mlsanityData to 7 Oct 2026

Rethinking Byzantine Robustness in Federated Recommendation from Sparse Aggregation Perspective

arXiv 2501.03301 ↗First posted 6 Jan 2025cs.CR cs.AI cs.DCcited by 4

Not on the map. Why?

Abstract (arXiv)

To preserve user privacy in recommender systems, federated recommendation (FR) based on federated learning (FL) emerges, keeping the personal data on the local client and updating a model collaboratively. Unlike FL, FR has a unique sparse aggregation mechanism, where the embedding of each item is updated by only partial clients, instead of full clients in a dense aggregation of general FL. Recently, as an essential principle of FL, model security has received increasing attention, especially for Byzantine attacks, where malicious clients can send arbitrary updates. The problem of exploring the Byzantine robustness of FR is particularly critical since in the domains applying FR, e.g., e-commerce, malicious clients can be injected easily by registering new accounts. However, existing Byzantine works neglect the unique sparse aggregation of FR, making them unsuitable for our problem. Thus, we make the first effort to investigate Byzantine attacks on FR from the perspective of sparse aggregation, which is non-trivial: it is not clear how to define Byzantine robustness under sparse aggregations and design Byzantine attacks under limited knowledge/capability. In this paper, we reformulate the Byzantine robustness under sparse aggregation by defining the aggregation for a single item as the smallest execution unit. Then we propose a family of effective attack strategies, named Spattack, which exploit the vulnerability in sparse aggregation and are categorized along the adversary's knowledge and capability. Extensive experimental results demonstrate that Spattack can effectively prevent convergence and even break down defenses under a few malicious clients, raising alarms for securing FR systems.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 33 of its 45 references that are in the map. First posted on arXiv 6 Jan 2025.

Builds on

33 of 45 references.

References · 33

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2018Graph Convolutional Neural Networks for Web-Scale Recommender Systemscited by 1,133
  3. 2017Neural Collaborative Filteringcited by 1,108
  4. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  5. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  6. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  7. 2019Robust Aggregation for Federated Learningcited by 314
  8. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  9. 2019Can You Really Backdoor Federated Learning?cited by 250
  10. 2018DKN: Deep Knowledge-Aware Network for News Recommendationcited by 137
  11. 2019Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulationcited by 136
  12. 2019Secure Federated Matrix Factorizationcited by 102
21 more
  1. 2021FedGNN: Federated Graph Neural Network for Privacy-Preserving Recommendationcited by 97
  2. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
  3. 2019Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attackscited by 79
  4. 2019NPA: Neural News Recommendation with Personalized Attentioncited by 73
  5. 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradientcited by 69
  6. 2024Number it: Temporal Grounding Videos like Flipping Mangacited by 65
  7. 2019Attack-Resistant Federated Learning with Residual-based Reweightingcited by 40
  8. 2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotioncited by 37
  9. 2019Deep Social Collaborative Filteringcited by 32
  10. 2021Byzantine-robust Federated Learning through Collaborative Malicious Gradient Filteringcited by 28
  11. 2022LightFR: Lightweight Federated Recommendation with Privacy-preserving Matrix Factorizationcited by 26
  12. 2022A Survey on Federated Recommendation Systemscited by 25
  13. 2022Personalized Federated Recommendation via Joint Representation Learning, User Clustering, and Model Adaptationcited by 24
  14. 2022FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Samplingcited by 21
  15. 2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 18
  16. 2023Federated Heterogeneous Graph Neural Network for Privacy-preserving Recommendationcited by 18
  17. 2022Untargeted Attack against Federated Recommendation Systems via Poisonous Item Embeddings and the Defensecited by 16
  18. 2024Endowing Pre-trained Graph Models with Provable Fairnesscited by 10
  19. 2020Robust Federated Recommendation Systemcited by 8
  20. 2024Federated Graph Condensation with Information Bottleneck Principlescited by 8
  21. 2020Shared MF: A privacy-preserving recommendation systemcited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 3.

4 papers.

  1. 2026Toward Graph-Tokenizing Large Language Models with Reconstructive Graph Instruction Tuningcited by 7
  2. 2026Bridging Semantic Understanding and Popularity Bias with LLMscited by 1
  3. 2025Spattack: Subgroup Poisoning Attacks on Federated Recommender Systemscited by 0
  4. 2026Enhanced Byzantine-Robust Federated Learning Via Truncated-Quadratic Loss for Heterogeneous Datacited by 0