Data Poisoning Attacks to Deep Learning Based Recommender Systems

Abstract

Recommender systems play a crucial role in helping users to find their interested information in various web services such as Amazon, YouTube, and Google News. Various recommender systems, ranging from neighborhood-based, association-rule-based, matrix-factorization-based, to deep learning based, have been developed and deployed in industry. Among them, deep learning based recommender systems become increasingly popular due to their superior performance. In this work, we conduct the first systematic study on data poisoning attacks to deep learning based recommender systems. An attacker's goal is to manipulate a recommender system such that the attacker-chosen target items are recommended to many users. To achieve this goal, our attack injects fake users with carefully crafted ratings to a recommender system. Specifically, we formulate our attack as an optimization problem, such that the injected ratings would maximize the number of normal users to whom the target items are recommended. However, it is challenging to solve the optimization problem because it is a non-convex integer programming problem. To address the challenge, we develop multiple techniques to approximately solve the optimization problem. Our experimental results on three real-world datasets, including small and large datasets, show that our attack is effective and outperforms existing attacks. Moreover, we attempt to detect fake users via statistical analysis of the rating patterns of normal and fake users. Our results show that our attack is still effective and outperforms existing attacks even if such a detector is deployed.

To appear in NDSS 2021

References in corpus (5)

• Poisoning Attacks to Graph-Based Recommender Systems
• SybilBelief: A Semi-supervised Learning Approach for Structure-based Sybil Detection
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks

Cited by in corpus (14)

• FedRecAttack: Model Poisoning Attack to Federated Recommendation
• Knowledge-enhanced Black-box Attacks for Recommendations
• Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• PEPPER: Empowering User-Centric Recommender Systems over Gossip Learning
• Rank List Sensitivity of Recommender Systems to Interaction Perturbations
• Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data
• Improving the Shortest Plank: Vulnerability-Aware Adversarial Training for Robust Recommender System
• Preventing the Popular Item Embedding Based Attack in Federated Recommendations
• Hidden Backdoors in Human-Centric Language Models
• Evaluating Impact of User-Cluster Targeted Attacks in Matrix Factorisation Recommenders
• Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
• 10 Security and Privacy Problems in Large Foundation Models
• SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models