | U f | , the maximum number ⌧ of items that each fake user can select, the predeﬁned threshold th , the epoch number L , and learning rate ↵ .
Revised: [Table]

Original: Output: Fake use behaviors R f 2 { 0 , 1 } | U f | ⇥ | I | 1 Initialize R f 2 { 0 , 1 } | U f | ⇥ | I | 2 for l = 1 to L do
Revised: 0 , 1 } | U f | ⇥ | I | 2 for l = 1 to L do

Original: R =
Revised: R =

Original: [ R r , R f ]
Revised: [ R r , R f ]

Original: ˆ ✓ ⇤ = arg min ˆ ✓ L tra ( ˆ M ˆ ✓ ( R ) , R )
Revised: ˆ ✓ ⇤ = arg min ˆ ✓ L tra ( ˆ M ˆ ✓ ( R ) , R )

Original: Compute O atk ( · )
Revised: Compute O atk ( · )

Original: Eq.
Revised: Eq.

Original: (6) ˜R f
Revised: (6) ˜R f

Original: = Continuous ( R f ) ˜R f = ˜R f + ↵ · r ˜R f O atk ( · )
Revised: = Continuous ( R f ) ˜R f = ˜R f + ↵ · r ˜R f O atk ( · )

Original: R f =
Revised: R f =

Original: Proj ( ˜ R f ; ⌧ ,th ) 9 Return R f
Revised: Proj ( ˜R f ; ⌧ , th ) 9 Return R f

Original: Due to the exponential search space
Revised: Due to the exponential search space

Original: O ( | I | ⌧ ·| U f | ) , it is nontrivial to ﬁnd the 280 exact optimal fake user behaviors for thedifﬁculty-aware and diversity-aware optimiza- 282 tion problem in Eq (6).
Revised: O ( | I | ⌧ ·| U f | ) , it is nontrivial to ﬁnd theexact optimal fake user behaviors for thedifﬁculty-aware and diversity-aware optimization problem in Eq (6).

Original: Thus, we prose agradient-based greedy algorithm to maximize 284 the objective in Alg. 1.
Revised: Thus, we propose agradient-based greedy algorithm to maximizethe objective in Alg. 1.

Original: With the help of 285 gradients, our algorithm can give a gooddirection to ﬁnd effective fake user behaviors.
Revised: With the help ofgradients, our algorithm can give a gooddirection to ﬁnd effective fake user behaviors.

Original: Speciﬁcally, we ﬁrst initialize the fake userbehaviors R f 2 { 0 , 1 } | U f | ⇥ | I | (line 1).
Revised: Speciﬁcally, we ﬁrst initialize the fake userbehaviors R f 2 { 0 , 1 } | U f | ⇥ | I | (line 1).

Original: In eachepoch l , we ﬁrst train the surrogate model ˆ M ˆ ✓ 290 on R , and then compute the attack objective
Revised: In eachepoch l , we ﬁrst train the surrogate model ˆ M ˆ ✓on R , and then compute the attack objective

Original: O atk ( · ) in Eq.
Revised: O atk ( · ) in Eq.

Original: (6) (line 4-5).
Revised: (6) (line 4-5).

Original: Second, we relaxthe discrete fake user behaviors R f into acontinuous one ˜R f 2 R | U f | ⇥ | I | , and take it as 294 our attacker’s parameter ' (line 6).
Revised: Second, we relaxthe discrete fake user behaviors R f into acontinuous one ˜R f 2 R | U f | ⇥ | I | , and take it asour attacker’s parameter ' (line 6).

Original: Then, wecompute the gradients r ˜R f O atk ( · ) accordingto [27] (line 7).
Revised: Then, we compute the gradients r ˜R f O atk ( · ) according to [28] (line 7).

Original: Finally, we update the ˜R f and utilize a projector to map it into discrete behaviors297 R f , where each fake user can select ⌧ items at most (line 8).
Revised: Finally, we update the ˜R f and utilize a projector to map it into discrete behaviors R f , whereeach fake user can select ⌧ items at most (line 8).

Original: Formally, given the continuous userbehaviors ˜R f , the maximum number ⌧ of items that each fake user u 2 U f can interact with, and thepre-deﬁned threshold th , the projector is formulated as follows:
Revised: Formally, given the continuous user behaviors ˜R f ,the maximum number ⌧ of items that each fake user u 2 U f can interact with, and the pre-deﬁnedthreshold th , the projector is formulated as follows:

Original: [Equation]
Revised: [Equation]

Original: where P u is top- ⌧ largest item set of user u according to the value in ˜R f [ u ] .
Revised: where P u is top- ⌧ largest item set of user u according to the value in ˜R f [ u ] .

Original: After ﬁnishing L epochs,we output R f for injection.
Revised: After ﬁnishing L epochs,we output R f for injection.

Original: We analyze the time complexity of Alg. 1 in Appx.
Revised: We analyze the time complexity of Alg. 1 in Appx.

Original: A.3.
Revised: A.3.

Original: [Table]

Original: [Table]

Original:  Experiments4.1 Experiment Setting
Revised:  Experiments

Revised: 4.1 Experiment Setting

Original: [Table]

Original: Datasets.
Revised: Datasets.

Original: We evaluate our attacker on widely used three real-world datasets: MovieLens-100k 305 (ML-100k)
Revised: We evaluate our attacker on widely used three real-world datasets: MovieLens-100k(ML-100k)

Original: [9], MovieLens-1M (ML-1M) [9], and Gowalla [4].
Revised: [10], MovieLens-1M (ML-1M) [10], and Gowalla [4].

Original: We put the descriptions of threedatasets in Appx.
Revised: We put the descriptions of threedatasets in Appx.

Original: B.1.
Revised: B.1.

Original: Attacker Baselines.
Revised: Attacker Baselines.

Original: To verify the effectiveness of our proposed attacker, we compare our proposed 308 attacker DADA with the three types of attackers in Tab. 1.
Revised: To verify the effectiveness of our proposed attacker, we compare our proposedattacker DADA with the three types of attackers in Tab. 1.

Original: Speciﬁcally, heuristic-based attacks includes Random [34, 8] and Popular [34, 17], neural network-based attacker includes TrialAttack [29], 310 and gradient-based includes CoVis [32], PGA [15], SGLD [15], SRWA [8], TNA [7], RevAdv [27],and PAPU [34].
Revised: Speciﬁcally, heuristic-based attacks includes Random [35, 9] and Popular [35, 18], neural network-based attacker includes TrialAttack [30],and gradient-based includes CoVis [33], PGA [16], SGLD [16], SRWA [9], TNA [8], RevAdv [28],and PAPU [35].

Original: Particularly, we do not compare PoisonRec [25] and CopyAttack [6] in Tab. 1, 312 because they need to access the predictions of the target RecSys for real users, which is impractical.
Revised: Particularly, we do not compare PoisonRec [26] and CopyAttack [7] in Tab. 1,because they need to access the predictions of the target RecSys for real users, which is impractical.

Original: Also, we compare two variants: DADA-DICT and DADA-DIV, which only optimize the difﬁculty 314 and diversity-aware objective in Eq.
Revised: Also, we compare two variants: DADA-DICT and DADA-DIV, which only optimize the difﬁcultyand diversity-aware objective in Eq.

Original: (4) and Eq.
Revised: (4) and Eq.

Original: (5), respectively.
Revised: (5), respectively.

Original: Targeted Recommender Systems.
Revised: Targeted Recommender Systems.

Original: Following [34, 27], we choose three representative target Rec- 316 Sys to evaluate the attacking performance of RecSys attackers, i.e., matrix factorization-based
Revised: Following [35, 28], we choose three representative target RecSys to evaluate the attacking performance of RecSys attackers, i.e., matrix factorization-based

Original: WRMF [13], neural network-based NCF [11], and graph neural network-based LightGCN [10].
Revised: WRMF [14], neural network-based NCF [12], and graph neural network-based LightGCN [11].

Original: Target Items and Evaluation Metric.
Revised: Target Items and Evaluation Metric.

Original: Following [34, 27], we uniformly sample 5 items as a target 319 item set I t and measure the hit ratio Hit@N of I t on the real users U r .
Revised: Following [35, 28], we uniformly sample 5 items as a targetitem set I t and measure the hit ratio Hit@N of I t on the real users U r .

Original: If one of these target items 320 appears in the top-N recommended item list of a user u 2 U r , the target item set is considered as ahit, i.e., Hit @ N[-= P u 
-]
Revised: If one of these target itemsappears in the top-N recommended item list of a user u 2 U r , the target item set is considered asa hit, i.e., Hit @ N[-= P u 
-]

Original: Ur I ( I t ,  u ) | U r | where I ( I t ,   u )
Revised: [Equation] where I ( I t ,  u ) = 1 if 9 t 2 I t , t 2  u . Besides, we use the

Original: = 1 if 9 t 2 I t , t 2  u .
Revised: Normalized Discounted Cumulative Gain (NDCG) to measure the rank quality of the target itemsin the recommendation list. Speciﬁcally, we set the relevance score of target items and the otheritems for all real users as 1 and 0, respectively. Then, a higher NDCG value indicates better attackperformance, where target items are ranked higher in the recommendation list. The reported resultsare averaged over three runs.

Original: Hyperparamter Setting.
Revised: Hyperparamter Setting.

Original: Due to datasets with different sizes, we set the fake user budget  = 323  1 ·| U r | and the maximum number of selected items ⌧ =  2 ·| I | , where  1 and  2 are the parameters 324 to control  and ⌧ .
Revised: Due to datasets with different sizes, we set the fake user budget  = 1 ·| U r | and the maximum number of selected items ⌧ =  2 ·| I | , where  1 and  2 are the parameters 341 to control  and ⌧ .

Revised: ML-100k, ML-1M, and Gowalla, respectively.

Original: The details about hyper-parameter settings are listed in Appx.
Revised: The details about hyper-parametersettings are listed in Appx.

Original: B.2.
Revised: B.2.

Original: 4.2 Experiment Results
Revised: 4.2 Experiment Results

Original: We report the  performance of attackers on ML-100k and ML-1M in Tab. 2 and Tab. 3, and report327 similar results of Gowalla in Appx.
Revised: We report the HR performance of attackers on ML-100k and ML-1M in Tab. 2 and Tab. 3. To bettershow the improvement, we add the improvement ratio of HR@10 for each attacker compared withthe result in clean data. Due to space limit, we report similar results of Gowalla in Appx.

Original: B.3.
Revised: B.3.

Original: Under the same target RecSys, the bold and underlinednumbers indicate the ﬁrst and second best performance, respectively. [Figure]
Revised: Wereport results three

Original: Baseline Comparison.
Revised: Baseline Comparison.

Original: As shown in Tab. 2 and Tab. 3, our attacker DADA outperforms all baselines 330 under different target RecSys on both ML-100k and ML-1M datasets.
Revised: As shown in Tab. 2 and Tab. 3, our attacker DADA outperforms all baselinesunder different target RecSys on both ML-100k and ML-1M datasets.

Original: Speciﬁcally, heuristics-basedapproaches, such as Random, Popular, and CoVis, achieve unsatisﬁed results.
Revised: Speciﬁcally, heuristics-basedapproaches, such as Random, Popular, and CoVis, achieve unsatisﬁed results.

Original: Because they only 332 consider to increase the co-occurrence between several items and the target items, which does notrelate to the attack objective directly and cannot cover various behavior patterns [27, 35, 34].
Revised: Because they onlyconsider to increase the co-occurrence between several items and the target items, which does notrelate to the attack objective directly and cannot cover various behavior patterns [28, 36, 35].

Original: Instead, 334 neural network-based and gradient-based attackers optimize the attack objective directly. 
Revised: Instead,neural network-based and gradient-based attackers optimize the attack objective directly. Compared [Table] [Table]

Revised: with TrialAttack

Revised: [Table]

Original: Comparedwith TrialAttack, RevAdv and PAPU, several gradient-based attackers, including SRWA, PGA,336 SGLD, and TNA, achieve inferior performance.
Revised: RevAdv and PAPU [Table] several gradient-based attackers, including SRWA, PGA, SGLD, and TNA, achieve inferior performance.

Original: It is because when computing the gradients to designfake user behaviors, these approaches approximate the gradients in a biased way instead of exact 338 computing gradients [27].
Revised: It is because when computing the gradients to designfake user behaviors, these approaches approximate the gradients in a biased way instead of exactcomputing gradients [28].

Original: Our attacker DADA outperforms the above baselines signiﬁcantly, becauseit enables the fake user behaviors to affect real users in a diverse manner.
Revised: Our attacker DADA outperforms the above baselines signiﬁcantly, becauseit enables the fake user behaviors to affect real users in a diverse manner.

Original: Ablation Study.
Revised: Ablation Study.

Original: As shown in Tab. 2 and Tab. 3, DADA-DICT achieves the second best results, 341 outperforming all baselines.
Revised: As shown in Tab. 2 and Tab. 3, DADA-DICT achieves the second best results,outperforming all baselines.

Original: It is because the difﬁculty-aware attack objective allows DADA-DICTto concentrate on easy users with high tendencies toward the target items.
Revised: It is because the difﬁculty-aware attack objective allows DADA-DICTto concentrate on easy users with high tendencies toward the target items.

Original: Moreover, DADA-DIV 343 achieves satisﬁed performance.
Revised: Moreover, DADA-DIVachieves satisﬁed performance.

Original: It outperforms current state-of-the-art attackers, including RevAdvand PAPU, in most cases.
Revised: It outperforms current state-of-the-art attackers, including RevAdvand PAPU, in most cases.

Original: It is because the diversity-aware attack objective allows the generated 345 fake user behaviors to affect real users more diversely, avoiding large communities dominating thegenerated fake users.
Revised: It is because the diversity-aware attack objective allows the generatedfake user behaviors to affect real users more diversely, avoiding large communities dominating thegenerated fake users.

Original: Nevertheless, DADA-DIV does not outperform DADA-DICT, because DADA- 347 DIV cannot differentiate easy users from all real users and put more efforts on them.
Revised: Nevertheless, DADA-DIV does not outperform DADA-DICT, because DADADIV cannot differentiate easy users from all real users and put more efforts on them.

Original: Furthermore,
Revised: Furthermore,

Original: DADA that considers both user difﬁculty and diversity can perform the best.
Revised: DADA that considers both user difﬁculty and diversity can perform the best.

Original: In such way, it can 349 potentially affect easy users from different communities, thereby boosting attacker’s effectiveness.
Revised: In such way, it canpotentially affect easy users from different communities, thereby boosting attacker’s effectiveness.

Original: 4.3 Parameter Sensitivity
Revised: 4.3 More Insights via Empirical Study

Original: 351 In this subsection, we evaluate DADA under different parameters. As shown in Tab 2 and Tab. 3,the results of DADA and baselines on different target RecSys and hit ratios have similar trends.

Original: For 353 simplicity and clariﬁcation, we use WRMF and HR@50 for evaluation. Fake User Budget  . As introduced in Sec. 4.1, the fake user budget  =  1 · | U r | is controlled by 355  1 .
Revised: Due to space limit, we include more experiments in Appx.

Original: Here we study the effect of fake user budget by varying  1 2 { 0 . 01 , 0 .

Original: For 356 simplicity and clariﬁcation, we only compare the effective baselines, including TrialAttack, TNA, RevAdv, and PAPU. As shown in Fig. 2 (a) and (b), HR@50 of all attackers increases as the fake 358 user budget increases on both ML-100k and ML-1M datasets.
Revised: B for more insights.

Original: Furthermore, our proposed attacker

Original: DADA outperforms all baselines under different attack budgets, i.e., the red solid line is above other 360 lines, demonstrating its effectiveness. Particularly, as the fake user budget increases, our attacker andbaselines improve HR@50 on ML-100k more than that on ML-1M. The reason is that ML-100k only 362 has 1682 items, while ML-1M has 3706 items. As a result, it is more difﬁcult to promote target itemsinto the top-50 recommendation list of each user in ML-1M than ML-100k.
Revised: In Appx.

Original: Maximum Selected Items ⌧ . As introduced in Sec. 4.1, the maximum number of selected items of 365 each fake user ⌧ = · | I | is controlled by the parameter  2 . Here we study the effect of different 366 maximum number of selected items by varying 2 { 0 . 01 , 0 .
Revised: B.5, tobetter mimic the real-world applications, we demonstrate the generality and practicability of ourattacker on partial and noisy user behaviors.

Original: As shown in 367 Fig. 2 (c) and (d), as the maximum number of items increases, the performance of attackers ﬁrstincreases and then decreases on both ML-100k and ML-1M datasets. It indicates that selecting suitable 369 items can increase the attacker’s power. But more items will reduce the effectiveness of attackers,since the valuable items are limited, and extra items will introduce noise [34, 8, 17].
Revised: In Appx.

Original: Furthermore, 371 compared with these powerful baselines, DADA can achieve stable and the best performance underdifferent maximum number of selected items. 4.4 More Insights via Empirical Study 374 Due to space limit, we include more experiments in Appx. B for more insights.
Revised: B.6, we evaluate our attacker under differentitem popularity.

Original: In Appx.
Revised: In Appx.

Original: B.4, weevaluate our attacker when only accessing partial user behaviors.
Revised: B.7, we more comprehensively reveal the effectiveness of the difﬁcultyaware objective and quantitatively measure the diversity brought by the diversity-aware objective.

Original: In Appx.
Revised: In Appx.

Original: B.5 and B.6, we evaluate376 our attacker under differentitem popularity and the parameter   , respectively.
Revised: B.8, we evaluate our attacker under different parameter settings, including fake user budget,the maximum number of interacted items per user, and  in Eq (6).

Original: Finally, in Appx.
Revised: In Appx.

Revised: B.9, we analyze the hitratio improvement under different target RecSys.

Revised: Finally, in Appx.

Original: B.7,we provide visualizations on gradient provided by different users and fake user distributions.
Revised: B.10, we provide visualizationson gradients provided by different users and fake user distributions.

Revised: Besides, since real user behaviorsand fake user budgets change, we discuss the warm-up strategy to create new fake user behaviorsbased on previously trained surrogate RecSys and created fake user behaviors in Appx.

Revised: B.11.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper, we revisit the problem of injective attacks against recommender systems and reveal 380 two issues of existing attackers: difﬁculty-agnostic and diversity-deﬁcit issues.
Revised: In this paper, we revisit the problem of injective attacks against recommender systems and revealtwo issues of existing attackers: difﬁculty-agnostic and diversity-deﬁcit issues.

Original: To address thesetwo issues, we propose DADA, a difﬁculty and diversity aware attacker.
Revised: To address thesetwo issues, we propose DADA, a difﬁculty and diversity aware attacker.

Original: Within a limited fake user 382 budget, DADA enables the generated fake user behaviors to concentrate on easy users who havehigh tendencies toward the target item, and affect real users in a more diverse manner.
Revised: Within a limited fake userbudget, DADA enables the generated fake user behaviors to concentrate on easy users who havehigh tendencies toward the target item, and affect real users in a more diverse manner.

Original: Extensive 384 experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.
Revised: Extensiveexperiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.

Original: Inthis paper, we mainly reveal the weakness of existing recommender systems and discuss how to attack 386 them.
Revised: Inthis paper, we mainly reveal the weakness of existing recommender systems and discuss how to attackthem.

Original: For the sake of society, we discuss how to defense and resist such attacks in Appx.
Revised: For the sake of society, we discuss how to defense and resist such attacks in Appx.

Original: B.

Revised: B.

Original: Checklist
Revised: Checklist

Original: Please do not modify the questions and only use the provided macros for your answers.
Revised: Please do not modify the questions and only use the provided macros for your answers.

Original: Note that the461 Checklist section does not count towards the page limit.
Revised: Note that the Checklist section does not count towards the page limit.

Original: In your paper, please delete this instructionsblock and only keep the Checklist section heading above along with the questions/answers below.
Revised: In your paper, please delete this instructionsblock and only keep the Checklist section heading above along with the questions/answers below.1.

Original: For all authors...
Revised: For all authors...

Original: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’scontributions and scope?
Revised: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?

Original: [Yes](b) Did you describe the limitations of your work?
Revised: [Yes] (b) Did you describe the limitations of your work?

Original: [Yes](c)
Revised: [Yes]

Original:  Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [Yes] Thispaper mainly reveals the potential way to attack some recommendation systems, anddiscuss some existing defense models.(d)
Revised: [Yes] This paper mainly reveals the potential way to attack some recommendation systems, and discuss some existing defense models.

Original:  Have you read the ethics review guidelines and ensured that your paper conforms tothem?
Revised: (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?

Original: [Yes]2.
Revised: [Yes]

Original: If you are including theoretical results...
Revised: If you are including theoretical results...

Original:  (a) Did you state the full 
Revised: [Table] (a) Did you state the full set of assumptions of all theoretical results? [Yes] [Table]

Original: (b) Did you include complete proofs of all theoretical results?
Revised: (b) Did you include complete proofs of all theoretical results?

Original: [Yes]
Revised: [Yes]

Original: [Table]
Revised: [Table]

Original: If you ran experiments...
Revised: If you ran experiments...

Original: [Table]
Revised: [Table]

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experi-
Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Original: [Table]
Revised: [Table]

Original: mental results (either in the supplemental material or as a URL)?
Revised: mental results (either in the supplemental material or as a URL)?

Original: [No]
Revised: [No]

Original: [Table]
Revised: [Table]

Original: (b) Did you specify all the training details (e.g., data splits, hyperparameters,
Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters,

Original: how they
Revised: how they

Original: [Table]
Revised: [Table]

Original: were chosen)?
Revised: were chosen)?

Original: [Yes]
Revised: [Yes]

Original: [Table]
Revised: [Table]

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)? 
Revised: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)? [No]

Original: [No](d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
Revised: [Table] (d) Did you include the total amount of compute and the type of resources used (e.g., type [Table] of GPUs, internal cluster, or cloud provider)?

Original: [Yes]
Revised: [Yes]

Original: [Table]
Revised: [Table]

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...

Original: [Table]
Revised: [Table]

Original: (a) If your work uses existing assets, did you cite the creators?
Revised: (a) If your work uses existing assets, did you cite the creators?

Original: [Yes](b) Did you mention the license of the assets?
Revised: [Yes] [Table] (b) Did you mention the license of the assets?

Original: [Yes](c)
Revised: [Yes] [Table]

Original:  Did you include any new assets either in the supplemental material or as a URL? 
Revised: (c) Did you include any new assets either in the supplemental material or as a URL? [No] [Table]

Original: [No](d) Did you discuss whether and how consent was obtained from people whose data you’reusing/curating?
Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’re [Table] using/curating?

Original: [Yes]
Revised: [Yes]

Original: [Table]
Revised: [Table]

Original: (e) Did you discuss whether the data you are using/curating contains personally identiﬁableinformation or offensive content?
Revised: (e) Did you discuss whether the data you are using/curating contains personally identiﬁable [Table] information or offensive content?

Original: [N/A]5.
Revised: [N/A] [Table]

Original: If you used crowdsourcing or conducted research with human subjects...
Revised: If you used crowdsourcing or conducted research with human subjects...

Original: [Table]
Revised: [Table]

Original: (a) Did you include the full text of instructions given to participants and screenshots, ifapplicable?
Revised: (a) Did you include the full text of instructions given to participants and screenshots, if [Table] applicable?

Original: [N/A]
Revised: [N/A]

Original: [Table]
Revised: [Table]

Original: (b) Did you describe any potential participant risks, with links to Institutional Review
Revised: (b) Did you describe any potential participant risks, with links to Institutional Review

Original: [Table]
Revised: [Table]

Original: Board (IRB) approvals, if applicable?
Revised: Board (IRB) approvals, if applicable?

Original: [N/A]
Revised: [N/A]

Original: [Table]
Revised: [Table]

Original: (c) Did you include the estimated hourly wage paid to participants and thetotal amount
Revised: (c) Did you include the estimated hourly wage paid to participants and the

Original: [Table]
Revised: [Table]

Original: spent on participant compensation?
Revised: compensation?

Original: [N/A]
Revised: [N/A]

Original: [Table]
Revised: [Table]