[Paper Review] Data Poisoning Attacks on Factorization-Based Collaborative Filtering

Bo Li, Yining Wang+2 more|arXiv (Cornell University)|Aug 29, 2016

Adversarial Robustness in Machine Learning7 references154 citations

TL;DR

The paper presents data poisoning attacks against factorization-based collaborative filtering, deriving near-optimal malicious data for two algorithms (alternating minimization and nuclear norm minimization) and ways to mimic normal user behavior to avoid detection.

ABSTRACT

Recommendation and collaborative filtering systems are important in modern information and e-commerce applications. As these systems are becoming increasingly popular in the industry, their outputs could affect business decision making, introducing incentives for an adversarial party to compromise the availability or integrity of such systems. We introduce a data poisoning attack on collaborative filtering systems. We demonstrate how a powerful attacker with full knowledge of the learner can generate malicious data so as to maximize his/her malicious objectives, while at the same time mimicking normal user behavior to avoid being detected. While the complete knowledge assumption seems extreme, it enables a robust assessment of the vulnerability of collaborative filtering schemes to highly motivated attacks. We present efficient solutions for two popular factorization-based collaborative filtering algorithms: the \emph{alternative minimization} formulation and the \emph{nuclear norm minimization} method. Finally, we test the effectiveness of our proposed algorithms on real-world data and discuss potential defensive strategies.

Motivation & Objective

• Motivate the study of data poisoning in collaborative filtering due to its impact on availability and integrity of recommendations.
• Develop near-optimal attack strategies under a worst-case knowledge assumption (Kerckhoffs’ principle).
• Provide gradient-based and probabilistic methods to generate poisoned data for two popular CF algorithms.
• Demonstrate attacks on real data and discuss potential defensive strategies.

Proposed method

• Formulate poisoning as an optimization where malicious data are chosen to maximize attacker utility under a feasible set of malicious profiles.
• Derive gradient computations for the attacker with respect to malicious data using first-order KKT conditions for alternating minimization and nuclear norm minimization.
• Propose a projected gradient ascent method and an SGLD-based approach to generate malicious profiles that mimic normal users.
• Provide a mitigation-oriented discussion on detecting deviations in feature correlations and using ensemble methods.

Experimental results

Research questions

• RQ1 How can an attacker optimally inject data to degrade the performance of factorization-based collaborative filtering under realistic constraints?
• RQ2 Can attackers maximize availability, integrity, or a combination of both while staying under detection by mimicking normal user behavior?
• RQ3 What gradient-based strategies enable efficient computation of near-optimal poisoning for alternating minimization and nuclear norm approaches?
• RQ4 How effective are detection-avoidance strategies like SGLD in producing realistic malicious profiles?

Key findings

• Optimal attack strategies can be computed for availability and integrity utilities under unified optimization frameworks.
• Gradient-based methods using KKT conditions enable approximately computing the derivative of the attacker’s objective with respect to poisoned data for both alternating minimization and nuclear norm formulations.
• Attacks can significantly degrade RMSE and alter item ratings, with targeted integrity attacks more effective at manipulating specific items.
• Mimicking normal user behavior via SGLD yields high detection-evading poisoned profiles with competitive attack performance compared to random-attacks.
• PGA yields stronger RMSE impact but less plausible attacker profiles, while SGLD offers detection-avoidance advantages.