mlsanityData to 7 Oct 2026

Data Poisoning Attacks to Deep Learning Based Recommender Systems

arXiv 2101.02644 ↗First posted 7 Jan 2021cs.CR cs.AIcited by 41

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Recommender systems play a crucial role in helping users to find their interested information in various web services such as Amazon, YouTube, and Google News. Various recommender systems, ranging from neighborhood-based, association-rule-based, matrix-factorization-based, to deep learning based, have been developed and deployed in industry. Among them, deep learning based recommender systems become increasingly popular due to their superior performance. In this work, we conduct the first systematic study on data poisoning attacks to deep learning based recommender systems. An attacker's goal is to manipulate a recommender system such that the attacker-chosen target items are recommended to many users. To achieve this goal, our attack injects fake users with carefully crafted ratings to a recommender system. Specifically, we formulate our attack as an optimization problem, such that the injected ratings would maximize the number of normal users to whom the target items are recommended. However, it is challenging to solve the optimization problem because it is a non-convex integer programming problem. To address the challenge, we develop multiple techniques to approximately solve the optimization problem. Our experimental results on three real-world datasets, including small and large datasets, show that our attack is effective and outperforms existing attacks. Moreover, we attempt to detect fake users via statistical analysis of the rating patterns of normal and fake users. Our results show that our attack is still effective and outperforms existing attacks even if such a detector is deployed.

Key facts. Cited by 41 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 15 of its 51 references that are in the map. First posted on arXiv 7 Jan 2021.

Builds on

15 of 51 references.

References · 15

  1. 2017Neural Collaborative Filteringcited by 1,108
  2. 2016Wide & Deep Learning for Recommender Systemscited by 745
  3. 2017Certified Defenses for Data Poisoning Attackscited by 288
  4. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  5. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  6. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  7. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  8. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  9. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 61
  10. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 52
  11. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  12. 2018Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagationcited by 14
3 more
  1. 2013SybilBelief: A Semi-supervised Learning Approach for Structure-based Sybil Detectioncited by 11
  2. 2019Data Poisoning Attacks on Neighborhood-based Recommender Systemscited by 10
  3. 2020Survey for Trust-aware Recommender Systems: A Deep Learning Perspectivecited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 12; 2023: 8; 2024: 9; 2025: 6; 2026: 1.

41 papers.

Sort:

By area:

  1. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  2. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  3. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 34
  4. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  5. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 25
  6. 2022A Survey on Federated Recommendation Systemscited by 25
  7. 2022Rank List Sensitivity of Recommender Systems to Interaction Perturbationscited by 20
  8. 2024Stealthy Attack on Large Language Model based Recommendationcited by 19
  9. 2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 18
  10. 2024Poisoning Federated Recommender Systems with Fake Userscited by 15
  11. 2023Recent Developments in Recommender Systems: A Surveycited by 14
  12. 2024Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasurescited by 14
29 more
  1. 2022Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarioscited by 13
  2. 2025DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agentscited by 12
  3. 2021Being Properly Impropercited by 11
  4. 2022Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenderscited by 11
  5. 2021Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspectivecited by 9
  6. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 9
  7. 2023Secure Split Learning against Property Inference, Data Reconstruction, and Feature Space Hijacking Attackscited by 8
  8. 2023Shilling Black-box Review-based Recommender Systems through Fake Review Generationcited by 8
  9. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  10. 2024Algorithmic Collective Action in Recommender Systems: Promoting Songs by Reordering Playlistscited by 7
  11. 2023Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Modelscited by 6
  12. 202110 Security and Privacy Problems in Large Foundation Modelscited by 5
  13. 2022PEPPER: Empowering User-Centric Recommender Systems over Gossip Learningcited by 4
  14. 2024ToDA: Target-oriented Diffusion Attacker against Recommendation Systemcited by 4
  15. 2024Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systemscited by 4
  16. 2022Towards Adversarially Robust Recommendation from Adaptive Fraudster Detectioncited by 3
  17. 2025Preventing the Popular Item Embedding Based Attack in Federated Recommendationscited by 3
  18. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systemscited by 3
  19. 2022Targeted Data Poisoning Attack on News Recommendation System by Content Perturbationcited by 2
  20. 2022Robust Offline Reinforcement Learning with Gradient Penalty and Constraint Relaxationcited by 2
  21. 2023Securing Visually-Aware Recommender Systems: An Adversarial Image Reconstruction and Detection Frameworkcited by 1
  22. 2023Defense Against Model Extraction Attacks on Recommender Systemscited by 1
  23. 2025Customized Retrieval-Augmented Generation with LLM for Debiasing Recommendation Unlearningcited by 1
  24. 2025Multi-Agent Framework for Threat Mitigation and Resilience in AI-Based Systemscited by 1
  25. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  26. 2024Securing Recommender System via Cooperative Trainingcited by 0
  27. 2024Defending Collaborative Filtering Recommenders via Adversarial Robustness Based Edge Reweightingcited by 0
  28. 2025Potent but Stealthy: Rethink Profile Pollution against Sequential Recommendation via Bi-level Constrained Reinforcement Paradigmcited by 0
  29. 2026SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Modelscited by 0