# Untargeted Attack against Federated Recommendation Systems via Poisonous Item Embeddings and the Defense

arXiv: https://arxiv.org/abs/2212.05399 · HTML: https://mlsanity.com/paper/2212.05399/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Dec 2022.

## Built on by (most cited first, 16 of 16)

- [Exploring Large Language Model for Graph Data Understanding in Online Job Recommendations](https://mlsanity.com/paper/2307.05722/) (2023)
- [A Survey of Foundation Model-Powered Recommender Systems: From Feature-Based, Generative to Agentic Paradigms](https://mlsanity.com/paper/2504.16420/) (2025)
- [A Survey on Point-of-Interest Recommendation: Models, Architectures, and Security](https://mlsanity.com/paper/2410.02191/) (2024)
- [Multi-agent Attacks for Black-box Social Recommendations](https://mlsanity.com/paper/2311.07127/) (2023)
- [PPIDSG: A Privacy-Preserving Image Distribution Sharing Scheme with GAN in Federated Learning](https://mlsanity.com/paper/2312.10380/) (2023)
- [Rethinking Byzantine Robustness in Federated Recommendation from Sparse Aggregation Perspective](https://mlsanity.com/paper/2501.03301/) (2025)
- [FedSC: Federated Learning with Semantic-Aware Collaboration](https://mlsanity.com/paper/2506.21012/) (2025)
- [FINEST: Stabilizing Recommendations by Rank-Preserving Fine-Tuning](https://mlsanity.com/paper/2402.03481/) (2024)
- [Personalized Recommendation Models in Federated Settings: A Survey](https://mlsanity.com/paper/2504.07101/) (2025)
- [FedSKC: Federated Learning with Non-IID Data via Structural Knowledge Collaboration](https://mlsanity.com/paper/2505.18981/) (2025)
- [KMF: Knowledge-Aware Multi-Faceted Representation Learning for Zero-Shot Node Classification](https://mlsanity.com/paper/2308.08563/) (2023)
- [How to Defend Against Large-scale Model Poisoning Attacks in Federated Learning: A Vertical Solution](https://mlsanity.com/paper/2411.10673/) (2024)
- [Spattack: Subgroup Poisoning Attacks on Federated Recommender Systems](https://mlsanity.com/paper/2507.06258/) (2025)
- [A Scenario-Oriented Survey of Federated Recommender Systems: Techniques, Challenges, and Future Directions](https://mlsanity.com/paper/2508.19620/) (2025)
- [Empowering Contrastive Federated Sequential Recommendation with LLMs](https://mlsanity.com/paper/2602.09306/) (2026)
- [Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities](https://mlsanity.com/paper/2609.28722/) (2026)

## Abstract (arXiv)

Federated recommendation (FedRec) can train personalized recommenders without collecting user data, but the decentralized nature makes it susceptible to poisoning attacks. Most previous studies focus on the targeted attack to promote certain items, while the untargeted attack that aims to degrade the overall performance of the FedRec system remains less explored. In fact, untargeted attacks can disrupt the user experience and bring severe financial loss to the service provider. However, existing untargeted attack methods are either inapplicable or ineffective against FedRec systems. In this paper, we delve into the untargeted attack and its defense for FedRec systems. (i) We propose ClusterAttack, a novel untargeted attack method. It uploads poisonous gradients that converge the item embeddings into several dense clusters, which make the recommender generate similar scores for these items in the same cluster and perturb the ranking order. (ii) We propose a uniformity-based defense mechanism (UNION) to protect FedRec systems from such attacks. We design a contrastive learning task that regularizes the item embeddings toward a uniform distribution. Then the server filters out these malicious gradients by estimating the uniformity of updated item embeddings. Experiments on two public datasets show that ClusterAttack can effectively degrade the performance of FedRec systems while circumventing many defense methods, and UNION can improve the resistance of the system against various untargeted attacks, including our ClusterAttack.