Data poisoning attacks on factorization-based collaborative filtering
Open accessAbstract
Recommendation and collaborative filtering systems are important in modern information and e-commerce applications. As these systems are becoming increasingly popular in the industry, their outputs could affect business decision making, introducing incentives for an adversarial party to compromise the availability or integrity of such systems. We introduce a data poisoning attack on collaborative filtering systems. We demonstrate how a powerful attacker with full knowledge of the learner can generate malicious data so as to maximize his/her malicious objectives, while at the same time mimicking normal user behavior to avoid being detected. While the complete knowledge assumption seems extreme, it enables a robust assessment of the vulnerability of collaborative filtering schemes to highly motivated attacks. We present efficient solutions for two popular factorization-based collaborative filtering algorithms: the \emph{alternative minimization} formulation and the \emph{nuclear norm minimization} method. Finally, we test the effectiveness of our proposed algorithms on real-world data and discuss potential defensive strategies.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Adversarial attack and defense have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].
“They have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].”
From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [47]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 7 · Cited by 235
Research works printed but not linked: 21
- [1][1] Jun Wang, Arjen de Vires, and Marcel Reinders. Unifying user-based and item-based collaborative filtering approaches by similarity fusion. In SIGIR , 2006. -
- [2][2] Emmanuel Candès and Ben Recht. Exact matrix completion via convex optimization. Foundations of Computational Mathematics , 9(6):717-772, 2007. -
- [3][3] Jian-Feng Cai, Emmanuel Candès, and Zuowei Shen. A singular value thresholding algorithm for matrix completion. SIAM Journal on Optimization , 20(4):1956-1982, 2010. -
- [4][4] Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams. Effective attack models for shilling item-based collaborative filtering systems. In Proceedings of the 2005 WebKDD Workshop, held in conjuction with ACM SIGKDD'2005 , 2005. -
- [5][5] Michael P O'Mahony, Neil J Hurley, and Guenole CM Silvestre. Promoting recommendations: An attack on collaborative filtering. In Database and Expert Systems Applications , pages 494-503. Springer, 2002. -
- [7][7] Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. Is feature selection secure against training data poisoning. In ICML , 2015. -
- [8][8] Shike Mei and Xiaojin Zhu. The security of latent dirichlet allocation. In AISTATS , 2015. -
- [9][9] Shike Mei and Xiaojin Zhu. Using machine teaching to identify optimal training-set attacks on machine learners. In AAAI , 2015. -
- [10][10] Max Welling and Yee W Teh. Bayesian learning via stochastic gradient langevin dynamics. In Proceedings of the 28th International Conference on Machine Learning (ICML-11) , pages 681-688, 2011. -
- [11][11] Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma, et al. Adversarial classification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining , pages 99-108. ACM, 2004. -
- [12][12] Daniel Lowd and Christopher Meek. Adversarial learning. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining , pages 641-647. ACM, 2005. -
- [13][13] Bo Li and Yevgeniy Vorobeychik. Feature cross-substitution in adversarial classification. In Advances in Neural Information Processing Systems , pages 2087-2095, 2014. -
- [14][14] Bo Li and Yevgeniy Vorobeychik. Scalable optimization of randomized operational decisions in adversarial classification settings. In Proceedings of the Eighteenth International Conference on Artificial Intelligence and Statistics , pages 599-607, 2015. -
- [15][15] Marco Barreno, Blaine Nelson, Russell Sears, Anthony D Joseph, and J Doug Tygar. Can machine learning be secure? In Proceedings of the 2006 ACM Symposium on Information, computer and communications security , pages 16-25. ACM, 2006. -
- [16][16] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In ICML , 2012. -
- [17][17] Scott Alfeld, Xiaojin Zhu, and Paul Barford. Data poisoning attacks against autoregressive models. In AAAI , 2016. -
- [18][18] Olga Klopp, Karim Lounici, and Alexandre Tsybakov. Robust matrix completion. arXiv:1412.8132 , 2014. - · arXiv
- [19][19] Yudong Chen, Huan Xu, Constantine Caramanis, and Sujay Sanghavi. Robust matrix completion and corrupted columns. In ICML , 2011. -
- [20][20] Yudong Chen, Ali Jalali, Sujay Sanghavi, and Constantine Caramanis. Low-rank matrix recovery from errors and erasures. IEEE Transactions on Information Theory , 59(7):4324-4337, 2013. -
- [21][21] Feiping Nie, Hua Wang, Xiao Cai, Heng Huang, and Chris Ding. Robust matrix completion via joint schatten p-norm and lp-norm minimization. In ICDM , 2012. -
- [22][22] Yu-Xiang Wang and Huan Xu. Stability of matrix factorization for collaborative filtering. In ICML , 2012. -
- Authors
- Li, B., Wang, Y., Singh, A., & Vorobeychik, Y.
- Affiliations
- Vanderbilt University (US)
- Carnegie Mellon University (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2016
- Volume
- 29
- Pages
- 1885-1893
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1608.08182
- OpenAlex
- W2509109313
- Cited by
- 235
- References
- 7
- Citations by year
- 2026: 1 · 2025: 13 · 2024: 23 · 2023: 32 · 2022: 29 · 2021: 44 · 2020: 47 · 2019: 22 · 2018: 19 · 2017: 5
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1238959, 1526860)
- Office of Naval Research (N00014-15-1-2621, N00014)
- Army Research Office (W911NF-16-1-0069, W911NF-16-1-, W911NF)
- Sandia National Laboratories
- Air Force Research Laboratory (FA 8750- 14-2-0180)
- Topics
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- data poisoning, collaborative filtering, adversarial learning, nuclear norm minimization, defense strategy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
