The DOI matches its Crossref record; 27 of the 27 references it cites were found in a registry or an index.
Adversarial attacks on an oblivious recommender
Open accessAbstract
Can machine learning models be easily fooled? Despite the recent surge of interest in learned adversarial attacks in other domains, in the context of recommendation systems this question has mainly been answered using hand-engineered fake user profiles. This paper attempts to reduce this gap. We provide a formulation for learning to attack a recommender as a repeated general-sum game between two players, i.e., an adversary and a recommender oblivious to the adversary's existence. We consider the challenging case of poisoning attacks, which focus on the training phase of the recommender model. We generate adversarial user profiles targeting subsets of users or items, or generally the top-K recommendation quality. Moreover, we ensure that the adversarial user profiles remain unnoticeable by preserving proximity of the real user rating/interaction distribution to the adversarial fake user distribution. To cope with the challenge of the adversary not having access to the gradient of the recommender's objective with respect to the fake user profiles, we provide a non-trivial algorithm building upon zero-order optimization techniques. We offer a wide range of experiments, instantiating the proposed method for the case of the classic popular approach of a low-rank recommender, and illustrating the extent of the recommender's vulnerability to a variety of adversarial intents. These results can serve as a motivating point for more research into recommender defense strategies against machine learned attacks.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To execute the attack, an adversary must create unnoticeable fake user profiles and perturb input data, known as “adversarial examples,” to exploit the recommendations [115].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]
In the citing paper
“To achieve this, adversaries typically employ a min-max game strategy to facilitate adversarial learning through the use of generative adversarial networks (GANs), knowledge graph networks, or reinforcement learning techniques [89, 91, 115].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [115]
Citations
Cites
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
The MovieLens Datasets: History and Context
Harper, F., & Konstan, J. (2016) · TIIS · doi:10.1145/2827872 · Cited by 5,938
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Completely Derandomized Self-Adaptation in Evolution Strategies
Hansen, N., & Ostermeier, A. (2001) · Evolutionary Computation · doi:10.1162/106365601750190398 · Cited by 4,397
Probabilistic Matrix Factorization
Mnih, A., & Salakhutdinov, R. (2007) · neural information processing systems · Cited by 3,538
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680
Adversarial Attacks on Neural Networks for Graph Data
Zügner, D., Akbarnejad, A., & Günnemann, S. (2018) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3219819.3220078 · Cited by 997
Wang, J., Yu, L., Zhang, W., Gong, Y., Xu, Y., Wang, B., Zhang, P., & Zhang, D. (2017) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3077136.3080786 · Cited by 662
Optimal Rates for Zero-Order Convex Optimization: The Power of Two Function Evaluations
Duchi, J. C., Jordan, M. I., Wainwright, M., & Wibisono, A. (2013) · IEEE Transactions on Information Theory · doi:10.1109/tit.2015.2409256 · Cited by 651
(2022) · Springer eBooks · doi:10.1007/978-1-0716-2197-4 · Cited by 587
IRGAN: A Minimax Game for Unifying Generative and Discriminative Information Retrieval Models
Wang, Y.-X., Yu, L., Zhang, W., Gong, Y., Xu, Y., Wang, B., Zhang, P., & Zhang, D. (2017) · BIROn (Birkbeck, University of London) · doi:10.48550/arxiv.1705.10513 · Cited by 526
Toward trustworthy recommender systems
Mobasher, B., Burke, R., Bhaumik, R., & Williams, C. (2007) · ACM Transactions on Internet Technology · doi:10.1145/1278366.1278372 · Cited by 458
Adversarial Personalized Ranking for Recommendation
He, X., He, Z., Du, X., & Chua, T. (2018) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3209978.3209981 · Cited by 386
Making machine learning robust against adversarial inputs
Goodfellow, I., McDaniel, P., & Papernot, N. (2018) · Communications of the ACM · doi:10.1145/3134599 · Cited by 358
Recommender Systems: The Textbook
Aggarwal, C. C. (2016) · Springer eBooks · doi:10.1007/978-3-319-29659-3 · Cited by 342
O’Mahony, M. P., Hurley, N., Kushmerick, N., & Silvestre, G. C. M. (2004) · ACM Transactions on Internet Technology · doi:10.1145/1031114.1031116 · Cited by 324
Visually-Aware Fashion Recommendation and Design with Generative Image Models
Kang, W.-C., Chen, F., Wang, Z., & McAuley, J. (2017) · Proceedings · doi:10.1109/icdm.2017.30 · Cited by 309
Optimal Algorithms for Online Convex Optimization with Multi-Point Bandit Feedback.
Agarwal, A., Dekel, O., & Xiao, L. (2010) · Cited by 237
Data poisoning attacks on factorization-based collaborative filtering
Li, B., Wang, Y., Singh, A., & Vorobeychik, Y. (2016) · arXiv · doi:10.48550/arxiv.1608.08182 · Cited by 235
Poisoning Attacks to Graph-Based Recommender Systems
Fang, M., Yang, G., Gong, N. Z., & Liu, J. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274706 · Cited by 217
Chae, D., Kang, J.-S., Kim, S., & Lee, J. (2018) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3269206.3271743 · Cited by 196
Promoting Recommendations: An Attack on Collaborative Filtering
O’Mahony, M. P., Hurley, N., & Silvestre, G. C. M. (2002) · Lecture notes in computer science · doi:10.1007/3-540-46146-9_49 · Cited by 100
Analysis of universal adversarial perturbationsPreprint
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., Pascal Frossard, B., & Soatto, S. (2017) · arXiv (Cornell University) · Cited by 86
Stochastic Recursive Algorithms for Optimization: Simultaneous Perturbation Methods
Prashanth, L. A., Prasad, H. L., & Bhatnagar, S. (2012) · Medical Entomology and Zoology · Cited by 62
Attack-Resistant Recommender Systems
Aggarwal, C. C. (2016) · Springer eBooks · doi:10.1007/978-3-319-29659-3_12 · Cited by 15
Research works printed but not linked: 4
- Ian Goodfellow Nicolas Papernot Patrick McDaniel R Feinman F Faghri A Matyasko K Hambardzumyan YL Juang A Kurakin R Sheatsley etal 2016. cleverhans v0. 1: an adversarial machine learning library. arXiv preprint (2016). Ian Goodfellow Nicolas Papernot Patrick McDaniel R Feinman F Faghri A Matyasko K Hambardzumyan YL Juang A Kurakin R Sheatsley et al. 2016. cleverhans v0. 1: an adversarial machine learning library. arXiv preprint (2016).
- Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In NIPS. 2672--2680. Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In NIPS . 2672--2680.
- Nicolas Papernot , Patrick McDaniel , Arunesh Sinha , and Michael Wellman . 2016. Towards the science of security and privacy in machine learning. arXiv preprint arXiv:1611.03814 ( 2016 ). Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman. 2016. Towards the science of security and privacy in machine learning. arXiv preprint arXiv:1611.03814 (2016). · arXiv
- Jiawei Su , Danilo Vasconcellos Vargas, and Sakurai Kouichi . 2017 . One pixel attack for fooling deep neural networks. arXiv preprint arXiv:1710.08864 (2017). Jiawei Su, Danilo Vasconcellos Vargas, and Sakurai Kouichi. 2017. One pixel attack for fooling deep neural networks. arXiv preprint arXiv:1710.08864 (2017). · arXiv
Cited by
Sorted by citations
A Survey on Adversarial Recommender Systems
Deldjoo, Y., Noia, T. D., & Merra, F. A. (2021) · ACM Computing Surveys · doi:10.1145/3439729 · Cited by 244
Weaponized AI for cyber attacks
Yamin, M. M., Ullah, M., Ullah, H., & Katt, B. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102722 · Cited by 154
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151
Himeur, Y., Sohail, S. S., Bensaali, F., Amira, A., & Alazab, M. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102746 · Cited by 139
Recent Developments in Recommender Systems: A Survey [Review Article]
Li, Y., Liu, K., Satapathy, R., Wang, S., & Cambria, E. (2024) · IEEE Computational Intelligence Magazine · doi:10.1109/mci.2024.3363984 · Cited by 197
Metadata
- Authors
- Christakopoulou, K., & Banerjee, A.
- Affiliations
- University of Minnesota (US)
- Venue
- Proceedings of the 13th ACM Conference on Recommender Systems
- Publisher
- ACM
- Published
- 2019-09-10
- Pages
- 322-330
- OpenAlex
- W2972646741
- Cited by
- 105
- References
- 27
- Citations by year
- 2026: 6 · 2025: 10 · 2024: 21 · 2023: 16 · 2022: 14 · 2021: 26 · 2020: 12
- FWCI
- 4.97
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Conference on Recommender Systems (RecSys) (publishedVersion)
- Funders
- IIS (0953274)
- NNX (12AQ39A)
- California Community Foundation (1451986)
- CNS (1314560)
- National Science Foundation (IIS-1563950)
- Division of Information and Intelligent Systems (1447566)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial attacks, recommender systems, poisoning attacks, derivative-free optimization, general-sum games, top-k recommendation, model robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
