The rise of online social networks has facilitated the evolution of social
recommender systems, which incorporate social relations to enhance users'
decision-making process. With the great success of Graph Neural Networks in
learning node representations, GNN-based social recommendations have been
widely studied to model user-item interactions and user-user social relations
simultaneously. Despite their great successes, recent studies have shown that
these advanced recommender systems are highly vulnerable to adversarial
attacks, in which attackers can inject well-designed fake user profiles to
disrupt recommendation performances. While most existing studies mainly focus
on targeted attacks to promote target items on vanilla recommender systems,
untargeted attacks to degrade the overall prediction performance are less
explored on social recommendations under a black-box scenario. To perform
untargeted attacks on social recommender systems, attackers can construct
malicious social relationships for fake users to enhance the attack
performance. However, the coordination of social relations and item profiles is
challenging for attacking black-box social recommendations. To address this
limitation, we first conduct several preliminary studies to demonstrate the
effectiveness of cross-community connections and cold-start items in degrading
recommendations performance. Specifically, we propose a novel framework
Multiattack based on multi-agent reinforcement learning to coordinate the
generation of cold-start item profiles and cross-community social relations for
conducting untargeted attacks on black-box social recommendations.
Comprehensive experiments on various real-world datasets demonstrate the
effectiveness of our proposed attacking framework under the black-box setting.

通过使用多代理强化学习算法，我们提出了一种名为 Multiattack 的新型框架，用于在黑盒社交推荐系统中进行协调生成冷启动物品概述和跨社区社交关系，以进行非定向的攻击。我们在多个现实世界数据集上进行了综合实验，证明了我们所提出的攻击框架在黑盒环境下的有效性。

社交推荐的无目标黑盒攻击

Untargeted Black-box Attacks for Social Recommendations

We offer a study that connects robust discriminative classifiers trained with
adversarial training (AT) with generative modeling in the form of Energy-based
Models (EBM). We do so by decomposing the loss of a discriminative classifier
and showing that the discriminative model is also aware of the input data
density. Though a common assumption is that adversarial points leave the
manifold of the input data, our study finds out that, surprisingly, untargeted
adversarial points in the input space are very likely under the generative
model hidden inside the discriminative classifier -- have low energy in the
EBM. We present two evidence: untargeted attacks are even more likely than the
natural data and their likelihood increases as the attack strength increases.
This allows us to easily detect them and craft a novel attack called
High-Energy PGD that fools the classifier yet has energy similar to the data
set.

本研究连接了利用对抗训练 (adversarial training，AT) 训练的鲁棒判别器和基于能量的生成模型 (Energy-based Models，EBM)，通过分解判别器的损失并展示判别模型也能意识到输入数据密度实现。研究发现，令人惊讶的是，输入空间中未定向攻击点非常可能在判别分类器中隐藏的生成模型里 —— 即 EBM 中的能量非常低。我们展示了两个证据：未定向攻击比自然数据甚至更可能出现，当攻击强度增强时，它们的可能性也会增加。这使得我们能够轻松检测它们，并设计了一种名为 High-Energy PGD 的新型攻击方法，它能欺骗分类器但具有与数据集相似的能量。

探究稳健和生成模型之间的联系

Exploring the Connection between Robust and Generative Models

Attacks on Federated Learning (FL) can severely reduce the quality of the
generated models and limit the usefulness of this emerging learning paradigm
that enables on-premise decentralized learning. There have been various
untargeted attacks on FL, but they are not widely applicable as they i) assume
that the attacker knows every update of benign clients, which is indeed sent in
encrypted form to the central server, or ii) assume that the attacker has a
large dataset and sufficient resources to locally train updates imitating
benign parties. In this paper, we design a zero-knowledge untargeted attack
(ZKA), which synthesizes malicious data to craft adversarial models without
eavesdropping on the transmission of benign clients at all or requiring a large
quantity of task-specific training data. To inject malicious input into the FL
system by synthetic data, ZKA has two variants. ZKA-R generates adversarial
ambiguous data by reversing engineering from the global models. To enable
stealthiness, ZKA-G trains the local model on synthetic data from the generator
that aims to synthesize images different from a randomly chosen class.
Furthermore, we add a novel distance-based regularization term for both attacks
to further enhance stealthiness. Experimental results on Fashion-MNIST and
CIFAR-10 show that the ZKA achieves similar or even higher attack success rate
than the state-of-the-art untargeted attacks against various defense
mechanisms, namely more than 50% for Cifar-10 for all considered defense
mechanisms. As expected, ZKA-G is better at circumventing defenses, even
showing a defense pass rate of close to 90% when ZKA-R only achieves 70%.
Higher data heterogeneity favours ZKA-R since detection becomes harder.

本文设计了一种零知识的非定向攻击 (ZKA)，通过合成恶意数据来制造对抗性模型，无需窃听良性客户端的传输或需要大量的任务特定训练数据。实验结果表明，ZKA 可以绕过各种防御机制，高攻击成功率，克服了传统攻击方法的缺陷。

盲人引盲：针对联合学习的零知识攻击

Blind leads Blind: A Zero-Knowledge Attack on Federated Learning

We demonstrate the existence of universal adversarial perturbations, which
can fool a family of audio classification architectures, for both targeted and
untargeted attack scenarios. We propose two methods for finding such
perturbations. The first method is based on an iterative, greedy approach that
is well-known in computer vision: it aggregates small perturbations to the
input so as to push it to the decision boundary. The second method, which is
the main contribution of this work, is a novel penalty formulation, which finds
targeted and untargeted universal adversarial perturbations. Differently from
the greedy approach, the penalty method minimizes an appropriate objective
function on a batch of samples. Therefore, it produces more successful attacks
when the number of training samples is limited. Moreover, we provide a proof
that the proposed penalty method theoretically converges to a solution that
corresponds to universal adversarial perturbations. We also demonstrate that it
is possible to provide successful attacks using the penalty method when only
one sample from the target dataset is available for the attacker. Experimental
results on attacking various 1D CNN architectures have shown attack success
rates higher than 85.0% and 83.1% for targeted and untargeted attacks,
respectively using the proposed penalty method.

本文展示了普适对抗扰动的存在，基于一些新提出的方法，使用惩罚公式可以成功实现针对音频分类体系结构的有目标攻击和无目标攻击。