The DOI matches its Crossref record; 27 of the 27 references it cites were found in a registry or an index.
Adversarial attacks on an oblivious recommender
Open accessAbstract
Can machine learning models be easily fooled? Despite the recent surge of interest in learned adversarial attacks in other domains, in the context of recommendation systems this question has mainly been answered using hand-engineered fake user profiles. This paper attempts to reduce this gap. We provide a formulation for learning to attack a recommender as a repeated general-sum game between two players, i.e., an adversary and a recommender oblivious to the adversary's existence. We consider the challenging case of poisoning attacks, which focus on the training phase of the recommender model. We generate adversarial user profiles targeting subsets of users or items, or generally the top-K recommendation quality. Moreover, we ensure that the adversarial user profiles remain unnoticeable by preserving proximity of the real user rating/interaction distribution to the adversarial fake user distribution. To cope with the challenge of the adversary not having access to the gradient of the recommender's objective with respect to the fake user profiles, we provide a non-trivial algorithm building upon zero-order optimization techniques. We offer a wide range of experiments, instantiating the proposed method for the case of the classic popular approach of a low-rank recommender, and illustrating the extent of the recommender's vulnerability to a variety of adversarial intents. These results can serve as a motivating point for more research into recommender defense strategies against machine learned attacks.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To execute the attack, an adversary must create unnoticeable fake user profiles and perturb input data, known as “adversarial examples,” to exploit the recommendations [115].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]
In the citing paper
“To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques [89, 91, 115].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]
Citations
Cites
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
The MovieLens Datasets: History and Context
Harper, F., & Konstan, J. (2016) · TIIS · doi:10.1145/2827872 · Cited by 5,938
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Completely Derandomized Self-Adaptation in Evolution Strategies
Hansen, N., & Ostermeier, A. (2001) · Evolutionary Computation · doi:10.1162/106365601750190398 · Cited by 4,397
Probabilistic Matrix Factorization
Mnih, A., & Salakhutdinov, R. (2007) · neural information processing systems · Cited by 3,538
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680
Adversarial Attacks on Neural Networks for Graph Data
Zügner, D., Akbarnejad, A., & Günnemann, S. (2018) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3219819.3220078 · Cited by 997
Wang, J., Yu, L., Zhang, W., Gong, Y., Xu, Y., Wang, B., Zhang, P., & Zhang, D. (2017) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3077136.3080786 · Cited by 662
Research works printed but not linked: 4
- Ian Goodfellow Nicolas Papernot Patrick McDaniel R Feinman F Faghri A Matyasko K Hambardzumyan YL Juang A Kurakin R Sheatsley etal 2016. cleverhans v0. 1: an adversarial machine learning library. arXiv preprint (2016). Ian Goodfellow Nicolas Papernot Patrick McDaniel R Feinman F Faghri A Matyasko K Hambardzumyan YL Juang A Kurakin R Sheatsley et al. 2016. cleverhans v0. 1: an adversarial machine learning library. arXiv preprint (2016).
- Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In NIPS. 2672--2680. Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In NIPS . 2672--2680.
- Nicolas Papernot , Patrick McDaniel , Arunesh Sinha , and Michael Wellman . 2016. Towards the science of security and privacy in machine learning. arXiv preprint arXiv:1611.03814 ( 2016 ). Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman. 2016. Towards the science of security and privacy in machine learning. arXiv preprint arXiv:1611.03814 (2016). · arXiv
- Jiawei Su , Danilo Vasconcellos Vargas, and Sakurai Kouichi . 2017 . One pixel attack for fooling deep neural networks. arXiv preprint arXiv:1710.08864 (2017). Jiawei Su, Danilo Vasconcellos Vargas, and Sakurai Kouichi. 2017. One pixel attack for fooling deep neural networks. arXiv preprint arXiv:1710.08864 (2017). · arXiv
Cited by
Sorted by citations
A Survey on Adversarial Recommender Systems
Deldjoo, Y., Noia, T. D., & Merra, F. A. (2021) · ACM Computing Surveys · doi:10.1145/3439729 · Cited by 244
Weaponized AI for cyber attacks
Yamin, M. M., Ullah, M., Ullah, H., & Katt, B. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102722 · Cited by 154
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151
Himeur, Y., Sohail, S. S., Bensaali, F., Amira, A., & Alazab, M. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102746 · Cited by 139
Recent Developments in Recommender Systems: A Survey [Review Article]
Li, Y., Liu, K., Satapathy, R., Wang, S., & Cambria, E. (2024) · IEEE Computational Intelligence Magazine · doi:10.1109/mci.2024.3363984 · Cited by 197
PipAttack: Poisoning Federated Recommender Systems for Manipulating Item Promotion
Zhang, S., Yin, H., Chen, T., Huang, Z., Nguyen, Q. V. H., & Cui, L. (2022) · Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining · doi:10.1145/3488560.3498386 · Cited by 98
Attacking Recommender Systems with Augmented User Profiles
Lin, C., Chen, S., Li, H., Xiao, Y., Li, L., & Yang, Q. (2020) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3340531.3411884 · Cited by 94
PoisonRec: An Adaptive Data Poisoning Framework for Attacking Black-box Recommender Systems
Song, J., Li, Z., Hu, Z., Wu, Y., Li, Z., Li, J., & Gao, J. (2020) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde48307.2020.00021 · Cited by 87
Attacking Black-box Recommendations via Copying Cross-domain User Profiles
Fan, W., Derr, T., Zhao, X., Ma, Y., Liu, H., Wang, J., Tang, J., & Li, Q. (2021) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde51399.2021.00140 · Cited by 85
Revisiting Adversarially Learned Injection Attacks Against Recommender Systems
Tang, J., Wen, H., & Wang, K. (2020) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3383313.3412243 · Cited by 82
Ye, H., Li, X., Yao, Y., & Tong, H. (2022) · ACM Transactions on Information Systems · doi:10.1145/3568396 · Cited by 73
Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
Yue, Z., He, Z., Zeng, H., & McAuley, J. (2021) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3460231.3474275 · Cited by 77
Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures
Nguyen, T. T., Nguyen, Q. V. H., Nguyen, T. T., Huynh, T. T., Nguyen, T. T., Weidlich, M., & Yin, H. (2024) · ACM Computing Surveys · doi:10.1145/3677328 · Cited by 70
Shilling Black-Box Recommender Systems by Learning to Generate Fake User Profiles
Lin, C., Chen, S., Zeng, M., Zhang, S., Gao, M., & Li, H. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3183210 · Cited by 62
Triple Adversarial Learning for Influence based Poisoning Attack in Recommender Systems
Wu, C., Lian, D., Ge, Y., Zhu, Z., & Chen, E. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467335 · Cited by 53
Wu, F., Gao, M., Yu, J., Wang, Z., Liu, K., & Wang, X. (2021) · Information Sciences · doi:10.1016/j.ins.2021.07.041 · Cited by 52
Knowledge-enhanced Black-box Attacks for Recommendations
Chen, J., Fan, W., Zhu, G., Zhao, X., Yuan, C., Li, Q., & Huang, Y. (2022) · Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining · doi:10.1145/3534678.3539359 · Cited by 49
Data Poisoning Attacks and Defenses to Crowdsourcing Systems
Fang, M., Sun, M., Li, Q., Gong, N. Z., Tian, J. W., & Liu, J. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3450066 · Cited by 48
Fight Fire with Fire: Towards Robust Recommender Systems via Adversarial Poisoning Training
Wu, C., Lian, D., Ge, Y., Zhu, Z., Chen, E., & Yuan, S. (2021) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3404835.3462914 · Cited by 47
Influence-Driven Data Poisoning for Robust Recommender Systems
Wu, C., Lian, D., Ge, Y., Zhu, Z., & Chen, E. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3274759 · Cited by 46
Fan, W., Zhao, X., Li, Q., Derr, T., Ma, Y., Liu, H., Wang, J., & Tang, J. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3272652 · Cited by 41
Attacking Recommender Systems With Plausible Profile
Zhang, X., Chen, J., Zhang, R., Wang, C., & Liu, L. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117078 · Cited by 32
On-Device Recommender Systems: A Comprehensive Survey
Yin, H., Qu, L., Chen, T., Yuan, W., Zheng, R., Long, J., Xia, X., Shi, Y., & Chengqi Zhang, B. (2025) · Data Science and Engineering · doi:10.1007/s41019-025-00308-8 · Cited by 82
Deldjoo, Y., Noia, T. D., & Merra, F. A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.10322 · Cited by 29
Gray-Box Shilling Attack: An Adversarial Learning Approach
Wang, Z., Gao, M., Li, J., Zhang, J., & Zhong, J. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3512352 · Cited by 28
Adversarial Recommender Systems: Attack, Defense, and Advances
Anelli, V. W., Deldjoo, Y., DiNoia, T., & Merra, F. A. (2021) · Springer eBooks · doi:10.1007/978-1-0716-2197-4_9 · Cited by 27
Recommender Systems in Cybersecurity
Ferreira, L., Silva, D. C., & Uriarte, M. (2023) · Knowledge and Information Systems · doi:10.1007/s10115-023-01906-6 · Cited by 31
Certifiable Robustness to Discrete Adversarial Perturbations for Factorization Machines
Liu, Y., Xia, X., Chen, L., He, X., Yang, C., & Zheng, Z. (2020) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3397271.3401087 · Cited by 25
Reverse Attack: Black-box Attacks on Collaborative Recommendation
Zhang, Y., Yuan, X., Li, J., Lou, J., Chen, L., & Tzeng, N.-F. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484805 · Cited by 31
Liu, Z., & Larson, M. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3449891 · Cited by 23
Adversarial Attacks on Linear Contextual BanditsPreprint
Garcelon, E., Rozière, B., Meunier, L., Tarbouriech, J., Teytaud, O., Lazaric, A., & Pirotta, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.03839 · Cited by 24
Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders
Yue, Z., Zeng, H., Kou, Z., Shang, L., & Wang, D. (2022) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3523227.3546770 · Cited by 25
CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent
Ning, L.-B., Wang, S., Fan, W., Li, Q., Xu, X., Chen, H., & Huang, F. (2024) · Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining · doi:10.1145/3637528.3671837 · Cited by 22
Rank List Sensitivity of Recommender Systems to Interaction Perturbations
Oh, S., Ustun, B., McAuley, J., & Kumar, S. (2022) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3511808.3557425 · Cited by 24
Poisoning Self-supervised Learning Based Sequential Recommendations
Wang, Y., Liu, Y., Wang, Q., Wang, C., & Li, C. (2023) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3539618.3591751 · Cited by 23
Qian, F., Yuan, B., Chen, H., Chen, J., Lian, D., & Zhao, S. G. (2023) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2023.3248626 · Cited by 19
Adversarial Machine Learning on Social Network: A Survey
Guo, S., Li, X., & Mu, Z. (2021) · Frontiers in Physics · doi:10.3389/fphy.2021.766540 · Cited by 17
Identification of Malicious Injection Attacks in Dense Rating and Co-Visitation Behaviors
Yang, Z., Sun, Q., Zhang, Y., & Wang, W. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3016827 · Cited by 17
Turning Privacy-preserving Mechanisms against Federated Learning
Arazzi, M., Conti, M., Nocera, A., & Picek, S. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623114 · Cited by 16
Recommender Systems Meet Large Language Model Agents: A Survey
Zhu, X., Wang, Y., Gao, H., Xu, W., Wang, C., Liu, Z., Wang, K., Jin, M., Pang, L. X., Weng, Q., et al. (2025) · Foundations and Trends® in Privacy and Security · doi:10.1561/3300000050 · Cited by 26
Single-User Injection for Invisible Shilling Attack against Recommender Systems
Huang, C., & Li, H. (2023) · Proceedings of the 32nd ACM International Conference on Information and Knowledge Management · doi:10.1145/3583780.3615062 · Cited by 14
Sequential Attack Detection in Recommender Systems
Aktukmak, M., Yılmaz, Y., & Uysal, I. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3076295 · Cited by 13
Toward Adversarially Robust Recommendation From Adaptive Fraudster Detection
Lai, Y., Zhu, Y., Fan, W., Zhang, X., & Zhou, K. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3327876 · Cited by 13
Simulating real profiles for shilling attacks: A generative approach
Barbieri, J., Alvim, L. G. M., Braida, F., & Zimbrão, G. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.107390 · Cited by 11
The Idiosyncratic Effects of Adversarial Training on Bias in Personalized Recommendation Learning
Anelli, V. W., Noia, T. D., & Merra, F. A. (2021) · ACM Conference on Recommender Systems · doi:10.1145/3460231.3478858 · Cited by 9
Attacking Click-through Rate Predictors via Generating Realistic Fake Samples
Duan, M., Li, K., Zhang, W., Qin, J., & Xiao, B. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3643685 · Cited by 8
Robustness in Fairness Against Edge-Level Perturbations in GNN-Based Recommendation
Boratto, L., Fabbri, F., Fenu, G., Marras, M., & Medda, G. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-56063-7_3 · Cited by 8
Secure and Enhanced Online Recommendations: A Federated Intelligence Approach
Tariq, M., Tahir, B., & Zhou, Z. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2023.3335156 · Cited by 8
Recommender System: A Comprehensive Overview of Technical Challenges and Social Implications
An, Y., Tan, Y., Sun, X. J., & Ferrari, G. (2024) · ICCK Transactions on Sensing Communication and Control · doi:10.62762/tscc.2024.898503 · Cited by 8
Yang, Z., Sun, Q., & Liu, Z. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3146769 · Cited by 9
On the Vulnerability of Graph Learning-based Collaborative Filtering
Xu, S., Li, L., Li, Z., Yao, Y., Xu, F., Chen, Z., Lu, Q., & Tong, H. (2022) · ACM Transactions on Information Systems · doi:10.1145/3572834 · Cited by 7
A Peep into the Future: Adversarial Future Encoding in Recommendation
Xie, R., Zhang, S., Wang, R., Xia, F., & Lin, L. (2022) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3488560.3498476 · Cited by 7
Planning Data Poisoning Attacks on Heterogeneous Recommender Systems in a Multiplayer Setting
Yeh, C.-Y., Chen, H.-W., Yang, D.-N., Lee, W.-C., Yu, P. S., & Chen⋆, M.-S. (2023) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde55515.2023.00193 · Cited by 7
Anti-FakeU: Defending Shilling Attacks on Graph Neural Network based Recommender Model
You, X., Li, C., Ding, D., Zhang, M., Feng, F., Pan, X., & Yang, M. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583289 · Cited by 6
Multi-Agent Attacks for Black-Box Social Recommendations
Wang, S., Fan, W., Wei, X.-Y., Mei, X., Lin, S., & Li, Q. (2024) · ACM Transactions on Information Systems · doi:10.1145/3696105 · Cited by 13
Attack Detection Using Item Vector Shift in Matrix Factorisation Recommenders
Shams, S., & Leith, D. J. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3721285 · Cited by 6
Towards Robust Recommender Systems via Triple Cooperative Defense
Wang, Q., Lian, D., Wu, C., & Chen, E. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20891-1_40 · Cited by 6
Practical Cross-System Shilling Attacks with Limited Access to Data
Zeng, M., Li, K., Jiang, B., Cao, L., & Li, H. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25612 · Cited by 6
Machine Learning Adversarial Attacks: A Survey Beyond
Magoo, C., & Garg, P. (2021) · Wiley eBooks · doi:10.1002/9781119764113.ch13 · Cited by 7
Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective
Wang, Y., Tang, M., Shen, N., Cui, S., & Wang, W. (2025) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3705328.3748158 · Cited by 8
Constrained Dual-Level Bandit for Personalized Impression Regulation in Online Ranking Systems
Li, Z., Song, J., Hu, Z., Wang, Z., & Gao, J. (2021) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3461340 · Cited by 5
LLM Agent-based Shilling Attack on Recommender Systems
Gu, S., Liu, J., Li, D., Zhang, G., Han, M., Gu, H., Zhang, P., Gu, N., Shang, L., & Lu, T. (2026) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3773966.3777981 · Cited by 4
Evaluating Impact of User-Cluster Targeted Attacks in Matrix Factorisation Recommenders
Shams, S., & Leith, D. J. (2024) · ACM Transactions on Recommender Systems · doi:10.1145/3674157 · Cited by 4
Securing recommender system via cooperative training
Wang, Q., Wu, C., Lian, D., & Chen, E. (2023) · World Wide Web · doi:10.1007/s11280-023-01214-7 · Cited by 4
Towards Robust Recommendation: A Review and an Adversarial Robustness Evaluation Library
Cheng, L., Huang, X., Sang, J., & Yu, J. Q. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3581553 · Cited by 5
Accelerating the Surrogate Retraining for Poisoning Attacks against Recommender Systems
Wu, Y., Cao, Q., Tao, S., Zhang, K., Sun, F., & Shen, H. (2024) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3640457.3688148 · Cited by 3
Qian, F., Cui, Y., Xu, M., Chen, H., Chen, W., Xu, Q., Cai-hong, W., Yan, Y., & Zhao, S. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113111 · Cited by 3
Low-rank Defenses Against Adversarial Attacks in Recommender Systems
Entezari, N., & Papalexakis, E. E. (2022) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata55660.2022.10020712 · Cited by 3
Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systems
Yang, S., Yao, L., Wang, C., Xu, X., & Zhu, L. (2023) · Proceedings · doi:10.1109/icdm58522.2023.00195 · Cited by 3
Lu, Q., & Gao, M. (2024) · International Conference on Generative Artificial Intelligence and Information Security (GAIIS) · doi:10.1145/3665348.3665370 · Cited by 3
Attacking Visually-aware Recommender Systems with Transferable and Imperceptible Adversarial Styles
Yang, S.-M., Wang, C., Xu, X., Zhu, L., & Yao, L. (2024) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3627673.3679828 · Cited by 3
Panda or Not Panda? Understanding Adversarial Attacks with Interactive Visualization
You, Y., Tse, J., & Zhao, J. (2025) · ACM Transactions on Interactive Intelligent Systems · doi:10.1145/3725739 · Cited by 4
Simplicial-Map Neural Networks Robust to Adversarial Examples
Paluzo-Hidalgo, E., González-Dı́az, R., Gutiérrez-Naranjo, M. Á., & Heras, J. (2021) · Mathematics · doi:10.3390/math9020169 · Cited by 3
An empirical study on metamorphic testing for recommender systems
Mao, C., Chen, J., Xiao-rong, Y., & Wen, L. (2024) · Information and Software Technology · doi:10.1016/j.infsof.2024.107410 · Cited by 2
Detecting the adversarially-learned injection attacks via knowledge graphs
Hao, Y., Wang, H., Zhao, Q., Feng, L., & Wang, J. (2024) · Information Systems · doi:10.1016/j.is.2024.102419 · Cited by 2
Enhancing Neural Recommender Models through Domain-Specific Concordance
Balashankar, A., Beutel, A., & Subramanian, L. (2021) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3437963.3441784 · Cited by 2
Wang, H., Zhong, J., & Kin Tak, U. (2020) · International Conference on Wavelet Analysis and Pattern Recognition · doi:10.1109/icwapr51924.2020.9494616 · Cited by 2
Multi-Step Adversarial Perturbations on Recommender Systems EmbeddingsPreprint
Anelli, V. W., Bellogín, A., Deldjoo, Y., Noia, T. D., & Merra, F. A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.01329 · Cited by 2
Learning Robust Recommender from Noisy Implicit FeedbackPreprint
Wang, W., Feng, F., He, X., Nie, L., & Chua, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.01160 · Cited by 3
DIFshilling: A Diffusion Model for Shilling Attacks
Chen, W., Ma, X., Liu, B., & Liu, B. (2025) · Applied Sciences · doi:10.3390/app15063412 · Cited by 2
DefenseNet-A Resilent Network Against Adverserail Attacks On Recommendation Systems
Ain, Q. U., Nida, N., & Irtaza, A. (2021) · International Conference on Frontiers of Information Technology (FIT) · doi:10.1109/fit53504.2021.00032 · Cited by 1
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_2 · Cited by 1
Barnett, C., & Kashef, R. F. (2024) · IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT) · doi:10.1109/bdcat63179.2024.00022 · Cited by 1
Big Enough to Care Not Enough to Scare! Crawling to Attack Recommender Systems
Aiolli, F., Conti, M., Picek, S., & Polato, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-59013-0_9 · Cited by 1
On Detecting Data Pollution Attacks On Recommender Systems Using Sequential GANsPreprint
Shahrasbi, B., Mani, V., Arrabothu, A. R., Sharma, D., Achan, K., & Kumar, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.02509 · Cited by 2
Dismantle Shilling Attacks in Recommendations Systems
Embarak, O. H. (2021) · Advances in Science Technology and Engineering Systems Journal · doi:10.25046/aj060174
Incentives in Two-sided Matching Markets with Prediction-enhanced Preference-formationPreprint
Ionescu, S., Du, Y., Joseph, K., & Hannák, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.07835
PipAttack: Poisoning Federated Recommender Systems forManipulating Item PromotionPreprint
Zhang, S., Yin, H., Chen, T., Huang, Z. H., Nguyen, Q. V. H., & Cui, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.10926
On the feasibility of crawling-based attacks against recommender systems
Aiolli, F., Conti, M., Picek, S., & Polato, M. (2021) · Journal of Computer Security · doi:10.3233/jcs-210041
Indira, K., & Thaker, K. (2023) · International Journal of Computer Applications · doi:10.5120/ijca2023922852
Improving Adversarially Robust Sequential Recommendation through Generalizable Perturbations
Yao, X., He, R., Hu, X., Yang, J., Guo, Y., & Huang, Z. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386799
ReOP: Generating Transferable Fake Users for Recommendation Systems via Reverse Optimization
Qian, F., Cui, Y., Chen, H., Chen, W., Yan, Y., & Zhao, S. G. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3451452
Conclusions and Open Challenges
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_6
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_5
Biases, Fairness, and Non-discrimination
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_3
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_1
Schedl, M., Anelli, V. W., & Lex, E. (2024) · The information retrieval series · doi:10.1007/978-3-031-69978-8_4
FA 3 T: Feature-Aware Adversarial Attacks for Multi-modal Tracking
Wang, J., Liu, F., Jiao, L., Wang, H., Li, S., Li, L., Chen, P., Liu, X., & Wang, X. (2025) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3746027.3755155
Budget and Frequency Controlled Cost-Aware Model Extraction Attack on Sequential Recommenders
Zhou, L., Gao, M., Wang, Z., & Bai, Y. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3761032
Adversarial attacks : a theoretical journey
Meunier, L. (2022) · theses.fr (ABES) · doi:10.70675/c792c77cz8c7bz4930za4fbz79b40c3d10d1
Metadata
- Authors
- Christakopoulou, K., & Banerjee, A.
- Affiliations
- University of Minnesota (US)
- Venue
- Proceedings of the 13th ACM Conference on Recommender Systems
- Publisher
- ACM
- Published
- 2019-09-10
- Pages
- 322-330
- OpenAlex
- W2972646741
- Cited by
- 105
- References
- 27
- Citations by year
- 2026: 6 · 2025: 10 · 2024: 21 · 2023: 16 · 2022: 14 · 2021: 26 · 2020: 12
- FWCI
- 4.97
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Conference on Recommender Systems (RecSys) (publishedVersion)
- Funders
- IIS (0953274)
- NNX (12AQ39A)
- California Community Foundation (1451986)
- CNS (1314560)
- National Science Foundation (IIS-1563950)
- Division of Information and Intelligent Systems (1447566)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial attacks, recommender systems, poisoning attacks, derivative-free optimization, general-sum games, top-k recommendation, model robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
