mlsanityData to 14 Oct 2026

Data Poisoning Attacks on Factorization-Based Collaborative Filtering

arXiv 1608.08182 ↗First posted 29 Aug 2016cs.LG cs.CR cs.IRcited by 83

Not on the map. Why?

Abstract (arXiv)

Recommendation and collaborative filtering systems are important in modern information and e-commerce applications. As these systems are becoming increasingly popular in the industry, their outputs could affect business decision making, introducing incentives for an adversarial party to compromise the availability or integrity of such systems. We introduce a data poisoning attack on collaborative filtering systems. We demonstrate how a powerful attacker with full knowledge of the learner can generate malicious data so as to maximize his/her malicious objectives, while at the same time mimicking normal user behavior to avoid being detected. While the complete knowledge assumption seems extreme, it enables a robust assessment of the vulnerability of collaborative filtering schemes to highly motivated attacks. We present efficient solutions for two popular factorization-based collaborative filtering algorithms: the alternative minimization formulation and the nuclear norm minimization method. Finally, we test the effectiveness of our proposed algorithms on real-world data and discuss potential defensive strategies.

Key facts. Cited by 83 papers in the map (data through 14 Oct 2026). First posted on arXiv 29 Aug 2016.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2019: 1; 2020: 0; 2021: 15; 2022: 17; 2023: 19; 2024: 12; 2025: 14; 2026: 5.

83 papers.

Sort:

By area:

  1. 2021Trustworthy AI: From Principles to Practicescited by 207
  2. 2019Policy Poisoning in Batch Reinforcement Learning and Controlcited by 70
  3. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 43
  4. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 37
  5. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 34
  6. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  7. 2022Making Recommender Systems Forget: Learning and Unlearning for Erasable Recommendationcited by 29
  8. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  9. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 26
  10. 2022A Survey on Federated Recommendation Systemscited by 25
  11. 2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agentcited by 25
  12. 2023A Survey of Trustworthy Federated Learning with Perspectives on Security, Robustness, and Privacycited by 24
38 more
  1. 2021Defense Against Reward Poisoning Attacks in Reinforcement Learningcited by 21
  2. 2022Fair ranking: a critical review, challenges, and future directionscited by 21
  3. 2021Graph Sanitation with Application to Node Classificationcited by 20
  4. 2022Rank List Sensitivity of Recommender Systems to Interaction Perturbationscited by 20
  5. 2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 20
  6. 2024Stealthy Attack on Large Language Model based Recommendationcited by 19
  7. 2024Poison-splat: Computation Cost Attack on 3D Gaussian Splattingcited by 18
  8. 2021Security and Privacy for Artificial Intelligence: Opportunities and Challengescited by 16
  9. 2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
  10. 2023Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systemscited by 15
  11. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  12. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  13. 2024Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasurescited by 14
  14. 2022Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarioscited by 13
  15. 2021Data Poisoning Attacks and Defenses to Crowdsourcing Systemscited by 12
  16. 2025DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agentscited by 12
  17. 2023Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attackscited by 11
  18. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  19. 2021Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attackcited by 10
  20. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 10
  21. 2024ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systemscited by 10
  22. 2023Multi-agent Attacks for Black-box Social Recommendationscited by 9
  23. 2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Modelscited by 9
  24. 2023Shilling Black-box Review-based Recommender Systems through Fake Review Generationcited by 8
  25. 2024A Survey on Recommendation Unlearning: Fundamentals, Taxonomy, Evaluation, and Open Questionscited by 7
  26. 2021Turning Federated Learning Systems Into Covert Channelscited by 6
  27. 202110 Security and Privacy Problems in Large Foundation Modelscited by 6
  28. 2023FedDebug: Systematic Debugging for Federated Learning Applicationscited by 6
  29. 2023Recommendation Unlearning via Matrix Correctioncited by 6
  30. 2024FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learningcited by 6
  31. 2025No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanismscited by 6
  32. 2025StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusionscited by 6
  33. 2021Preventing Machine Learning Poisoning Attacks Using Authentication and Provenancecited by 5
  34. 2022FairRoad: Achieving Fairness for Recommender Systems with Optimized Antidote Datacited by 5
  35. 2023Practical Cross-System Shilling Attacks with Limited Access to Datacited by 5
  36. 2023Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directionscited by 4
  37. 2024ToDA: Target-oriented Diffusion Attacker against Recommendation Systemcited by 4
  38. 2024Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systemscited by 4

50 most cited of 83 All 83 (JSON)