CoChat
Sign Up
Cited by 106Adversarial Robustness in Machine LearningRecommender Systems and TechniquesPrivacy-Preserving Technologies in Data

Adversarial attacks on an oblivious recommender

Open access
Christakopoulou, Konstantina, Banerjee, Arindam·2019·Proceedings of the 13th ACM Conference on Recommender Systems
DOI 10.1145/3298689.3347031
Open this paper in CoChat — free accountOpen PDF

Abstract

Can machine learning models be easily fooled? Despite the recent surge of interest in learned adversarial attacks in other domains, in the context of recommendation systems this question has mainly been answered using hand-engineered fake user profiles. This paper attempts to reduce this gap. We provide a formulation for learning to attack a recommender as a repeated general-sum game between two players, i.e., an adversary and a recommender oblivious to the adversary's existence. We consider the challenging case of poisoning attacks, which focus on the training phase of the recommender model. We generate adversarial user profiles targeting subsets of users or items, or generally the top-K recommendation quality. Moreover, we ensure that the adversarial user profiles remain unnoticeable by preserving proximity of the real user rating/interaction distribution to the adversarial fake user distribution. To cope with the challenge of the adversary not having access to the gradient of the recommender's objective with respect to the fake user profiles, we provide a non-trivial algorithm building upon zero-order optimization techniques. We offer a wide range of experiments, instantiating the proposed method for the case of the classic popular approach of a low-rank recommender, and illustrating the extent of the recommender's vulnerability to a variety of adversarial intents. These results can serve as a motivating point for more research into recommender defense strategies against machine learned attacks.

Integrity signals

Registry

Crossref · 10.1145/3298689.3347031

Cites

27 of 27 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • To execute the attack, an adversary must create unnoticeable fake user profiles and perturb input data, known as 'adversarial examples,' to exploit the recommendations.

    “To execute the attack, an adversary must create unnoticeable fake user profiles and perturb input data, known as “adversarial examples,” to exploit the recommendations [115].”

    From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]

  • To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques.

    “To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques [89, 91, 115].”

    From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Christakopoulou, K., & Banerjee, A.
Affiliations
University of Minnesota (US)
ORCID
Venue
Proceedings of the 13th ACM Conference on Recommender Systems
Publisher
ACM
Published
2019-09-10
Pages
322-330
DOI
10.1145/3298689.3347031
OpenAlex
W2972646741
Cited by
105
References
27
Citations by year
2026: 6 · 2025: 10 · 2024: 21 · 2023: 16 · 2022: 14 · 2021: 26 · 2020: 12
FWCI
4.97
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM Conference on Recommender Systems (RecSys) (publishedVersion)
Funders
  • IIS (0953274)
  • NNX (12AQ39A)
  • California Community Foundation (1451986)
  • CNS (1314560)
  • National Science Foundation (IIS-1563950)
  • Division of Information and Intelligent Systems (1447566)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
adversarial attacks, recommender systems, poisoning attacks, derivative-free optimization, general-sum games, top-k recommendation, model robustness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review