[Paper Review] Adversarial Machine Learning in Recommender Systems: State of the art and Challenges.

Yashar Deldjoo, Tommaso Di Noia+1 more|arXiv (Cornell University)|May 20, 2020

Adversarial Robustness in Machine Learning4 citations

TL;DR

This survey reviews adversarial machine learning (AML) in recommender systems (RS), analyzing attacks and defenses on latent-factor models (LFM) like matrix factorization. It highlights AML's dual role: compromising RS robustness via adversarial examples and enhancing model precision through generative adversarial networks (GANs), based on a review of 60 key studies.

ABSTRACT

Latent-factor models (LFM) based on collaborative filtering (CF), such as matrix factorization (MF) and deep CF methods, are widely used in modern recommender systems (RS) due to their excellent performance and recommendation accuracy. Notwithstanding their great success, in recent years, it has been shown that these methods are vulnerable to adversarial examples, i.e., subtle but non-random perturbations designed to force recommendation models to produce erroneous outputs. The main reason for this behavior is that user interaction data used for training of LFM can be contaminated by malicious activities or users' misoperation that can induce an unpredictable amount of natural noise and harm recommendation outcomes. On the other side, it has been shown that these systems, conceived originally to attack machine learning applications, can be successfully adopted to strengthen their robustness against attacks as well as to train more precise recommendation engines. In this respect, the goal of this survey is two-fold: (i) to present recent advances on AML-RS for the security of RS (i.e., attacking and defense recommendation models), (ii) to show another successful application of AML in generative adversarial networks (GANs), which use the core concept of learning in AML (i.e., the min-max game) for generative applications. In this survey, we provide an exhaustive literature review of 60 articles published in major RS and ML journals and conferences. This review serves as a reference for the RS community, working on the security of RS and recommendation models leveraging generative models to improve their quality.

Motivation & Objective

• To analyze recent advances in adversarial machine learning for securing recommender systems (RS) against targeted attacks.
• To investigate how adversarial examples—subtle, non-random perturbations—can degrade recommendation accuracy in latent-factor models (LFM).
• To explore the use of adversarial training techniques to improve the robustness of recommendation models.
• To examine the application of generative adversarial networks (GANs) in RS, leveraging the min-max game framework of AML for improved recommendation quality.
• To provide a comprehensive literature review of 60 studies from top RS and machine learning venues as a reference for researchers in RS security and generative modeling.

Proposed method

• Systematically reviewed 60 peer-reviewed articles from major RS and machine learning conferences and journals (e.g., KDD, SIGIR, NeurIPS, ACM TOIS).
• Classified and analyzed adversarial attacks on latent-factor models (LFM), including matrix factorization (MF) and deep collaborative filtering (CF) methods.
• Examined defense mechanisms that use adversarial training to improve model robustness against perturbations in user-item interaction data.
• Explored the application of generative adversarial networks (GANs) in RS, using the min-max game framework of AML to generate high-quality recommendations.
• Categorized attacks based on their objectives (e.g., poisoning, evasion) and defense strategies based on adversarial example detection and robust optimization.
• Evaluated the role of data contamination from malicious users or misoperations in introducing noise that undermines LFM performance.

Experimental results

Research questions

• RQ1 How do adversarial examples compromise the performance of latent-factor models (LFM) in recommender systems?
• RQ2 What are the primary sources of vulnerability in collaborative filtering-based RS, particularly in the presence of noisy or malicious user interactions?
• RQ3 To what extent can adversarial training improve the robustness of recommendation models against targeted attacks?
• RQ4 How can generative adversarial networks (GANs) be leveraged to enhance recommendation quality using adversarial learning principles?
• RQ5 What are the key challenges and open research directions in applying adversarial machine learning to secure and improve recommender systems?

Key findings

• Latent-factor models (LFM), including matrix factorization and deep CF methods, are vulnerable to adversarial examples due to contamination of user interaction data by malicious actors or operational noise.
• Adversarial attacks on RS can be categorized into poisoning and evasion attacks, both of which exploit model sensitivity to subtle input perturbations.
• Adversarial training techniques significantly improve model robustness by simulating attack scenarios during model optimization.
• Generative adversarial networks (GANs) successfully apply the min-max game framework of adversarial machine learning to generate high-quality recommendations.
• The integration of adversarial learning in RS not only strengthens security but also enhances recommendation accuracy through improved representation learning.
• A comprehensive literature review of 60 studies confirms the growing interest in AML for RS, with increasing focus on both security hardening and generative model enhancement.