# Shilling Black-box Review-based Recommender Systems through Fake Review Generation

arXiv: https://arxiv.org/abs/2306.16526 · HTML: https://mlsanity.com/paper/2306.16526/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 61 references that are in the map.
- First posted on arXiv 27 Jun 2023.

## Builds on (most cited first, 25 of 25)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Universal Adversarial Triggers for Attacking and Analyzing NLP](https://mlsanity.com/paper/1908.07125/) (2019)
- [Self-critical Sequence Training for Image Captioning](https://mlsanity.com/paper/1612.00563/) (2016)
- [TextBugger: Generating Adversarial Text Against Real-world Applications](https://mlsanity.com/paper/1812.05271/) (2018)
- [Joint Deep Modeling of Users and Items Using Reviews for Recommendation](https://mlsanity.com/paper/1701.04783/) (2017)
- [Data Poisoning Attacks on Factorization-Based Collaborative Filtering](https://mlsanity.com/paper/1608.08182/) (2016)
- [Influence Function based Data Poisoning Attacks to Top-N Recommender Systems](https://mlsanity.com/paper/2002.08025/) (2020)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP](https://mlsanity.com/paper/2005.05909/) (2020)
- [Data Poisoning Attacks to Deep Learning Based Recommender Systems](https://mlsanity.com/paper/2101.02644/) (2021)
- [Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction](https://mlsanity.com/paper/2109.01165/) (2021)
- [Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variables](https://mlsanity.com/paper/1905.04016/) (2019)
- [Attacking Recommender Systems with Augmented User Profiles](https://mlsanity.com/paper/2005.08164/) (2020)
- [Knowledge-enhanced Black-box Attacks for Recommendations](https://mlsanity.com/paper/2207.10307/) (2022)
- [Learning Opinion Summarizers by Selecting Informative Reviews](https://mlsanity.com/paper/2109.04325/) (2021)
- [A Review-aware Graph Contrastive Learning Framework for Recommendation](https://mlsanity.com/paper/2204.12063/) (2022)
- [PETGEN: Personalized Text Generation Attack on Deep Sequence Embedding-based Classification Models](https://mlsanity.com/paper/2109.06777/) (2021)
- [ReGen: Reinforcement Learning for Text and Knowledge Base Generation using Pretrained Language Models](https://mlsanity.com/paper/2108.12472/) (2021)
- [Cold-Start Reinforcement Learning with Softmax Policy Gradient](https://mlsanity.com/paper/1709.09346/) (2017)
- [Shilling Black-box Recommender Systems by Learning to Generate Fake User Profiles](https://mlsanity.com/paper/2206.11433/) (2022)
- [Debiasing Learning for Membership Inference Attacks Against Recommender Systems](https://mlsanity.com/paper/2206.12401/) (2022)
- [A Black-Box Attack Model for Visually-Aware Recommender Systems](https://mlsanity.com/paper/2011.02701/) (2020)
- [Asymmetrical Hierarchical Networks with Attentive Interactions for Interpretable Review-Based Recommendation](https://mlsanity.com/paper/2001.04346/) (2019)
- [NRPA: Neural Recommendation with Personalized Attention](https://mlsanity.com/paper/1905.12480/) (2019)
- [Unorganized Malicious Attacks Detection](https://mlsanity.com/paper/1610.04086/) (2016)

## Built on by (most cited first, 8 of 8)

- [ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systems](https://mlsanity.com/paper/2409.11690/) (2024)
- [ToDA: Target-oriented Diffusion Attacker against Recommendation System](https://mlsanity.com/paper/2401.12578/) (2024)
- [Beyond Easy Wins: A Text Hardness-Aware Benchmark for LLM-generated Text Detection](https://mlsanity.com/paper/2507.15286/) (2025)
- [LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems](https://mlsanity.com/paper/2505.13528/) (2025)
- [Retrieval-Augmented Review Generation for Poisoning Recommender Systems](https://mlsanity.com/paper/2508.15252/) (2025)
- [Adversarial Text Rewriting for Text-aware Recommender Systems](https://mlsanity.com/paper/2408.00312/) (2024)
- [Towards Bridging Review Sparsity in Recommendation with Textual Edge Graph Representation](https://mlsanity.com/paper/2508.01128/) (2025)
- [ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Model](https://mlsanity.com/paper/2507.15067/) (2025)

## Abstract (arXiv)

Review-Based Recommender Systems (RBRS) have attracted increasing research interest due to their ability to alleviate well-known cold-start problems. RBRS utilizes reviews to construct the user and items representations. However, in this paper, we argue that such a reliance on reviews may instead expose systems to the risk of being shilled. To explore this possibility, in this paper, we propose the first generation-based model for shilling attacks against RBRSs. Specifically, we learn a fake review generator through reinforcement learning, which maliciously promotes items by forcing prediction shifts after adding generated reviews to the system. By introducing the auxiliary rewards to increase text fluency and diversity with the aid of pre-trained language models and aspect predictors, the generated reviews can be effective for shilling with high fidelity. Experimental results demonstrate that the proposed framework can successfully attack three different kinds of RBRSs on the Amazon corpus with three domains and Yelp corpus. Furthermore, human studies also show that the generated reviews are fluent and informative. Finally, equipped with Attack Review Generators (ARGs), RBRSs with adversarial training are much more robust to malicious reviews.