Adversarial Attacks for Black-Box Recommender Systems via Copying Transferable Cross-Domain User Profiles
Abstract
As widely used in data-driven decision-making, recommender systems have been recognized for their capabilities to provide users with personalized services in many user-oriented online services, such as E-commerce (e.g., Amazon, Taobao, etc.) and Social Media sites (e.g., Facebook and Twitter). Recent works have shown that deep neural networks-based recommender systems are highly vulnerable to adversarial attacks, where adversaries can inject carefully crafted fake user profiles (i.e., a set of items that fake users have interacted with) into a target recommender system to promote or demote a set of target items. Instead of generating users with fake profiles from scratch, in this article, we introduce a novel strategy to obtain “fake” user profiles via copying cross-domain user profiles, where a reinforcement learning based black-box attacking framework (CopyAttack+) is developed to effectively and efficiently select cross-domain user profiles from the source domain to attack the target system. Moreover, we propose to train a local surrogate system for mimicking adversarial black-box attacks in the source domain, so as to provide transferable signals with the purpose of enhancing the attacking strategy in the target black-box recommender system. Comprehensive experiments on three real-world datasets are conducted to demonstrate the effectiveness of the proposed attacking framework.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Recommender system's security and privacy features make it difficult for an adversary to have the deep knowledge required for white box or grey box attacks, making them unrealistic for real-world applications.
“However, the recommender system's security and privacy features make it difficult for an adversary to have the deep knowledge required for white box or grey box attacks, making them unrealistic for real-world applications [89].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [89]
Attacks on recommender systems can be classified based on the adversary's knowledge level into black, grey, or white box attacks.
“Attacks can be classified based on the adversary's knowledge level into black, grey, or white box attacks [89-94].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [89]
To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques.
“To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques [89, 91, 115].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [89]
Deep neural network (DNN) model-based RS, such as recurrent neural networks (RNNs) and graph neural networks (GNNs), are particularly susceptible to these attacks since minor, unnoticeable changes in input data can significantly alter the output results.
“Deep neural network (DNN) model-based RS, such as recurrent neural networks (RNNs) and graph neural networks (GNNs), are particularly susceptible to these attacks since minor, unnoticeable changes in input data can significantly alter the output results [89, 91, 114].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [89]
Cites
GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection
Zhang, S., Yin, H., Chen, T., Hung, Q. V. N., Huang, Z., & Cui, L. (2020) · Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval · doi:10.1145/3397271.3401165 · Cited by 175 · see citing works
Adversarial attacks on an oblivious recommender
Christakopoulou, K., & Banerjee, A. (2019) · Proceedings of the 13th ACM Conference on Recommender Systems · doi:10.1145/3298689.3347031 · Cited by 105 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Recommender Systems in the Era of Large Language Models (LLMs)
Zhao, Z., Fan, W., Li, J., Liu, Y., Mei, X., Wang, Y., Wen, Z., Wang, F., Zhao, X., Tang, J., et al. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3392335 · Cited by 481 · see citing works
Self-citationRoy, F., Ding, X., Choo, K. K. R., & Zhou, P. (2024) · arXiv · doi:10.48550/arxiv.2409.12651
- Authors
- Fan, W., Zhao, X., Li, Q., Derr, T., Ma, Y., Liu, H., Wang, J., & Tang, J.
- Affiliations
- Hong Kong Polytechnic University (HK)
- City University of Hong Kong (HK)
- Vanderbilt University (US)
- New Jersey Institute of Technology (US)
- Michigan State University (US)
- Venue
- IEEE Transactions on Knowledge and Data Engineering
- Published
- 2023-12-01
- Volume
- 35
- Issue
- 12
- Pages
- 12415-12429
- ISSN
- 1041-4347 (ISSN-L)
- 1558-2191
- 2326-3865
- OpenAlex
- W4368232818
- Cited by
- 41
- References
- 2
- Citations by year
- 2026: 12 · 2025: 18 · 2024: 9 · 2023: 2
- FWCI
- 9.62
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Knowledge and Data Engineering (publishedVersion)
- Funders
- National Natural Science Foundation of China (62102335)
- General Research Funds from the Hong Kong Research Grants Council (PolyU 15200021, 15207322)
- Hong Kong Polytechnic University (P0036200, P0042693)
- Research Collaborative (P0041282)
- SHTM Interdisciplinary Large (P0043302)
- Hong Kong Research Grant Council (R1012-21)
- APRC-CityU New Research Initiatives (9610565)
- New Faculty of City University of Hong Kong
- SIRG-CityU Strategic Interdisciplinary Research (7020046, 7020074)
- HKIDS Early Career Research (9360163)
- Huawei Innovation Research Program
- CCF-Ant Research Fund
- Ant Group Research Fund
- National Science Foundation (CNS1815636, IIS1845081, IIS1928278, IIS1955285, IIS2212032, IIS2212144, IOS2107215, IOS2035472, IIS-2153326, IIS-2212145)
- Army Research Office (W911NF-21-1-0198)
- Home Depot
- Cisco Systems
- Amazon Faculty Award
- Johnson&Johnson
- SNAP
- Topics
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial attacks, black-box attacks, recommender systems, fake accounts, transfer learning, reinforcement learning, deep neural network vulnerabilities, surrogate models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
