DRLAttack: A Deep Reinforcement Learning-Based Framework for Data Poisoning Attack on Collaborative Filtering Algorithms
Source abstract
Abstract
Collaborative filtering, as a widely used recommendation method, is widely applied but susceptible to data poisoning attacks, where malicious actors inject synthetic user interaction data to manipulate recommendation results and secure illicit benefits. Traditional poisoning attack methods require in-depth understanding of the recommendation system. However, they fail to address its dynamic nature and algorithmic complexity, thereby hindering effective breaches of the system’s defensive mechanisms. In this paper, we propose DRLAttack, a deep reinforcement learning-based framework for data poisoning attacks. DRLAttack can launch both white-box and black-box data poisoning attacks. In the white-box setting, DRLAttack dynamically tailors attack strategies to recommendation context changes, generating more potent and stealthy fake user interactions for the precise targeting of data poisoning. Furthermore, we extend DRLAttack to black-box settings. By introducing spy users to simulate the behavior of active and inactive users into the training dataset, we indirectly obtain the promotion status of target items and adjust the attack strategy in response. Experimental results on real-world recommendation system datasets demonstrate that DRLAttack can effectively manipulate recommendation results.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Internet Traffic Analysis and Secure E-voting · Digital Mental Health Interventions
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Guangdong Key Laboratory of Industrial Control System Security, Huangpu Research School of Guangzhou University, Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China
Funding
National Natural Science Foundation of China · Guangdong Basic and Applied Basic Research Foundation · the Key Technologies R&D Program of Guangdong Province · Strategic Research and Consulting Project of the Chinese Academy of Engineering · The Project of Guangdong Key Laboratory of Industrial Control System Security
References (41)
Show source-provided references
1. Fan, J., Yan, Q., Li, M., Qu, G., and Xiao, Y. (2022, January 11–13). A survey on data poisoning attacks and defenses. Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), Guilin, China.10.1109/DSC55868.2022.00014 ↗
2. Li, M., Lian, Y., Zhu, J., Lin, J., Wan, J., and Sun, Y. (2024). A Sampling-Based Method for Detecting Data Poisoning Attacks in Recommendation Systems. Mathematics, 12.10.3390/math12020247 ↗
3. Biggio, B., Rieck, K., Ariu, D., Wressnegger, C., Corona, I., Giacinto, G., and Roli, F. (2014, January 7). Poisoning behavioral malware clustering. Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, Scottsdale, AZ, USA.10.1145/2666652.2666666 ↗
4. Deldjoo, Y., Di Noia, T., and Merra, F.A. (2019). Assessing the impact of a user-item collaborative attack on class of users. arXiv.
5. Wang, Z., Gao, M., Yu, J., Ma, H., Yin, H., and Sadiq, S. (2024). Poisoning Attacks against Recommender Systems: A Survey. arXiv.
6. Yuan, W., Nguyen, Q.V.H., He, T., Chen, L., and Yin, H. (2023, January 23–27). Manipulating federated recommender systems: Poisoning with synthetic users and its countermeasures. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, Taipei, Taiwan.10.1145/3539618.3591722 ↗
7. A survey on adversarial recommender systems: From attack/defense strategies to generative adversarial networks10.1145/3439729 ↗
8. Anelli, V.W., Deldjoo, Y., DiNoia, T., and Merra, F.A. (2021). Adversarial recommender systems: Attack, defense, and advances. Recommender Systems Handbook, Springer.10.1007/978-1-0716-2197-4_9 ↗
9. Lin, C., Chen, S., Li, H., Xiao, Y., Li, L., and Yang, Q. (2020, January 19–23). Attacking recommender systems with augmented user profiles. Proceedings of the 29th ACM International Conference on Information & Knowledge Management, Virtual.10.1145/3340531.3411884 ↗
10. Burke, R., Mobasher, B., and Bhaumik, R. (August, January 30). Limited knowledge shilling attacks in collaborative filtering systems. Proceedings of the 19th International Joint Conference on Artificial Intelligence (IJCAI 2005), Edinburgh, Scotland.
11. Wu, C., Lian, D., Ge, Y., Zhu, Z., Chen, E., and Yuan, S. (2021, January 11–15). Fight fire with fire: Towards robust recommender systems via adversarial poisoning training. Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, Virtual Event.10.1145/3404835.3462914 ↗
12. Huang, C., and Li, H. (2023, January 21–25). Single-user injection for invisible shilling attack against recommender systems. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, Birmingham, UK.10.1145/3583780.3615062 ↗
13. Data poisoning attacks on neighborhood-based recommender systems10.1002/ett.3872 ↗
14. Guo, S., Bai, T., and Deng, W. (2023, January 21–25). Targeted shilling attacks on gnn-based recommender systems. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, Birmingham, UK.10.1145/3583780.3615073 ↗
15. Yang, G., Gong, N.Z., and Cai, Y. (March, January 26). Fake Co-visitation Injection Attacks to Recommender Systems. Proceedings of the NDSS, San Diego, CA, USA.
16. Peng, S., and Mine, T. (2020). A robust hierarchical graph convolutional network model for collaborative filtering. arXiv.
17. Poisoning GNN-based recommender systems with generative surrogate-based attacks
18. Yu, Y., Liu, Q., Wu, L., Yu, R., Yu, S.L., and Zhang, Z. (2023, January 7–14). Untargeted attack against federated recommendation systems via poisonous item embeddings and the defense. Proceedings of the AAAI Conference on Artificial Intelligence, Washington, DC, USA.10.1609/aaai.v37i4.25611 ↗
19. Fang, M., Yang, G., Gong, N.Z., and Liu, J. (2018, January 3–7). Poisoning attacks to graph-based recommender systems. Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, PR, USA.10.1145/3274694.3274706 ↗
20. Song, J., Li, Z., Hu, Z., Wu, Y., Li, Z., Li, J., and Gao, J. (2020, January 20–24). Poisonrec: An adaptive data poisoning framework for attacking black-box recommender systems. Proceedings of the 2020 IEEE 36th International Conference on Data Engineering (ICDE), Dallas, TX, USA.10.1109/ICDE48307.2020.00021 ↗
21. LOKI: A practical data poisoning attack framework against next item recommendations
22. Fang, M., Gong, N.Z., and Liu, J. (2020, January 20–24). Influence function based data poisoning attacks to top-n recommender systems. Proceedings of the Web Conference 2020, Taipei, Taiwan.10.1145/3366423.3380072 ↗
23. Towards deep learning models resistant to adversarial attacks
24. Chiang, H.Y., Chen, Y.S., Song, Y.Z., Shuai, H.H., and Chang, J.S. (2023, January 6–10). Shilling black-box review-based recommender systems through fake review generation. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Long Beach, CA, USA.10.1145/3580305.3599502 ↗
25. Liu, X., Tao, Z., Jiang, T., Chang, H., Ma, Y., and Huang, X. (2024). ToDA: Target-oriented Diffusion Attacker against Recommendation System. arXiv.
26. Tan, P.N., Steinbach, M., and Kumar, V. (2006). Introduction to Data Mining, Addison-Wesley.
27. Adversarial attacks for black-box recommender systems via copying transferable cross-domain user profiles10.1109/TKDE.2023.3272652 ↗
28. Yang, S., Yao, L., Wang, C., Xu, X., and Zhu, L. (2023, January 1–4). Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systems. Proceedings of the 2023 IEEE International Conference on Data Mining (ICDM), Shanghai, China.10.1109/ICDM58522.2023.00195 ↗
29. Attacking recommender systems with plausible profile10.1109/TIFS.2021.3117078 ↗
30. Zhao, W.X., Mu, S., Hou, Y., Lin, Z., Chen, Y., Pan, X., Li, K., Lu, Y., Wang, H., and Tian, C. (2021, January 1–5). Recbole: Towards a unified, comprehensive and efficient framework for recommendation algorithms. Proceedings of the 30th acm International Conference on Information & Knowledge Management, Queensland, Australia.10.1145/3459637.3482016 ↗
31. Xu, L., Tian, Z., Zhang, G., Zhang, J., Wang, L., Zheng, B., Li, Y., Tang, J., Zhang, Z., and Hou, Y. (2023, January 23–27). Towards a more user-friendly and easy-to-use benchmark library for recommender systems. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, Taipei, Taiwan.10.1145/3539618.3591889 ↗
32. Wang, Y., Liu, Y., Wang, Q., Wang, C., and Li, C. (2023, January 23–27). Poisoning self-supervised learning based sequential recommendations. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, Taipei, Taiwan.10.1145/3539618.3591751 ↗
33. Yuan, F., Yao, L., and Benatallah, B. (2019, January 14–19). Adversarial collaborative auto-encoder for top-n recommendation. Proceedings of the 2019 International Joint Conference on Neural Networks (IJCNN), Budapest, Hungary.10.1109/IJCNN.2019.8851902 ↗
34. He, X., He, Z., Du, X., and Chua, T.S. (2018, January 8–12). Adversarial personalized ranking for recommendation. Proceedings of the 41st International ACM SIGIR Conference on Research & Development in Information Retrieval, Ann Arbor, MI, USA.10.1145/3209978.3209981 ↗
35. Zhang, S., Yin, H., Chen, T., Huang, Z., Nguyen, Q.V.H., and Cui, L. (2022, January 21–25). Pipattack: Poisoning federated recommender systems for manipulating item promotion. Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, Virtual.10.1145/3488560.3498386 ↗
36. Cao, Y., Chen, X., Yao, L., Wang, X., and Zhang, W.E. (2020, January 25–30). Adversarial attacks and detection on reinforcement learning-based interactive recommender systems. Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, Virtual.10.1145/3397271.3401196 ↗
37. Yue, Z., He, Z., Zeng, H., and McAuley, J. (October, January 27). Black-box attacks on sequential recommenders via data-free model extraction. Proceedings of the 15th ACM Conference on Recommender Systems, Amsterdam, The Netherlands.
38. Fan, W., Derr, T., Zhao, X., Ma, Y., Liu, H., Wang, J., Tang, J., and Li, Q. (2021, January 19–22). Attacking black-box recommendations via copying cross-domain user profiles. Proceedings of the 2021 IEEE 37th International Conference on Data Engineering (ICDE), Chania, Greece.10.1109/ICDE51399.2021.00140 ↗
39. Zhang, K., Cao, Q., Wu, Y., Sun, F., Shen, H., and Cheng, X. (2024, January 14–18). Improving the Shortest Plank: Vulnerability-Aware Adversarial Training for Robust Recommender System. Proceedings of the 18th ACM Conference on Recommender Systems, New York, NY, USA. RecSys ’24.10.1145/3640457.3688120 ↗
40. Pourashraf, P., and Mobasher, B. (2022, January 4–7). Using user’s local context to support local news. Proceedings of the 30th ACM Conference on User Modeling, Adaptation and Personalization, Barcelona, Spain. UMAP’22 Adjunct.10.1145/3511047.3537657 ↗
41. Reinforced Explainable Knowledge Concept Recommendation in MOOCs10.1145/3579991 ↗