Practical cross-system attack method with restricted data access

Abstract

Data access limited practical cross-system attack method belongs to the research of recommendation system robustness. By using the cross-system idea, a practical cross-system attack framework is designed to capture the recommendation knowledge from the source data, migrate and apply it to the recommended model data, and alleviate the data sparsity and incompleteness problem existing in the recommendation system attack. The graph encoder is trained to capture the structure pattern of the source data, and a part of the public target data is transmitted into the graph encoder to fine-tune the simulated attack successful representation. Based on the simulated representation, the common interaction projects that affect the probability of the target project being recommended to ordinary users are searched and filled into the false user profile. The false user profile is injected into the victim recommendation system to start the attack. After pre-training the graph encoder that can learn the internal and transferable structure representation on the public complete source data, the false user profile is constructed and injected into the recommendation model to pollute the target data, achieving the purpose of modifying the recommendation result.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of recommendation system robustness research, and particularly relates to a practical cross-system attack method with limited data access. BACKGROUND

[0002] As a technology means of actively providing personalized information filtering for users, the recommendation system is widely used in various online service platforms and creates huge commercial value. In e-commerce websites, a high-quality recommendation system can create a win-win situation among users, merchants and platforms.

[0003] Since the recommendation system can affect the user's consumption decision, some merchants will try to attack the recommendation system and manipulate the recommendation results, resulting in a serious security threat to the recommendation system. Studies have shown that the recommendation system is very vulnerable under the attack of the attack, and companies such as Sony, Amazon and eBay have suffered attacks. This is because the data in the recommendation scenario is open, that is, anyone can influence the data of the recommendation system by registering users and generating behaviors in the system, which makes malicious merchants manipulate and abuse the recommendation system by faking users and their behaviors, affecting the fairness and effectiveness of the recommendation system.

[0004] The existence of the attack interferes with the healthy ecological environment of the recommendation system, and more and more researchers have begun to realize the importance of the security problem of the recommendation system, but most of the research is still committed to detection technology, and the attack means has not been thoroughly discussed. In order to develop more effective defense technology, it is necessary to deeply study the attack technology to know the enemy and know oneself, and further understand the attack to inspire the development of more effective attack defense technology. The two research branches of attack and detection seem to be opposite to each other, but the ultimate goal is to build a safer and healthier recommendation system environment.

[0005] Early heuristic strategy-based attack methods are based on the statistical information of user feedback data for attacks, such as random attack, average attack and popular attack, etc. The recent attack methods mostly adopt the idea of adversarial attack, which can be mainly divided into the following four categories:

[0006] (1) Optimization-based method, which studies how to model the attack as an optimization task and solve it using optimization strategies. Li et al. assumed that the victim recommendation system adopts matrix factorization (MF), and they proposed a method PGA and SGLD to add the attack target directly to the matrix factorization target. Zhang et al. proposed RAPU and Tang et al. proposed RevAdv to model the attack as a double-layer optimization problem.

[0007] (2) Generative Adversarial Network (GAN) based methods, which use GAN to construct fake user profiles, the generator models the data distribution of real users and generates similar data, and the discriminator is responsible for identifying fake users generated along this direction, a large number of algorithms have emerged, such as DCGAN, Leg-UP, AUSH, RecUP and TrialAttack, etc.

[0008] (3) Reinforcement Learning based methods, which query the recommendation system for feedback during the attack and adjust the attack using reinforcement learning, representative works include PoisonRec, LOKI and CopyAttack, etc.

[0009] (4) Knowledge Distillation based methods, which focus on narrowing the gap between the proxy recommendation model and the victim recommendation model, in the absence of prior knowledge, the proxy model is used to simulate the victim recommendation model, and the model extraction attack method belongs to this category.

[0010] Although existing works have invested a lot of effort in developing new ToR attack methods, they are still far from being practical, existing ToR attack algorithms usually require full access to training data to infer item features and make fake interactions for fake user profiles, however, due to the limited data collection ability of attackers and the limited access to training data, this attack method may not be feasible in practice, and sometimes it will be interfered by the service provider's privacy protection mechanism, the gap between this design and reality may lead to attack failure. Some works use incomplete data for attack or migrate knowledge from other fields to attack target recommendation systems, but they still need a large amount of target data or assume that the data of the source field and the target field share some items.

[0011] A practical ToR attack method should have the following good properties:

[0012] Property 1: No need for any prior knowledge of the victim recommendation system (e.g., model architecture or parameters in the model).

[0013] Property 2: When training the attack model, other data sources (e.g., public recommendation system datasets) can be used, while it is not assumed that the other data sources used contain any users or items present in the victim recommendation system.

[0014] Property 3: The attacker should use as little data information in the victim recommendation system as possible during the attack, and the information needed should be easily accessible in the real world. SUMMARY

[0015] The present application aims to design a practical poisoning attack method for the limitations of existing methods, which can guarantee attack effect and attack undetectability even when data is sparse and incomplete. The strategy of poisoning attack is to forge a set of user profiles and inject them into user feedback data in the form of ordinary users to modify the recommended model parameters as needed. The attack target is to promote the target item to as many ordinary users as possible, specifically, to make the proportion of ordinary users containing the target item in the Top-K recommendation list as high as possible.

[0016] Limiting access to the data of the target recommendation system does not mean that attackers cannot use other public recommendation system data to train attack models, so the present application proposes a new concept of cross-system attack: due to the vigorous development of recommendation system research, there are many publicly available recommendation system data sets in the real world that can be directly used, and these public data sets can be used to extract knowledge and train attack models.

[0017] In this direction, the present application proposes a practical cross-system poisoning attack (PC-Attack) framework that only needs very little information about the victim's recommendation system model and data to achieve performance comparable to the most advanced attack methods.

[0018] The present application includes the following steps:

[0019] Step 1: Construct a user-item bipartite graph on the source data, where each user-item edge represents the existence of a corresponding user-item interaction;

[0020] Step 2: Train a graph structure encoder (GS-Encoder) to capture the structural patterns of the source data in a self-supervised manner;

[0021] Step 3: Input a small amount of publicly available data of the target recommendation system (i.e., target data, such as a popular item and some people who bought it) into the GS-Encoder and fine-tune it to obtain a simulated representation after a successful attack;

[0022] Step 4: Based on the simulated representation, search for common interaction items that affect the probability of the target item being recommended to ordinary users and fill them into the fake user profiles, which are injected into the victim's recommendation system to launch the attack;

[0023] PC-Attack does not assume the existence of corresponding entities across different domains / systems (i.e., users or items exist in both source and target data), even if they do exist. In addition, the PC-Attack model does not require additional prior knowledge or rely on any auxiliary features, only user-item IDs and a structure graph built on interaction data, and the feature vectors of users and items are completely obtained by model training, in other words, the PC-Attack model only captures the structural patterns of the source data without knowing the true identity of each node.

[0024] The advantages of the present application are as follows:

[0025] 1. Analyze the shortcomings of existing attack methods, and propose the concept of cross-system attack for designing a practical attack model.

[0026] 2. Design a practical attack method PC-Attack. PC-Attack captures graph topology knowledge from public recommendation system data in a self-supervised manner, and then fine-tunes on a small amount of target data available in practice to build fake user profiles for attack. PC-Attack has the three excellent properties that a practical attack method should have as discussed above.

[0027] 3. Experiments show that PC-Attack outperforms the most advanced attack methods in both attack ability and attack stealth, even in unfair comparisons where other attack methods have access to complete target data, PC-Attack with limited access to target data still performs outstandingly. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 is the basic flowchart of the present application. From left to right are pre-training, fine-tuning and building fake user profiles. DETAILED DESCRIPTION

[0029] The following examples will further illustrate the present application in conjunction with the accompanying drawings.

[0030] The existing work of cross-domain and cross-system recommendation verifies that the knowledge learned from the source domain or system can help improve the recommendation results of the target domain or system, that is, the knowledge of recommendation is transferable. Therefore, the present application uses the idea of cross-system to design a practical cross-system attack (PC-Attack) framework, which captures recommendation knowledge from source data, migrates and applies it to the data of the victim recommendation model, thereby alleviating the problem of data sparsity and incompleteness in recommendation system attacks.

[0031] The present application first trains a graph encoder in a self-supervised manner to capture the structural patterns in the source data, then passes a small amount of disclosed target data into the graph encoder and fine-tunes the simulated attack successful representation, and finally searches for common interaction items that affect the probability of the target item being recommended to ordinary users based on the simulated representation and fills them into the fake user profile, which is injected into the victim recommendation system to start the attack.

[0032] In order to better capture the structural patterns in the data, the present application uses multi-view learning to model the graph encoder. By sampling paths through random walks, individual nodes in the user-item bipartite graph are expanded into their local structures as subgraph views, while sequence views are constructed to capture structural patterns in the 1-hop and 2-hop neighborhoods of nodes, the former mixes the two data patterns together for learning, and the latter separates and learns the two data patterns separately.

[0033] After pre-training the graph encoder that can learn intrinsic and transferable structural representations on the complete source data, some fake user profiles are constructed and injected into the victim recommendation model to pollute the target data, in order to modify the recommendation results.

[0034] 1. Related terms and attack settings

[0035] The strategy of the To attack is to forge a group of user profiles and inject them into the user feedback data in the form of ordinary users. In order to better introduce the cross-system To attack framework, the following briefly introduces the related terms and concepts commonly used in To attacks.

[0036] Source data: public recommendation system data, used for pre-training process

[0037] Target data: data of the victim recommendation system, used for fine-tuning process

[0038] User profile: the interaction record of a user with all items in the system, which can be represented as a rating vector or an interaction vector with a length of the number of items.

[0039] Real user: a normal and legitimate user in the system, the real user is represented by its corresponding profile, and this part of data is the original sample that is not attacked.

[0040] Fake user: a profile forged by the attacker, the fake user data will be injected into the real user to attack the target recommendation system / victim recommendation system: the recommendation system that the attacker is preparing to attack.

[0041] Literatures classify trojan attacks according to attack intention and attack knowledge. Attack intention refers to the effect that the attacker expects to produce in the target recommendation system. From the dimension of attack intention specificity, trojan attacks can be divided into targeted trojan attacks and non-targeted trojan attacks.

[0042] Non-targeted trojan attacks aim to reduce the overall performance of the recommendation system. Such attacks do not target specific users or items, but indiscriminately induce the recommendation system to output inaccurate recommendation results for all users and items. For example, a company may want to reduce the accuracy and credibility of a competitor's recommendation system to attract more users to itself.

[0043] Targeted trojan attacks aim to induce the recommendation system to produce false recommendation results on target items. They are mainly divided into push attacks and kernel attacks. Push attacks refer to the attacker intentionally increasing the probability of the target item being recommended. For example, a malicious merchant attacks the recommendation system to make its own products more recommended. On the contrary, under kernel attacks, the attacker wants to reduce the probability of the target item being recommended, which is common in the scenario of malicious merchants wanting to suppress competitors.

[0044] Attack knowledge refers to the background knowledge that the attacker has about the target recommendation system. The amount of information that the attacker possesses is a key factor that affects the attack effect, mainly including training data and model knowledge. The training data of the recommendation system is the user-item interaction data, also known as user feedback data. According to the amount of information, user feedback data is divided into complete user feedback data and limited user feedback data. The background knowledge about the target recommendation model includes the specific structure of the model, the algorithm, and the trained parameters, etc. Trojan attacks can be divided into white-box attacks and black-box attacks according to the degree of knowledge that the attacker possesses. White-box attacks, also known as complete knowledge attacks or high-knowledge attacks, refer to the attacker completely mastering the background knowledge of the target recommendation system, including complete data sets and model structure, parameters, etc. Black-box attacks, also known as limited knowledge attacks or low-knowledge attacks, refer to the attacker only obtaining part of the background knowledge.

[0045] Trojan attack capability refers to the attacker's manipulation ability of user feedback data. Manipulation ability can be defined from two aspects: manipulation stage and manipulation degree. Attacks on traditional machine learning models can occur in the training phase or the testing phase of the model. Since attacking the recommendation system in the testing phase requires invading the real user's account and changing their preferences, it is difficult to implement, so trojan attacks occur in the training phase. The degree of the attacker's manipulation of data, also known as attack budget, is related to the attack scale. Attack scale refers to the number of injected fake user profiles. The larger the attack scale, the higher the efficiency and cost of the attack.

[0046] The following introduces the setting of the attack framework in the above three dimensions:

[0047] In the setting of attack intention, push attack in targeted attack is a common setting in related research. Since the core idea of push attack and nuclear attack is similar, the skill and model design can be converted to each other. In order to avoid redundancy of writing, this paper mainly studies push attack.

[0048] In the setting of attack knowledge, the hypothesis of black box attack more in line with the actual is adopted, that is, the attacker does not have any prior knowledge about the target model, and the access to the target data is limited.

[0049] In the setting of attack ability, since in the real attack scene, the attacker needs to inject the generated user profile into the recommendation system, this step needs to pay a high cost, especially on the e-commerce platform, because the false rating can be successfully injected only by real purchase. Therefore, a practical attack model must constrain the attack budget to improve the input-output ratio.

[0050] 2. Model framework

[0051] The existing work of cross-domain and cross-system recommendation has verified that the knowledge learned from the source domain / system can help to improve the recommendation results in the target domain / system, that is, the recommendation system knowledge is transferable. Design an attack model to capture the recommendation knowledge from the source data, migrate and apply it to the data of the victim recommendation model, so as to alleviate the problem of data sparsity and incompleteness existing in the recommendation system attack.

[0052] As shown in Figure 1 The implementation of the present application comprises the following steps:

[0053] (1) A user-item bipartite graph is constructed on the source data, wherein each user-item edge represents the existence of corresponding user-item interaction.

[0054] (2) A graph structure encoder (GS-Encoder) is trained to capture the structural patterns of the source data in a self-supervised manner.

[0055] (3) A small part of the publicly available data of the target recommendation system (i.e. target data, for example, a popular item and some people who buy it) is input into the GS-Encoder, and fine-tuning is performed to obtain a simulated representation after successful attack.

[0056] (4) Based on the simulated representation, search for common interaction items that affect the probability of the target item being recommended to ordinary users and fill them into the fake user profile, which is injected into the victim recommendation system to start the attack.

[0057] PC-Attack does not assume the existence of corresponding entities across different domains / systems (i.e., users or items exist in both source and target data), even if they do exist. In addition, the PC-Attack model does not require additional prior knowledge or rely on any auxiliary features, but only requires user-item IDs and a structure graph built on interaction data, and the feature vectors of users and items are completely obtained by model training. In other words, the PC-Attack model only captures the structural patterns of the source data without knowing the true identity of each node. Such an approach saves the step of feature engineering, and this pre-training method has been applied in the fields of CV and NLP and has achieved very significant results, but has not been popularized in the field of recommendation systems. In order to endow the PC-Attack model with attack ability, when constructing the fake user profile in step 4, the idea that items that may affect whether the target item is recommended are likely to have been interacted with the target item by some users is adopted. This idea is called co-visitation attack and has been verified in existing attack methods.

[0058] 3. Learning graph topology from source data

[0059] Without knowing the explicit entity correspondence between the source data and the target data, the historical records in the source data cannot be directly used to encode users and items into vector representations that can be used to attack the target data. However, previous studies have shown that the topology of user-item bipartite graphs from different recommendation system data has some common properties, and a user-item bipartite graph can be constructed on the source data and a graph structure encoder (GS-Encoder) can be trained to capture the graph topology properties shared between different recommendation system domains / systems.

[0060] Graph Neural Network (GNN) is a commonly used neural network for modeling graph structure data, so GNN is used as the backbone of GS-Encoder to capture the intrinsic and transferable properties from the interaction data in the bipartite graph. However, most of the feedback provided by users is implicit (e.g., clicks and views) rather than explicit (e.g., ratings). Therefore, the observed interactions often contain noise that may not indicate the true user preference, and the neighborhood aggregation scheme in GNN amplifies the impact of interactions on representation learning, making learning more susceptible to interaction noise.

[0061] To alleviate the negative impact of noise, a contrastive learning, a kind of self-supervised learning (SSL), is introduced in the GS-Encoder. SSL constructs supervision information according to the correlation of input data, avoiding the need for implicit labels. By contrasting samples, the GS-Encoder learns to keep similar sample pairs close and different sample pairs far apart. When designing the self-supervised contrastive learning task, the idea of multi-view learning is adopted to model the node neighborhood as subgraphs and sequences, which helps the GS-Encoder better capture the topological properties.

[0062] 3.1 Multi-view data augmentation

[0063] To model the node neighborhood, first, the paths are sampled by random walk, which expands a single node j in the user-item bipartite graph into its local structure as a subgraph-view g j . Using random walk with a restart process, the random walk starts from node j of the bipartite graph and randomly walks to the neighbor node with probability a or returns to node j with probability 1. Note that the subgraph-view is reconstructed at each training epoch.

[0064] For each node, its 1-hop neighborhood describes the user-item interaction pattern, and its 2-hop neighborhood describes the co-interaction pattern (i.e., users interacting with the same item or items interacting with the same user), which are two important structural patterns in the To attack, so a sequence-view is constructed to better capture the two types of patterns. Centered at node j, the IDs of its 1-hop nodes and 2-hop nodes are sequentially sorted to construct the sequence-view s j of j.

[0065] The difference between the sequence-view and the subgraph-view is that the sequence-view directly separates the two data patterns, while the subgraph-view mixes the two patterns together. Using the sequence-view emphasizes learning the two patterns separately, while using the subgraph-view learns them as a whole.

[0066] 3.2 Multi-view contrastive learning

[0067] Contrastive learning aims to maximize the similarity between positive samples while minimizing the similarity between negative samples, and a suitable contrastive task helps better capture the topological properties from the source data. Unlike most contrastive learning methods that only focus on contrasting positive and negative samples in one view, a multi-view contrast mechanism is deployed when designing the GS-Encoder, so that the GS-Encoder can benefit from more supervision signals.

[0068] The subgraph view of each node is passed to the GNN encoder in the GS-Encoder, in the present invention GIN is used as the GNN encoder, other GNNs can also be used. The GNN encoder updates the node representation as follows:

[0069]

[0070] where is the representation vector of node v at the b-th layer of the GNN encoder, N(v) is the set of 1-hop nodes of node v, and MLP(·) represents a multi-layer perceptron. The eigenvector of the normalized graph Laplacian of the subgraph is used to initialize h (0) For node j, its representation from the subgraph view is is the concatenation of the aggregation of its neighborhood representation generated in all GNN layers:

[0071]

[0072] where Concat(·) represents the concatenation operation, and the Readout(·) function aggregates the node representations of the subgraph of node j in each iteration, represents the number of layers of the graph encoder.

[0073] The sequence view of each node j is passed to the LSTM, using the last hidden state as the representation of the sequence view. h g and h s are further fed into a fully connected feedforward neural network to map them to the same latent space:

[0074]

[0075]

[0076] where W1, W2, b1, b2 are all learnable weights, and σ(·) represents the sigmoid activation function.

[0077] In contrast learning, positive and negative samples need to be defined, for each node j, its positive sample pos j and negative sample neg j are defined as the subgraph view and its corresponding sequence view obtained by random walk starting from node j, and the subgraph view and its corresponding sequence view obtained by random walk starting from other nodes. In order to improve efficiency and avoid processing too many negative subgraphs / sequences, the subgraph / sequence views of other nodes in the same batch are used as negative samples.

[0078] The contrastive loss under the subgraph view is:

[0079]

[0080] where sim(·) denotes the cosine similarity and τ denotes the temperature parameter.

[0081] The contrastive loss under the sequence view is defined similarly:

[0082]

[0083] The overall multi-view contrastive objective function for the GS-Encoder is as follows:

[0084]

[0085] where λ g and λ s are hyperparameters that balance the two views, I denotes the item set, and n denotes the number of items.

[0086] 4. Learning fake user profiles from the future

[0087] After pre-training the GS-Encoder, the next step is to construct some fake user profiles and inject them into the victim recommendation system to pollute the training data. The construction method of fake users is based on three design principles in the literature:

[0088] Principle 1: Item-based recommendation systems aim to recommend items similar to those the target user has been interested in the past.

[0089] Principle 2: User-based recommendation systems aim to recommend items that similar users to the target user have been interested in.

[0090] Principle 3: According to the idea of the common access attack, the common interaction items of the target item (i.e., the 2-hop neighbor nodes of the target item in the bipartite graph) can influence whether the target item is recommended.

[0091] Based on the above principles, the goal of the present invention is:

[0092] Goal 1: Based on Principle 1, the goal of the present invention is to influence the victim recommendation system so that the representation of the target item is as similar as possible to the representations of other items, so that the likelihood of the target item being recommended increases. The attack is expected to achieve the following goal: for any item i, sim(q i ,q t ) > sim(q i ,q j ), where t is the target item, j denotes any other item, sim(·) denotes the similarity measure between items (e.g., cosine similarity), and q i is the vector representation of item i in the victim recommendation system.

[0093] Target 2: Based on Principle 2, the goal of the invention is to influence the victim recommendation system such that the representation of the user interacting with the target item is as similar as possible to the representation of other users, so that the likelihood of the target item being recommended increases. It is desired that for any user u, sim(p u ,p r ) > sim(p u ,p e ), where r e N(t) represents the users interacting with the target item t, any other user, p u is the vector representation of user u in the victim recommendation system.

[0094] Target 3: Based on Principle 3, the goal of the invention is to find possible co-interaction items of the target item after a successful attack and populate them into the fake user profile.

[0095] However, the above goals are challenging without knowing the details of the victim recommendation system and the target data, i.e., q and p in the victim recommendation system are unknown. The GS-Encoder captures transferable knowledge from the source data with more information, which can help to accomplish this task:

[0096] Step 1: Use the pre-trained GS-Encoder to generate node representations based on the graph topology information of the incomplete target data

[0097] Step 2: Fine-tune and obtain the simulated representation after a successful attack (Target 1 and Target 2);

[0098] Step 3: Based on the simulated post-attack representation, search for possible co-interaction items of the target item and make fake user profiles (Target 3).

[0099] Considering that the complete target data cannot be accessed, a small amount of publicly accessible target data is collected. An example is the popular items in the victim recommendation system, some ordinary users who buy these items, and the 2-hop neighbor items of the popular items. Such information is usually available, for example, Amazon provides "Popular Items This Season" on its homepage, Newsegg provides "Popular Products" on its homepage, and by clicking on the popular items, the information of the buyers can be found, and the homepage of the buyer may provide information about some of the items he / she has previously purchased.

[0100] Based on the above considerations, starting from a popular item, collect users / items in its 2-hop graph through restart-free random walk, while limiting the total number of sampled nodes to less than p percent of the target data to maintain a low level of knowledge. In addition to the collected subgraph of popular items, a user set M(t) containing users who have interacted with the target item t is also collected. Based on the available data collected from the target data, a small subgraph centered on the popular item is constructed and input into the pre-trained GS-Encoder to generate the initial representation of users / items in the subgraph:

[0101]

[0102] where η g and η s are hyperparameters that balance the two views, h j is the fused representation of node j, and are the subgraph view representation and sequence view representation of node j generated by the pre-trained GS-Encoder, respectively.

[0103] For the majority of users and items not collected in the target data, assume the number of users (m) and the number of items (n) in the victim recommendation system are known, and initialize their representations from a normal distribution N(0, 0.1). This is a reasonable assumption because many recommendation system websites reveal the exact number or order of magnitude of users / items. Users and items not in the collected small subgraph make it possible to generate fake user profiles that include items not in the collected subgraph.

[0104] Continue to fine-tune the collected data as described above, and the goal of target 1 is to simulate the performance after a successful attack:

[0105]

[0106] where represents the vector representation of item i.

[0107] Similarly, for target 2, fine-tune the following target to simulate the performance after a successful attack:

[0108]

[0109] where represents the vector representation of user u.

[0110] The overall objective function is as follows:

[0111] L fine-tune = μ item · L item + μ user · Luser ,

[0112] where μ_item and μ user is a hyper-parameter balancing the influence of both losses.

[0113] After fine-tuning, the new representations of users and items are obtained, which simulate the representations of users and items in the victim recommendation system after a successful attack. Then, the possible co-interaction items of the target item are searched based on the simulated representations. Similar to other poisoning attack methods, the fake user profiles in PC-Attack contain three parts: selected items, padded items and target items. The potential interest of all users to the target item t after the attack is estimated by the inner product of the representations, and z users are sampled according to the probability:

[0114]

[0115] The common items existing in these z user profiles are selected as selected items. Since popular items are always more accessible than other items and appear in the profiles of many ordinary users, y popular items are randomly sampled from the collected subgraph as padded items to enhance the invisibility of PC-Attack. For each fake user profile, the above production process is carried out independently.

[0116] The characteristics of the present application compared with existing poisoning attack methods are shown in Table 1.

[0117] Table 1

[0118]

[0119] The performance of the present application compared with other advanced algorithms is shown in Table 2.

[0120] Table 2

[0121]

[0122] As can be seen from Tables 1 and 2, none of the existing methods fully contains the three properties mentioned above. In other words, there is still no truly practical shilling attack method, especially, no method with property 2 and capable of achieving cross-system attacks has been found. Property 2 is partially shown in CopyAttack, but CopyAttack assumes that the source data and the target data share some items, and it can only achieve cross-domain attacks. Model extraction attack considers a data-free setting and uses limited queries to narrow the gap between the proxy recommendation system and the victim recommendation system, but its idea is only applicable to sequential recommendation systems, and the number of queries required is difficult to define in advance. The method PC-Attack of the present application has all three properties that a practical shilling attack method should have, and it can achieve cross-system attacks, which is a difficult but practical shilling attack setting.

Claims

1. A method for a practical cross-system attack on data access-restricted systems, characterized by A cross-system attack framework PC-Attack is constructed, PC-Attack does not assume that there is a corresponding entity across different domains / systems, even if there is; PC-Attack model does not require additional prior knowledge, nor does it rely on any auxiliary features, only user item ID and the structure graph constructed on the interaction data, the feature vectors of users and items are completely obtained by model training, and the PC-Attack model only captures the structural patterns of the source data; the method comprises the following steps: Step 1: Construct a user-item bipartite graph on the source data, where each user-item edge represents the existence of corresponding user-item interaction; Step 2: Train a graph structure encoder GS-Encoder to capture the structural patterns of the source data in a self-supervised manner; The subgraph view of each node is passed to the GNN encoder in the GS-Encoder, and GIN is used as the GNN encoder, or other GNNs are used, and the GNN encoder updates the node representation as follows: where, is the representation vector of node v at the b-th layer of the GNN encoder, N(v) is the set of 1 -hop nodes of node v, MLP(·) denotes a multi-layer perceptron; h (0) For node j, from the subgraph view, its representation is the concatenation of the aggregations of its neighborhood representations generated in all GNN layers: where Concat(·) denotes a concatenation operation, the Readout(·) function aggregates the node representations of the subgraph of node j in each iteration, denotes the number of layers of the graph encoder; The sequence view of each node j is passed to an LSTM, using the last hidden state as representation of the sequence view, h g and h s are further fed to a fully connected feed forward neural network to map them to the same latent space: Where W1, W2, b1, b2 are learnable weights, and sigma(·) represents the sigmoid activation function; In contrastive learning, positive and negative samples need to be defined, for each node j, its positive samples pos j and negative samples neg j are defined as the subgraph views and their corresponding sequence views obtained by random walk starting from node j and the subgraph views and their corresponding sequence views obtained by random walk starting from other nodes, in order to improve efficiency and avoid processing too many negative subgraphs / sequences, the subgraph / sequence views of other nodes in the same batch are used as negative samples; The contrastive loss under the subgraph view is: Where sim(·) represents the cosine similarity, and tau represents the temperature parameter; The contrastive loss under the sequence view is defined similarly: The overall multi-view contrastive objective function of the GS-Encoder is as follows: where λ g and λ s are hyperparameters balancing the two views, I denotes the item set, and n denotes the number of items; Step 3: Input a small amount of publicly available data of the target recommendation system into the GS-Encoder and fine-tune to obtain simulated representations after successful attacks; Step 4: Based on the simulated representations, search for common interaction items that affect the probability of the target item being recommended to ordinary users and fill them into the fake user profile, and the fake user profile is injected into the victim recommendation system to start the attack; according to the idea of common access attack, the common interaction items of the target item, i.e. the 2-hop neighbor nodes of the target item in the bipartite graph, can affect whether the target item is recommended or not; According to the above considerations, start from a popular item, collect users / items in its 2-hop subgraph through random walk without restart, and limit the total number of sampled nodes to less than p percent of the target data to maintain a low level of knowledge; in addition to the subgraph of the collected popular item, a user set M(t) containing users who have interacted with the target item t is also collected; based on the available data collected from the target data, a small subgraph centered on the popular item is constructed and input into the pre-trained GS-Encoder to generate the initial representations of the users / items in the subgraph: where η g and η s are hyperparameters balancing the two views, h j is the fused representation of node j, and are the subgraph view representation and the sequential view representation of node j generated by the pre-trained GS-Encoder, respectively. Continue to fine-tune the above collected data, and the goal of target 1 is to simulate the performance after a successful attack: wherein, represents the vector representation of item i; Similarly, for target 2, fine-tune the following targets to simulate the performance after a successful attack: wherein, represents a vector representation of a user u; The overall objective function is shown as follows: L fine-tune = μ item · L item + μ user · L user , where μ item and μ user are hyperparameters balancing the influence of both losses.

Images