Recommender systems play a crucial role in helping users to find their
interested information in various web services such as Amazon, YouTube, and
Google News. Various recommender systems, ranging from neighborhood-based,
association-rule-based, matrix-factorization-based, to deep learning based,
have been developed and deployed in industry. Among them, deep learning based
recommender systems become increasingly popular due to their superior
performance.
In this work, we conduct the first systematic study on data poisoning attacks
to deep learning based recommender systems. An attacker's goal is to manipulate
a recommender system such that the attacker-chosen target items are recommended
to many users. To achieve this goal, our attack injects fake users with
carefully crafted ratings to a recommender system. Specifically, we formulate
our attack as an optimization problem, such that the injected ratings would
maximize the number of normal users to whom the target items are recommended.
However, it is challenging to solve the optimization problem because it is a
non-convex integer programming problem. To address the challenge, we develop
multiple techniques to approximately solve the optimization problem. Our
experimental results on three real-world datasets, including small and large
datasets, show that our attack is effective and outperforms existing attacks.
Moreover, we attempt to detect fake users via statistical analysis of the
rating patterns of normal and fake users. Our results show that our attack is
still effective and outperforms existing attacks even if such a detector is
deployed.

本研究针对基于深度学习的推荐系统进行了第一次系统性研究，提出了一个注入可控用户的数据污染攻击模型并发现此攻击在小、大规模数据集上都表现出色，同时提出多种优化方法用于解决此非凸整数编程问题。

深度学习推荐系统中的数据毒化攻击

Data Poisoning Attacks to Deep Learning Based Recommender Systems

Recommender system is an important component of many web services to help
users locate items that match their interests. Several studies showed that
recommender systems are vulnerable to poisoning attacks, in which an attacker
injects fake data to a given system such that the system makes recommendations
as the attacker desires. However, these poisoning attacks are either agnostic
to recommendation algorithms or optimized to recommender systems that are not
graph-based. Like association-rule-based and matrix-factorization-based
recommender systems, graph-based recommender system is also deployed in
practice, e.g., eBay, Huawei App Store. However, how to design optimized
poisoning attacks for graph-based recommender systems is still an open problem.
In this work, we perform a systematic study on poisoning attacks to graph-based
recommender systems. Due to limited resources and to avoid detection, we assume
the number of fake users that can be injected into the system is bounded. The
key challenge is how to assign rating scores to the fake users such that the
target item is recommended to as many normal users as possible. To address the
challenge, we formulate the poisoning attacks as an optimization problem,
solving which determines the rating scores for the fake users. We also propose
techniques to solve the optimization problem. We evaluate our attacks and
compare them with existing attacks under white-box (recommendation algorithm
and its parameters are known), gray-box (recommendation algorithm is known but
its parameters are unknown), and black-box (recommendation algorithm is
unknown) settings using two real-world datasets. Our results show that our
attack is effective and outperforms existing attacks for graph-based
recommender systems. For instance, when 1% fake users are injected, our attack
can make a target item recommended to 580 times more normal users in certain
scenarios.

该研究系统地研究了针对基于图的推荐系统的攻击方法，将攻击行为转化为一个最优化问题，并提出可行的技术解决方案，针对广泛部署的基于图的推荐系统，攻击效果优于现有攻击方式，攻击效果显著。