On the Detection of Shilling Attacks in Federated Collaborative Filtering
Abstract
Federated collaborative filtering (Fed-CF) is a variant of federated learning (FL) models, which can protect user privacy in recommender systems. In Fed-CF, the recommendation model is collectively trained across multiple decentralized clients by exchanging gradients only. However, the decentralized nature of Fed-CF makes it vulnerable to shilling attacks, which can be realized by inserting fake ratings of target items to distort recommendation results. Unfortunately, previous detection algorithms cannot work well in the FL framework, as all original data samples are not disclosed at all. In this paper, we are the first to systematically study the problem of shilling attacks in the context of federated learning, and propose an effective detection method called Federated Shilling Attack Detector (FSAD) to detect shilling attackers in Fed-CF. We first show the feasibility of shilling attacks in Fed-CF. Next, we dedicatedly design four novel features based on exchanged gradients among clients. By incorporating these gradient-based features, we train a semi-supervised Bayes classifier to identify shilling attackers effectively. Finally, we conduct extensive experiments based on real-world datasets to evaluate the performance of our proposed FSAD method. The experimental results show that FSAD can detect shilling attackers in Fed-CF with high accuracy, with the F1value as high as 0.90 on the Netflix dataset, which approaches the performance of the optimal detector that utilizes complete private user information for detection.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Increasing privacy reduces the accuracy of the training algorithm.
“It has been observed from the analysis of the results that by increasing privacy, the accuracy of the training algorithm is reduced.”
From Federated Learning for Privacy Preservation in Smart Healthcare Systems: A Comprehensive Survey (2023) · cites this paper as [65]
All FL privacy preserved algorithms are designed such that clients will have a dataset containing almost the same features.
“More probably, all the FL privacy preserved algorithms are designed in such a manner that the clients will have a dataset containing almost the same features [64], [65].”
From Federated Learning for Privacy Preservation in Smart Healthcare Systems: A Comprehensive Survey (2023) · cites this paper as [65]
The proposed idea can not only identify shilling hackers but also improve the performance of recommendations significantly.
“The performance evaluation on two real-world datasets, namely, MovieLens and Netflix, demonstrates that the proposed idea can not only identify shilling hackers but also improve the performance of recommendations significantly.”
From Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis (2021) · cites this paper as [131]
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
The MovieLens Datasets: History and Context
Harper, F., & Konstan, J. (2016) · TIIS · doi:10.1145/2827872 · Cited by 5,938 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2014) · Foundations and Trends® in Theoretical Computer Science · doi:10.1561/0400000042 · Cited by 5,557 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856 · see citing works
Ricci⋆, F., Kantor, P. B., Shapira, B., & Rokach, L. (2010) · Springer eBooks · doi:10.1007/978-0-387-85820-3 · Cited by 3,823 · see citing works
Text classification from labeled and unlabeled documents using EM
Nigam, K., Mccallum, A. K., Thrun, S., & Mitchell, T. (2000) · Machine Learning · doi:10.1023/a:1007692713085 · Cited by 2,736 · see citing works
Collaborative Filtering Recommender Systems
Schafer, J. B., Frankowski, D., Herlocker, J., & Sen, S. (2007) · Springer eBooks · doi:10.1007/978-3-540-72079-9_9 · Cited by 2,192 · see citing works
RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
Erlingsson, Ú., Pihur, V., & Korolova, A. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660348 · Cited by 1,838 · see citing works
Recommender system application developments: A survey
Jie Lu, B., Wu, D., Mao, M., Wang, W., & Zhang, G. (2015) · Decision Support Systems · doi:10.1016/j.dss.2015.03.008 · Cited by 1,584 · see citing works
Self-citationFederated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
The Netflix Recommender System: Algorithms, Business Value, and Innovation
Gomez-Uribe, C. A., & Hunt, N. (2016) · ACM Transactions on Management Information Systems · doi:10.1145/2843948 · Cited by 1,418 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Bennett, J. R., & Lanning, S. (2007) · Cited by 1,118 · see citing works
Differentially Private Federated Learning: A Client Level Perspective
Geyer, R. C., Klein, T., & Nabi, M. (2017) · arXiv · doi:10.48550/arxiv.1712.07557 · Cited by 1,052 · see citing works
Shilling recommender systems for fun and profit
Lam, S. K., & Riedl, J. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988726 · Cited by 646 · see citing works
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385 · see citing works
Shilling attacks against recommender systems: a comprehensive survey
Güneş, İ., Kaleli, C., Bilge, A., & Polat, H. (2012) · Artificial Intelligence Review · doi:10.1007/s10462-012-9364-9 · Cited by 325 · see citing works
O’Mahony, M. P., Hurley, N., Kushmerick, N., & Silvestre, G. C. M. (2004) · ACM Transactions on Internet Technology · doi:10.1145/1031114.1031116 · Cited by 324 · see citing works
Preventing shilling attacks in online recommender systems
Chirita, P., Nejdl, W., & Zamfir, C. (2005) · ACM International Workshop on Web Information and Data Management (WIDM) · doi:10.1145/1097047.1097061 · Cited by 310 · see citing works
Classification features for attack detection in collaborative recommender systems
Burke, R., Mobasher, B., Williams, C., & Bhaumik, R. (2006) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1150402.1150465 · Cited by 251 · see citing works
Federated Collaborative Filtering for Privacy-Preserving Personalized Recommendation SystemPreprint
Ammad-ud-din, M., Ivannikova, E., Khan, S. A., Oyomno, W., Fu, Q., Tan, K. E., & Flanagan, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09888 · Cited by 220 · see citing works
Hurley, N., Cheng, Z., & Zhang, M. (2009) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/1639714.1639740 · Cited by 145 · see citing works
A scalable P2P recommender system based on distributed collaborative filtering
Han, P., Xie, B., Yang, F., & Shen, R. (2004) · Expert Systems with Applications · doi:10.1016/j.eswa.2004.01.003 · Cited by 142 · see citing works
Wu, Z., Wu, J., Cao, J., & Tao, D. (2012) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2339530.2339684 · Cited by 119 · see citing works
Identifying Attack Models for Secure Recommendation
Burke, R., Mobasher, B., Zabicki, R., & Bhaumik, R. (2004) · Cited by 86 · see citing works
A Simple and Efficient Federated Recommender System
Jalalirad, A., Scavuzzo, M., Capota, C., & Sprague, M. (2019) · IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT) · doi:10.1145/3365109.3368788 · Cited by 75 · see citing works
Unsupervised shilling detection for collaborative filtering
Mehta, B. (2007) · Cited by 69 · see citing works
Federated Multi-view Matrix Factorization for Personalized Recommendations
Flanagan, A., Oyomno, W., Grigorievskiy, A., Tan, K. E., Khan, S. A., & Ammad-ud-din, M. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67661-2_20 · Cited by 68 · see citing works
Distributed recommender for peer-to-peer knowledge sharing
Zhen, L., Jiang, Z., & Song, H. (2010) · Information Sciences · doi:10.1016/j.ins.2010.05.036 · Cited by 54 · see citing works
Profile Injection Attack Detection for Securing Collaborative Recommender Systems 1
Williams, C., & Mobasher, B. (2006) · Cited by 31 · see citing works
Quick and accurate attack detection in recommender systems through user attributes
Aktukmak, M., Yılmaz, Y., & Uysal, I. (2019) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3298689.3347050 · Cited by 23 · see citing works
Strategies for Effective Shilling Attacks against Recommender Systems
Ray, S., & Mahanti, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01718-6_8 · Cited by 22 · see citing works
Flagged first, then by citations
1 of the 36 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Federated Learning for Privacy Preservation in Smart Healthcare Systems: A Comprehensive Survey
Ali, M., Naeem, F., Tariq, M., & Kaddoum, G. (2023) · IEEE Journal of Biomedical and Health Informatics · doi:10.1109/jbhi.2022.3181823 · Cited by 366 · see citing works
Ferrag, M. A., Friha, O., Maglaras, L., Janicke, H., & Shu, L. (2021) · IEEE Access · doi:10.1109/access.2021.3118642 · Cited by 342 · see citing works
Ali, S., Li, Q., & Yousafzai, A. (2023) · Ad Hoc Networks · doi:10.1016/j.adhoc.2023.103320 · Cited by 216 · see citing works
A Survey on Federated Recommendation Systems
Sun, Z., Xu, Y., Liu, Y., He, W., Kong, L., Wu, F., Jiang, Y., & Cui, L. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3354924 · Cited by 133 · see citing works
Self-citationFederated learning for 6G-enabled secure communication systems: a comprehensive survey
Sirohi, D., Kumar, N., Rana, P. S., Tanwar, S., Iqbal, R., & Hijji, M. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-023-10417-3 · Cited by 98 · see citing works
Safe: Synergic Data Filtering for Federated Learning in Cloud-Edge Computing
Xu, X., Li, H., Li, Z., & Zhou, X. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3195896 · Cited by 76 · see citing works
A Survey on the use of Federated Learning in Privacy-Preserving Recommender Systems
Chronis, C., Varlamis, I., Himeur, Y., Sayed, A. N., Al-Hasan, T. M., Nhlabatsi, A., Bensaali, F., & Dimitrakopoulos, G. J. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3396344 · Cited by 51 · see citing works
Ali, W., Zhou, X., & Shao, J. (2024) · ACM Computing Surveys · doi:10.1145/3708982 · Cited by 50 · see citing works
Karras, A., Γιάνναρος, Α., Theodorakopoulos, L., Krimpas, G. A., Kalogeratos, G., Karras, C., & Sioutas, S. (2023) · Electronics · doi:10.3390/electronics12224633 · Cited by 36 · see citing works
A Survey on the Applications of Semi-supervised Learning to Cyber-security
Mvula, P. K., Branco, P., Jourdan, G.-V., & Viktor, H. L. (2024) · ACM Computing Surveys · doi:10.1145/3657647 · Cited by 36 · see citing works
On-Device Recommender Systems: A Comprehensive Survey
Yin, H., Qu, L., Chen, T., Yuan, W., Zheng, R., Long, J., Xia, X., Shi, Y., & Chengqi Zhang, B. (2025) · Data Science and Engineering · doi:10.1007/s41019-025-00308-8 · Cited by 67 · see citing works
Cui, L., Ma, J., Zhou, Y., & Yu, S. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3161517 · Cited by 28 · see citing works
Self-citationOn Data Distribution Leakage in Cross-Silo Federated Learning
Jiang, Y., Luo, X., Wu, Y., Zhu, X., Xiao, X., & Ooi, B. C. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3349323 · Cited by 14 · see citing works
Self-citationRAP: A Light-Weight Privacy-Preserving Framework for Recommender Systems
Hu, M., Wu, D., Wu, R., Shi, Z., Chen, M., & Zhou, Y. (2021) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2021.3065035 · Cited by 13 · see citing works
Self-citationZhou, Y., Liu, J., Wang, J. H., Wang, J., Li, C., Yu, S., Li, C., & Yu, S. (2022) · Information Sciences · doi:10.1016/j.ins.2022.05.083 · Cited by 14 · see citing works
Self-citationChen, R., Chen, X., & Zhao, J. (2024) · PLoS ONE · doi:10.1371/journal.pone.0301897 · Cited by 13 · see citing works
Tan, X. M., Xiao, D., Huang, H. M., Wang, M., & Li, M. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3431100 · Cited by 6 · see citing works
Hybrid CNN and RNN-based shilling attack framework in social recommender networks
Narayanan, P., & Kalimuthu, V. (2018) · ICST Transactions on Scalable Information Systems · doi:10.4108/eai.2-11-2021.171754 · Cited by 6 · see citing works
Feng, Y., Yang, Z., Li, K., Li, J., Wang, P., & Liu, Z. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3639434 · Cited by 3 · see citing works
Penalized GANs with latent perturbation for robust shilling attack generation in recommender systems
Nawara, D., & Kashef, R. F. (2025) · Discover Computing · doi:10.1007/s10791-025-09702-2 · Cited by 2 · see citing works
(2020) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds51746.2020.00004
Pu, R., Yang, X., Liu, Y., Li, J., Jin, Y., Song, F., & Wang, B. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-4155-3_36
- Authors
- Jiang, Y., Zhou, Y., Wu, D., Li, C., & Wang, Y.
- Affiliations
- Sun Yat-sen University (CN)
- Macquarie University (AU)
- Tencent (China) (CN)
- Venue
- 2020 International Symposium on Reliable Distributed Systems (SRDS)
- Publisher
- IEEE
- Published
- 2020-09
- Pages
- 185-194
- ISSN
- 1060-9857 (ISSN-L)
- OpenAlex
- W3103801419
- Cited by
- 22
- References
- 36
- Citations by year
- 2026: 1 · 2025: 3 · 2024: 7 · 2023: 3 · 2022: 4 · 2021: 2 · 2020: 1 · 2018: 1
- FWCI
- 0.95
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Symposium on Reliable Distributed Systems (SRDS) (publishedVersion)
- Funders
- National Natural Science Foundation of China
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Keywords
- shilling attacks, federated learning, attack detection, gradient-based features, recommender systems, privacy preservation, Netflix dataset
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
