Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start

Abstract

E-commerce platforms provide their customers with ranked lists of recommended items matching the customers' preferences. Merchants on e-commerce platforms would like their items to appear as high as possible in the top-N of these ranked lists. In this paper, we demonstrate how unscrupulous merchants can create item images that artificially promote their products, improving their rankings. Recommender systems that use images to address the cold start problem are vulnerable to this security risk. We describe a new type of attack, Adversarial Item Promotion (AIP), that strikes directly at the core of Top-N recommenders: the ranking mechanism itself. Existing work on adversarial images in recommender systems investigates the implications of conventional attacks, which target deep learning classifiers. In contrast, our AIP attacks are embedding attacks that seek to push features representations in a way that fools the ranker (not a classifier) and directly lead to item promotion. We introduce three AIP attacks insider attack, expert attack, and semantic attack, which are defined with respect to three successively more realistic attack models. Our experiments evaluate the danger of these attacks when mounted against three representative visually-aware recommender algorithms in a framework that uses images to address cold start. We also evaluate potential defenses, including adversarial training and find that common, currently-existing, techniques do not eliminate the danger of AIP attacks. In sum, we show that using images to address cold start opens recommender systems to potential threats with clear practical implications.

arXiv commentOur code is available at https://github.com/liuzrcc/AIP

References in corpus (8)

• BPR: Bayesian Personalized Ranking from Implicit Feedback
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• On Evaluating Adversarial Robustness
• A study of the effect of JPG compression on adversarial images
• Poisoning Attacks to Graph-Based Recommender Systems
• Data Poisoning Attacks on Factorization-Based Collaborative Filtering
• Revisiting Adversarially Learned Injection Attacks Against Recommender Systems
• Fashion DNA: Merging Content and Sales Data for Recommendation and Article Mapping

Cited by in corpus (1)

• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks