mlsanityData to 7 Oct 2026

Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures

arXiv 2404.14942 ↗First posted 23 Apr 2024cs.CR cs.IR cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

Recommender systems have become an integral part of online services to help users locate specific information in a sea of data. However, existing studies show that some recommender systems are vulnerable to poisoning attacks, particularly those that involve learning schemes. A poisoning attack is where an adversary injects carefully crafted data into the process of training a model, with the goal of manipulating the system's final recommendations. Based on recent advancements in artificial intelligence, such attacks have gained importance recently. While numerous countermeasures to poisoning attacks have been developed, they have not yet been systematically linked to the properties of the attacks. Consequently, assessing the respective risks and potential success of mitigation strategies is difficult, if not impossible. This survey aims to fill this gap by primarily focusing on poisoning attacks and their countermeasures. This is in contrast to prior surveys that mainly focus on attacks and their detection methods. Through an exhaustive literature review, we provide a novel taxonomy for poisoning attacks, formalise its dimensions, and accordingly organise 30+ attacks described in the literature. Further, we review 40+ countermeasures to detect and/or prevent poisoning attacks, evaluating their effectiveness against specific types of attacks. This comprehensive survey should serve as a point of reference for protecting recommender systems against poisoning attacks. The article concludes with a discussion on open issues in the field and impactful directions for future research. A rich repository of resources associated with poisoning attacks is available at https://github.com/tamlhp/awesome-recsys-poisoning.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 33 of its 181 references that are in the map. First posted on arXiv 23 Apr 2024.

Builds on

33 of 181 references.

References · 33

  1. 2019A Survey on Bias and Fairness in Machine Learningcited by 1,911
  2. 2017One pixel attack for fooling deep neural networkscited by 579
  3. 2019Reinforcement Learning in Healthcare: A Surveycited by 308
  4. 2020A Survey on Knowledge Graph-Based Recommender Systemscited by 170
  5. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  6. 2020A Survey of Reinforcement Learning Algorithms for Dynamically Varying Environmentscited by 62
  7. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 61
  8. 2020GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detectioncited by 53
  9. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 52
  10. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
  11. 2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotioncited by 37
  12. 2021DA-GCN: A Domain-aware Attentive Graph Convolution Network for Shared-account Cross-domain Sequential Recommendationcited by 34
21 more
  1. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 34
  2. 2021Socially-Aware Self-Supervised Tri-Training for Recommendationcited by 32
  3. 2020Attacking Black-box Recommendations via Copying Cross-domain User Profilescited by 31
  4. 2020Revisiting Adversarially Learned Injection Attacks Against Recommender Systemscited by 30
  5. 2020Practical Data Poisoning Attack against Next-Item Recommendationcited by 27
  6. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 25
  7. 2020Attacking Recommender Systems with Augmented User Profilescited by 24
  8. 2022FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Samplingcited by 21
  9. 2021Generative Adversarial Networks: A Survey Towards Private and Secure Applicationscited by 15
  10. 2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
  11. 2016Hybrid Recommender System based on Autoencoderscited by 14
  12. 2022Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarioscited by 13
  13. 2020Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Startcited by 11
  14. 2019Data Poisoning Attacks on Neighborhood-based Recommender Systemscited by 10
  15. 2021Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attackcited by 10
  16. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 9
  17. 2020Cyberattacks and Countermeasures For In-Vehicle Networkscited by 8
  18. 2022UA-FedRec: Untargeted Attack on Federated News Recommendationcited by 8
  19. 2015Panther: Fast Top-k Similarity Search in Large Networkscited by 4
  20. 2015Re-scale AdaBoost for Attack Detection in Collaborative Filtering Recommender Systemscited by 4
  21. 2021A Survey on Amazon Alexa Attack Surfacescited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 8; 2026: 4.

14 papers.

Sort:

By area:

  1. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  2. 2025HMARK: Radioactive Multi-Bit Semantic-Latent Watermarking for Diffusion Modelscited by 2
  3. 2024Heterogeneous Hypergraph Embedding for Recommendation Systemscited by 1
  4. 2025Handling Heterophily in Recommender Systems with Wavelet Hypergraph Diffusioncited by 1
  5. 2025Robustness in Text-Attributed Graph Learning: Insights, Trade-offs, and New Defensescited by 1
  6. 2026Byzantine Machine Learning: MultiKrum and an optimal notion of robustnesscited by 1
  7. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  8. 2024Towards Reliable Recommender Systems for Rating Datacited by 0
  9. 2025Hypergraph Diffusion for High-Order Recommender Systemscited by 0
  10. 2025Model-Free Counterfactual Subset Selection at Scalecited by 0
  11. 2025Recommendation systems in e-commerce applications with machine learning methodscited by 0
  12. 2025Shilling Recommender Systems by Generating Side-feature-aware Fake User Profilescited by 0
2 more
  1. 2026Empowering Contrastive Federated Sequential Recommendation with LLMscited by 0
  2. 2026FINER-SQL: Boosting Small Language Models for Text-to-SQLcited by 0