mlsanityData to 14 Oct 2026

Poisoning Attacks to Graph-Based Recommender Systems

arXiv 1809.04127 ↗First posted 11 Sep 2018cs.IR cs.CR cs.LGcited by 56

Not on the map. Why?

Abstract (arXiv)

Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning attacks, in which an attacker injects fake data to a given system such that the system makes recommendations as the attacker desires. However, these poisoning attacks are either agnostic to recommendation algorithms or optimized to recommender systems that are not graph-based. Like association-rule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store. However, how to design optimized poisoning attacks for graph-based recommender systems is still an open problem. In this work, we perform a systematic study on poisoning attacks to graph-based recommender systems. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. The key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning attacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our attacks and compare them with existing attacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and black-box (recommendation algorithm is unknown) settings using two real-world datasets. Our results show that our attack is effective and outperforms existing attacks for graph-based recommender systems. For instance, when 1% fake users are injected, our attack can make a target item recommended to 580 times more normal users in certain scenarios.

Key facts. Cited by 56 papers in the map (data through 14 Oct 2026). First posted on arXiv 11 Sep 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 11; 2022: 15; 2023: 10; 2024: 12; 2025: 6; 2026: 2.

56 papers.

Sort:

By area:

  1. 2021Trustworthy AI: A Computational Perspectivecited by 93
  2. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 43
  3. 2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotioncited by 37
  4. 2024Advances and Open Challenges in Federated Foundation Modelscited by 36
  5. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 36
  6. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 34
  7. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  8. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  9. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 26
  10. 2022A Survey on Federated Recommendation Systemscited by 25
  11. 2023A Survey of Trustworthy Federated Learning with Perspectives on Security, Robustness, and Privacycited by 24
  12. 2022Rank List Sensitivity of Recommender Systems to Interaction Perturbationscited by 20
38 more
  1. 2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 20
  2. 2024Stealthy Attack on Large Language Model based Recommendationcited by 19
  3. 2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
  4. 2024Poisoning Federated Recommender Systems with Fake Userscited by 15
  5. 2022Projective Ranking-based GNN Evasion Attackscited by 14
  6. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  7. 2024Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasurescited by 14
  8. 2022Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarioscited by 13
  9. 2021Data Poisoning Attacks and Defenses to Crowdsourcing Systemscited by 12
  10. 2021Blockchain-based Recommender Systems: Applications, Challenges and Future Opportunitiescited by 11
  11. 2023Analysis of Label-Flip Poisoning Attack on Machine Learning Based Malware Detectorcited by 11
  12. 2023Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attackscited by 11
  13. 2021Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attackcited by 10
  14. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 10
  15. 2021Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspectivecited by 9
  16. 2023Multi-agent Attacks for Black-box Social Recommendationscited by 9
  17. 2023Turning Privacy-preserving Mechanisms against Federated Learningcited by 8
  18. 2023Shilling Black-box Review-based Recommender Systems through Fake Review Generationcited by 8
  19. 2021Turning Federated Learning Systems Into Covert Channelscited by 6
  20. 202110 Security and Privacy Problems in Large Foundation Modelscited by 6
  21. 2021Adversarial Diffusion Attacks on Graph-based Traffic Prediction Modelscited by 5
  22. 2022FairRoad: Achieving Fairness for Recommender Systems with Optimized Antidote Datacited by 5
  23. 2024Multi-Modal Recommendation Unlearning for Legal, Licensing, and Modality Constraintscited by 5
  24. 2024ToDA: Target-oriented Diffusion Attacker against Recommendation Systemcited by 4
  25. 2024Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systemscited by 4
  26. 2022Detect Professional Malicious User with Metric Learning in Recommender Systemscited by 3
  27. 2024FedRDF: A Robust and Dynamic Aggregation Function against Poisoning Attacks in Federated Learningcited by 3
  28. 2025Preventing the Popular Item Embedding Based Attack in Federated Recommendationscited by 3
  29. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systemscited by 3
  30. 2022Towards Robust Recommender Systems via Triple Cooperative Defensecited by 1
  31. 2023Securing Visually-Aware Recommender Systems: An Adversarial Image Reconstruction and Detection Frameworkcited by 1
  32. 2023Defense Against Model Extraction Attacks on Recommender Systemscited by 1
  33. 2024Fooling Neural Networks for Motion Forecasting via Adversarial Attackscited by 1
  34. 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clientscited by 1
  35. 2025IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotioncited by 1
  36. 2021FedCom: A Byzantine-Robust Local Model Aggregation Rule Using Data Commitment for Federated Learningcited by 0
  37. 2022Privacy protection based on mask templatecited by 0
  38. 2022Federated Learning based on Defending Against Data Poisoning Attacks in IoTcited by 0

50 most cited of 56 All 56 (JSON)