[Paper Review] Manipulating Visually-aware Federated Recommender Systems and Its Countermeasures

Wei Yuan, Shilong Yuan+3 more|arXiv (Cornell University)|May 14, 2023

Mental Health via WritingPsychology3 citations

TL;DR

This paper proposes PSMU(V), a novel image poisoning attack that manipulates visually-aware federated recommender systems by subtly altering uploaded images to promote target items, and introduces a diffusion model-based defense (GDMPD) that purifies and detects adversarial images. The defense achieves 100% detection accuracy with no false positives, effectively neutralizing both image and model poisoning attacks.

ABSTRACT

Federated recommender systems (FedRecs) have been widely explored recently due to their ability to protect user data privacy. In FedRecs, a central server collaboratively learns recommendation models by sharing model public parameters with clients, thereby offering a privacy-preserving solution. Unfortunately, the exposure of model parameters leaves a backdoor for adversaries to manipulate FedRecs. Existing works about FedRec security already reveal that items can easily be promoted by malicious users via model poisoning attacks, but all of them mainly focus on FedRecs with only collaborative information (i.e., user-item interactions). We argue that these attacks are effective because of the data sparsity of collaborative signals. In practice, auxiliary information, such as products' visual descriptions, is used to alleviate collaborative filtering data's sparsity. Therefore, when incorporating visual information in FedRecs, all existing model poisoning attacks' effectiveness becomes questionable. In this paper, we conduct extensive experiments to verify that incorporating visual information can beat existing state-of-the-art attacks in reasonable settings. However, since visual information is usually provided by external sources, simply including it will create new security problems. Specifically, we propose a new kind of poisoning attack for visually-aware FedRecs, namely image poisoning attacks, where adversaries can gradually modify the uploaded image to manipulate item ranks during FedRecs' training process. Furthermore, we reveal that the potential collaboration between image poisoning attacks and model poisoning attacks will make visually-aware FedRecs more vulnerable to being manipulated. To safely use visual information, we employ a diffusion model in visually-aware FedRecs to purify each uploaded image and detect the adversarial images.

Motivation & Objective

• To investigate whether incorporating visual information in federated recommender systems (FedRecs) can mitigate existing model poisoning attacks that exploit data sparsity.
• To identify new security vulnerabilities introduced by external visual data in FedRecs, particularly through image poisoning attacks.
• To design a robust, training-free defense mechanism that can purify and detect adversarial images in visually-aware FedRecs.
• To evaluate the synergy between image poisoning and model poisoning attacks, demonstrating increased threat surface in multimodal FedRecs.
• To validate the effectiveness and generalization of the proposed attack and defense framework on real-world datasets and multiple FedRec architectures.

Proposed method

• Proposes PSMU(V), a new image poisoning attack that gradually modifies uploaded images to manipulate item rankings during federated training.
• Employs a denoising diffusion probabilistic model (DDPM) as the core purification mechanism to restore adversarial images to their original form.
• Introduces a guidance mechanism in the diffusion model to improve fidelity and consistency between original and purified images.
• Develops a training-free detection method based on cosine similarity between original and purified images, using a threshold ρ derived from normal image similarity scores.
• Uses Brisque and blur score standard deviations to evaluate image quality deviation and validate attack stealthiness.
• Employs a joint attack framework combining PSMU(V) with existing model poisoning attacks (e.g., PSMU++) to amplify manipulation effectiveness.

Experimental results

Research questions

• RQ1 Can incorporating visual information in FedRecs effectively neutralize existing model poisoning attacks that rely on collaborative data sparsity?
• RQ2 What new attack surface is introduced by using external visual data in visually-aware FedRecs?
• RQ3 How effective is a diffusion model-based purification mechanism in detecting and removing adversarial images in FedRecs?
• RQ4 Can image poisoning attacks be combined with model poisoning attacks to create a more powerful and stealthy threat?
• RQ5 What is the robustness of the proposed defense mechanism under varying perturbation scales (ε) and real-world data distributions?

Key findings

• Existing model poisoning attacks, such as PSMU++, fail to promote target items in visually-aware FedRecs due to the mitigating effect of visual signals on data sparsity.
• The proposed PSMU(V) image poisoning attack successfully manipulates item rankings with 100% effectiveness (ER@5 = 1.0) across both ML and AZ datasets, even under high perturbation scales (ε = 32).
• The GDMPD defense mechanism reduces ER@5 to 0.0 when applied, demonstrating complete mitigation of the attack across all ε values tested.
• The detection mechanism achieves 72% accuracy using ρ = ρ₀ (minimum similarity score from normal images), with no false positives on normal images.
• The best possible detection threshold ρ₁ = 0.69 achieves 100% accuracy, confirming the feasibility of the approach with optimal parameter tuning.
• Visualization shows that the diffusion model effectively removes high-scale noise (ε = 16, 32), and the guided version improves image fidelity compared to non-guided purification.