Title: Poisoning Attacks to Graph-Based Recommender Systems,
Abstract: Recommender system is an important component of many web services to help
users locate items that match their interests. Several studies showed that
recommender systems are vulnerable to poisoning attacks, in which an attacker
injects fake data to a given system such that the system makes recommendations
as the attacker desires. However, these poisoning attacks are either agnostic
to recommendation algorithms or optimized to recommender systems that are not
graph-based. Like association-rule-based and matrix-factorization-based
recommender systems, graph-based recommender system is also deployed in
practice, e.g., eBay, Huawei App Store. However, how to design optimized
poisoning attacks for graph-based recommender systems is still an open problem.
In this work, we perform a systematic study on poisoning attacks to graph-based
recommender systems. Due to limited resources and to avoid detection, we assume
the number of fake users that can be injected into the system is bounded. The
key challenge is how to assign rating scores to the fake users such that the
target item is recommended to as many normal users as possible. To address the
challenge, we formulate the poisoning attacks as an optimization problem,
solving which determines the rating scores for the fake users. We also propose
techniques to solve the optimization problem. We evaluate our attacks and
compare them with existing attacks under white-box (recommendation algorithm
and its parameters are known), gray-box (recommendation algorithm is known but
its parameters are unknown), and black-box (recommendation algorithm is
unknown) settings using two real-world datasets. Our results show that our
attack is effective and outperforms existing attacks for graph-based
recommender systems. For instance, when 1% fake users are injected, our attack
can make a target item recommended to 580 times more normal users in certain
scenarios.