[Paper Review] Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasures

Wei Yuan, Quoc Viet Hung Nguyen+3 more|arXiv (Cornell University)|Apr 6, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper proposes PSMU, a novel gradient poisoning attack that manipulates federated recommender systems by using synthetic malicious users to elevate target items' exposure rates without prior knowledge. It achieves high effectiveness with minimal malicious users and few training epochs, while introducing HiCS—a hierarchical gradient clipping with sparsified updating—as a robust defense that maintains recommendation performance under attack.

ABSTRACT

Federated Recommender Systems (FedRecs) are considered privacy-preserving techniques to collaboratively learn a recommendation model without sharing user data. Since all participants can directly influence the systems by uploading gradients, FedRecs are vulnerable to poisoning attacks of malicious clients. However, most existing poisoning attacks on FedRecs are either based on some prior knowledge or with less effectiveness. To reveal the real vulnerability of FedRecs, in this paper, we present a new poisoning attack method to manipulate target items' ranks and exposure rates effectively in the top-$K$ recommendation without relying on any prior knowledge. Specifically, our attack manipulates target items' exposure rate by a group of synthetic malicious users who upload poisoned gradients considering target items' alternative products. We conduct extensive experiments with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on two real-world recommendation datasets. The experimental results show that our attack can significantly improve the exposure rate of unpopular target items with extremely fewer malicious users and fewer global epochs than state-of-the-art attacks. In addition to disclosing the security hole, we design a novel countermeasure for poisoning attacks on FedRecs. Specifically, we propose a hierarchical gradient clipping with sparsified updating to defend against existing poisoning attacks. The empirical results demonstrate that the proposed defending mechanism improves the robustness of FedRecs.

Motivation & Objective

• To expose the real-world vulnerability of federated recommender systems (FedRecs) to gradient poisoning attacks by eliminating reliance on impractical prior knowledge.
• To design a highly effective poisoning attack that increases exposure rates of unpopular target items with minimal malicious users and training epochs.
• To propose a novel defense mechanism, HiCS, that effectively counters poisoning attacks without degrading recommendation performance.
• To empirically validate the attack's effectiveness and the defense's robustness across two widely used FedRecs and two real-world datasets.

Proposed method

• PSMU constructs synthetic users who randomly select items as interactions and optimize gradients to elevate target item rankings based on similarity to real users' top-K recommendations.
• The attack enhances competition by including alternative items of the target, ensuring the target's predicted score exceeds those in the competition set.
• It leverages popularity bias, where synthetic users' recommendations closely mirror real users', to amplify the attack's impact on actual system behavior.
• The defense, HiCS, employs hierarchical gradient clipping with sparsified updating to filter out malicious gradients while preserving benign model updates.
• Sparsified updating reduces noise and improves defense efficiency by focusing on high-magnitude gradient components.
• HiCS is designed to maintain recommendation performance under attack by minimizing side effects on legitimate training.

Experimental results

Research questions

• RQ1 Can a poisoning attack on FedRecs be effective without requiring prior knowledge of item popularity or user data?
• RQ2 How few malicious users and global training epochs are needed for a successful attack to significantly increase target item exposure rates?
• RQ3 Can a defense mechanism effectively neutralize such attacks while preserving the recommendation system's performance?
• RQ4 How does the proposed defense, HiCS, compare to existing defense baselines under increasing numbers of malicious users?

Key findings

• PSMU achieved a 100% exposure rate (ER@5) for target items with only 3 malicious users on the ML dataset using Fed-NCF, and 2 users on the AZ dataset with Fed-LightGCN.
• The attack remained effective at a malicious user proportion of 0.1%, requiring only 6 and 16 malicious users on the ML and AZ datasets, respectively.
• HiCS successfully defended against PSMU even at a malicious user proportion of 10%, outperforming all baselines including ℓ₂ clipping and trimmed mean.
• While ℓ₂ clipping and sparsified updating improved defense, only HiCS maintained consistent effectiveness across all attack scales and datasets.
• The defense mechanism caused no measurable side effects on recommendation performance, as shown by unchanged performance metrics under normal and attack conditions.
• The attack's success is attributed to popularity bias, where synthetic users' recommendations closely match real users', amplifying the attack's impact on real system behavior.