# Data Poisoning Attacks on Neighborhood-based Recommender Systems

arXiv: https://arxiv.org/abs/1912.04109 · HTML: https://mlsanity.com/paper/1912.04109/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Dec 2019.

## Built on by (most cited first, 10 of 10)

- [Data Poisoning Attacks to Deep Learning Based Recommender Systems](https://mlsanity.com/paper/2101.02644/) (2021)
- [Poisoning Federated Recommender Systems with Fake Users](https://mlsanity.com/paper/2402.11637/) (2024)
- [Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures](https://mlsanity.com/paper/2404.14942/) (2024)
- [Retrieval-Augmented Review Generation for Poisoning Recommender Systems](https://mlsanity.com/paper/2508.15252/) (2025)
- [Influence Based Defense Against Data Poisoning Attacks in Online Learning](https://mlsanity.com/paper/2104.13230/) (2021)
- [Targeted Data Poisoning Attack on News Recommendation System by Content Perturbation](https://mlsanity.com/paper/2203.03560/) (2022)
- [Securing Visually-Aware Recommender Systems: An Adversarial Image Reconstruction and Detection Framework](https://mlsanity.com/paper/2306.07992/) (2023)
- [Training-Time Attacks against k-Nearest Neighbors](https://mlsanity.com/paper/2208.07272/) (2022)
- [Securing Recommender System via Cooperative Training](https://mlsanity.com/paper/2401.12700/) (2024)
- [Toward Trustworthy AI: Multi-Target Adversarial Attacks and Robust Defenses for Continuous Data Summarization](https://mlsanity.com/paper/2606.11804/) (2026)

## Abstract (arXiv)

Nowadays, collaborative filtering recommender systems have been widely deployed in many commercial companies to make profit. Neighbourhood-based collaborative filtering is common and effective. To date, despite its effectiveness, there has been little effort to explore their robustness and the impact of data poisoning attacks on their performance. Can the neighbourhood-based recommender systems be easily fooled? To this end, we shed light on the robustness of neighbourhood-based recommender systems and propose a novel data poisoning attack framework encoding the purpose of attack and constraint against them. We firstly illustrate how to calculate the optimal data poisoning attack, namely UNAttack. We inject a few well-designed fake users into the recommender systems such that target items will be recommended to as many normal users as possible. Extensive experiments are conducted on three real-world datasets to validate the effectiveness and the transferability of our proposed method. Besides, some interesting phenomenons can be found. For example, 1) neighbourhood-based recommender systems with Euclidean Distance-based similarity have strong robustness. 2) the fake users can be transferred to attack the state-of-the-art collaborative filtering recommender systems such as Neural Collaborative Filtering and Bayesian Personalized Ranking Matrix Factorization.