# Securing Recommender System via Cooperative Training

arXiv: https://arxiv.org/abs/2401.12700 · HTML: https://mlsanity.com/paper/2401.12700/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 30 of its 59 references that are in the map.
- First posted on arXiv 23 Jan 2024.

## Builds on (most cited first, 30 of 30)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [Neural Collaborative Filtering](https://mlsanity.com/paper/1708.05031/) (2017)
- [DeepFM: A Factorization-Machine based Neural Network for CTR Prediction](https://mlsanity.com/paper/1703.04247/) (2017)
- [Attacks Which Do Not Kill Training Make Adversarial Learning Stronger](https://mlsanity.com/paper/2002.11242/) (2020)
- [Adversarial Training Can Hurt Generalization](https://mlsanity.com/paper/1906.06032/) (2019)
- [Data Poisoning Attacks on Factorization-Based Collaborative Filtering](https://mlsanity.com/paper/1608.08182/) (2016)
- [Influence Function based Data Poisoning Attacks to Top-N Recommender Systems](https://mlsanity.com/paper/2002.08025/) (2020)
- [Triple Generative Adversarial Nets](https://mlsanity.com/paper/1703.02291/) (2017)
- [Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective](https://mlsanity.com/paper/2009.03728/) (2020)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [Adversarial Personalized Ranking for Recommendation](https://mlsanity.com/paper/1808.03908/) (2018)
- [Data Poisoning Attacks to Deep Learning Based Recommender Systems](https://mlsanity.com/paper/2101.02644/) (2021)
- [A Survey on Trustworthy Recommender Systems](https://mlsanity.com/paper/2207.12515/) (2022)
- [Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction](https://mlsanity.com/paper/2109.01165/) (2021)
- [PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion](https://mlsanity.com/paper/2110.10926/) (2021)
- [Revisiting Adversarially Learned Injection Attacks Against Recommender Systems](https://mlsanity.com/paper/2008.04876/) (2020)
- [Attacking Black-box Recommendations via Copying Cross-domain User Profiles](https://mlsanity.com/paper/2005.08147/) (2020)
- [Adversarial Training Towards Robust Multimedia Recommender System](https://mlsanity.com/paper/1809.07062/) (2018)
- [Attacking Recommender Systems with Augmented User Profiles](https://mlsanity.com/paper/2005.08164/) (2020)
- [Adversarial Sampling and Training for Semi-Supervised Information Retrieval](https://mlsanity.com/paper/1811.04155/) (2018)
- [Rank List Sensitivity of Recommender Systems to Interaction Perturbations](https://mlsanity.com/paper/2201.12686/) (2022)
- [Sampling-Decomposable Generative Adversarial Recommender](https://mlsanity.com/paper/2011.00956/) (2020)
- [A Black-Box Attack Model for Visually-Aware Recommender Systems](https://mlsanity.com/paper/2011.02701/) (2020)
- [Blockchain-based Recommender Systems: Applications, Challenges and Future Opportunities](https://mlsanity.com/paper/2111.11509/) (2021)
- [Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders](https://mlsanity.com/paper/2207.11237/) (2022)
- [Data Poisoning Attacks on Neighborhood-based Recommender Systems](https://mlsanity.com/paper/1912.04109/) (2019)
- [RGRecSys: A Toolkit for Robustness Evaluation of Recommender Systems](https://mlsanity.com/paper/2201.04399/) (2022)
- [Re-scale AdaBoost for Attack Detection in Collaborative Filtering Recommender Systems](https://mlsanity.com/paper/1506.04584/) (2015)
- [Towards Robust Recommender Systems via Triple Cooperative Defense](https://mlsanity.com/paper/2210.13762/) (2022)

## Abstract (arXiv)

Recommender systems are often susceptible to well-crafted fake profiles, leading to biased recommendations. Among existing defense methods, data-processing-based methods inevitably exclude normal samples, while model-based methods struggle to enjoy both generalization and robustness. To this end, we suggest integrating data processing and the robust model to propose a general framework, Triple Cooperative Defense (TCD), which employs three cooperative models that mutually enhance data and thereby improve recommendation robustness. Furthermore, Considering that existing attacks struggle to balance bi-level optimization and efficiency, we revisit poisoning attacks in recommender systems and introduce an efficient attack strategy, Co-training Attack (Co-Attack), which cooperatively optimizes the attack optimization and model training, considering the bi-level setting while maintaining attack efficiency. Moreover, we reveal a potential reason for the insufficient threat of existing attacks is their default assumption of optimizing attacks in undefended scenarios. This overly optimistic setting limits the potential of attacks. Consequently, we put forth a Game-based Co-training Attack (GCoAttack), which frames the proposed CoAttack and TCD as a game-theoretic process, thoroughly exploring CoAttack's attack potential in the cooperative training of attack and defense. Extensive experiments on three real datasets demonstrate TCD's superiority in enhancing model robustness. Additionally, we verify that the two proposed attack strategies significantly outperform existing attacks, with game-based GCoAttack posing a greater poisoning threat than CoAttack.