# Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attack

arXiv: https://arxiv.org/abs/2107.10457 · HTML: https://mlsanity.com/paper/2107.10457/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 52 references that are in the map.
- First posted on arXiv 22 Jul 2021.

## Builds on (most cited first, 22 of 22)

- [Improved Training of Wasserstein GANs](https://mlsanity.com/paper/1704.00028/) (2017)
- [Conditional Generative Adversarial Nets](https://mlsanity.com/paper/1411.1784/) (2014)
- [Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks](https://mlsanity.com/paper/1511.06434/) (2015)
- [Spectral Normalization for Generative Adversarial Networks](https://mlsanity.com/paper/1802.05957/) (2018)
- [LightGCN: Simplifying and Powering Graph Convolution Network for Recommendation](https://mlsanity.com/paper/2002.02126/) (2020)
- [Graph Convolutional Neural Networks for Web-Scale Recommender Systems](https://mlsanity.com/paper/1806.01973/) (2018)
- [Neural Collaborative Filtering](https://mlsanity.com/paper/1708.05031/) (2017)
- [Graph Neural Networks for Social Recommendation](https://mlsanity.com/paper/1902.07243/) (2019)
- [Neural Graph Collaborative Filtering](https://mlsanity.com/paper/1905.08108/) (2019)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [AttGAN: Facial Attribute Editing by Only Changing What You Want](https://mlsanity.com/paper/1711.10678/) (2017)
- [Data Poisoning Attacks on Factorization-Based Collaborative Filtering](https://mlsanity.com/paper/1608.08182/) (2016)
- [IRGAN: A Minimax Game for Unifying Generative and Discriminative Information Retrieval Models](https://mlsanity.com/paper/1705.10513/) (2017)
- [Influence Function based Data Poisoning Attacks to Top-N Recommender Systems](https://mlsanity.com/paper/2002.08025/) (2020)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [Adversarial Personalized Ranking for Recommendation](https://mlsanity.com/paper/1808.03908/) (2018)
- [Dual Graph Attention Networks for Deep Latent Representation of Multifaceted Social Effects in Recommender Systems](https://mlsanity.com/paper/1903.10433/) (2019)
- [Revisiting Adversarially Learned Injection Attacks Against Recommender Systems](https://mlsanity.com/paper/2008.04876/) (2020)
- [Attacking Recommender Systems with Augmented User Profiles](https://mlsanity.com/paper/2005.08164/) (2020)
- [Recommender Systems Based on Generative Adversarial Networks: A Problem-Driven Perspective](https://mlsanity.com/paper/2003.02474/) (2020)
- [Generating Reliable Friends via Adversarial Training to Improve Social Recommendation](https://mlsanity.com/paper/1909.03529/) (2019)
- [Unorganized Malicious Attacks Detection](https://mlsanity.com/paper/1610.04086/) (2016)

## Built on by (most cited first, 10 of 10)

- [Efficient Bi-Level Optimization for Recommendation Denoising](https://mlsanity.com/paper/2210.10321/) (2022)
- [Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures](https://mlsanity.com/paper/2404.14942/) (2024)
- [Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attacks](https://mlsanity.com/paper/2311.18244/) (2023)
- [Towards Adversarially Robust Recommendation from Adaptive Fraudster Detection](https://mlsanity.com/paper/2211.11534/) (2022)
- [Retrieval-Augmented Review Generation for Poisoning Recommender Systems](https://mlsanity.com/paper/2508.15252/) (2025)
- [SemanticShield: LLM-Powered Audits Expose Shilling Attacks in Recommender Systems](https://mlsanity.com/paper/2509.24961/) (2025)
- [Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems](https://mlsanity.com/paper/2506.08401/) (2025)
- [Discussion about Attacks and Defenses for Fair and Robust Recommendation System Design](https://mlsanity.com/paper/2210.07817/) (2022)
- [The GANfather: Controllable generation of malicious activity to improve defence systems](https://mlsanity.com/paper/2307.13787/) (2023)
- [An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems](https://mlsanity.com/paper/2609.09551/) (2026)

## Abstract (arXiv)

To explore the robustness of recommender systems, researchers have proposed various shilling attack models and analyzed their adverse effects. Primitive attacks are highly feasible but less effective due to simplistic handcrafted rules, while upgraded attacks are more powerful but costly and difficult to deploy because they require more knowledge from recommendations. In this paper, we explore a novel shilling attack called Graph cOnvolution-based generative shilling ATtack (GOAT) to balance the attacks' feasibility and effectiveness. GOAT adopts the primitive attacks' paradigm that assigns items for fake users by sampling and the upgraded attacks' paradigm that generates fake ratings by a deep learning-based model. It deploys a generative adversarial network (GAN) that learns the real rating distribution to generate fake ratings. Additionally, the generator combines a tailored graph convolution structure that leverages the correlations between co-rated items to smoothen the fake ratings and enhance their authenticity. The extensive experiments on two public datasets evaluate GOAT's performance from multiple perspectives. Our study of the GOAT demonstrates technical feasibility for building a more powerful and intelligent attack model with a much-reduced cost, enables analysis the threat of such an attack and guides for investigating necessary prevention measures.