# Band Together: Untargeted Adversarial Training with Multimodal Coordination against Evasion-based Promotion Attacks

arXiv: https://arxiv.org/abs/2605.06238 · HTML: https://mlsanity.com/paper/2605.06238/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 20 of its 33 references that are in the map.
- First posted on arXiv 7 May 2026.

## Builds on (most cited first, 20 of 20)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Ups and Downs: Modeling the Visual Evolution of Fashion Trends with One-Class Collaborative Filtering](https://mlsanity.com/paper/1602.01585/) (2016)
- [VBPR: Visual Bayesian Personalized Ranking from Implicit Feedback](https://mlsanity.com/paper/1510.01784/) (2015)
- [Mining Latent Structures for Multimedia Recommendation](https://mlsanity.com/paper/2104.09036/) (2021)
- [GRCN: Graph-Refined Convolutional Network for Multimedia Recommendation with Implicit Feedback](https://mlsanity.com/paper/2111.02036/) (2021)
- [Bootstrap Latent Representations for Multi-modal Recommendation](https://mlsanity.com/paper/2207.05969/) (2022)
- [LGMRec: Local and Global Graph Learning for Multimodal Recommendation](https://mlsanity.com/paper/2312.16400/) (2023)
- [Multi-View Graph Convolutional Network for Multimedia Recommendation](https://mlsanity.com/paper/2308.03588/) (2023)
- [Adversarial Training Towards Robust Multimedia Recommender System](https://mlsanity.com/paper/1809.07062/) (2018)
- [AutoDenoise: Automatic Data Instance Denoising for Recommendations](https://mlsanity.com/paper/2303.06611/) (2023)
- [AlignRec: Aligning and Training in Multimodal Recommendations](https://mlsanity.com/paper/2403.12384/) (2024)
- [Stealthy Attack on Large Language Model based Recommendation](https://mlsanity.com/paper/2402.14836/) (2024)
- [A Comprehensive Survey on Multimodal Recommender Systems: Taxonomy, Evaluation, and Future Directions](https://mlsanity.com/paper/2302.04473/) (2023)
- [Enhancing Dyadic Relations with Homogeneous Graphs for Multimodal Recommendation](https://mlsanity.com/paper/2301.12097/) (2023)
- [Spectrum-based Modality Representation Fusion Graph Convolutional Network for Multimodal Recommendation](https://mlsanity.com/paper/2412.14978/) (2024)
- [Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start](https://mlsanity.com/paper/2006.01888/) (2020)
- [Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attacks](https://mlsanity.com/paper/2311.18244/) (2023)
- [Adversarial Item Promotion on Visually-Aware Recommender Systems by Guided Diffusion](https://mlsanity.com/paper/2312.15826/) (2023)
- [Teach Me How to Denoise: A Universal Framework for Denoising Multi-modal Recommender Systems via Guided Calibration](https://mlsanity.com/paper/2504.14214/) (2025)

## Abstract (arXiv)

Multimodal recommender systems exploit visual and textual signals to alleviate data sparsity, but this also makes them more vulnerable to evasion-based promotion attacks. Existing defenses are largely limited to single-modal settings and mainly focus on poisoning-based threats, leaving evasion-based threats underexplored. In this work, we first identify a cross-modal gradient mismatch under the multi-user promotion setting, where visual and textual perturbations are optimized in inconsistent directions due to the dominance of distinct user groups. This phenomenon dilutes the attack effectiveness and leads robust training to underestimate worst-case risks. To address this issue, we propose Untargeted Adversarial Training with Multimodal Coordination (UAT-MC). UAT-MC tackles the challenge of unknown targeted items in evasion-based attacks (as opposed to poisoning-based attacks) by treating all items as potential targets, and introduces a gradient alignment mechanism to explicitly correct this mismatch. This design ensures synchronized perturbations across modalities, thereby maximizing adversarial strength for robust training. Extensive experiments demonstrate that UAT-MC significantly improves robustness against promotion attacks while maintaining acceptable recommendation performance under the defense-accuracy trade-off. Code is available at https://github.com/gmXian/UAT-MC.