Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning aacks, in which an aacker injects fake data to a recommender system such that the system makes recommendations as the aacker desires. However, these poisoning aacks are either agnostic to recommendation algorithms or optimized to recommender systems (e.g., association-rule-based or matrix-factorization-based recommender systems) that are not graph-based. Like associationrule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store (a big app store in China). However, how to design optimized poisoning aacks for graph-based recommender systems is still an open problem. In this work, we perform a systematic study on poisoning aacks to graph-based recommender systems. We consider an aacker's goal is to promote a target item to be recommended to as many users as possible. To achieve this goal, our aacks inject fake users with carefully craed rating scores to the recommender system. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. e key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning aacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our aacks and compare them with existing aacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and blackbox (recommendation algorithm is unknown) seings using two real-world datasets. Our results show that our aack is eective and outperforms existing aacks for graph-based recommender systems. For instance, when 1% of users are injected fake users, our aack can make a target item recommended to 580 times more normal users in certain scenarios.
For example, Fang et al. REF proposed efficient poisoning attacks to graph-based recommender systems.
Poisoning Attacks to Graph-Based Recommender Systems
ACSAC '18
Computer Science Mathematics