# Revisiting Adversarially Learned Injection Attacks Against Recommender Systems

arXiv: https://arxiv.org/abs/2008.04876 · HTML: https://mlsanity.com/paper/2008.04876/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Aug 2020.

## Built on by (most cited first, 30 of 32)

- [Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction](https://mlsanity.com/paper/2109.01165/) (2021)
- [A Comprehensive Survey on Trustworthy Recommender Systems](https://mlsanity.com/paper/2209.10117/) (2022)
- [Knowledge-enhanced Black-box Attacks for Recommendations](https://mlsanity.com/paper/2207.10307/) (2022)
- [Rank List Sensitivity of Recommender Systems to Interaction Perturbations](https://mlsanity.com/paper/2201.12686/) (2022)
- [Shilling Black-box Recommender Systems by Learning to Generate Fake User Profiles](https://mlsanity.com/paper/2206.11433/) (2022)
- [Poisoning Federated Recommender Systems with Fake Users](https://mlsanity.com/paper/2402.11637/) (2024)
- [Recent Developments in Recommender Systems: A Survey](https://mlsanity.com/paper/2306.12680/) (2023)
- [Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures](https://mlsanity.com/paper/2404.14942/) (2024)
- [DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents](https://mlsanity.com/paper/2503.23804/) (2025)
- [Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders](https://mlsanity.com/paper/2207.11237/) (2022)
- [Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attack](https://mlsanity.com/paper/2107.10457/) (2021)
- [PORE: Provably Robust Recommender Systems against Data Poisoning Attacks](https://mlsanity.com/paper/2303.14601/) (2023)
- [Multi-agent Attacks for Black-box Social Recommendations](https://mlsanity.com/paper/2311.07127/) (2023)
- [Algorithmic Collective Action in Recommender Systems: Promoting Songs by Reordering Playlists](https://mlsanity.com/paper/2404.04269/) (2024)
- [Practical Cross-System Shilling Attacks with Limited Access to Data](https://mlsanity.com/paper/2302.07145/) (2023)
- [Multi-Modal Recommendation Unlearning for Legal, Licensing, and Modality Constraints](https://mlsanity.com/paper/2405.15328/) (2024)
- [ToDA: Target-oriented Diffusion Attacker against Recommendation System](https://mlsanity.com/paper/2401.12578/) (2024)
- [Towards Adversarially Robust Recommendation from Adaptive Fraudster Detection](https://mlsanity.com/paper/2211.11534/) (2022)
- [LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems](https://mlsanity.com/paper/2505.13528/) (2025)
- [Retrieval-Augmented Review Generation for Poisoning Recommender Systems](https://mlsanity.com/paper/2508.15252/) (2025)
- [FINEST: Stabilizing Recommendations by Rank-Preserving Fine-Tuning](https://mlsanity.com/paper/2402.03481/) (2024)
- [Towards Robust Recommender Systems via Triple Cooperative Defense](https://mlsanity.com/paper/2210.13762/) (2022)
- [Adversarial Text Rewriting for Text-aware Recommender Systems](https://mlsanity.com/paper/2408.00312/) (2024)
- [IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion](https://mlsanity.com/paper/2511.05845/) (2025)
- [Mitigating Human and Computer Opinion Fraud via Contrastive Learning](https://mlsanity.com/paper/2301.03025/) (2023)
- [The GANfather: Controllable generation of malicious activity to improve defence systems](https://mlsanity.com/paper/2307.13787/) (2023)
- [Securing Recommender System via Cooperative Training](https://mlsanity.com/paper/2401.12700/) (2024)
- [Defending Collaborative Filtering Recommenders via Adversarial Robustness Based Edge Reweighting](https://mlsanity.com/paper/2412.10850/) (2024)
- [Potent but Stealthy: Rethink Profile Pollution against Sequential Recommendation via Bi-level Constrained Reinforcement Paradigm](https://mlsanity.com/paper/2511.09392/) (2025)
- [Sharpness-Aware Poisoning: Enhancing Transferability of Injective Attacks on Recommender Systems](https://mlsanity.com/paper/2604.22170/) (2026)

## Abstract (arXiv)

Recommender systems play an important role in modern information and e-commerce applications. While increasing research is dedicated to improving the relevance and diversity of the recommendations, the potential risks of state-of-the-art recommendation models are under-explored, that is, these models could be subject to attacks from malicious third parties, through injecting fake user interactions to achieve their purposes. This paper revisits the adversarially-learned injection attack problem, where the injected fake user `behaviors' are learned locally by the attackers with their own model -- one that is potentially different from the model under attack, but shares similar properties to allow attack transfer. We found that most existing works in literature suffer from two major limitations: (1) they do not solve the optimization problem precisely, making the attack less harmful than it could be, (2) they assume perfect knowledge for the attack, causing the lack of understanding for realistic attack capabilities. We demonstrate that the exact solution for generating fake users as an optimization problem could lead to a much larger impact. Our experiments on a real-world dataset reveal important properties of the attack, including attack transferability and its limitations. These findings can inspire useful defensive methods against this possible existing attack.