# Adversarial Attacks and Detection on Reinforcement Learning-Based Interactive Recommender Systems

arXiv: https://arxiv.org/abs/2006.07934 · HTML: https://mlsanity.com/paper/2006.07934/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2020.

## Built on by (most cited first, 9 of 9)

- [Believe What You See: Implicit Constraint Approach for Offline Multi-Agent Reinforcement Learning](https://mlsanity.com/paper/2106.03400/) (2021)
- [A Survey of Deep Reinforcement Learning in Recommender Systems: A Systematic Review and Future Directions](https://mlsanity.com/paper/2109.03540/) (2021)
- [Rank List Sensitivity of Recommender Systems to Interaction Perturbations](https://mlsanity.com/paper/2201.12686/) (2022)
- [Blockchain-based Recommender Systems: Applications, Challenges and Future Opportunities](https://mlsanity.com/paper/2111.11509/) (2021)
- [On the Opportunities and Challenges of Offline Reinforcement Learning for Recommender Systems](https://mlsanity.com/paper/2308.11336/) (2023)
- [A Distance-based Anomaly Detection Framework for Deep Reinforcement Learning](https://mlsanity.com/paper/2109.09889/) (2021)
- [Learning Robust Recommender from Noisy Implicit Feedback](https://mlsanity.com/paper/2112.01160/) (2021)
- [Evaluating the Robustness of Conversational Recommender Systems by Adversarial Examples](https://mlsanity.com/paper/2303.05575/) (2023)
- [Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks](https://mlsanity.com/paper/2512.10936/) (2025)

## Abstract (arXiv)

Adversarial attacks pose significant challenges for detecting adversarial attacks at an early stage. We propose attack-agnostic detection on reinforcement learning-based interactive recommendation systems. We first craft adversarial examples to show their diverse distributions and then augment recommendation systems by detecting potential attacks with a deep learning-based classifier based on the crafted data. Finally, we study the attack strength and frequency of adversarial examples and evaluate our model on standard datasets with multiple crafting methods. Our extensive experiments show that most adversarial attacks are effective, and both attack strength and attack frequency impact the attack performance. The strategically-timed attack achieves comparative attack performance with only 1/3 to 1/2 attack frequency. Besides, our black-box detector trained with one crafting method has the generalization ability over several crafting methods.