mlsanityData to 14 Oct 2026

Shilling Black-box Review-based Recommender Systems through Fake Review Generation

arXiv 2306.16526 ↗First posted 27 Jun 2023cs.IR cs.LG cs.SIcited by 8

Not on the map. Why?

Abstract (arXiv)

Review-Based Recommender Systems (RBRS) have attracted increasing research interest due to their ability to alleviate well-known cold-start problems. RBRS utilizes reviews to construct the user and items representations. However, in this paper, we argue that such a reliance on reviews may instead expose systems to the risk of being shilled. To explore this possibility, in this paper, we propose the first generation-based model for shilling attacks against RBRSs. Specifically, we learn a fake review generator through reinforcement learning, which maliciously promotes items by forcing prediction shifts after adding generated reviews to the system. By introducing the auxiliary rewards to increase text fluency and diversity with the aid of pre-trained language models and aspect predictors, the generated reviews can be effective for shilling with high fidelity. Experimental results demonstrate that the proposed framework can successfully attack three different kinds of RBRSs on the Amazon corpus with three domains and Yelp corpus. Furthermore, human studies also show that the generated reviews are fluent and informative. Finally, equipped with Attack Review Generators (ARGs), RBRSs with adversarial training are much more robust to malicious reviews.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 25 of its 61 references that are in the map. First posted on arXiv 27 Jun 2023.

Builds on

25 of 61 references.

References · 25

  1. 2017Attention Is All You Needcited by 60,361
  2. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  3. 2016Self-critical Sequence Training for Image Captioningcited by 547
  4. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  5. 2017Joint Deep Modeling of Users and Items Using Reviews for Recommendationcited by 84
  6. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 83
  7. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 63
  8. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 56
  9. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45
  10. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 43
  11. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 37
  12. 2019Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variablescited by 26
13 more
  1. 2020Attacking Recommender Systems with Augmented User Profilescited by 26
  2. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 26
  3. 2021Learning Opinion Summarizers by Selecting Informative Reviewscited by 25
  4. 2022A Review-aware Graph Contrastive Learning Framework for Recommendationcited by 18
  5. 2021PETGEN: Personalized Text Generation Attack on Deep Sequence Embedding-based Classification Modelscited by 17
  6. 2021ReGen: Reinforcement Learning for Text and Knowledge Base Generation using Pretrained Language Modelscited by 16
  7. 2017Cold-Start Reinforcement Learning with Softmax Policy Gradientcited by 15
  8. 2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
  9. 2022Debiasing Learning for Membership Inference Attacks Against Recommender Systemscited by 12
  10. 2020A Black-Box Attack Model for Visually-Aware Recommender Systemscited by 11
  11. 2019Asymmetrical Hierarchical Networks with Attentive Interactions for Interpretable Review-Based Recommendationcited by 9
  12. 2019NRPA: Neural Recommendation with Personalized Attentioncited by 7
  13. 2016Unorganized Malicious Attacks Detectioncited by 3

Built on by

Cited by year

Citing papers per year: 2024: 3; 2025: 5.

8 papers.

  1. 2024ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systemscited by 10
  2. 2024ToDA: Target-oriented Diffusion Attacker against Recommendation Systemcited by 4
  3. 2025Beyond Easy Wins: A Text Hardness-Aware Benchmark for LLM-generated Text Detectioncited by 4
  4. 2025LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systemscited by 3
  5. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systemscited by 3
  6. 2024Adversarial Text Rewriting for Text-aware Recommender Systemscited by 1
  7. 2025Towards Bridging Review Sparsity in Recommendation with Textual Edge Graph Representationcited by 1
  8. 2025ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Modelcited by 0