DIFshilling: A Diffusion Model for Shilling Attacks
Source abstract
Abstract
Recommender systems (RSs) are widely used in various domains, such as e-commerce, social media, and online content platforms, to guide users’ decision-making by suggesting items that match their preferences and interests. However, these systems are highly vulnerable to shilling attacks, where malicious users create fake profiles to manipulate the recommendation results, thereby influencing users’ decisions. Such attacks can severely degrade the quality and reliability of recommendations, undermining the trust in RSs. A comprehensive understanding of shilling attacks is critical not only for improving the robustness of RSs but also for designing effective countermeasures to mitigate their impact. Existing shilling attack methods often face significant challenges in achieving both invisibility (i.e., making fake profiles indistinguishable from legitimate ones) and transferability (i.e., the ability to work across different RSs). Many current approaches either fail to capture the natural distribution of real user data or are highly tailored to specific RS algorithms, limiting their general applicability and effectiveness. To overcome these limitations, we propose DIFshilling, a novel diffusion-based model for shilling attacks. DIFshilling leverages forward noising and reverse denoising techniques to better model the distribution of real user data, allowing it to generate fake users that are statistically similar to legitimate users, thus enhancing the invisibility of the attack. Unlike traditional methods, DIFshilling is independent of the specific recommendation algorithm, making it highly transferable across various RSs. We evaluate DIFshilling through extensive experiments on seven different victim RS models, demonstrating its superior transferability. The experimental results show that DIFshilling not only achieves outstanding effectiveness in terms of attack success but also exhibits strong adversarial defense capabilities, effectively evading detection mechanisms. Specifically, in experiments conducted on the ML100K dataset with the DGCF victim model, DIFshilling was able to increase the frequency of the targeted item by a factor of 15 while maintaining the lowest detection precision and recall, illustrating its ability to remain undetected by common defense techniques. These results underscore the potential of DIFshilling as a powerful tool for both evaluating the vulnerabilities of RS and designing more robust countermeasures.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Recommender Systems and Techniques · Spam and Phishing Detection · Peer-to-Peer Network Technologies
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
Academy of Military Science, Beijing 100097, China
References (44)
Show source-provided references
1. Sen, S., Geyer, W., Freyne, J., and Castells, P. (2016, January 15–19). Deep Neural Networks for YouTube Recommendations. Proceedings of the 10th ACM Conference on Recommender Systems, Boston, MA, USA.
2. The Netflix Recommender System: Algorithms, Business Value, and Innovation10.1145/2843948 ↗
3. Lam, S.K., and Riedl, J. (2004, January 17–20). Shilling recommender systems for fun and profit. Proceedings of the 13th International Conference on World Wide Web, WWW 2004, New York, NY, USA.10.1145/988672.988726 ↗
4. Pang, M., Gao, W., Tao, M., and Zhou, Z.H. (2018, January 3–8). Unorganized Malicious Attacks Detection. Proceedings of the Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, Montréal, QC, Canada.
5. Calrino, J.A., Kilzer, A., Narayanan, A., Felten, E.W., and Shmatikov, V. (2011, January 22–25). “You Might Also Like:” Privacy Risks of Collaborative Filtering. Proceedings of the 32nd IEEE Symposium on Security and Privacy, SP 2011, Berkeley, CA, USA.
6. Shilling attacks against recommender systems: A comprehensive survey10.1007/s10462-012-9364-9 ↗
7. Chen, H., and Li, J. (2019, January 3–7). Data Poisoning Attacks on Cross-domain Recommendation. Proceedings of the 28th ACM International Conference on Information and Knowledge Management, CIKM 2019, Beijing, China.10.1145/3357384.3358116 ↗
8. Burke, R.D., Mobasher, B., Bhaumik, R., and Williams, C. (2005, January 27–30). Segment-Based Injection Attacks against Collaborative Filtering Recommender Systems. Proceedings of the 5th IEEE International Conference on Data Mining (ICDM 2005), Houston, TX, USA.
9. Lin, C., Chen, S., Li, H., Xiao, Y., Li, L., and Yang, Q. (2020, January 19–23). Attacking Recommender Systems with Augmented User Profiles. Proceedings of the CIKM ’20: The 29th ACM International Conference on Information and Knowledge Management, Virtual Event.10.1145/3340531.3411884 ↗
10. Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness10.1145/1278366.1278372 ↗
11. Ho, J., Jain, A., and Abbeel, P. (2020, January 6–12). Denoising Diffusion Probabilistic Models. Proceedings of the Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, Virtual.
12. Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. (2022). Hierarchical Text-Conditional Image Generation with CLIP Latents. arXiv.
13. AudioGuard: Speech Recognition System Robust against Optimized Audio Adversarial Examples10.1007/s11042-023-15961-2 ↗
14. Laskar, A.K., Ahmed, J., Sohail, S.S., Nafis, A., and Haq, Z.A. (2023, January 15–17). Shilling Attacks on Recommender System: A Critical Analysis. Proceedings of the 2023 10th International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India.
15. Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014, January 8–13). Generative Adversarial Nets. Proceedings of the Advances in Neural Information Processing Systems 27: Annual Conference on Neural Information Processing Systems 2014, Montreal, QC, Canada.
16. A review of attacks and its detection attributes on collaborative recommender systems10.26483/ijarcs.v8i7.4550 ↗
17. Attacks and Remedies in Collaborative Recommendation10.1109/MIS.2007.45 ↗
18. O’Mahony, M.P., Hurley, N.J., and Silvestre, G.C.M. (2005, January 9–13). Recommender Systems: Attack Types and Strategies. Proceedings of the Twentieth National Conference on Artificial Intelligence and the Seventeenth Innovative Applications of Artificial Intelligence Conference, Pittsburgh, PA, USA.
19. Tang, J., Wen, H., and Wang, K. (2020, January 22–26). Revisiting Adversarially Learned Injection Attacks Against Recommender Systems. Proceedings of the RecSys 2020: Fourteenth ACM Conference on Recommender Systems, Virtual Event.10.1145/3383313.3412243 ↗
20. Christakopoulou, K., and Banerjee, A. (2019, January 16–20). Adversarial attacks on an oblivious recommender. Proceedings of the 13th ACM Conference on Recommender Systems, RecSys 2019, Copenhagen, Denmark.10.1145/3298689.3347031 ↗
21. Shilling Black-Box Recommender Systems by Learning to Generate Fake User Profiles10.1109/TNNLS.2022.3183210 ↗
22. A novel Kalman Filter based shilling attack detection algorithm10.3934/mbe.2020081 ↗
23. Understanding Shilling Attacks and Their Detection Traits: A Comprehensive Survey10.1109/ACCESS.2020.3022962 ↗
24. Fang, M., Yang, G., Gong, N.Z., and Liu, J. (2018, January 3–7). Poisoning Attacks to Graph-Based Recommender Systems. Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA.10.1145/3274694.3274706 ↗
25. Yang, G., Gong, N.Z., and Cai, Y. (March, January 26). Fake Co-visitation Injection Attacks to Recommender Systems. Proceedings of the 24th Annual Network and Distributed System Security Symposium, NDSS 2017, San Diego, CA, USA.10.14722/ndss.2017.23020 ↗
26. Fang, M., Gong, N.Z., and Liu, J. (2020, January 20–24). Influence Function based Data Poisoning Attacks to Top-N Recommender Systems. Proceedings of the WWW ’20: The Web Conference 2020, Taipei, Taiwan.10.1145/3366423.3380072 ↗
27. Li, B., Wang, Y., Singh, A., and Vorobeychik, Y. (2016, January 5–10). Data Poisoning Attacks on Factorization-Based Collaborative Filtering. Proceedings of the Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, Barcelona, Spain.
28. Data poisoning attacks on neighborhood-based recommender systems10.1002/ett.3872 ↗
29. Industry Report: Amazon.com Recommendations: Item-to-Item Collaborative Filtering
30. Burke, R., Mobasher, B., and Bhaumik, R. (2005, January 1). Limited knowledge shilling attacks in collaborative filtering systems. Proceedings of the 3rd International Workshop on Intelligent Techniques for Web Personalization (ITWP 2005), 19th International Joint Conference on Artificial Intelligence (IJCAI 2005), Edinburgh, UK.
31. Seminario, C.E., and Wilson, D.C. (2014, January 6–10). Attacking item-based recommender systems with power items. Proceedings of the Eighth ACM Conference on Recommender Systems, RecSys ’14, Foster City, Silicon Valley, CA, USA.10.1145/2645710.2645722 ↗
32. Frommholz, I., Hopfgartner, F., Lee, M., Oakes, M., Lalmas, M., Zhang, M., and Santos, R.L.T. (2023, January 21–25). Targeted Shilling Attacks on GNN-based Recommender Systems. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, CIKM 2023, Birmingham, UK.
33. A novel shilling attack on black-box recommendation systems for multiple targets10.1007/s00521-024-10798-8 ↗
34. Radford, A., Metz, L., and Chintala, S. (2016, January 2–4). Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks. Proceedings of the 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico.
35. Kawar, B., Elad, M., Ermon, S., and Song, J. (December, January 28). Denoising Diffusion Restoration Models. Proceedings of the Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA.
36. Rendle, S., Freudenthaler, C., Gantner, Z., and Schmidt-Thieme, L. (2009, January 18–21). BPR: Bayesian Personalized Ranking from Implicit Feedback. Proceedings of the UAI 2009, Proceedings of the Twenty-Fifth Conference on Uncertainty in Artificial Intelligence, Montreal, QC, Canada.
37. Wang, X., Jin, H., Zhang, A., He, X., Xu, T., and Chua, T.S. (2020, January 25–30). Disentangled Graph Collaborative Filtering. Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, SIGIR 2020, Virtual Event.10.1145/3397271.3401137 ↗
38. Xue, H., Dai, X., Zhang, J., Huang, S., and Chen, J. (2017, January 19–25). Deep Matrix Factorization Models for Recommender Systems. Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence, IJCAI 2017, Melbourne, Australia.10.24963/ijcai.2017/447 ↗
39. van den Berg, R., Kipf, T.N., and Welling, M. (2017). Graph Convolutional Matrix Completion. arXiv.
40. Lin, Z., Tian, C., Hou, Y., and Zhao, W.X. (2022, January 25–29). Improving Graph Collaborative Filtering with Neighborhood-enriched Contrastive Learning. Proceedings of the WWW ’22: The ACM Web Conference 2022, Lyon, France.10.1145/3485447.3512104 ↗
41. He, X., Liao, L., Zhang, H., Nie, L., Hu, X., and Chua, T.S. (2017, January 3–7). Neural Collaborative Filtering. Proceedings of the 26th International Conference on World Wide Web, WWW 2017, Perth, Australia.10.1145/3038912.3052569 ↗
42. Wang, X., He, X., Wang, M., Feng, F., and Chua, T.S. (2019, January 21–25). Neural Graph Collaborative Filtering. Proceedings of the 42nd International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR 2019, Paris, France.10.1145/3331184.3331267 ↗
43. Zhao, W.X., Hou, Y., Pan, X., Yang, C., Zhang, Z., Lin, Z., Zhang, J., Bian, S., Tang, J., and Sun, W. (2022, January 17–21). RecBole 2.0: Towards a More Up-to-Date Recommendation Library. Proceedings of the 31st ACM International Conference on Information & Knowledge Management, Atlanta, GA, USA.10.1145/3511808.3557680 ↗
44. Zhang, Y., Tan, Y., Zhang, M., Liu, Y., Chua, T.S., and Ma, S. (2015, January 25–31). Catch the Black Sheep: Unified Framework for Shilling Attack Detection Based on Fraudulent Action Propagation. Proceedings of the Twenty-Fourth International Joint Conference on Artificial Intelligence, IJCAI 2015, Buenos Aires, Argentina.