Poisoning Federated Recommender Systems with Fake Users
Open accessAbstract
Federated recommendation is a prominent use case within federated learning, yet it remains susceptible to various attacks, from user to server-side vulnerabilities. Poisoning attacks are particularly notable among user-side attacks, as participants upload malicious model updates to deceive the global model, often intending to promote or demote specific targeted items. This study investigates strategies for executing promotion attacks in federated recommender systems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Decentralized recommender systems remain vulnerable to threats such as inference attacks and differential attacks.
“Although decentralized RS inherently provides a privacy protocol, as users preserve their entire historical data, and even FedRec prioritizes user privacy over DCS, it remains vulnerable to threats such as inference attacks and differential attacks [105, 138-142].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [140]
Cites
Matrix Factorization Techniques for Recommender Systems
Koren, Y., Bell, R. M., & Volinsky, C. (2009) · Computer · doi:10.1109/mc.2009.263 · Cited by 11,232 · see citing works
Density-Based Clustering Based on Hierarchical Density Estimates
Campello, R. J. G. B., Moulavi, D., & Sander, J. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-37456-2_14 · Cited by 2,680 · see citing works
(2011) · IEEE Software · doi:10.1109/ms.2011.67 · Cited by 2,038 · see citing works
Fouss, F., Pirotte, A., Renders, J.-M., & Saerens, M. (2007) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2007.46 · Cited by 1,265 · see citing works
Sedhain, S., Menon, A. K., Sanner, S., & Xie, L. (2015) · International World Wide Web Conference (WWW) · doi:10.1145/2740908.2742726 · Cited by 1,175 · see citing works
Collaborative Denoising Auto-Encoders for Top-N Recommender Systems
Wu, Y., DuBois, C., Zheng, A. X., & Ester, M. (2016) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/2835776.2835837 · Cited by 1,025 · see citing works
Zhang, Z., Cao, X., Jia, J., & Gong, N. Z. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539231 · Cited by 359 · see citing works
Self-citationShilling attacks against recommender systems: a comprehensive survey
Güneş, İ., Kaleli, C., Bilge, A., & Polat, H. (2012) · Artificial Intelligence Review · doi:10.1007/s10462-012-9364-9 · Cited by 325 · see citing works
FedRec: Federated Recommendation With Explicit Feedback
Lin, G., Liang, F., Pan, W., & Ming, Z. (2020) · IEEE Intelligent Systems · doi:10.1109/mis.2020.3017205 · Cited by 214 · see citing works
MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clients
Cao, X., & Gong, N. Z. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw56347.2022.00383 · Cited by 205 · see citing works
Self-citationFederated Recommendation Systems
Yang, L., Tan, B., Zheng, V. W., Chen, K., & Yang, Q. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_16 · Cited by 191 · see citing works
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151 · see citing works
Self-citationFast-adapting and privacy-preserving federated recommender system
Wang, Q., Yin, H., Chen, T., Yu, J., Zhou, A., & Zhang, X. (2021) · The VLDB Journal · doi:10.1007/s00778-021-00700-6 · Cited by 151 · see citing works
Yoshii, K., Goto, M., Komatani, K., Ogata, T., & Okuno, H. G. (2008) · IEEE Transactions on Audio Speech and Language Processing · doi:10.1109/tasl.2007.911503 · Cited by 150 · see citing works
Heterogeneous Global Graph Neural Networks for Personalized Session-based Recommendation
Pang, Y., Wu, L., Shen, Q., Zhang, Y., Wei, Z., Xu, F., Chang, E., Long, B., & Pei, J. (2022) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3488560.3498505 · Cited by 147 · see citing works
FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
Cao, X., Jia, J., Zhang, Z., & Gong, N. Z. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179336 · Cited by 126 · see citing works
Self-citationFLCert: Provably Secure Federated Learning Against Poisoning Attacks
Cao, X., Zhang, Z., Jia, J., & Gong, N. Z. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3212174 · Cited by 92 · see citing works
Self-citationPoisonRec: An Adaptive Data Poisoning Framework for Attacking Black-box Recommender Systems
Song, J., Li, Z., Hu, Z., Wu, Y., Li, Z., Li, J., & Gao, J. (2020) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde48307.2020.00021 · Cited by 87 · see citing works
Practical Data Poisoning Attack against Next-Item Recommendation
Zhang, H., Li, Y., Ding, B., & Gao, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3379992 · Cited by 77 · see citing works
Revisiting Adversarially Learned Injection Attacks Against Recommender Systems
Tang, J., Wen, H., & Wang, K. (2020) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3383313.3412243 · Cited by 73 · see citing works
Federated Recommendation System via Differential Privacy
Li, T. K., Song, L., & Fragouli, C. (2020) · IEEE International Symposium on Information Theory (ISIT) · doi:10.1109/isit44484.2020.9174297 · Cited by 52 · see citing works
Data Poisoning Attacks and Defenses to Crowdsourcing Systems
Fang, M., Sun, M., Li, Q., Gong, N. Z., Tian, J. W., & Liu, J. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3450066 · Cited by 47 · see citing works
Self-citationInfluence-Driven Data Poisoning for Robust Recommender Systems
Wu, C., Lian, D., Ge, Y., Zhu, Z., & Chen, E. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3274759 · Cited by 46 · see citing works
Data poisoning attacks on neighborhood‐based recommender systems
Chen, L., Xu, Y., Xie, F., Huang, M., & Zheng, Z. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.3872 · Cited by 34 · see citing works
Self-citationReverse Attack: Black-box Attacks on Collaborative Recommendation
Zhang, Y., Yuan, X., Li, J., Lou, J., Chen, L., & Tzeng, N.-F. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484805 · Cited by 25 · see citing works
Detecting Fake Co-visitation Injection Attack in Graph-based Recommendation Systems
Mahmood, T., & Adnan, M. A. (2022) · International Conference on Networking, Systems and Security (NSysS) · doi:10.1145/3569551.3569556 · Cited by 2 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
On-Device Recommender Systems: A Comprehensive Survey
Yin, H., Qu, L., Chen, T., Yuan, W., Zheng, R., Long, J., Xia, X., Shi, Y., & Chengqi Zhang, B. (2025) · Data Science and Engineering · doi:10.1007/s41019-025-00308-8 · Cited by 67 · see citing works
Personalized Federated Recommendation for Cold-Start Users via Adaptive Knowledge Fusion
Li, Y., Shan, Y., Liu, Y., Wang, H., Wang, W., Wang, Y., & Li, R. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3696410.3714635 · Cited by 14 · see citing works
Poisoning Attacks on Federated Learning-based Wireless Traffic Prediction
Zhang, Z., Fang, M., Huang, J., & Liu, Y. (2024) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking62109.2024.10619763 · Cited by 12 · see citing works
Self-citationA survey on cross-user federated recommendation
Yang, E., Xiong, Y., Yuan, W., Pan, W., Yang, Q., & Ming, Z. (2025) · Science China Information Sciences · doi:10.1007/s11432-024-4310-7 · Cited by 12 · see citing works
Provably Robust Federated Reinforcement Learning
Fang, M., Wang, X., & Gong, N. Z. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3696410.3714728 · Cited by 12 · see citing works
Self-citationPoisoning Attacks and Defenses to Federated Unlearning
Wang, W., Ma, Q., Zhang, Z., Liu, Y., Liu, Z., & Fang, M. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715494 · Cited by 11 · see citing works
Self-citationPersonalized Recommendation Models in Federated Settings: A Survey
Zhang, C., Long, G., Zhang, Z., Li, Z., Zhang, H., Yang, Q., & Yang, B. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3606643 · Cited by 14 · see citing works
Toward Malicious Clients Detection in Federated Learning
Dou, Z., Wang, J., Sun, W., Liu, Z., & Fang, M. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736194 · Cited by 5 · see citing works
Self-citationSu, J., Chen, C., Wang, Y., Liu, W., Li, Y., Wang, T., Li, Z., Zheng, X., & Yin, J. (2025) · ACM Transactions on Information Systems · doi:10.1145/3757059 · Cited by 3 · see citing works
Feng, Y., Yang, Z., Li, K., Li, J., Wang, P., & Liu, Z. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3639434 · Cited by 3 · see citing works
Eyes on Federated Recommendation: Targeted Poisoning With Competition and Its Mitigation
Hao, Y., Chen, X., Wang, W., Liu, J., Li, T., Wang, J., & Pedrycz, W. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3488500 · Cited by 2 · see citing works
GCPA: GAN-Based Collusive Poisoning Attack in Federated Recommender Systems
Gu, T., TAN, S., Hao, F., Liu, X., Chang, L., & Liu, Y. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3579807 · Cited by 2 · see citing works
Poisoning Attacks Against Federated Recommender Systems and the Defenses: A Survey
Pan, D., Liu, Y., Wang, Z., Liu, Y., & Ze, Z. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033513 · Cited by 2 · see citing works
Poisoning Attacks Against Security-Aware Federated Recommendation System
Lee, C., Huang, S.-H., & Chen, C.-T. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-6400-9_22 · Cited by 1 · see citing works
Cross-User Federated Recommendation Unlearning
Li, Y., Yang, E., Pan, W., Yang, Q., & Ming, Z. (2025) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3749990 · Cited by 2 · see citing works
AttResRec: Learning User Credibility for Attack Resistant Matrix Factorization Recommendation
Zhao, J., Zhang, W., Wang, S., Bai, Q., & Liu, K. (2025) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2025.3604375 · Cited by 1 · see citing works
Zheng, D., Wang, L., Feng, J., Liao, X., Xiao, N., Tian, Y., & Liao, Q. (2026) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2026.3678755 · Cited by 1 · see citing works
SecureAFL: Secure Asynchronous Federated Learning
Gao, A., Wang, F., Wan, Z., Quan, Y., Liu, Z., & Fang, M. (2026) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3779208.3807486 · Cited by 1 · see citing works
Self-citationTrustworthy Recommendation for Consumer Electronics Using Hypernetworks
Di, Y., Shen, S., Bao, J., & Liu, Y. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10889609 · Cited by 1 · see citing works
Meet Trick With Trick: Revealing Collusion Intentions in Highly Concealed Poisoning Behavior
Yang, Z., Feng, Y., Li, J., Wang, P., & Liu, Z. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3613425
OGAS-DDS: an organized group attack strategy driven by human intelligence in dynamic data streams
Sun, J., Ji, S., Li, N., & Fang, X. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02626-9
Secure Vertical Federated Learning: A Review of Privacy and Security Challenges
Prabhune, S., & Jagdale, B. N. (2026) · Lecture notes in networks and systems · doi:10.1007/978-981-95-3486-9_22
Ali, W., Altulyan, M. S., Ihnaini, B., Zhou, X., & Shao, J. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11579-6
Liu, S., Sun, L., Zhang, H., & Li, F. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582837
Efficient Poisoning Attacks Against Reinforcement Learning-Based Recommender Systems
Yuan, Q., Du, L., Chen, M., Sun, M., Gao, Y., Cheng, P., He, S., Chen, J., & Zhang, Z. (2026) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2026.3722474
Defending Poisoning Attacks in Federated Learning Under System and Data Heterogeneity
Sun, P., Liu, T., Xu, Y., Luo, J., Chen, H., Wu, L., Chen, G., & Jin, W. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3708397
Self-citationSparse Adaptive Momentum Attack Against Federated Recommender Systems and Its Countermeasures
Zhang, Z.-L., Hong, Y., Huang, Z., Li, Q., & Zhang, X. (2026) · Expert Systems · doi:10.1111/exsy.70417
Roy, F., Ding, X., Choo, K. K. R., & Zhou, P. (2024) · arXiv · doi:10.48550/arxiv.2409.12651
- Authors
- Yin, M., Xu, Y., Fang, M., & Gong, N. Z.
- Affiliations
- University of Science and Technology of China (CN)
- Duke University (US)
- Venue
- Proceedings of the ACM Web Conference 2024
- Publisher
- ACM
- Published
- 2024-05-13
- Pages
- 3555-3565
- OpenAlex
- W4396757545
- Cited by
- 27
- References
- 26
- Citations by year
- 2026: 8 · 2025: 17 · 2024: 2
- FWCI
- 7.80
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International World Wide Web Conference (WWW) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1937787, 1937786, 2125977, 2131859, 2112562)
- Army Research Office (W911NF2110182)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- federated learning, federated recommendation, poisoning attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
