Original: Revisiting Injective Attacks on Recommender Systems
Revised: Revisiting Injective Attacks on Recommender Systems

Original: Abstract
Revised: Abstract

Original: Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks.
Revised: Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks.

Original: Given a limited fake user budget, attackers can inject fake users with carefully designed behaviors into the open platforms, making RecSys recommend a target item to more real users for proﬁts.
Revised: Given a limited fake user budget, attackers can inject fake users with carefully designed behaviors into the open platforms, making RecSys recommend a target item to more real users for proﬁts.

Original: In this paper, we ﬁrst revisit existing attackers and reveal that they suffer from the difﬁculty-agnostic and diversity-deﬁcit issues.
Revised: In this paper, we ﬁrst revisit existing attackers and reveal that they suffer from the difﬁculty-agnostic and diversity-deﬁcit issues.

Original: Existing attackers concentrate their efforts on difﬁcult users who have low tendencies toward the target item, thus reducing their effectiveness.
Revised: Existing attackers concentrate their efforts on difﬁcult users who have low tendencies toward the target item, thus reducing their effectiveness.

Original: Moreover, they are incapable of affecting the target RecSys to recommend the target item to real users in a diverse manner, because their generated fake user behaviors are dominated by large communities.
Revised: Moreover, they are incapable of affecting the target RecSys to recommend the target item to real users in a diverse manner, because their generated fake user behaviors are dominated by large communities.

Original: To alleviate these two issues, we propose a difﬁculty and diversity aware attacker, namely DADA.
Revised: To alleviate these two issues, we propose a difﬁculty and diversity aware attacker, namely DADA.

Original: We design the difﬁculty-aware and diversity-aware objectives to enable easy users from various communities to contribute more weights when optimizing attackers.
Revised: We design the difﬁculty-aware and diversity-aware objectives to enable easy users from various communities to contribute more weights when optimizing attackers.

Original: By incorporating these two objectives, the proposed attacker DADA can concentrate on easy users while also affecting a broader range of real users simultaneously, thereby boosting the effectiveness.
Revised: By incorporating these two objectives, the proposed attacker DADA can concentrate on easy users while also affecting a broader range of real users simultaneously, thereby boosting the effectiveness.

Original: Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.
Revised: Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.

Original:  introduction
Revised:  introduction

Original: In the era of big data, recommender systems (RecSys) [8, 28, 36, 39, 53] are a key component to help users locate items that they may be interested in.
Revised: In the era of big data recommender systems (RecSys) [8, 28, 36, 39, 53] are a key component to help users locate items that they may be interested in.

Original: Generally, given the user behaviors, such as item purchase history and movie viewing history, RecSys learn the latent tendency of users regarding each item, and then recommend the top-N matched items for each user.
Revised: Generally, given the user behaviors, such as item purchase history and movie viewing history, RecSys learn the latent tendency of users regarding each item, and then recommend the top-N matched items for each user.

Original: Over the past decade, various RecSys have been proposed to provide services for users.
Revised: Over the past decade, various RecSys have been proposed to provide services for users.

Original: Recent studies [17, 24, 33, 45, 51] demonstrate that RecSys are vulnerable to adversarial attacks, e.g., fake user behaviors.
Revised: Recent studies [17, 24, 33, 45, 51] demonstrate that RecSys are vulnerable to adversarial attacks, e.g., fake user behaviors.

Original: It is because the training of RecSys relies on user behaviors and attackers can easily inject fake users into openworld web platforms.
Revised: It is because the training of RecSys relies on user behaviors and attackers can easily inject fake users into openworld web platforms.

Original: Speciﬁcally, attackers want to promote an item to real users, which can increase the opportunity that users purchase this target item and thus bring economic proﬁts.
Revised: Speciﬁcally, attackers want to promote an item to real users, which can increase the opportunity that users purchase this target item and thus bring economic proﬁts.

Original: To achieve such goals, attackers generally inject a limited number of fake users with designed behaviors, i.e., injective attacks .
Revised: To achieve such goals, attackers generally inject a limited number of fake users with designed behaviors, i.e., injective attacks .

Original: Then, the target RecSys may be affected with these injected fake users, and then recommends the target item into the top-N item list of real users.
Revised: Then, the target RecSys may be affected with these injected fake users, and then recommends the target item into the top-N item list of real users.

Original: Based on the techniques that are employed to design the behaviors of injected fake users, existing attackers [4, 6, 10, 11, 12, 20, 30, 38, 41, 45, 49, 51, 52] can be classiﬁed into three types: heuristicsbased [4, 30, 49], neural network-based [10, 38, 45, 52], and gradient-based attackers [6, 11, 12, 20, 41, 51].
Revised: Based on the techniques that are employed to design the behaviors of injected fake users, existing attackers [4, 6, 10, 11, 12, 20, 30, 38, 41, 45, 49, 51, 52] can be classiﬁed into three types: heuristicsbased [4, 30, 49], neural network-based [10, 38, 45, 52], and gradient-based attackers [6, 11, 12, 20, 41, 51].

Original: Heuristics-based attackers [4, 30, 49] sample popular items together with the target item as the behaviors of each fake user to increase the co-occurrence between popular items and the target item, i.e., trying to increase the popularity of the target item.
Revised: Heuristics-based attackers [4, 30, 49] sample popular items together with the target item as the behaviors of each fake user to increase the co-occurrence between popular items and the target item, i.e., trying to increase the popularity of the target item.

Original: Then, RecSys can be affected, and will recommend the target item to more users.
Revised: Then, RecSys can be affected, and will recommend the target item to more users.

Original: However, such a way does not directly optimize the attack objective, reducing the effectiveness of attackers [41, 52].
Revised: However, such a way does not directly optimize the attack objective, reducing the effectiveness of attackers [41, 52].

Original: Instead, neural network-based attackers [10, 38, 45, 52] utilize neural networks to generate inﬂuential fake user behaviors.
Revised: Instead, neural network-based attackers [10, 38, 45, 52] utilize neural networks to generate inﬂuential fake user behaviors.

Original: They maximize the attack objective by optimizing the parameters of neural networks.
Revised: They maximize the attack objective by optimizing the parameters of neural networks.

Original: Gradient-based attackers [6, 11, 12, 20, 41, 51] adopt the continuous relaxation to project user behaviors from the discrete space into the continuous space.
Revised: Gradient-based attackers [6, 11, 12, 20, 41, 51] adopt the continuous relaxation to project user behaviors from the discrete space into the continuous space.

Original: This enables attackers to parameterize the fake user behaviors and maximize the attack objective by optimizing them with gradients.
Revised: This enables attackers to parameterize the fake user behaviors and maximize the attack objective by optimizing them with gradients.

Original: Though existing attackers can achieve reasonably good attacking performance, they still suffer from two crucial issues from the local and global views: difﬁculty-agnostic and diversity-deﬁcit .
Revised: Though existing attackers can achieve reasonably good attacking performance, they still suffer from two crucial issues from the local and global views: difﬁculty-agnostic and diversity-deﬁcit .

Original: First, existing attackers do not consider the promotion difﬁculty of each user regarding the target item.
Revised: First, existing attackers do not consider the promotion difﬁculty of each user regarding the target item.

Original: Particularly, users who have a higher (resp.
Revised: Particularly, users who have a higher (resp.

Original: lower) tendency toward the target item are referred to easier (resp.
Revised: lower) tendency toward the target item are referred to easier (resp.

Original: more difﬁcult) users.
Revised: more difﬁcult) users.

Original: According to the formulated attack objective of existing attackers, difﬁcult users will contribute more weights to optimize attackers’ parameters, e.g., neural network parameters for generating fake users.
Revised: According to the formulated attack objective of existing attackers, difﬁcult users will contribute more weights to optimize attackers’ parameters, e.g., neural network parameters for generating fake users.

Original: It makes attackers put more efforts to recommend the target item to difﬁcult users.
Revised: It makes attackers put more efforts to recommend the target item to difﬁcult users.

Original: However, the RecSys platforms will usually monitor the user registration, i.e., attackers only have a very limited budget for generating fake users.
Revised: However, the RecSys platforms will usually monitor the user registration, i.e., attackers only have a very limited budget for generating fake users.

Original: Thus, attackers that focus on difﬁcult users may only achieve small attacking gain, i.e., the target item can only be recommended to a small number of users.
Revised: Thus, attackers that focus on difﬁcult users may only achieve small attacking gain, i.e., the target item can only be recommended to a small number of users.

Original: Second, the generated fake behaviors of existing attackers cannot inﬂuence real users diversely.
Revised: Second, the generated fake behaviors of existing attackers cannot inﬂuence real users diversely.

Original: Speciﬁcally, real users with different preferences are dispersed into different communities.
Revised: Speciﬁcally, real users with different preferences are dispersed into different communities.

Original: Communities with more users may dominate the optimization of attackers.
Revised: Communities with more users may dominate the optimization of attackers.

Original: Consequently, the generated fake users cannot affect RecSys to promote the target item to various communities, decreasing the effectiveness of attackers.
Revised: Consequently, the generated fake users cannot affect RecSys to promote the target item to various communities, decreasing the effectiveness of attackers.

Original: To address difﬁculty-agnostic and diversity-deﬁcit issues, we propose a Difﬁculty-Aware and
Revised: To address difﬁculty-agnostic and diversity-deﬁcit issues, we propose a Difﬁculty-Aware and

Original: Diversity-Aware attacker, namely DADA, which takes the promotion difﬁculty and diversity into consideration simultaneously.
Revised: Diversity-Aware attacker, namely DADA, which takes the promotion difﬁculty and diversity into consideration simultaneously.

Original: First, to handle the difﬁculty-agnostic issue, we propose a novel difﬁculty-aware objective that more emphasizes easier users than difﬁcult users when optimizing attack parameters.
Revised: First, to handle the difﬁculty-agnostic issue, we propose a novel difﬁculty-aware objective that more emphasizes easier users than difﬁcult users when optimizing attack parameters.

Original: Moreover, we propose a diversity-aware attack objective that allows the generated fake user behaviors to affect the target RecSys to recommend the target item to real users diversely, thereby avoiding the diversity-deﬁcit issue.
Revised: Moreover, we propose a diversity-aware attack objective that allows the generated fake user behaviors to affect the target RecSys to recommend the target item to real users diversely, thereby avoiding the diversity-deﬁcit issue.

Original: By incorporating both attack objectives, our proposed attacker DADA can concentrate on easy users and generate fake user behaviors that are capable of affecting real users in a diverse manner.
Revised: By incorporating both attack objectives, our proposed attacker DADA can concentrate on easy users and generate fake user behaviors that are capable of affecting real users in a diverse manner.

Original: Overall, our contributions are summarized as follows:
Revised: Overall, our contributions are summarized as follows:

Original: • We revisit attackers on RecSys and reveal that existing attackers suffer from difﬁculty-agnostic and diversity-deﬁcit issues.
Revised: • We revisit attackers on RecSys and reveal that existing attackers suffer from difﬁculty-agnostic and diversity-deﬁcit issues.

Original: More speciﬁcally, the objective designs in existing attackers make them more focus on promoting the target item to those difﬁcult users in the dominant community.
Revised: More speciﬁcally, the objective designs in existing attackers make them more focus on promoting the target item to those difﬁcult users in the dominant community.

Original: However, it is hard to handle difﬁcult users with only a limited number of generated fake users.
Revised: However, it is hard to handle difﬁcult users with only a limited number of generated fake users.

Original: Besides, the generated fake users tend to fall into the dominant community, which is not helpful to affect real users in other communities.
Revised: Besides, the generated fake users tend to fall into the dominant community, which is not helpful to affect real users in other communities.

Original: • We propose two novel attack objectives (difﬁculty-aware and diversity-aware objectives) that force the RecSys attacker to attack easy users distributed in various communities.
Revised: • We propose two novel attack objectives (difﬁculty-aware and diversity-aware objectives) that force the RecSys attacker to attack easy users distributed in various communities.

Original: Generally, the proposed objectives could enable the easy users and unaffected real users to contribute more weights when optimizing the parameters of the RecSys attacker.
Revised: Generally, the proposed objectives could enable the easy users and unaffected real users to contribute more weights when optimizing the parameters of the RecSys attacker.

Original: • Experiments on three real-world datasets demonstrate that the proposed attacker DADA achieves superior performance compared with state-of-the-art attackers.
Revised: • Experiments on three real-world datasets demonstrate that the proposed attacker DADA achieves superior performance compared with state-of-the-art attackers.

Original: Besides, extensive experiments show that the generated fake users indeed focus on easy users in a diverse way.
Revised: Besides, extensive experiments show that the generated fake users indeed focus on easy users in a diverse way.

Original:  Related Work
Revised:  Related Work

Original: Formally, let U and I denote users and items, respectively.
Revised: Formally, let U and I denote users and items, respectively.

Original: R 2 { 0 , 1 } | U | ⇥ | I | denotes the records of user-item interactions.
Revised: R 2 { 0 , 1 } | U | ⇥ | I | denotes the records of user-item interactions.

Original: Speciﬁcally, each entry R [ u ][ i ] denotes whether the user u 2 U interacts with the item
Revised: Speciﬁcally, each entry R [ u ][ i ] denotes whether the user u 2 U interacts with the item

Original: i 2 I , and I u
Revised: i 2 I , and I u

Original: = { i : R [ u ][ i ] = 1 } denotes the interacted item set of each user
Revised: = { i : R [ u ][ i ] = 1 } denotes the interacted item set of each user

Original: u 2 U .
Revised: u 2 U .

Original: 2.1 Recommender System
Revised: 2.1 Recommender System

Original: Recently, various RecSys [47, 48] have been proposed and deployed in the website applications, which recommend the items for users that match the preference of users.
Revised: Recently, various RecSys [47, 48] have been proposed and deployed in the website applications, which recommend the items for users that match the preference of users.

Original: Formally, given users
Revised: Formally, given users

Original: U , items I , and user behaviors R 2 { 0 , 1 } | U | ⇥ | I | , RecSys M ✓ learns the latent tendency score
Revised: U , items I , and user behaviors R 2 { 0 , 1 } | U | ⇥ | I | , RecSys M ✓ learns the latent tendency score

Original: [Table]
Revised: [Table]

Original: [ t ])
Revised: [ t ])

Original: P i 2 I exp( S [ u ][ i ]) ) ⇥ ⇥
Revised: P i 2 I exp( S [ u ][ i ]) ) ⇥ ⇥

Original: DADA (Ours)
Revised: DADA (Ours)

Original: P u 2 Ur ^ t/ 2  u  log(1  b 1 · S [ u ][ t ]) +  ·  ( b 2 ⇤ ( S [ u ][ t ]  S 0 [ u ][ t ]  c ))
Revised: P u 2 Ur ^ t/ 2  u  log(1  b 1 · S [ u ][ t ]) +  ·  ( b 2 ⇤ ( S [ u ][ t ]  S 0 [ u ][ t ]  c ))

Original: X X
Revised: X X

Original: S =
Revised: S =

Original: M ✓ ( R ) 2 R | U | ⇥ | I | between users and items.
Revised: M ✓ ( R ) 2 R | U | ⇥ | I | between users and items.

Original: The parameters ✓ can be optimized as follows:
Revised: The parameters ✓ can be optimized as follows:

Original: [Equation]
Revised: [Equation]

Original: where L tra ( M ✓ ⇤ ( R ) , R ) measures the training loss of RecSys model M ✓ based on latent tendency S and user behaviors R .
Revised: where L tra ( M ✓ ⇤ ( R ) , R ) measures the training loss of RecSys model M ✓ based on latent tendency S and user behaviors R .

Original: Then, based on the learned tendency S , the RecSys
Revised: Then, based on the learned tendency S , the RecSys

Original: M ✓ recommends the top-N un-interacted items  u with the highest tendency scores for each user u 2 U , i.e.,  u ⇢ I \ I u and |  u | = N .
Revised: M ✓ recommends the top-N un-interacted items  u with the highest tendency scores for each user u 2 U , i.e.,  u ⇢ I \ I u and |  u | = N .

Original: Generally, current RecSys can be classiﬁed into three categories, i.e., neighborhoodbased [27, 35], matrix-factorization-based [18, 32], and neural-network-based [15, 50].
Revised: Generally, current RecSys can be classiﬁed into three categories, i.e., neighborhoodbased [27, 35], matrix-factorization-based [18, 32], and neural-network-based [15, 50].

Original: Take the fundamental matrix-factorization RecSys WRMF [18] as an example, it maps users U and items I into latent representations
Revised: Take the fundamental matrix-factorization RecSys WRMF [18] as an example, it maps users U and items I into latent representations

Original: U 2 R | U | ⇥
Revised: U 2 R | U | ⇥

Original: d x and I 2 R | I | ⇥
Revised: d x and I 2 R | I | ⇥

Original: d x , respectively.
Revised: d x , respectively.

Original: Then, it predicts the tendency
Revised: Then, it predicts the tendency

Original: S = UI T between users and items.
Revised: S = UI T between users and items.

Original: Particularly, WRMF takes ✓ =
Revised: Particularly, WRMF takes ✓ =

Original: { U , I } as the parameter and reformulates Eq.
Revised: { U , I } as the parameter and reformulates Eq.

Original: (1) into arg min ✓ = { U , I }
Revised: (1) into arg min ✓ = { U , I }

Original: [Equation]
Revised: [Equation]

Original: u ][ i ])
Revised: u ][ i ])

Original: [Equation]
Revised: [Equation]

Original: ⌘ ( k U k 

Revised: ⌘ ( k U k

Original: + k I k 22 ) .
Revised: + k I k 22 ) .

Original: where k · k 2 is the l 2 norm distance, w ui is the weight hyperparamter to differentiate the existing and un-existing interactions, and ⌘ is a regularization hyperparameter.
Revised: where k · k 2 is the l 2 norm distance, w ui is the weight hyperparamter to differentiate the existing and un-existing interactions, and ⌘ is a regularization hyperparameter.

Original: More details of recommender systems can be referred to comprehensive surveys [47, 48].
Revised: More details of recommender systems can be referred to comprehensive surveys [47, 48].

Original: 2.2 Injective Attacks on Recommender System
Revised: 2.2 Injective Attacks on Recommender System

Original: Given a target item that attackers are interested in, attackers can inject fake users with carefully crafted behaviors into platforms.
Revised: Given a target item that attackers are interested in, attackers can inject fake users with carefully crafted behaviors into platforms.

Original: The attacker’s goal is to affect the RecSys to promote the target item into the top-N recommendation item list of as many real users as possible.
Revised: The attacker’s goal is to affect the RecSys to promote the target item into the top-N recommendation item list of as many real users as possible.

Original: Note that attackers can also demote a target item, i.e., maximizing the number of real users whose top-N recommendation list does not include the target item.
Revised: Note that attackers can also demote a target item, i.e., maximizing the number of real users whose top-N recommendation list does not include the target item.

Original: In this paper, we focus on promotion, because attacks for demotion can be constructed by a similar technique as promotion [10, 12, 38, 49, 52].
Revised: In this paper, we focus on promotion, because attacks for demotion can be constructed by a similar technique as promotion [10, 12, 38, 49, 52].

Original: Formally, let U r and U f denote real users and fake users, respectively.
Revised: Formally, let U r and U f denote real users and fake users, respectively.

Original: Given the real user behaviors
Revised: Given the real user behaviors

Original: R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the target RecSys model M ✓ , the goal is to generate the fake user data R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget
Revised: R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the target RecSys model M ✓ , the goal is to generate the fake user data R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget

Original: | U f |   and the maximum number k R f [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attack objective as follows:
Revised: | U f |   and the maximum number k R f [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attack objective as follows:

Original: [Equation]
Revised: [Equation]

Original: u
Revised: u

Original: [Equation]
Revised: [Equation]

Original: where O atk ( · ) is the attack objective, L tra ( · ) is the training loss of RecSys M ✓ as Eq.
Revised: where O atk ( · ) is the attack objective, L tra ( · ) is the training loss of RecSys M ✓ as Eq.

Original: (1), and
Revised: (1), and

Original: R = 
Revised: R = 

Original: R r
Revised: R r

Original: R f  2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | is matrix concatenation.
Revised: R f  2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | is matrix concatenation.

Original: Based on this formulation, various attackers against RecSys are mainly different from three aspects: (1).
Revised: Based on this formulation, various attackers against RecSys are mainly different from three aspects: (1).

Original: The formulation of the attack objective O atk ; (2).
Revised: The formulation of the attack objective O atk ; (2).

Original: Technique used to optimize Eq.
Revised: Technique used to optimize Eq.

Original: Knowledge accessed by attackers.
Revised: Knowledge accessed by attackers.

Original: Formulation of O atk .
Revised: Formulation of O atk .

Original: Hit ratio [10, 38] is a common formulation, i.e., O atk ( · ) =|
Revised: Hit ratio [10, 38] is a common formulation, i.e., O atk ( · ) =|

Original: U r |
Revised: U r |

Original: P u 2 U r I ( t,  u ) , where indicator I ( t,  u ) = 1 if t is recommended in the top-N item list of u , i.e., t 2  u .
Revised: P u 2 U r I ( t,  u ) , where indicator I ( t,  u ) = 1 if t is recommended in the top-N item list of u , i.e., t 2  u .

Original: Also, several attackers [11, 12, 20, 41, 45, 51, 52] try to maximize the latent tendency between real users and the target item, and propose several attack objective variants.
Revised: Also, several attackers [11, 12, 20, 41, 45, 51, 52] try to maximize the latent tendency between real users and the target item, and propose several attack objective variants.

Original: The objective details of these attackers are listed in Tab. 1.
Revised: The objective details of these attackers are listed in Tab. 1.

Original: For clariﬁcation, we speciﬁcally list the part of the attack objective that is related to the learned latent tendency S between real users U r and items i 2 I , and omit unrelated parts, such as the regularization of attacker neural network parameters.
Revised: For clariﬁcation, we speciﬁcally list the part of the attack objective that is related to the learned latent tendency S between real users U r and items i 2 I , and omit unrelated parts, such as the regularization of attacker neural network parameters.

Original: Note that several attackers [11, 41, 51] try to minimize the attack loss L atk .
Revised: Note that several attackers [11, 41, 51] try to minimize the attack loss L atk .

Original: For generality, we set their attack objective O atk =
Revised: For generality, we set their attack objective O atk =

Original:  L atk and use two notations interchangeably in this paper.
Revised:  L atk and use two notations interchangeably in this paper.

Original: Technique.
Revised: Technique.

Original: It is a non-trivial task to generate the exact optimal fake user behaviors R f that can achieve the maximum attack objective due to the exponential candidate search space, i.e., O ( | I | ⌧ ·| U f | ) .
Revised: It is a non-trivial task to generate the exact optimal fake user behaviors R f that can achieve the maximum attack objective due to the exponential candidate search space, i.e., O ( | I | ⌧ ·| U f | ) .

Original: As shown in Tab. 1, regarding the technique that generates behaviors for injected fake users, there are three types of attackers: heuristics-based , neural network-based , and gradient-based attackers.
Revised: As shown in Tab. 1, regarding the technique that generates behaviors for injected fake users, there are three types of attackers: heuristics-based , neural network-based , and gradient-based attackers.

Original: As introduced in Sec. 1, heuristics-based attackers [4, 30, 49] cannot cover various behavior patterns and do not directly optimize the attack objective, leading to unsatisﬁed performance [52, 41].
Revised: As introduced in Sec. 1, heuristics-based attackers [4, 30, 49] cannot cover various behavior patterns and do not directly optimize the attack objective, leading to unsatisﬁed performance [52, 41].

Original: Instead, neural network-based attackers [10, 38, 45, 52] propose neural networks A ' parameterized with ' to learn probability distributions of selected items for each fake user.
Revised: Instead, neural network-based attackers [10, 38, 45, 52] propose neural networks A ' parameterized with ' to learn probability distributions of selected items for each fake user.

Original: Then, they sample fake user behaviors R f ⇠ A ' ( R r ) accordingly.
Revised: Then, they sample fake user behaviors R f ⇠ A ' ( R r ) accordingly.

Original: Formally, the parameter ' can be optimized by maximizing the attack objective as max ' , ✓ E R f ⇠ A ' ( R r )
Revised: Formally, the parameter ' can be optimized by maximizing the attack objective as max ' , ✓ E R f ⇠ A ' ( R r )

Original: [ O atk ( M ✓ ⇤ ( R ); U r , t )] .
Revised: [ O atk ( M ✓ ⇤ ( R ); U r , t )] .

Original: Besides, gradient-based attackers
Revised: Besides, gradient-based attackers

Original: A [6, 11, 12, 20, 41, 51] relax the discrete fake user behaviors into continuous ˜R f 2 R | U f | ⇥ | I | .
Revised: A [6, 11, 12, 20, 41, 51] relax the discrete fake user behaviors into continuous ˜R f 2 R | U f | ⇥ | I | .

Original: Then, they directly parameterize ˜R f and maximize attack objective as max ˜ R f , ✓ O atk ( M ✓ ⇤ ( ˜ R ); U r , t ) .
Revised: Then, they directly parameterize ˜R f and maximize attack objective as max ˜ R f , ✓ O atk ( M ✓ ⇤ ( ˜ R ); U r , t ) .

Original: After ﬁnishing the optimization of ˜R f , they use a projector function to project the continuous user behaviors ˜R f into discrete fake behaviors R f .
Revised: After ﬁnishing the optimization of ˜R f , they use a projector function to project the continuous user behaviors ˜R f into discrete fake behaviors R f .

Original: In this paper, we design a gradient-based attacker to generate fake user behaviors.
Revised: In this paper, we design a gradient-based attacker to generate fake user behaviors.

Original: For generality, we use ' to denote the parameterized ˜R f .
Revised: For generality, we use ' to denote the parameterized ˜R f .

Original: Speciﬁcally, existing gradient-based attackers A use gradient ascent approach [34] to optimize ' by maximizing the attack objective O atk ( · ) as follows
Revised: Speciﬁcally, existing gradient-based attackers A use gradient ascent approach [34] to optimize ' by maximizing the attack objective O atk ( · ) as follows

Original: [Equation]
Revised: [Equation]

Original: where ↵ is the learning rate, and O atk ( M ✓ ⇤ ( R ); u, t ) denotes the objective value of user u regarding the target item t .
Revised: where ↵ is the learning rate, and O atk ( M ✓ ⇤ ( R ); u, t ) denotes the objective value of user u regarding the target item t .

Original: Particularly, when a user u provides more gradients @
Revised: Particularly, when a user u provides more gradients @

Original: O atk ( M ✓ ⇤ ( R ); u,t ) @' to optimize parameter ' , the attacker will prioritize maximizing the user’s objective.
Revised: O atk ( M ✓ ⇤ ( R ); u,t ) @' to optimize parameter ' , the attacker will prioritize maximizing the user’s objective.

Original: For simplicity, we use
Revised: For simplicity, we use

Original: O atk ( U r , t ) and O atk ( u, t ) to denote O atk ( M ✓ ⇤ ( R ); U r , t ) and O atk ( M ✓ ⇤ ( R ); u, t ) , respectively.
Revised: O atk ( U r , t ) and O atk ( u, t ) to denote O atk ( M ✓ ⇤ ( R ); U r , t ) and O atk ( M ✓ ⇤ ( R ); u, t ) , respectively.

Original: Knowledge.
Revised: Knowledge.

Original: Regarding the knowledge accessed by attackers, existing attackers can be classiﬁed into two categories.
Revised: Regarding the knowledge accessed by attackers, existing attackers can be classiﬁed into two categories.

Original: White-box attackers [11, 12, 20] take real user behaviors and the target RecSys parameters as inputs to generate fake user behaviors.
Revised: White-box attackers [11, 12, 20] take real user behaviors and the target RecSys parameters as inputs to generate fake user behaviors.

Original: Unlike white-box attackers, gray-box attackers [10, 38, 41, 45, 51, 52] assume that the target RecSys parameters are inaccessible.
Revised: Unlike white-box attackers, gray-box attackers [10, 38, 41, 45, 51, 52] assume that the target RecSys parameters are inaccessible.

Original: Instead, the ﬁrst type of gray-box attackers [10, 38] assume that the top-N item lists of real users recommended by the target RecSys are available.
Revised: Instead, the ﬁrst type of gray-box attackers [10, 38] assume that the top-N item lists of real users recommended by the target RecSys are available.

Original: Also, the second type of gray-box attackers [41, 45, 51, 52] only access user behaviors and use a surrogate RecSys ˆ M ˆ ✓ to replace the target RecSys M ✓ in Eq.
Revised: Also, the second type of gray-box attackers [41, 45, 51, 52] only access user behaviors and use a surrogate RecSys ˆ M ˆ ✓ to replace the target RecSys M ✓ in Eq.

Original: (2), which is expected to mimic the target RecSys.
Revised: (2), which is expected to mimic the target RecSys.

Original: In summary, the second type of gray-box attackers are more realistic than white-box and the ﬁrst type of gray-box.
Revised: In summary, the second type of gray-box attackers are more realistic than white-box and the ﬁrst type of gray-box.

Original: The reason is that the target RecSys parameters and the recommendation lists of real users are difﬁcult to obtain.
Revised: The reason is that the target RecSys parameters and the recommendation lists of real users are difﬁcult to obtain.

Original: Instead, due to the openness of web platforms, it is easy to collect real user behaviors [41, 51], such as movie viewing history.
Revised: Instead, due to the openness of web platforms, it is easy to collect real user behaviors [41, 51], such as movie viewing history.

Original: More discussions on user behavior collection can be referred to Appx.
Revised: More discussions on user behavior collection can be referred to Appx.

Original: B.5.
Revised: B.5.

Original: Thus, we focus on the second type of gray-box attacks on RecSys in this paper.
Revised: Thus, we focus on the second type of gray-box attacks on RecSys in this paper.

Original:  DADA Attacker
Revised:  DADA Attacker

Original: In this section, we introduce our attacker DADA.
Revised: In this section, we introduce our attacker DADA.

Original: We ﬁrst propose two attack objectives that consider the promotion difﬁculty and the diversity of users, respectively.
Revised: We ﬁrst propose two attack objectives that consider the promotion difﬁculty and the diversity of users, respectively.

Original: Then, we formulate a novel difﬁculty and diversity-aware attack objective that enables our attacker DADA to simultaneously focus on easy users and affect real users diversely, and propose an efﬁcient greedy-based algorithm to optimize it.
Revised: Then, we formulate a novel difﬁculty and diversity-aware attack objective that enables our attacker DADA to simultaneously focus on easy users and affect real users diversely, and propose an efﬁcient greedy-based algorithm to optimize it.

Original: [Figure]
Revised: [Figure]

Original: 3.1 Difﬁculty-aware Attack Objective 3.1.1 Motivational Observations of Difﬁculty-agnostic
Revised: 3.1 Difﬁculty-aware Attack Objective 3.1.1 Motivational Observations of Difﬁculty-agnostic

Original: As discussed in Sec. 1, given a target item and a set of real users, existing RecSys attackers more focus on promoting the target item to difﬁcult users when designing fake user behaviors.
Revised: As discussed in Sec. 1, given a target item and a set of real users, existing RecSys attackers more focus on promoting the target item to difﬁcult users when designing fake user behaviors.

Original: We ﬁrst demonstrate several motivational observations in existing works.
Revised: We ﬁrst demonstrate several motivational observations in existing works.

Original: Speciﬁcally, we employ the representative and state-of-the-art gradient-based attackers, including RevAdv [41], TNA [11], and PAPU [51], to inject fake users into the ML-100K dataset [14], where fake user budget  = 0 .
Revised: Speciﬁcally, we employ the representative and state-of-the-art gradient-based attackers, including RevAdv [41], TNA [11], and PAPU [51], to inject fake users into the ML-100K dataset [14], where fake user budget  = 0 .

Original: | U r | .
Revised: | U r | .

Original: Speciﬁcally, we use the representative RecSys WRMF [18] as the target RecSys M ✓ for evaluation.
Revised: Speciﬁcally, we use the representative RecSys WRMF [18] as the target RecSys M ✓ for evaluation.

Original: We ﬁrst train WRMF on ML-100K without attacks, and output the latent tendency
Revised: We ﬁrst train WRMF on ML-100K without attacks, and output the latent tendency

Original: S between each user u 2 U r and each item i 2 I .
Revised: S between each user u 2 U r and each item i 2 I .

Original: We then randomly select an item t 2 I as the target item.
Revised: We then randomly select an item t 2 I as the target item.

Original: For simplicity and clariﬁcation, we separate real users into three groups as an example.
Revised: For simplicity and clariﬁcation, we separate real users into three groups as an example.

Original: Speciﬁcally, if the latent tendency of a user u toward the target item S [ u ][ t ] is at the top of { 33 . 3% , 33 . 3% ⇠ 66 .
Revised: Speciﬁcally, if the latent tendency of a user u toward the target item S [ u ][ t ] is at the top of { 33 . 3% , 33 . 3% ⇠ 66 .

Original: 7% ⇠ 100% } largest among all items
Revised: 7% ⇠ 100% } largest among all items

Original: I , it will be regarded as { easy, medium, difficult } users, respectively.
Revised: I , it will be regarded as { easy, medium, difficult } users, respectively.

Original: Then, we can obtain three groups { U e , U m , U d } .
Revised: Then, we can obtain three groups { U e , U m , U d } .

Original: For clariﬁcation, we show the result of RevAdv in Fig.
Revised: For clariﬁcation, we show the result of RevAdv in Fig.

Original: 1 and similar results of TNA and PAPU in
Revised: 1 and similar results of TNA and PAPU in

Original: Appx.
Revised: Appx.

Original: A.1.1.
Revised: A.1.1.

Original: For each group U g 2 { U e , U m , U d } , we show its average gradient for optimizing the attacker parameter ' in Fig.
Revised: For each group U g 2 { U e , U m , U d } , we show its average gradient for optimizing the attacker parameter ' in Fig.

Original: 1 (a), i.e.,
Revised: 1 (a), i.e.,

Original: [Equation]
Revised: [Equation]

Original: We can easily observe that the gradient value is directly proportional to the degree of difﬁculty.
Revised: We can easily observe that the gradient value is directly proportional to the degree of difﬁculty.

Original: In other words, the more difﬁcult it is, the greater gradient it is.
Revised: In other words, the more difﬁcult it is, the greater gradient it is.

Original: It indicates that RevAdv puts more efforts to promote the target item to difﬁcult and medium users than easy users.
Revised: It indicates that RevAdv puts more efforts to promote the target item to difﬁcult and medium users than easy users.

Original: Then, we investigate the hit ratio of 50 (HR@50) performance on three different user groups.
Revised: Then, we investigate the hit ratio of 50 (HR@50) performance on three different user groups.

Original: As illustrated in Fig.
Revised: As illustrated in Fig.

Original: 1 (b), despite that RevAdv puts more effort on medium and difﬁcult users, the HR@50 of them is only marginally improved.
Revised: 1 (b), despite that RevAdv puts more effort on medium and difﬁcult users, the HR@50 of them is only marginally improved.

Original: Moreover, putting more effort on medium and difﬁcult users leads that the HR@50 of easy users increases unstably.
Revised: Moreover, putting more effort on medium and difﬁcult users leads that the HR@50 of easy users increases unstably.

Original: Therefore, with a limited budget for fake users, it is preferable to concentrate on easy users, as it is easier to promote the target item for them.
Revised: Therefore, with a limited budget for fake users, it is preferable to concentrate on easy users, as it is easier to promote the target item for them.

Original: 3.1.2 Insights on Difﬁculty-agnostic Issue
Revised: 3.1.2 Insights on Difﬁculty-agnostic Issue

Original: Motivated by the observations, we plan to design a new difﬁculty-aware attack objective, which enables attackers to focus on easy users primarily and achieve more recommendation gain.
Revised: Motivated by the observations, we plan to design a new difﬁculty-aware attack objective, which enables attackers to focus on easy users primarily and achieve more recommendation gain.

Original: The basic idea is to let easier users outweigh difﬁcult users when optimizing the attacker’s parameter ' .
Revised: The basic idea is to let easier users outweigh difﬁcult users when optimizing the attacker’s parameter ' .

Original: As introduced in Eq.
Revised: As introduced in Eq.

Original: (3), the gradients for optimizing attack parameter ' that each user provides are related to the attack objective O atk .
Revised: (3), the gradients for optimizing attack parameter ' that each user provides are related to the attack objective O atk .

Original: Particularly, due to the chain rule, the gradients @
Revised: Particularly, due to the chain rule, the gradients @

Original: O atk ( u,t ) @' of each user u 2 U r can be formulated as @
Revised: O atk ( u,t ) @' of each user u 2 U r can be formulated as @

Original: O atk ( u,t ) @' =
Revised: O atk ( u,t ) @' =

Original: [Equation]
Revised: [Equation]

Original: S [
Revised: S [

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: S [ u ][
Revised: S [ u ][

Original: [Equation]
Revised: [Equation]

Original: ] @' , where @
Revised: ] @' , where @

Original: O
Revised: O

Original: [Equation]
Revised: [Equation]

Original: ( u
Revised: ( u

Original: [Equation]
Revised: [Equation]

Original: S [ u ][ t ] only relates to the attacker objective design.
Revised: S [ u ][ t ] only relates to the attacker objective design.

Original: S [ u ][ t ] @' only relies on the attacker parameters, which is ﬁxed and unrelated to attack objective O atk ( · ) .
Revised: S [ u ][ t ] @' only relies on the attacker parameters, which is ﬁxed and unrelated to attack objective O atk ( · ) .

Original: Thus, we can increase the @
Revised: Thus, we can increase the @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] of easier user to let them more determine the optimization direction of attacker parameters.
Revised: S [ u ][ t ] of easier user to let them more determine the optimization direction of attacker parameters.

Original: Besides, if a user has received the target item in the top-N recommendation list, it indicates that the RecSys has promoted the target item to this user successfully.
Revised: Besides, if a user has received the target item in the top-N recommendation list, it indicates that the RecSys has promoted the target item to this user successfully.

Original: Thus, this user should not provide any gradient, because increasing its tendency toward the target item will not have any improvement on the recommendation gain.
Revised: Thus, this user should not provide any gradient, because increasing its tendency toward the target item will not have any improvement on the recommendation gain.

Original: Based on the above analysis, the difﬁculty-aware attack objective should satisfy two difﬁculty properties : (1) given two users u
Revised: Based on the above analysis, the difﬁculty-aware attack objective should satisfy two difﬁculty properties : (1) given two users u

Original: and v ,
Revised: and v ,

Original: if the tendency score S [ v ][ t ] < S
Revised: if the tendency score S [ v ][ t ] < S

Original: [ u ][ t ] and t / 2  u , @
Revised: [ u ][ t ] and t / 2  u , @

Original: O atk ( v,t ) @
Revised: O atk ( v,t ) @

Original: S [ v ][ t ] < @
Revised: S [ v ][ t ] < @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] .
Revised: S [ u ][ t ] .

Original: (2) if the target item t 2  u , @
Revised: (2) if the target item t 2  u , @

Original: O atk ( u,t ) @
Revised: O atk ( u,t ) @

Original: S [ u ][ t ] = 0 .
Revised: S [ u ][ t ] = 0 .

Original: As shown in Tab. 1, the attack objectives of existing attackers do not satisfy both properties simultaneously.
Revised: As shown in Tab. 1, the attack objectives of existing attackers do not satisfy both properties simultaneously.

Original: In this paper, based on the two properties, we formulate a difﬁculty-aware attack objective.
Revised: In this paper, based on the two properties, we formulate a difﬁculty-aware attack objective.

Original: Formally, given the tendency ˆ S learned by the surrogate RecSys ˆ M ˆ ✓ , the target item t , the difﬁculty-aware attack objective regarding each real user u 2 U r is formulated as follows:
Revised: Formally, given the tendency ˆ S learned by the surrogate RecSys ˆ M ˆ ✓ , the target item t , the difﬁculty-aware attack objective regarding each real user u 2 U r is formulated as follows:

Original: [Equation]
Revised: [Equation]

Original: where b 1 is a positive hyperparameter.
Revised: where b 1 is a positive hyperparameter.

Original: Furthermore, we use the following Proposition 1 to show that
Revised: Furthermore, we use the following Proposition 1 to show that

Original: Eq.
Revised: Eq.

Original: (4) enables easier users to more dominate the the attack parameter optimization than difﬁcult users.
Revised: (4) enables easier users to more dominate the the attack parameter optimization than difﬁcult users.

Original: Due to space limit, we put the proof in Appx.
Revised: Due to space limit, we put the proof in Appx.

Original: A.2.1.
Revised: A.2.1.

Original: Proposition 1.
Revised: Proposition 1.

Original: Our difﬁculty-aware attack objective satisﬁes difﬁculty property 1 and property 2.
Revised: Our difﬁculty-aware attack objective satisﬁes difﬁculty property 1 and property 2.

Original: 3.2 Diversity-aware Attack Objective 3.2.1 Motivational Observations of Diversity-deﬁcit
Revised: 3.2 Diversity-aware Attack Objective 3.2.1 Motivational Observations of Diversity-deﬁcit

Original: As introduced in Sec. 1, existing attackers have the diversity-deﬁcit issue that the generated fake behaviors are dominated by large communities, where users in each community have similar preferences.
Revised: As introduced in Sec. 1, existing attackers have the diversity-deﬁcit issue that the generated fake behaviors are dominated by large communities, where users in each community have similar preferences.

Original: Speciﬁcally, as introduced in Eq.
Revised: Speciﬁcally, as introduced in Eq.

Original: (3), each real user u 2 U r will provide gradients to optimize the attackers’ parameters ' .
Revised: (3), each real user u 2 U r will provide gradients to optimize the attackers’ parameters ' .

Original: Since similar real users have similar preferences on items, real users can form several communities { C j } n c j =1 , where each community C j has n j real users.
Revised: Since similar real users have similar preferences on items, real users can form several communities { C j } n c j =1 , where each community C j has n j real users.

Original: Thus, from the community perspective, the optimization process of the attacker parameter ' via maximizing the attack objective O atk ( · ) can be reformulated as follows: ' = ' + ↵ ·
Revised: Thus, from the community perspective, the optimization process of the attacker parameter ' via maximizing the attack objective O atk ( · ) can be reformulated as follows: ' = ' + ↵ ·

Original: [Equation]
Revised: [Equation]

Original: Intuitively, users in the same community who are similar will give the gradients in similar directions.
Revised: Intuitively, users in the same community who are similar will give the gradients in similar directions.

Original: Thus, there is a potential risk that the large communities C k will dominate the optimization direction of attacker parameter ' via
Revised: Thus, there is a potential risk that the large communities C k will dominate the optimization direction of attacker parameter ' via

Original: P
Revised: P

Original: [Equation]
Revised: [Equation]

Original: Consequently, this community will dominate the generated fake user behaviors.
Revised: Consequently, this community will dominate the generated fake user behaviors.

Original: The generated fake user behaviors can only manipulate the target
Revised: The generated fake user behaviors can only manipulate the target

Original: RecSys to promote the target item to the dominated communities.
Revised: RecSys to promote the target item to the dominated communities.

Original: In another words, the target RecSys is incapable of promoting the target item to more users in other communities diversely.
Revised: In another words, the target RecSys is incapable of promoting the target item to more users in other communities diversely.

Original: Similar to Sec.
Revised: Similar to Sec.

Original: 3.1.1, we demonstrate several motivational observations.
Revised: 3.1.1, we demonstrate several motivational observations.

Original: We use state-of-the-art gradient-based attackers RevAdv [41], TNA [11], and PAPU [51], and neural network-based attacker
Revised: We use state-of-the-art gradient-based attackers RevAdv [41], TNA [11], and PAPU [51], and neural network-based attacker

Original: TrialAttack [45], to generate 0 . 

Revised: TrialAttack [45], to generate 0 .

Original: | U r | fake users and inject them into the ML-100K dataset [14].
Revised: | U r | fake users and inject them into the ML-100K dataset [14].

Original: Then, we train the target RecSys WRMF and study the attacking results.
Revised: Then, we train the target RecSys WRMF and study the attacking results.

Original: For simplicity and clariﬁcation, we put the result of RevAdv in Fig.
Revised: For simplicity and clariﬁcation, we put the result of RevAdv in Fig.

Original: 1 and similar results of TNA, PAPU, and TrialAttack in Appx.
Revised: 1 and similar results of TNA, PAPU, and TrialAttack in Appx.

Original: A.1.2.
Revised: A.1.2.

Original: Following [41], we extract the representations of real and fake users learned by WRMF, and use
Revised: Following [41], we extract the representations of real and fake users learned by WRMF, and use

Original: PCA [1] to visualize them.
Revised: PCA [1] to visualize them.

Original: Based on the result of PCA, we separate real users into three communities by KMeans [19].
Revised: Based on the result of PCA, we separate real users into three communities by KMeans [19].

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 1 (c), the fake users (blue points) tend to form a cluster that is distributed in the community 1 (yellow points).
Revised: 1 (c), the fake users (blue points) tend to form a cluster that is distributed in the community 1 (yellow points).

Original: It indicates that community 1 dominates the generated fake users.
Revised: It indicates that community 1 dominates the generated fake users.

Original: It is because users in the same community will generate gradients with similar directions.
Revised: It is because users in the same community will generate gradients with similar directions.

Original: Thus, large communities with more users are more likely to dominate the optimization directions of the attacker parameter.
Revised: Thus, large communities with more users are more likely to dominate the optimization directions of the attacker parameter.

Original: Consequently, RecSys can only be affected by the generated fake user behaviors to recommend the target item to more users in the community 1.
Revised: Consequently, RecSys can only be affected by the generated fake user behaviors to recommend the target item to more users in the community 1.

Original: To further verify this, we list the hit ratio 50 (HR@50) of each community before and after injecting fake users in Fig.
Revised: To further verify this, we list the hit ratio 50 (HR@50) of each community before and after injecting fake users in Fig.

Original: 1 (d).
Revised: 1 (d).

Original: It shows that the generated fake users improve the HR@50 of the community 1 signiﬁcantly, while maintaining similar HR@50 in the other two communities.
Revised: It shows that the generated fake users improve the HR@50 of the community 1 signiﬁcantly, while maintaining similar HR@50 in the other two communities.

Original: To enable RevAdv to affect users diversely, we add our formulated diversity-aware attack objective (see Sec. 3.2.2) into
Revised: To enable RevAdv to affect users diversely, we add our formulated diversity-aware attack objective (see Sec. 3.2.2) into

Original: RevAdv’s objective.
Revised: RevAdv’s objective.

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 1 (d), RevAdv+Diverse improves HR@50 of communityand 3.
Revised: 1 (d), RevAdv+Diverse improves HR@50 of communityand 3.

Original: Particularly, HR@50 on community 1 increases as well.
Revised: Particularly, HR@50 on community 1 increases as well.

Original: As described in Sec.
Revised: As described in Sec.

Original: 3.1.1, RevAdv more focuses on difﬁcult users, thus the generated fake user behaviors may not be able to affect the target RecSys to recommend the target item to other less difﬁcult users in community 1.
Revised: 3.1.1, RevAdv more focuses on difﬁcult users, thus the generated fake user behaviors may not be able to affect the target RecSys to recommend the target item to other less difﬁcult users in community 1.

Original: Fortunately, the diverse-aware objective allows RevAdv to put more efforts on these users, thereby improving the performance of community 1.
Revised: Fortunately, the diverse-aware objective allows RevAdv to put more efforts on these users, thereby improving the performance of community 1.

Original: 3.2.2 Insights on Diversity-deﬁcit Issue
Revised: 3.2.2 Insights on Diversity-deﬁcit Issue

Original: Motivated by these observations, we propose a diversity-aware attack objective that enables fake user behaviors to affect real users diversely.
Revised: Motivated by these observations, we propose a diversity-aware attack objective that enables fake user behaviors to affect real users diversely.

Original: The basic idea is that if the real users are less affected by fake user behavior, the diversity-aware objective will concentrate on these real users in the subsequent gradient computation process.
Revised: The basic idea is that if the real users are less affected by fake user behavior, the diversity-aware objective will concentrate on these real users in the subsequent gradient computation process.

Original: Then, the attacker will be optimized to generate fake user behaviors that can affect these users.
Revised: Then, the attacker will be optimized to generate fake user behaviors that can affect these users.

Original: In such a way, users in different communities can be affected diversely.
Revised: In such a way, users in different communities can be affected diversely.

Original: Speciﬁcally, the inﬂuence of fake user behaviors on each user regarding the target item can be measured by the difference between tendencies before and after attacks.
Revised: Speciﬁcally, the inﬂuence of fake user behaviors on each user regarding the target item can be measured by the difference between tendencies before and after attacks.

Original: Formally, let S 0 and S denote the tendencies learned by RecSys M before and after attacks, the inﬂuence of fake user behaviors
Revised: Formally, let S 0 and S denote the tendencies learned by RecSys M before and after attacks, the inﬂuence of fake user behaviors

Original: R f on user u regarding the target item t is computed by 4 S [ u ][ t ] =
Revised: R f on user u regarding the target item t is computed by 4 S [ u ][ t ] =

Original: S [ u ][ t ]  S 

Revised: S [ u ][ t ]  S

Original: [ u ][ t ] .
Revised: [ u ][ t ] .

Original: To enable attackers to affect more real users, the attack objective should focus on users with a smaller 4 S [ u ][ t ] when optimizing the attacker parameter ' .
Revised: To enable attackers to affect more real users, the attack objective should focus on users with a smaller 4 S [ u ][ t ] when optimizing the attacker parameter ' .

Original: Speciﬁcally, according to the chain rule and @ 4 S [ u ][ t ] @
Revised: Speciﬁcally, according to the chain rule and @ 4 S [ u ][ t ] @

Original: S [ u ][ t ] = 1 , the gradients @
Revised: S [ u ][ t ] = 1 , the gradients @

Original: O atk ( u,t ) @' regarding the attacker parameter ' in Eq.
Revised: O atk ( u,t ) @' regarding the attacker parameter ' in Eq.

Original: (3) of each user u 2 U r can be formulated as @
Revised: (3) of each user u 2 U r can be formulated as @

Original: O
Revised: O

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Thus, we can increase the @
Revised: Thus, we can increase the @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] of real users with smaller inﬂuence 4 S [ u ][ t ] to let them more determine the attacker parameter optimization direction.
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] of real users with smaller inﬂuence 4 S [ u ][ t ] to let them more determine the attacker parameter optimization direction.

Original: Similar to Sec.
Revised: Similar to Sec.

Original: 3.1.2, the diversity-aware attacker objective should satisfy two diversity properties : (1) given two users u
Revised: 3.1.2, the diversity-aware attacker objective should satisfy two diversity properties : (1) given two users u

Original: and v , if 4 S [ v ][ t ] > 4 S [ u ][ t ] , and t / 2  u , @
Revised: and v , if 4 S [ v ][ t ] > 4 S [ u ][ t ] , and t / 2  u , @

Original: O atk ( v,t ) @ 4 S [ v ][ t ] < @
Revised: O atk ( v,t ) @ 4 S [ v ][ t ] < @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] ; (2) if the target item t has been recommended to a user u , the user u should have no effect on the attackers’ parameter optimization, i.e., if t 2  u , @
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] ; (2) if the target item t has been recommended to a user u , the user u should have no effect on the attackers’ parameter optimization, i.e., if t 2  u , @

Original: O atk ( u,t ) @ 4 S [ u ][ t ] = 0 .
Revised: O atk ( u,t ) @ 4 S [ u ][ t ] = 0 .

Original: Obviously, existing attackers do not satisfy both properties because they do not consider the difference of tendency between before and after attacks.
Revised: Obviously, existing attackers do not satisfy both properties because they do not consider the difference of tendency between before and after attacks.

Original: Based on the two properties, we formulate a diversityaware attack objective.
Revised: Based on the two properties, we formulate a diversityaware attack objective.

Original: Formally, given the target item t , and the real user u 2 U r , let ˆ S 0 and ˆS denote the tendencies learned by the surrogate RecSys ˆ M ˆ ✓ before and after injecting fake user behaviors
Revised: Formally, given the target item t , and the real user u 2 U r , let ˆ S 0 and ˆS denote the tendencies learned by the surrogate RecSys ˆ M ˆ ✓ before and after injecting fake user behaviors

Original: R f , the diversity-aware objective on each user u 2 U r regarding the target item t is computed as:
Revised: R f , the diversity-aware objective on each user u 2 U r regarding the target item t is computed as:

Original: [Equation]
Revised: [Equation]

Original: where c = min v 2 U r ( ˆS [ v ][ t ]  ˆS 

Revised: where c = min v 2 U r ( ˆS [ v ][ t ]  ˆS

Original: [ v ][ t ]) is a constant for normalization, and b 2 is a positive hyperparameter to scale the tendency difference.
Revised: [ v ][ t ]) is a constant for normalization, and b 2 is a positive hyperparameter to scale the tendency difference.

Original:  ( x ) =
Revised:  ( x ) =

Original: [Equation]
Revised: [Equation]

Original: ) is the Sigmoid function.
Revised: ) is the Sigmoid function.

Original: Additionally, we use Proposition 2 to show that Eq.
Revised: Additionally, we use Proposition 2 to show that Eq.

Original: (5) enables users with a smaller 4 ˆS [ u ][ t ] to contribute more weights to the attack parameter optimization.
Revised: (5) enables users with a smaller 4 ˆS [ u ][ t ] to contribute more weights to the attack parameter optimization.

Original: Due to space limit, we put the proof in Appx.
Revised: Due to space limit, we put the proof in Appx.

Original: A.2.2.
Revised: A.2.2.

Original: Proposition 2.
Revised: Proposition 2.

Original: Our diversity-aware attack objective satisﬁes diversity property 1 and property 2.
Revised: Our diversity-aware attack objective satisﬁes diversity property 1 and property 2.

Original: 3.3 Difﬁculty and Diversity Aware Attacker 3.3.1 Problem Formulation
Revised: 3.3 Difﬁculty and Diversity Aware Attacker 3.3.1 Problem Formulation

Original: Based on two measurements proposed in Eq.
Revised: Based on two measurements proposed in Eq.

Original: (4) and Eq.
Revised: (4) and Eq.

Original: (5), we formally formulate the DifﬁcultyAware and Diversity-Aware
Revised: (5), we formally formulate the DifﬁcultyAware and Diversity-Aware

Original: (DADA) RecSys attacking problem as follows.
Revised: (DADA) RecSys attacking problem as follows.

Original: Deﬁnition 1 (DADA Problem) .
Revised: Deﬁnition 1 (DADA Problem) .

Original: Given the real user behaviors R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the surrogate RecSys ˆ M ˆ ✓ , the goal is to generate the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget | U f |   and the maximum number k R f
Revised: Given the real user behaviors R r 2 { 0 , 1 } | U r | ⇥ | I | , the target item t , and the surrogate RecSys ˆ M ˆ ✓ , the goal is to generate the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I | with the constraints, injection budget | U f |   and the maximum number k R f

Original: [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attack objective as follows:
Revised: [ u ] k 0  ⌧ of items that each fake user can interact with, which can maximize the attack objective as follows:

Original: [Equation]
Revised: [Equation]

Original: where  is a trade-off hyperparamter, R 2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | concatenates the real and fake user representations, ˆS and ˆS 0 are the learned latent tendencies of the surrogate RecSys
Revised: where  is a trade-off hyperparamter, R 2 { 0 , 1 } ( | U r | + | U f | ) ⇥ | I | concatenates the real and fake user representations, ˆS and ˆS 0 are the learned latent tendencies of the surrogate RecSys

Original: ˆ M ˆ ✓ on R and
Revised: ˆ M ˆ ✓ on R and

Original: R r , respectively.
Revised: R r , respectively.

Original: L tra ( · ) is the training loss of ˆ M ˆ ✓ as in Eq.
Revised: L tra ( · ) is the training loss of ˆ M ˆ ✓ as in Eq.

Original: 3.3.2 Greedy Algorithm
Revised: 3.3.2 Greedy Algorithm

Original: Due to the exponential search space O ( | I | ⌧ ·| U f | ) , it is nontrivial to ﬁnd the exact optimal fake user behaviors for the difﬁculty-aware and diversity-aware optimization problem in Eq (6).
Revised: Due to the exponential search space O ( | I | ⌧ ·| U f | ) , it is nontrivial to ﬁnd the exact optimal fake user behaviors for the difﬁculty-aware and diversity-aware optimization problem in Eq (6).

Original: Thus, we propose a gradient-based greedy algorithm to maximize the objective in Alg. 1 in Appx.
Revised: Thus, we propose a gradient-based greedy algorithm to maximize the objective in Alg. 1 in Appx.

Original: A.3.
Revised: A.3.

Original: With the help of gradients, our algorithm can give a good direction to ﬁnd effective fake user behaviors.
Revised: With the help of gradients, our algorithm can give a good direction to ﬁnd effective fake user behaviors.

Original: Speciﬁcally, we ﬁrst initialize the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I | (line 1).
Revised: Speciﬁcally, we ﬁrst initialize the fake user behaviors R f 2 { 0 , 1 } | U f | ⇥ | I | (line 1).

Original: In each epoch l , we ﬁrst train the surrogate model ˆ M ˆ ✓ on R , and then compute the attack objective O atk ( · ) in
Revised: In each epoch l , we ﬁrst train the surrogate model ˆ M ˆ ✓ on R , and then compute the attack objective O atk ( · ) in

Original: Eq.
Revised: Eq.

Original: (6) (line 4-5).
Revised: (6) (line 4-5).

Original: Second, we relax the discrete fake user behaviors R f into a continuous one ˜R f 2 R | U f | ⇥ | I | , and take it as our attacker’s parameter ' (line 6).
Revised: Second, we relax the discrete fake user behaviors R f into a continuous one ˜R f 2 R | U f | ⇥ | I | , and take it as our attacker’s parameter ' (line 6).

Original: Then, we compute the gradients r ˜R f O atk ( · ) according to [41] (line 7).
Revised: Then, we compute the gradients r ˜R f O atk ( · ) according to [41] (line 7).

Original: Finally, we update the ˜R f and utilize a projector to map it into discrete behaviors R f , where each fake user can select ⌧ items at most (line 8).
Revised: Finally, we update the ˜R f and utilize a projector to map it into discrete behaviors R f , where each fake user can select ⌧ items at most (line 8).

Original: Formally, given the continuous user behaviors ˜R f , the maximum number ⌧ of items that each fake user u 2 U f can interact with, and the pre-deﬁned threshold th , the projector is formulated as follows:
Revised: Formally, given the continuous user behaviors ˜R f , the maximum number ⌧ of items that each fake user u 2 U f can interact with, and the pre-deﬁned threshold th , the projector is formulated as follows:

Original: [Equation]
Revised: [Equation]

Original: where P u is top- ⌧ largest item set of user u according to the value in ˜R f [ u ] .
Revised: where P u is top- ⌧ largest item set of user u according to the value in ˜R f [ u ] .

Original: After ﬁnishing L epochs, we output R f for injection.
Revised: After ﬁnishing L epochs, we output R f for injection.

Original: We analyze the time complexity of Alg. 1 in Appx.
Revised: We analyze the time complexity of Alg. 1 in Appx.

Original: A.4.
Revised: A.4.

Original:  Experiments 4.1 Experiment Setting
Revised:  Experiments 4.1 Experiment Setting

Original: Datasets.
Revised: Datasets.

Original: We evaluate our attacker on widely used three real-world datasets: MovieLens-100K (ML-100K) [14], MovieLens-1M (ML-1M) [14], and Gowalla [5].
Revised: We evaluate our attacker on widely used three real-world datasets: MovieLens-100K (ML-100K) [14], MovieLens-1M (ML-1M) [14], and Gowalla [5].

Original: We put the descriptions of three datasets in Appx.
Revised: We put the descriptions of three datasets in Appx.

Original: B.1.
Revised: B.1.

Original: Attacker Baselines.
Revised: Attacker Baselines.

Original: To verify the effectiveness of our proposed attacker, we compare our proposed attacker DADA with the three types of attackers in Tab. 1.
Revised: To verify the effectiveness of our proposed attacker, we compare our proposed attacker DADA with the three types of attackers in Tab. 1.

Original: Speciﬁcally, heuristic-based attackers include Random [12, 51] and Popular [29, 51], neural network-based attackers include TrialAttack [45], and gradient-based attackers include CoVis [49], PGA [20], SGLD [20], SRWA [12], TNA [11],
Revised: Speciﬁcally, heuristic-based attackers include Random [12, 51] and Popular [29, 51], neural network-based attackers include TrialAttack [45], and gradient-based attackers include CoVis [49], PGA [20], SGLD [20], SRWA [12], TNA [11],

Original: RevAdv [41], and PAPU [51].
Revised: RevAdv [41], and PAPU [51].

Original: Particularly, we do not compare PoisonRec [38] and CopyAttack [10] in Tab. 1, because they need to access the predictions of the target RecSys for real users.
Revised: Particularly, we do not compare PoisonRec [38] and CopyAttack [10] in Tab. 1, because they need to access the predictions of the target RecSys for real users.

Original: Also, we compare two variants: DADA-DICT and DADA-DIV, which only optimize the difﬁculty and diversity-aware objective in Eq.
Revised: Also, we compare two variants: DADA-DICT and DADA-DIV, which only optimize the difﬁculty and diversity-aware objective in Eq.

Original: (4) and Eq.
Revised: (4) and Eq.

Original: (5), respectively.
Revised: (5), respectively.

Original: Targeted Recommender Systems.
Revised: Targeted Recommender Systems.

Original: Following [41, 51], we choose three representative target RecSys to evaluate the attacking performance of RecSys attackers, i.e., matrix factorization-based
Revised: Following [41, 51], we choose three representative target RecSys to evaluate the attacking performance of RecSys attackers, i.e., matrix factorization-based

Original: WRMF [18], neural network-based NCF [16], and graph neural network-based LightGCN [15].
Revised: WRMF [18], neural network-based NCF [16], and graph neural network-based LightGCN [15].

Original: Target Items and Evaluation Metric.
Revised: Target Items and Evaluation Metric.

Original: Following [41, 51], we uniformly sample 5 items as a target item set I t and measure the hit ratio Hit@N of I t on the real users U r .
Revised: Following [41, 51], we uniformly sample 5 items as a target item set I t and measure the hit ratio Hit@N of I t on the real users U r .

Original: If one of these target items appears in the top-N recommended item list of a user u 2 U r , the target item set is considered as a hit.
Revised: If one of these target items appears in the top-N recommended item list of a user u 2 U r , the target item set is considered as a hit.

Original: Besides, we use the Normalized Discounted Cumulative Gain (NDCG) to measure the rank quality of the target items in the recommendation list.
Revised: Besides, we use the Normalized Discounted Cumulative Gain (NDCG) to measure the rank quality of the target items in the recommendation list.

Original: Speciﬁcally, we set the relevance score of target items and the other items for all real users as 1 and 0, respectively.
Revised: Speciﬁcally, we set the relevance score of target items and the other items for all real users as 1 and 0, respectively.

Original: Then, a higher NDCG value indicates better attack performance, where target items are ranked higher in the recommendation list.
Revised: Then, a higher NDCG value indicates better attack performance, where target items are ranked higher in the recommendation list.

Original: The reported results are averaged over ﬁve different runs.
Revised: The reported results are averaged over ﬁve different runs.

Original: Hyperparamter Setting.
Revised: Hyperparamter Setting.

Original: Due to datasets with different sizes, we set the fake user budget  =  1 ·| U r | and the maximum number of selected items ⌧ =  2 ·| I | , where  1 and  2 are the parameters to control  and ⌧ .
Revised: Due to datasets with different sizes, we set the fake user budget  =  1 ·| U r | and the maximum number of selected items ⌧ =  2 ·| I | , where  1 and  2 are the parameters to control  and ⌧ .

Original: For default, we set  1 = 0 .
Revised: For default, we set  1 = 0 .

Original: 01 for all datasets.
Revised: 01 for all datasets.

Original: For unnoticeable, we set the default ⌧ to be similar to the average number of interacted items of real users as shown in Tab. 4, i.e.,  2 is { 0 . 05 , 0 . 05 , 0 . 002 } for ML-100K, ML-1M, and Gowalla, respectively.
Revised: For unnoticeable, we set the default ⌧ to be similar to the average number of interacted items of real users as shown in Tab. 4, i.e.,  2 is { 0 . 05 , 0 . 05 , 0 . 002 } for ML-100K, ML-1M, and Gowalla, respectively.

Original: The details about hyper-parameter settings are listed in Appx.
Revised: The details about hyper-parameter settings are listed in Appx.

Original: B.2.
Revised: B.2.

Original: 4.2 Experiment Results
Revised: 4.2 Experiment Results

Original: We report the HR performance of attackers on ML-100K and ML-1M in Tab. 2 and Tab. 3.
Revised: We report the HR performance of attackers on ML-100K and ML-1M in Tab. 2 and Tab. 3.

Original: To better show the improvement, we add the improvement ratio of HR@10 for each attacker compared with the result in clean data.
Revised: To better show the improvement, we add the improvement ratio of HR@10 for each attacker compared with the result in clean data.

Original: Due to space limit, we report similar results of Gowalla in Appx.
Revised: Due to space limit, we report similar results of Gowalla in Appx.

Original: B.3.
Revised: B.3.

Original: We report the NDCG results on three datasets in Appx.
Revised: We report the NDCG results on three datasets in Appx.

Original: B.4.
Revised: B.4.

Original: Under the same target RecSys, the bold and underlined numbers indicate the ﬁrst and second best performance, respectively.
Revised: Under the same target RecSys, the bold and underlined numbers indicate the ﬁrst and second best performance, respectively.

Original: Baseline Comparison.
Revised: Baseline Comparison.

Original: As shown in Tab. 2 and Tab. 3, our attacker DADA outperforms all baselines under different target RecSys on both ML-100K and ML-1M datasets.
Revised: As shown in Tab. 2 and Tab. 3, our attacker DADA outperforms all baselines under different target RecSys on both ML-100K and ML-1M datasets.

Original: Speciﬁcally, heuristics-based
Revised: Speciﬁcally, heuristics-based

Original: [Table] [Table]
Revised: [Table] [Table]

Original: approaches, such as Random, Popular
Revised: approaches, such as Random, Popular

Original: [Table]
Revised: [Table]

Original: and CoVis
Revised: and CoVis

Original: [Table]
Revised: [Table]

Original: achieve unsatisﬁed results
Revised: achieve unsatisﬁed results

Original: [Table]
Revised: [Table]

Original: Because they only consider to increase the co-occurrence between several items and the target items, which does not relate to the attack objective directly and cannot cover various behavior patterns [41, 51, 52].
Revised: Because they only consider to increase the co-occurrence between several items and the target items, which does not relate to the attack objective directly and cannot cover various behavior patterns [41, 51, 52].

Original: Instead, neural network-based and gradient-based attackers optimize the attack objective directly.
Revised: Instead, neural network-based and gradient-based attackers optimize the attack objective directly.

Original: Compared with TrialAttack, RevAdv and PAPU, several gradient-based attackers, including SRWA, PGA,
Revised: Compared with TrialAttack, RevAdv and PAPU, several gradient-based attackers, including SRWA, PGA,

Original: SGLD, and TNA, achieve inferior performance.
Revised: SGLD, and TNA, achieve inferior performance.

Original: It is because when computing the gradients to design fake user behaviors, these approaches approximate the gradients in a biased way instead of exact computing gradients [41].
Revised: It is because when computing the gradients to design fake user behaviors, these approaches approximate the gradients in a biased way instead of exact computing gradients [41].

Original: Our attacker DADA outperforms the above baselines signiﬁcantly, because it enables the fake user behaviors to affect real users in a diverse manner.
Revised: Our attacker DADA outperforms the above baselines signiﬁcantly, because it enables the fake user behaviors to affect real users in a diverse manner.

Original: Ablation Study.
Revised: Ablation Study.

Original: As shown in Tab. 2 and Tab. 3, DADA-DICT achieves the second best results, outperforming all baselines.
Revised: As shown in Tab. 2 and Tab. 3, DADA-DICT achieves the second best results, outperforming all baselines.

Original: It is because the difﬁculty-aware attack objective allows DADA-DICT to concentrate on easy users with high tendencies toward the target items.
Revised: It is because the difﬁculty-aware attack objective allows DADA-DICT to concentrate on easy users with high tendencies toward the target items.

Original: Moreover, DADA-DIV achieves satisﬁed performance.
Revised: Moreover, DADA-DIV achieves satisﬁed performance.

Original: It outperforms current state-of-the-art attackers, including RevAdv and PAPU, in most cases.
Revised: It outperforms current state-of-the-art attackers, including RevAdv and PAPU, in most cases.

Original: It is because the diversity-aware attack objective allows the generated fake user behaviors to affect real users more diversely, avoiding large communities dominating the generated fake users.
Revised: It is because the diversity-aware attack objective allows the generated fake user behaviors to affect real users more diversely, avoiding large communities dominating the generated fake users.

Original: Nevertheless, DADA-DIV does not outperform DADA-DICT, because DADADIV cannot differentiate easy users from all real users and put more efforts on them.
Revised: Nevertheless, DADA-DIV does not outperform DADA-DICT, because DADADIV cannot differentiate easy users from all real users and put more efforts on them.

Original: Furthermore,
Revised: Furthermore,

Original: DADA that considers both user difﬁculty and diversity can perform the best.
Revised: DADA that considers both user difﬁculty and diversity can perform the best.

Original: In such a way, it can potentially affect easy users from different communities, thereby boosting attacker’s effectiveness.
Revised: In such a way, it can potentially affect easy users from different communities, thereby boosting attacker’s effectiveness.

Original: 4.3 Parameter Sensitivity
Revised: 4.3 Parameter Sensitivity

Original: In this subsection, we evaluate DADA under different parameters.
Revised: In this subsection, we evaluate DADA under different parameters.

Original: As shown in Tab 2 and Tab. 3, the results of DADA and baselines on different target RecSys and hit ratios have similar trends.
Revised: As shown in Tab 2 and Tab. 3, the results of DADA and baselines on different target RecSys and hit ratios have similar trends.

Original: For clariﬁcation, we use WRMF and HR@50 for evaluation on ML-100K and ML-1M datasets.
Revised: For clariﬁcation, we use WRMF and HR@50 for evaluation on ML-100K and ML-1M datasets.

Original: Fake User Budget  .
Revised: Fake User Budget  .

Original: We study the effect of fake user budget  =  1 | U r | by varying  1{ 0 . 01 , 0 .
Revised: We study the effect of fake user budget  =  1 | U r | by varying  1{ 0 . 01 , 0 .

Original: For clariﬁcation, we only compare the effective baselines, including
Revised: For clariﬁcation, we only compare the effective baselines, including

Original: TrialAttack, TNA, RevAdv, and PAPU.
Revised: TrialAttack, TNA, RevAdv, and PAPU.

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 2 (a) and (b), HR@50 of all attackers increases as the fake user budget increases on both ML-100K and ML-1M datasets.
Revised: 2 (a) and (b), HR@50 of all attackers increases as the fake user budget increases on both ML-100K and ML-1M datasets.

Original: Furthermore,
Revised: Furthermore,

Original: [Figure]
Revised: [Figure]

Original: DADA outperforms all baselines under different attack budgets, i.e., the red solid line is above other lines, demonstrating its effectiveness.
Revised: DADA outperforms all baselines under different attack budgets, i.e., the red solid line is above other lines, demonstrating its effectiveness.

Original: Particularly, as the fake user budget increases, our attacker and baselines improve HR@50 on ML-100K more than that on ML-1M.
Revised: Particularly, as the fake user budget increases, our attacker and baselines improve HR@50 on ML-100K more than that on ML-1M.

Original: The reason is that ML-100K only has 1682 items, while ML-1M has 3706 items.
Revised: The reason is that ML-100K only has 1682 items, while ML-1M has 3706 items.

Original: As a result, it is more difﬁcult to promote target items into the top-50 recommendation list of each user in ML-1M than ML-100K.
Revised: As a result, it is more difﬁcult to promote target items into the top-50 recommendation list of each user in ML-1M than ML-100K.

Original: Maximum Selected Items ⌧ .
Revised: Maximum Selected Items ⌧ .

Original: We study the effect of different maximum number of selected items ⌧ =  2 | I | by varying  2 2 { 0 . 01 , 0 . 03 , 0 . 05 , 0 . 07 , 0 . 09 } .
Revised: We study the effect of different maximum number of selected items ⌧ =  2 | I | by varying  2 2 { 0 . 01 , 0 . 03 , 0 . 05 , 0 . 07 , 0 . 09 } .

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 2 (c) and (d), as the maximum number of items increases, the performance of attackers ﬁrst increases and then decreases on both datasets.
Revised: 2 (c) and (d), as the maximum number of items increases, the performance of attackers ﬁrst increases and then decreases on both datasets.

Original: It indicates that selecting suitable items can increase the attacker’s power.
Revised: It indicates that selecting suitable items can increase the attacker’s power.

Original: But more items will reduce the effectiveness of attackers, since the valuable items are limited, and extra items will introduce noise [12, 29, 51].
Revised: But more items will reduce the effectiveness of attackers, since the valuable items are limited, and extra items will introduce noise [12, 29, 51].

Original: Furthermore, compared with these powerful baselines, DADA can achieve stable and the best performance under different maximum number of selected items.
Revised: Furthermore, compared with these powerful baselines, DADA can achieve stable and the best performance under different maximum number of selected items.

Original: 4.4 More Insights via Empirical Study
Revised: 4.4 More Insights via Empirical Study

Original: Due to space limit, we include more experiments in Appx.
Revised: Due to space limit, we include more experiments in Appx.

Original: B for more insights.
Revised: B for more insights.

Original: In Appx.
Revised: In Appx.

Original: B.5, to better mimic the real-world applications, we demonstrate the generality and practicability of our attacker on partial and noisy user behaviors.
Revised: B.5, to better mimic the real-world applications, we demonstrate the generality and practicability of our attacker on partial and noisy user behaviors.

Original: In Appx.
Revised: In Appx.

Original: B.6, we evaluate our attacker under different item popularity.
Revised: B.6, we evaluate our attacker under different item popularity.

Original: In Appx.
Revised: In Appx.

Original: B.7, we more comprehensively reveal the effectiveness of the difﬁcultyaware objective and quantitatively measure the diversity brought by the diversity-aware objective.
Revised: B.7, we more comprehensively reveal the effectiveness of the difﬁcultyaware objective and quantitatively measure the diversity brought by the diversity-aware objective.

Original: In
Revised: In

Original: Appx.
Revised: Appx.

Original: B.8, we evaluate our attacker under more parameter settings, including extremely limited fake user budget and  in Eq (6).
Revised: B.8, we evaluate our attacker under more parameter settings, including extremely limited fake user budget and  in Eq (6).

Original: In Appx.
Revised: In Appx.

Original: B.9, we analyze the hit ratio improvement under different target
Revised: B.9, we analyze the hit ratio improvement under different target

Original: RecSys.
Revised: RecSys.

Original: In Appx.
Revised: In Appx.

Original: B.10, we provide visualizations on gradients provided by different users and fake user distributions.
Revised: B.10, we provide visualizations on gradients provided by different users and fake user distributions.

Original: Finally, in Appx.
Revised: Finally, in Appx.

Original: B.11, we list several future directions based on our observations.
Revised: B.11, we list several future directions based on our observations.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper, we revisit the problem of injective attacks against recommender systems and reveal two issues of existing attackers: difﬁculty-agnostic and diversity-deﬁcit issues.
Revised: In this paper, we revisit the problem of injective attacks against recommender systems and reveal two issues of existing attackers: difﬁculty-agnostic and diversity-deﬁcit issues.

Original: To address these two issues, we propose DADA, a difﬁculty and diversity aware attacker.
Revised: To address these two issues, we propose DADA, a difﬁculty and diversity aware attacker.

Original: Within a limited fake user budget, DADA enables the generated fake user behaviors to concentrate on easy users who have high tendencies toward the target item, and affect real users in a more diverse manner.
Revised: Within a limited fake user budget, DADA enables the generated fake user behaviors to concentrate on easy users who have high tendencies toward the target item, and affect real users in a more diverse manner.

Original: Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.
Revised: Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.

Original: In this paper, we mainly reveal the weakness of existing recommender systems and discuss how to attack them.
Revised: In this paper, we mainly reveal the weakness of existing recommender systems and discuss how to attack them.

Original: For the sake of society, we discuss how to defense and resist such attacks in Appx.
Revised: For the sake of society, we discuss how to defense and resist such attacks in Appx.

Original: B.12.
Revised: B.12.

Original:  Acknowledgement
Revised:  Acknowledgement

Original: Lei Chen’s work is partially supported by National Key Research and Development Program ofChina
Revised: Lei Chen’s work is partially supported by National Key Research and Development Program of

Original:  Grant No.  2018AAA0101100, the Hong Kong RGC GRF Project 16213620, CRF Project C603018G, C1031-18G, C5026-18G, CRF C2004-21GF, AOE Project AoE/E603/18, RIF Project R602019, Theme-based project TRS T41-603/20R, China NSFC No.61729201, Guangdong Basic and
Revised: China Grant No. 2022YFE0200500 and 2018AAA0101100, the Hong Kong RGC GRF Project 16213620, CRF Project C6030-18G, C1031-18G, C5026-18G, CRF C2004-21GF, AOE Project AoE/E603/18, RIF Project R6020-19, Theme-based project TRS T41-603/20R, China NSFC No.

Original:  Applied Basic Research Foundation 2019B151530001, Hong Kong ITC ITF grants ITS/044/18FX and ITS/470/18FX, Microsoft Research Asia CollaborativeResearch Grant, HKUST-NAVER/LINE
Revised: 61729201, Guangdong Basic and Applied Basic Research Foundation 2019B151530001, Hong Kong ITC ITF grants ITS/044/18FX and ITS/470/18FX, Microsoft Research Asia Collaborative

Original:  AI Lab, Didi-HKUST joint research lab, HKUST-Webank joint research lab grants and HKUST Global Strategic Partnership Fund (2021 SJTU-HKUST).
Revised: Research Grant, HKUST-NAVER/LINE AI Lab, Didi-HKUST joint research lab, HKUST-Webank joint research lab grants and HKUST Global Strategic Partnership Fund (2021 SJTU-HKUST).

Original: Shimin Di’s work is supported by the JC STEM Lab of Data Science Foundations funded by The Hong Kong Jockey Club Charities Trust.
Revised: Shimin Di’s work is supported by the JC STEM Lab of Data Science Foundations funded by The Hong Kong Jockey Club Charities Trust.

Original: Checklist
Revised: Checklist

Original: Please do not modify the questions and only use the provided macros for your answers.
Revised: Please do not modify the questions and only use the provided macros for your answers.

Original: Note that the
Revised: Note that the

Original: Checklist section does not count towards the page limit.
Revised: Checklist section does not count towards the page limit.

Original: In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.
Revised: In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.

Original: For all authors... (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?
Revised: For all authors... (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you describe the limitations of your work?
Revised: (b) Did you describe the limitations of your work?

Original: [Yes] (c) Did you discuss any potential negative societal impacts of your work?
Revised: [Yes] (c) Did you discuss any potential negative societal impacts of your work?

Original: [Yes] This paper mainly reveals the potential way to attack some recommendation systems.
Revised: [Yes] This paper mainly reveals the potential way to attack some recommendation systems.

Original: We discuss some existing defense models and future directions in Appx.
Revised: We discuss some existing defense models and future directions in Appx.

Original: B. (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
Revised: B. (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?

Original: [Yes] 2.
Revised: [Yes] 2.

Original: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
Revised: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes] (b) Did you include complete proofs of all theoretical results?
Revised: [Yes] (b) Did you include complete proofs of all theoretical results?

Original: [Yes] 3.
Revised: [Yes] 3.

Original: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
Revised: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?

Original: [No] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
Revised: [No] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?

Original: [Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
Revised: [Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Original: [No] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
Revised: [No] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?

Original: [Yes] 4.
Revised: [Yes] 4.

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?

Original: [Yes] (b) Did you mention the license of the assets?
Revised: [Yes] (b) Did you mention the license of the assets?

Original: [Yes] (c) Did you include any new assets either in the supplemental material or as a URL?
Revised: [Yes] (c) Did you include any new assets either in the supplemental material or as a URL?

Original: [No] (d) Did you discuss whether
Revised: [No] (d) Did you discuss whether

Original: and how consent was obtained from people whose data you’re using/curating?
Revised: and how consent was obtained from people whose data you’re using/curating?

Original: [Yes] (e) Did you discuss whether the data you are using/curating contains personally identiﬁable information or offensive content?
Revised: [Yes] (e) Did you discuss whether the data you are using/curating contains personally identiﬁable information or offensive content?

Original: [N/A] 5.
Revised: [N/A] 5.

Original: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
Revised: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?

Original: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
Revised: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?

Original: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
Revised: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?

Original: [N/A]
Revised: [N/A]