mlsanityData to 7 Oct 2026

Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction

arXiv 2109.01165 ↗First posted 1 Sep 2021cs.CR cs.AI cs.IRcited by 34

Not on the map. Why?

Abstract (arXiv)

We investigate whether model extraction can be used to "steal" the weights of sequential recommender systems, and the potential threats posed to victims of such attacks. This type of risk has attracted attention in image and text classification, but to our knowledge not in recommender systems. We argue that sequential recommender systems are subject to unique vulnerabilities due to the specific autoregressive regimes used to train them. Unlike many existing recommender attackers, which assume the dataset used to train the victim model is exposed to attackers, we consider a data-free setting, where training data are not accessible. Under this setting, we propose an API-based model extraction method via limited-budget synthetic data generation and knowledge distillation. We investigate state-of-the-art models for sequential recommendation and show their vulnerability under model extraction and downstream attacks. We perform attacks in two stages. (1) Model extraction: given different types of synthetic data and their labels retrieved from a black-box recommender, we extract the black-box model to a white-box model via distillation. (2) Downstream attacks: we attack the black-box model with adversarial samples generated by the white-box recommender. Experiments show the effectiveness of our data-free model extraction and downstream attacks on sequential recommenders in both profile pollution and data poisoning settings.

Key facts. Cited by 34 papers in the map (data through 7 Oct 2026). Builds on 29 of its 47 references that are in the map. First posted on arXiv 1 Sep 2021.

Builds on

29 of 47 references.

References · 29

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2014Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translationcited by 4,016
  6. 2016Pointer Sentinel Mixture Modelscited by 2,992
  7. 2016Adversarial examples in the physical worldcited by 1,762
  8. 2018Self-Attentive Sequential Recommendationcited by 1,169
  9. 2017Neural Collaborative Filteringcited by 1,108
  10. 2019BERT4Rec: Sequential Recommendation with Bidirectional Encoder Representations from Transformercited by 952
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2015Image-based Recommendations on Styles and Substitutescited by 702
17 more
  1. 2015Session-based Recommendations with Recurrent Neural Networkscited by 685
  2. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  3. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  4. 2018Personalized Top-N Sequential Recommendation via Convolutional Sequence Embeddingcited by 473
  5. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  6. 2017Neural Attentive Session-based Recommendationcited by 237
  7. 2016Fusing Similarity Models with Markov Chains for Sparse Sequential Recommendationcited by 152
  8. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  9. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  10. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  11. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 61
  12. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  13. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
  14. 2017Deep Reinforcement Learning for List-wise Recommendationscited by 35
  15. 2020Revisiting Adversarially Learned Injection Attacks Against Recommender Systemscited by 30
  16. 2020Practical Data Poisoning Attack against Next-Item Recommendationcited by 27
  17. 2019A framework for the extraction of Deep Neural Networks by leveraging public datacited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 8; 2023: 8; 2024: 11; 2025: 3; 2026: 3.

34 papers.

Sort:

By area:

  1. 2022Filter-enhanced MLP is All You Need for Sequential Recommendationcited by 96
  2. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  3. 2024A Review of Modern Recommender Systems Using Generative Models (Gen-RecSys)cited by 58
  4. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  5. 2021Data-Free Knowledge Transfer: A Surveycited by 31
  6. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 25
  7. 2022A Systematic Review and Replicability Study of BERT4Rec for Sequential Recommendationcited by 22
  8. 2022Rank List Sensitivity of Recommender Systems to Interaction Perturbationscited by 20
  9. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  10. 2023Recent Developments in Recommender Systems: A Surveycited by 14
  11. 2024Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasurescited by 14
  12. 2022Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenderscited by 11
22 more
  1. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  2. 2023Shilling Black-box Review-based Recommender Systems through Fake Review Generationcited by 8
  3. 2024Algorithmic Collective Action in Recommender Systems: Promoting Songs by Reordering Playlistscited by 7
  4. 2023Practical Cross-System Shilling Attacks with Limited Access to Datacited by 4
  5. 2023Towards More Robust and Accurate Sequential Recommendation with Cascade-guided Adversarial Trainingcited by 2
  6. 2024FINEST: Stabilizing Recommendations by Rank-Preserving Fine-Tuningcited by 2
  7. 2024Privacy in LLM-based Recommendation: Recent Advances and Future Directionscited by 2
  8. 2025BESA: Boosting Encoder Stealing Attack with Perturbation Recoverycited by 2
  9. 2026With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systemscited by 2
  10. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
  11. 2023Defense Against Model Extraction Attacks on Recommender Systemscited by 1
  12. 2024Adversarial Text Rewriting for Text-aware Recommender Systemscited by 1
  13. 2024ELASTIC: Efficient Linear Attention for Sequential Interest Compressioncited by 1
  14. 2024Obsidian: Cooperative State-Space Exploration for Performant Inference on Secure ML Acceleratorscited by 1
  15. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  16. 2022Revealing Secrets From Pre-trained Modelscited by 0
  17. 2023Model Stealing Attack against Graph Classification with Authenticity, Uncertainty and Diversitycited by 0
  18. 2024Securing Recommender System via Cooperative Trainingcited by 0
  19. 2024Watermarking Recommender Systemscited by 0
  20. 2025I Stolenly Swear That I Am Up to (No) Good: Design and Evaluation of Model Stealing Attackscited by 0
  21. 2025Potent but Stealthy: Rethink Profile Pollution against Sequential Recommendation via Bi-level Constrained Reinforcement Paradigmcited by 0
  22. 2026BAHSD: Bridging the Long-tail Gap via Adaptive Distillation in Black-box Sequential Recommendationcited by 0