# FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling

arXiv: https://arxiv.org/abs/2202.04975 · HTML: https://mlsanity.com/paper/2202.04975/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Feb 2022.

## Built on by (most cited first, 22 of 22)

- [Recent Advances on Federated Learning: A Systematic Survey](https://mlsanity.com/paper/2301.01299/) (2023)
- [A Survey on Federated Recommendation Systems](https://mlsanity.com/paper/2301.00767/) (2022)
- [Dual Personalization on Federated Recommendation](https://mlsanity.com/paper/2301.08143/) (2023)
- [Recent Developments in Recommender Systems: A Survey](https://mlsanity.com/paper/2306.12680/) (2023)
- [Towards Efficient Communication and Secure Federated Recommendation System via Low-rank Training](https://mlsanity.com/paper/2401.03748/) (2024)
- [Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures](https://mlsanity.com/paper/2404.14942/) (2024)
- [FedDefender: Client-Side Attack-Tolerant Federated Learning](https://mlsanity.com/paper/2307.09048/) (2023)
- [A Survey on Point-of-Interest Recommendation: Models, Architectures, and Security](https://mlsanity.com/paper/2410.02191/) (2024)
- [Federated Recommendation with Additive Personalization](https://mlsanity.com/paper/2301.09109/) (2023)
- [Multi-agent Attacks for Black-box Social Recommendations](https://mlsanity.com/paper/2311.07127/) (2023)
- [Co-clustering for Federated Recommender System](https://mlsanity.com/paper/2411.01690/) (2024)
- [Turning Privacy-preserving Mechanisms against Federated Learning](https://mlsanity.com/paper/2305.05355/) (2023)
- [Towards Attack-tolerant Federated Learning via Critical Parameter Analysis](https://mlsanity.com/paper/2308.09318/) (2023)
- [Rethinking Byzantine Robustness in Federated Recommendation from Sparse Aggregation Perspective](https://mlsanity.com/paper/2501.03301/) (2025)
- [BadSampler: Harnessing the Power of Catastrophic Forgetting to Poison Byzantine-robust Federated Learning](https://mlsanity.com/paper/2406.12222/) (2024)
- [Forward Once for All: Structural Parameterized Adaptation for Efficient Cloud-coordinated On-device Recommendation](https://mlsanity.com/paper/2501.02837/) (2025)
- [Preventing the Popular Item Embedding Based Attack in Federated Recommendations](https://mlsanity.com/paper/2502.12958/) (2025)
- [Large-Scale Distributed Learning via Private On-Device Locality-Sensitive Hashing](https://mlsanity.com/paper/2306.02563/) (2023)
- [Personalized Recommendation Models in Federated Settings: A Survey](https://mlsanity.com/paper/2504.07101/) (2025)
- [Interactive Trimming against Evasive Online Data Manipulation Attacks: A Game-Theoretic Approach](https://mlsanity.com/paper/2403.10313/) (2024)
- [A Scenario-Oriented Survey of Federated Recommender Systems: Techniques, Challenges, and Future Directions](https://mlsanity.com/paper/2508.19620/) (2025)
- [Shilling Recommender Systems by Generating Side-feature-aware Fake User Profiles](https://mlsanity.com/paper/2509.17918/) (2025)

## Abstract (arXiv)

Federated learning (FL) is a feasible technique to learn personalized recommendation models from decentralized user data. Unfortunately, federated recommender systems are vulnerable to poisoning attacks by malicious clients. Existing recommender system poisoning methods mainly focus on promoting the recommendation chances of target items due to financial incentives. In fact, in real-world scenarios, the attacker may also attempt to degrade the overall performance of recommender systems. However, existing general FL poisoning methods for degrading model performance are either ineffective or not concealed in poisoning federated recommender systems. In this paper, we propose a simple yet effective and covert poisoning attack method on federated recommendation, named FedAttack. Its core idea is using globally hardest samples to subvert model training. More specifically, the malicious clients first infer user embeddings based on local user profiles. Next, they choose the candidate items that are most relevant to the user embeddings as hardest negative samples, and find the candidates farthest from the user embeddings as hardest positive samples. The model gradients inferred from these poisoned samples are then uploaded to the server for aggregation and model update. Since the behaviors of malicious clients are somewhat similar to users with diverse interests, they cannot be effectively distinguished from normal clients by the server. Extensive experiments on two benchmark datasets show that FedAttack can effectively degrade the performance of various federated recommender systems, meanwhile cannot be effectively detected nor defended by many existing methods.