mlsanityData to 7 Oct 2026

PORE: Provably Robust Recommender Systems against Data Poisoning Attacks

arXiv 2303.14601 ↗First posted 26 Mar 2023cs.CR cs.IR cs.LGcited by 9

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Data poisoning attacks spoof a recommender system to make arbitrary, attacker-desired recommendations via injecting fake users with carefully crafted rating scores into the recommender system. We envision a cat-and-mouse game for such data poisoning attacks and their defenses, i.e., new defenses are designed to defend against existing attacks and new attacks are designed to break them. To prevent such a cat-and-mouse game, we propose PORE, the first framework to build provably robust recommender systems in this work. PORE can transform any existing recommender system to be provably robust against any untargeted data poisoning attacks, which aim to reduce the overall performance of a recommender system. Suppose PORE recommends top-N items to a user when there is no attack. We prove that PORE still recommends at least r of the N items to the user under any data poisoning attack, where r is a function of the number of fake users in the attack. Moreover, we design an efficient algorithm to compute r for each user. We empirically evaluate PORE on popular benchmark datasets.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 12 of its 51 references that are in the map. First posted on arXiv 26 Mar 2023.

Builds on

12 of 51 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systems7 Jan

Other references · 11

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,134
  3. 2017Neural Collaborative Filteringcited by 1,108
  4. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  5. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  6. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 61
  7. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  8. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 52
  9. 2020Revisiting Adversarially Learned Injection Attacks Against Recommender Systemscited by 30
  10. 2018Adversarial Training Towards Robust Multimedia Recommender Systemcited by 27
  11. 2020Practical Data Poisoning Attack against Next-Item Recommendationcited by 27

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 5; 2025: 3.

9 papers.

  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  2. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  3. 2024Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasurescited by 14
  4. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  5. 2024Collective Certified Robustness against Graph Injection Attackscited by 3
  6. 2025EmoRAG: Evaluating RAG Robustness to Symbolic Perturbationscited by 3
  7. 2025Efficient and Responsible Adaptation of Large Language Models for Robust and Equitable Top-k Recommendationscited by 2
  8. 2025Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbationscited by 2
  9. 2024Advancements in Recommender Systems: A Comprehensive Analysis Based on Data, Algorithms, and Evaluationcited by 0