# Evaluating the Robustness of Conversational Recommender Systems by Adversarial Examples

arXiv: https://arxiv.org/abs/2303.05575 · HTML: https://mlsanity.com/paper/2303.05575/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 26 of its 40 references that are in the map.
- First posted on arXiv 9 Mar 2023.

## Builds on (most cited first, 26 of 26)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial Examples for Evaluating Reading Comprehension Systems](https://mlsanity.com/paper/1707.07328/) (2017)
- [Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers](https://mlsanity.com/paper/1801.04354/) (2018)
- [Understanding Neural Networks through Representation Erasure](https://mlsanity.com/paper/1612.08220/) (2016)
- [Generating Natural Adversarial Examples](https://mlsanity.com/paper/1710.11342/) (2017)
- [Towards Deep Conversational Recommendations](https://mlsanity.com/paper/1812.07617/) (2018)
- [Improving Conversational Recommender Systems via Knowledge Graph based Semantic Fusion](https://mlsanity.com/paper/2007.04032/) (2020)
- [Conversational Recommender System](https://mlsanity.com/paper/1806.03277/) (2018)
- [Towards Knowledge-Based Recommender Dialog System](https://mlsanity.com/paper/1908.05391/) (2019)
- [Deep Text Classification Can be Fooled](https://mlsanity.com/paper/1704.08006/) (2017)
- [Crafting Adversarial Input Sequences for Recurrent Neural Networks](https://mlsanity.com/paper/1604.08275/) (2016)
- [Estimation-Action-Reflection: Towards Deep Interaction Between Conversational and Recommender Systems](https://mlsanity.com/paper/2002.09102/) (2020)
- [Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples](https://mlsanity.com/paper/1803.01128/) (2018)
- [Towards Topic-Guided Conversational Recommender System](https://mlsanity.com/paper/2010.04125/) (2020)
- [Towards Crafting Text Adversarial Samples](https://mlsanity.com/paper/1707.02812/) (2017)
- [Greedy Attack and Gumbel Attack: Generating Adversarial Examples for Discrete Data](https://mlsanity.com/paper/1805.12316/) (2018)
- [CRSLab: An Open-Source Toolkit for Building Conversational Recommender System](https://mlsanity.com/paper/2101.00939/) (2021)
- [CR-Walker: Tree-Structured Graph Reasoning and Dialog Acts for Conversational Recommendation](https://mlsanity.com/paper/2010.10333/) (2020)
- [Towards Question-based Recommender Systems](https://mlsanity.com/paper/2005.14255/) (2020)
- [Response Ranking with Deep Matching Networks and External Knowledge in Information-seeking Conversation Systems](https://mlsanity.com/paper/1805.00188/) (2018)
- [Deep Conversational Recommender in Travel](https://mlsanity.com/paper/1907.00710/) (2019)
- [Adversarial Attacks and Detection on Reinforcement Learning-Based Interactive Recommender Systems](https://mlsanity.com/paper/2006.07934/) (2020)
- [Distributed-Representation Based Hybrid Recommender System with Short Item Descriptions](https://mlsanity.com/paper/1703.04854/) (2017)
- [Neural Matching Models for Question Retrieval and Next Question Prediction in Conversation](https://mlsanity.com/paper/1707.05409/) (2017)

## Abstract (arXiv)

Conversational recommender systems (CRSs) are improving rapidly, according to the standard recommendation accuracy metrics. However, it is essential to make sure that these systems are robust in interacting with users including regular and malicious users who want to attack the system by feeding the system modified input data. In this paper, we propose an adversarial evaluation scheme including four scenarios in two categories and automatically generate adversarial examples to evaluate the robustness of these systems in the face of different input data. By executing these adversarial examples we can compare the ability of different conversational recommender systems to satisfy the user's preferences. We evaluate three CRSs by the proposed adversarial examples on two datasets. Our results show that none of these systems are robust and reliable to the adversarial examples.