# Spattack: Subgroup Poisoning Attacks on Federated Recommender Systems

arXiv: https://arxiv.org/abs/2507.06258 · HTML: https://mlsanity.com/paper/2507.06258/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 24 of its 53 references that are in the map.
- First posted on arXiv 7 Jul 2025.

## Builds on (most cited first, 24 of 24)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [LightGCN: Simplifying and Powering Graph Convolution Network for Recommendation](https://mlsanity.com/paper/2002.02126/) (2020)
- [Neural Collaborative Filtering](https://mlsanity.com/paper/1708.05031/) (2017)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Neural Graph Collaborative Filtering](https://mlsanity.com/paper/1905.08108/) (2019)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [VBPR: Visual Bayesian Personalized Ranking from Implicit Feedback](https://mlsanity.com/paper/1510.01784/) (2015)
- [Secure Federated Matrix Factorization](https://mlsanity.com/paper/1906.05108/) (2019)
- [Data Poisoning Attacks on Factorization-Based Collaborative Filtering](https://mlsanity.com/paper/1608.08182/) (2016)
- [Influence Function based Data Poisoning Attacks to Top-N Recommender Systems](https://mlsanity.com/paper/2002.08025/) (2020)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [Federated Social Recommendation with Graph Neural Network](https://mlsanity.com/paper/2111.10778/) (2021)
- [PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion](https://mlsanity.com/paper/2110.10926/) (2021)
- [Neural Interactive Collaborative Filtering](https://mlsanity.com/paper/2007.02095/) (2020)
- [FedRecAttack: Model Poisoning Attack to Federated Recommendation](https://mlsanity.com/paper/2204.01499/) (2022)
- [Federated Heterogeneous Graph Neural Network for Privacy-preserving Recommendation](https://mlsanity.com/paper/2310.11730/) (2023)
- [Untargeted Attack against Federated Recommendation Systems via Poisonous Item Embeddings and the Defense](https://mlsanity.com/paper/2212.05399/) (2022)
- [Poisoning Federated Recommender Systems with Fake Users](https://mlsanity.com/paper/2402.11637/) (2024)
- [Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios](https://mlsanity.com/paper/2204.13594/) (2022)
- [Federated Graph Condensation with Information Bottleneck Principles](https://mlsanity.com/paper/2405.03911/) (2024)
- [On the Consistency of Average Embeddings for Item Recommendation](https://mlsanity.com/paper/2308.12767/) (2023)
- [Rethinking Byzantine Robustness in Federated Recommendation from Sparse Aggregation Perspective](https://mlsanity.com/paper/2501.03301/) (2025)
- [Preventing the Popular Item Embedding Based Attack in Federated Recommendations](https://mlsanity.com/paper/2502.12958/) (2025)

## Abstract (arXiv)

Federated recommender systems (FedRec) have emerged as a promising approach to provide personalized recommendations while protecting user privacy. However, recent studies have shown their vulnerability to poisoning attacks, where malicious clients inject crafted gradients to promote target items to benign users. Existing attacks typically target the full user group, which compromises stealth and increases detection risk. In contrast, real-world adversaries may prefer to target specific user subgroups, such as promoting health supplements to older individuals, to maximize effectiveness while preserving stealth. Motivated by this gap, we introduce Spattack, the first poisoning attack designed to manipulate recommendations for specific user subgroups in federated settings. Spattack adopts an approximate-and-promote paradigm, which approximates user embeddings of target and non-target subgroups and then promotes target items to the target subgroup. We further reveal a trade-off between strong attack performance on the target subgroup and limited impact on the non-target subgroup. To achieve a better trade-off, we propose enhanced approximation and promotion strategies. For approximation, we push embeddings of different subgroups apart via contrastive learning and augment the target subgroup's relevant item set through clustering. For promotion, we align embeddings of target items and relevant items to strengthen their semantic connections, together with an adaptive weighting strategy to balance effects across subgroups. Experiments on three real-world datasets demonstrate that Spattack achieves strong attack performance on the target subgroup with minimal impact on non-target users, even when only 0.1% of users are malicious. Moreover, Spattack maintains competitive recommendation performance and shows strong resilience against mainstream defenses.