A robust cross-domain recommendation model against adversarial attacks and a training method

Abstract

The application discloses a kind of cross-domain recommendation model and training method of confrontation robust, it is related to computer information recommendation technical field, including domain confrontation network component, cross-domain confrontation sample generation network and recommender component;The domain confrontation network component includes user embedding component, domain invariant preference encoder and domain discriminator;The cross-domain confrontation sample generation network includes cross-domain confrontation sample generator and cross-domain confrontation sample discriminator;The recommender component includes target domain recommender and auxiliary domain recommender.The application is by transferring the confrontation robustness of auxiliary domain to target domain, to enhance the confrontation robustness of sparse recommendation domain;The application establishes a cross-domain confrontation sample generation network to capture the cross-domain confrontation sample distribution with attackability and imperceptibility, while under the help of user domain invariant representation distribution containing shared and non-shared user data and the constraint of cross-domain confrontation sample discriminator, support cross-domain distribution confrontation training.

Description

Technical Field

[0001] This invention relates to the field of computer information recommendation technology, and in particular to a robust cross-domain recommendation model and method. Background Technology

[0002] Deep learning-based recommender systems are widely used in online service platforms. However, these systems are vulnerable to adversarial attacks when faced with adversarial examples, leading to a decline in recommendation performance. An adversarial example is a carefully designed input data set that adds small but intentional perturbations to the original input sample. This vulnerability of recommender systems can expose individuals and businesses to risks and losses. Therefore, improving the adversarial robustness of recommender systems—that is, their ability to defend against adversarial examples—has attracted widespread attention from researchers. Adversarial training is a mainstream method for enhancing the adversarial robustness of recommender systems. It dynamically generates adversarial examples and feeds them into the training process, allowing the recommender system to acquire adversarial robustness in the process.

[0003] Training an adversarially robust model typically requires a large amount of data. However, in recommender systems, due to the sparsity of interaction data, adversarial training methods may not effectively improve the system's adversarial robustness. Cross-domain recommendation is an effective way to address the data sparsity problem in recommender systems. The general idea behind cross-domain recommendation is to leverage data from an auxiliary domain to enhance the recommendation performance of the target domain. However, we observe that while general cross-domain recommendation methods transfer recommendation information, they neglect the transfer of adversarial robustness information. To address this issue, some methods introduce an auxiliary domain to assist the target domain in constructing adversarial examples, i.e., perturbing shared user embeddings to obtain adversarial examples. However, the large amount of non-shared user data more commonly found in cross-domain scenarios is not utilized. Therefore, when the target domain is very sparse, with very few shared users, such methods may fail. On the other hand, intuitively, when improving the model's adversarial robustness against adversarial attacks, more aggressive adversarial examples can provide the model with more challenging targets, enabling it to learn stronger defenses. Therefore, using highly aggressive adversarial examples for adversarial training can lead to stronger adversarial robustness in the model. However, existing adversarial training methods typically employ pointwise perturbation to generate adversarial examples. Pointwise perturbation involves adding perturbations to each sample individually to obtain adversarial examples. However, not all samples in the dataset are equally sensitive to such perturbations, resulting in uneven quality of the obtained adversarial examples and thus suboptimal adversarial robustness for the model.

[0004] However, in cross-domain scenarios, achieving adversarial robustness in cross-domain recommender systems presents the following challenges: First, how to simultaneously utilize shared and non-shared user data from different domains: Since the data distributions of the two domains are different, it is difficult to directly utilize data from the auxiliary domain to help the target domain improve adversarial robustness; Second, how to jointly perturb all samples: Since the norm constraint of pointwise perturbation is not applicable to distribution-level perturbation, it cannot be ensured that adversarial samples can acquire sufficient offensiveness to improve adversarial robustness. Summary of the Invention

[0005] The purpose of this invention is to provide an adversarially robust cross-domain recommendation model and method, which aims to address the technical problem of enhancing the adversarial robustness of sparse recommendation domains during cross-domain distributed adversarial training.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] An adversarially robust cross-domain recommendation model includes a domain adversarial network component, a cross-domain adversarial sample generation network, and a recommender component;

[0008] The domain adversarial network components include a user embedding component, a domain-invariant preference encoder, and a domain discriminator;

[0009] The user embedding component transforms user ID features into low-dimensional dense embedding vectors.

[0010] The domain-invariant preference encoder encodes the user embedding vector into a domain-invariant preference;

[0011] The domain discriminator assists the domain-invariant preference encoder to perform domain adversarial operations against the domain-invariant preference encoder in order to capture the domain-invariant preference.

[0012] The cross-domain adversarial sample generation network includes a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator;

[0013] The cross-domain adversarial sample generator transforms user domain-invariant preferences into cross-domain adversarial samples to support cross-domain distributed adversarial training.

[0014] The cross-domain adversarial sample discriminator assists the cross-domain adversarial sample generator, enabling it to generate adversarial samples against the cross-domain adversarial sample generator, thereby capturing cross-domain adversarial samples that are imperceptible and supporting cross-domain distributed adversarial training.

[0015] The recommender component includes a target domain recommender and an auxiliary domain recommender;

[0016] The target domain recommender and the auxiliary domain recommender are used for adversarial training against a cross-domain adversarial sample generator in order to transfer the adversarial robustness of the auxiliary domain to the target domain.

[0017] A method for training an adversarially robust cross-domain recommendation model includes the following steps:

[0018] S1: Obtain user IDs, item IDs, and interaction records from two different domains to form a cross-domain dataset including the auxiliary domain and the target domain;

[0019] S2: Divide the cross-domain dataset into training and test sets;

[0020] S3: By looking up a table, the user ID and item ID are obtained through the queryable embedding matrix to obtain the low-dimensional embeddings of the user and item;

[0021] S4: The user's low-dimensional embedding is processed by the domain-invariant preference encoder, and under the action of the domain discriminator, the domain-invariant preference is obtained; the domain-invariant preference and the low-dimensional embedding of the item are concatenated and sent to the recommender component to obtain the recommendation score, so that the domain-invariant preference encoder can capture recommendation information;

[0022] S5: Domain-invariant preferences generate imperceptible cross-domain adversarial samples through a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator; these cross-domain adversarial samples are then fed into the recommender component to obtain adversarial recommendation scores, thereby increasing the aggressiveness of the cross-domain adversarial samples.

[0023] S6: Cross-domain distributed adversarial training feeds cross-domain adversarial samples into the thruster component, enabling the cross-domain adversarial sample generator and the thruster component to perform adversarial training in order to transfer the adversarial robustness of the auxiliary domain to the target domain.

[0024] S7: A joint training method is used to train on the training set to obtain a cross-domain recommendation model with adversarial robustness;

[0025] S8: Inputting test set data into the trained cross-domain recommendation model and performing adversarial robustness evaluation can ensure that the cross-domain recommendation model can still recommend the correct items to the user when it suffers adversarial attacks.

[0026] Preferably, step S2 includes the following steps:

[0027] First, duplicate interaction records and user IDs with fewer than 5 interaction records and their corresponding interaction records are removed;

[0028] Second, the dataset is divided into training and test sets based on 70% and 30% of the number of interaction records for each user ID, respectively.

[0029] Preferably, in S3, the table lookup method is as follows:

[0030] User low-dimensional embedding e u By querying a learnable embedding matrix To obtain, i.e., eu =W u x u ; Low-dimensional embedding of items v By querying a learnable embedding matrix To obtain, that is, e v =W v x v ;

[0031] Among them, one-hot encoding is used x u ∈{0,1} m and x v ∈{0,1} n Each represents a user Let u be the set of users u and v be the set of items v. This refers to the size of the embedded space.

[0032] Preferably, in S4, obtaining the domain-invariant preference includes the following steps:

[0033] S41, User-embedded Generating domain-invariant preferences using a domain-invariant preference encoder in, θ I For the domain-invariant preference encoder G I The learnable parameters are s, where s is the auxiliary domain and t is the target domain; Size of the field-invariant preference space

[0034] S42. By introducing a domain discriminator that takes domain-invariant preferences as input, the domain invariance of the preferences is ensured, and the domain adversarial loss function is defined as follows:

[0035]

[0036] Where, θ φ Domain discriminator D φ Learnable parameters, It is based on domain-invariant preferences obtained from user embeddings in the auxiliary domain. It is based on domain-invariant preferences obtained from user embeddings of the target domain, making As a label, conversely, Let p be the mean and p be the probability distribution. For user embedding in auxiliary domains, Embedded for users in the target domain;

[0037] S43. To enable the domain-invariant preference encoder to learn a preference that is difficult to discern with the help of the domain discriminator, the optimization objective is defined as the following mini-game:

[0038]

[0039] in, For domain adversarial loss function;

[0040] S44, through auxiliary losses To maintain a user's preferences in two domains invariantly close within the same embedding space, the auxiliary loss... for:

[0041]

[0042] in, It is based on domain-invariant preferences obtained from user embeddings in the auxiliary domain. It is based on domain-invariant preferences obtained from user embeddings of the target domain; For the user set of the auxiliary domain, For the set of users in the target domain;

[0043] S45. Recommendation loss that combines an auxiliary domain with domain-invariant preferences as input. Recommendation loss for the target domain The optimization process is guided by the goal of ensuring that the domain-invariant preference encoder can capture recommendation information. The optimization objective of the domain adversarial network is:

[0044]

[0045] in, For domain adversarial network loss, i.e.

[0046] Preferably, in S5, the step of generating offensive and imperceptible cross-domain adversarial examples is as follows:

[0047] S51. Using the domain-invariant preference distribution as input to the cross-domain adversarial example generator, generate cross-domain adversarial examples.

[0048]

[0049] Where, θ A It is G A Learnable parameters, G A θ is a cross-domain adversarial sample generator. A Learnable parameters for cross-domain adversarial example generators;

[0050] S52. To ensure the imperceptibility of cross-domain adversarial sample distribution, a concept θ is introduced. ψ Cross-domain adversarial sample discriminator D with parameters ψ With domain-invariant preferences and cross-domain adversarial examples as input, the loss of the cross-domain adversarial example generation network is:

[0051]

[0052] If cross-domain adversarial sample discriminant D ψ The input is domain-invariant preferences. Then set on the contrary,

[0053] S53. The adversarial loss of the recommender, which uses cross-domain adversarial examples as input, guides the optimization of the cross-domain adversarial example generation network to ensure that the cross-domain adversarial examples are aggressive. The following maximum and minimum optimization objectives are set for the cross-domain adversarial example generation network:

[0054]

[0055] Where λ is a hyperparameter that controls the degree of contribution of cross-domain distributed adversarial training. To improve the loss of cross-domain adversarial sample generation networks, For the adversarial losses of the auxiliary domain, The adversarial loss in the target domain.

[0056] Preferably, in S6, the process of cross-domain distributed adversarial training is as follows:

[0057] S61. Predict the interaction probability of the attacked target domain recommender using the following formula.

[0058]

[0059] in, For a certain attacked user The probability of interacting with a certain item v. For embedding items in the target domain, Rec (t) For the target domain recommender, This is a cross-domain adversarial example for the target domain. Embed for items in the target domain. These are the learnable parameters for the target domain recommender;

[0060] S62. Guide the recommender parameter updates using the following objective function:

[0061]

[0062] in, For the adversarial training dataset, where v + and v - These are the positive and negative item samples corresponding to the attacked user, respectively. For the users who have been attacked;

[0063] S63. To enhance the adversarial robustness of sparse target domains through cross-domain distributed adversarial training, the target domain recommender Rec... (t) The optimization objective is defined as the following max-min game:

[0064]

[0065] In this process, by updating the parameter θ A Maximize loss To destroy Rec (t) Performance; at the same time, through updates Minimize loss This makes the recommender Rec in the target domain... (t) It can defend against attacks.

[0066] Preferably, in S7, by combining domain adversarial network loss Loss of cross-domain adversarial example generation networks Recommendation loss in the auxiliary domain Recommendation loss for the target domain Adversarial losses in the auxiliary domain The loss of adversarial power against the target domain Define the overall optimization objective:

[0067]

[0068] The joint training includes the following steps:

[0069] S71. Iteratively update the parameters θ of the domain adversarial network. φ and θ I To capture domain-invariant preferences;

[0070] S72. Iteratively update the parameters θ of the cross-domain adversarial example generation network. ψ and θ A By using joint perturbation, we can obtain offensive and imperceptible cross-domain adversarial samples to attack the recommender in the target domain;

[0071] S73. Update parameters with the help of the auxiliary domain. and To improve the adversarial robustness of the target domain while maintaining recommended performance.

[0072] Preferably, in S8, the evaluation method for adversarial robustness adopts the classic adversarial attack method to attack the trained adversarial robust cross-domain recommendation system, obtain the recommendation results after the attack, and evaluate them. If the evaluation of the recommendation results is no different from the evaluation of the results without the attack, it indicates that the cross-domain recommendation system has good adversarial robustness; otherwise, the adversarial robustness is insufficient.

[0073] Compared with the prior art, the present invention has the following beneficial effects:

[0074] (1) This invention establishes a cross-domain distributed adversarial training method, which can enhance the adversarial robustness of the sparse recommendation domain by transferring the adversarial robustness of the auxiliary domain to the target domain.

[0075] (2) This invention establishes a domain adversarial network to capture the domain-invariant preference distribution of shared and non-shared users.

[0076] (3) This invention establishes a cross-domain adversarial sample generation network to capture the distribution of aggressive and imperceptible cross-domain adversarial samples. At the same time, with the help of the user domain invariant representation distribution containing shared and non-shared user data and the constraint of the cross-domain adversarial sample discriminator, it supports cross-domain distribution adversarial training. Attached Figure Description

[0077] Figure 1 This is a schematic diagram of the overall structure of the present invention;

[0078] Figure 2 This is a schematic diagram illustrating the imperceptibility of cross-domain adversarial examples in the film-book domain according to an embodiment of the present invention;

[0079] Figure 3 This is a schematic diagram illustrating the imperceptibility of cross-domain adversarial examples in the film-music field according to an embodiment of the present invention;

[0080] Figure 4 This is a visual representation of the adversarial robustness of a cross-domain recommendation system after cross-domain distributed adversarial training in a movie-book scenario, according to an embodiment of the present invention. Detailed Implementation

[0081] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0082] Example 1:

[0083] Please see Figure 1An adversarially robust cross-domain recommendation model includes a domain adversarial network component for generating and learning a distribution of user domain-invariant preferences containing shared and non-shared user domains, a cross-domain adversarial sample generation network for generating and learning a cross-domain adversarial sample distribution with aggressiveness and imperceptibility, and a recommender component for scoring the matching degree between user embeddings and item embeddings. Cross-domain distribution adversarial training connects two recommenders in the cross-domain adversarial sample generation network and the recommender component, making the two recommenders adversarial, thereby improving the adversarial robustness of the cross-domain recommendation model.

[0084] The domain adversarial network component includes a user embedding component, a domain invariant preference encoder, and a domain discriminator; the domain invariant preference encoder and the domain discriminator are both multilayer perceptrons containing the ReLU activation function.

[0085] The user embedding component transforms user ID features into low-dimensional dense embedding vectors.

[0086] The domain-invariant preference encoder encodes the user embedding vector into a domain-invariant preference.

[0087] The domain discriminator assists the domain-invariant preference encoder to perform domain adversarial operations against the domain-invariant preference encoder in order to capture the domain-invariant preference.

[0088] The primary function of the Domain Adversarial Network (DAN) component is to capture a user's domain-invariant preference distribution. In this process, the DAN component aligns user preference embeddings from two different domains, paving the way for the use of non-shared users. Specifically, the domain-invariant preference encoder takes all user data from both domains as input and, with the help of a domain discriminator, learns a domain-invariant preference distribution. In this process, shared and non-shared users are transformed into the same embedding space.

[0089] The cross-domain adversarial sample generation network includes a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator;

[0090] The cross-domain adversarial sample generator transforms user domain-invariant preferences into cross-domain adversarial samples to support cross-domain distributed adversarial training.

[0091] The cross-domain adversarial sample discriminator assists the cross-domain adversarial sample generator, enabling it to generate adversarial samples with the cross-domain adversarial sample generator, thereby capturing cross-domain adversarial samples that are imperceptible and supporting cross-domain distributed adversarial training.

[0092] The recommender component includes a target domain recommender and an auxiliary domain recommender;

[0093] The target domain recommender and the auxiliary domain recommender are used for adversarial training against a cross-domain adversarial sample generator in order to transfer the adversarial robustness of the auxiliary domain to the target domain.

[0094] Under the constraint of a cross-domain adversarial example discriminator, a user embedding distribution perturbed by adversarial examples is learned. Specifically, the cross-domain adversarial example generator takes a domain-invariant preference distribution as input and then perturbs this distribution to generate a cross-domain adversarial example distribution; this process is equivalent to jointly perturbing all samples. To ensure the aggressiveness of the cross-domain adversarial examples, the cross-domain adversarial example generator also attacks the auxiliary domain recommender and the target domain recommender during training. Simultaneously, the cross-domain adversarial example discriminator constrains the distance between the cross-domain adversarial example distribution and the domain-invariant preference distribution, ensuring the imperceptibility of the cross-domain adversarial examples. Finally, a large number of effective and imperceptible cross-domain adversarial examples are sampled from the perturbed distribution (i.e., the cross-domain adversarial example distribution) learned by the cross-domain adversarial example generator for cross-domain adversarial training. In this way, the adversarial robustness of the auxiliary domain is transferred to the target domain, resulting in an adversarially robust cross-domain recommender system.

[0095] The recommendation system of this invention can still recommend items that users are interested in even when subjected to adversarial attacks. For example, if a user likes a light blue top, a robust cross-domain recommendation system can still recommend a light blue top to the user when subjected to an adversarial attack; however, if the cross-domain recommendation system is not robust, it may recommend a dark blue top to the user when subjected to an adversarial attack, even though the user does not actually like a dark blue top.

[0096] Example 2:

[0097] Please see Figure 1 - Figure 4 A method for training a robust cross-domain recommendation model includes the following steps:

[0098] S1: Obtain user IDs, item IDs, and interaction records from two different domains to form a cross-domain dataset including the auxiliary domain and the target domain;

[0099] S2: Remove duplicate interaction records and user IDs with fewer than 5 interaction records and their corresponding interaction records; then divide the dataset according to 70% and 30% of the number of interaction records for each user ID to obtain the training set and test set respectively.

[0100] S3: By looking up a table, the user ID and item ID are obtained through the queryable embedding matrix to obtain the low-dimensional embeddings of the user and item;

[0101] The table lookup method is as follows:

[0102] make Let u be the set of users. Let v be the set of items v; where Using one-hot encoding x u ∈{0,1} m and x v ∈{0,1} n Each represents a user and a certain item The low-dimensional embedding e of a certain user u u This can be achieved by querying a learnable embedding matrix. To obtain, i.e., e u =W u x u The low-dimensional embedding e of an item v v By querying a learnable embedding matrix To obtain, that is, e v =W v x v .

[0103] S4: The user's low-dimensional embedding is processed by the domain-invariant preference encoder, and under the action of the domain discriminator, the domain-invariant preference is obtained; the domain-invariant preference and the low-dimensional embedding of the item are concatenated and sent to the recommender component to obtain the recommendation score, so that the domain-invariant preference encoder can capture recommendation information;

[0104] The method for invariant coding domain preferences is as follows:

[0105] S41, User-embedded Through the domain-invariant preference encoder G I Generator domain invariant preferences

[0106] in, θ I For the domain-invariant preference encoder G I The learnable parameters are s, where s is the auxiliary domain and t is the target domain.

[0107] S42. To ensure domain-invariant preferences It is domain invariant. By introducing a domain discriminator that takes the domain invariant preference as input, the domain invariance of the preference is ensured, and the loss function is defined as:

[0108]

[0109] Where, θ φ Domain discriminator D φ The learnable parameters are domain-invariant preferences obtained from user embeddings in the auxiliary domain. It is based on domain-invariant preferences obtained from user embeddings of the target domain, making As a label, conversely, Let p be the mean and p be the probability distribution. For user embedding in auxiliary domains, Embedded for users in the target domain.

[0110] S43. To enable the domain-invariant preference encoder to learn a preference that is difficult to discern with the help of the domain discriminator, the optimization objective is defined as the following mini-game:

[0111]

[0112] in, for;

[0113] S44, through auxiliary losses To maintain a user's preferences in two domains invariantly close within the same embedding space, the auxiliary loss... for:

[0114]

[0115] in, It is based on domain-invariant preferences obtained from user embeddings in the auxiliary domain. It is based on domain-invariant preferences obtained from user embeddings of the target domain; For the user set of the auxiliary domain, For the set of users in the target domain;

[0116] S45. Joint recommendation loss with domain-invariant preferences as input. and The optimization process is guided by the goal of ensuring that the domain-invariant preference encoder can capture recommendation information. The optimization objective of the domain adversarial network is:

[0117]

[0118] in, For domain adversarial network loss, i.e.

[0119] S5: Domain-invariant preferences generate imperceptible cross-domain adversarial samples through a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator; these cross-domain adversarial samples are then fed into the recommender component to obtain adversarial recommendation scores, thereby increasing the aggressiveness of the cross-domain adversarial samples.

[0120] The method for generating offensive yet undetectable cross-domain adversarial examples is as follows:

[0121] S51. Using the domain-invariant preference distribution as input to the cross-domain adversarial example generator, generate cross-domain adversarial examples.

[0122]

[0123] Where, θA It is G A Learnable parameters, G A θ is a cross-domain adversarial sample generator. A These are the learnable parameters for a cross-domain adversarial example generator.

[0124] S52. To ensure the imperceptibility of cross-domain adversarial sample distribution, a concept θ is introduced. ψ Cross-domain adversarial sample discriminator D with parameters ψ With domain-invariant preferences and cross-domain adversarial examples as input, the loss of the cross-domain adversarial example generation network is:

[0125]

[0126] If cross-domain adversarial sample discriminant D ψ The input is domain-invariant preferences. Then set on the contrary,

[0127] S53. The adversarial loss of the recommender, which uses cross-domain adversarial examples as input, guides the optimization of the cross-domain adversarial example generation network to ensure that the cross-domain adversarial examples are aggressive. The following maximum and minimum optimization objectives are set for the cross-domain adversarial example generation network:

[0128]

[0129] Where λ is a hyperparameter that controls the degree of contribution of cross-domain distributed adversarial training. To improve the loss of cross-domain adversarial sample generation networks, For the adversarial losses of the auxiliary domain, The adversarial loss in the target domain.

[0130] S6: Cross-domain distributed adversarial training feeds cross-domain adversarial samples into the thruster component, enabling the cross-domain adversarial sample generator and the thruster component to perform adversarial training in order to transfer the adversarial robustness of the auxiliary domain to the target domain.

[0131] The process of cross-domain distributed adversarial training is as follows:

[0132] S61. Predict the interaction probability of the attacked target domain recommender using the following formula.

[0133]

[0134] in, For a certain attacked user The probability of interacting with a certain item v. For embedding items in the target domain, Rec (t)For the target domain recommender, This is a cross-domain adversarial example for the target domain. Embed for items in the target domain. These are the learnable parameters for the target domain recommender.

[0135] S62, By constructing an adversarial training dataset Where v + and v - These are the positive and negative item samples corresponding to the attacked user, respectively. Define the following objective function to guide the recommender parameter updates:

[0136]

[0137] in, For the adversarial training dataset, where v + and v - These are the positive and negative item samples corresponding to the attacked user, respectively. For users who have been attacked.

[0138] S63. To enhance the adversarial robustness of sparse target domains through cross-domain distributed adversarial training, the target domain recommender Rec... (t) The optimization objective is defined as the following max-min game:

[0139]

[0140] In this process, by updating the parameter θ A Maximize loss To destroy Rec (t) Performance; at the same time, through updates Minimize loss This makes the recommender Rec in the target domain... (t) It can defend against attacks.

[0141] S7: The recommendation model is trained on the training set using a joint training method to obtain a cross-domain recommendation model with adversarial robustness.

[0142] By combining domain adversarial network loss Loss of cross-domain adversarial example generation networks Recommendation loss in the auxiliary domain Recommendation loss for the target domain Adversarial losses in the auxiliary domain The loss of adversarial power against the target domain Define the overall optimization objective:

[0143]

[0144] The optimization process includes the following steps:

[0145] S71. Iteratively update the parameters θ of the domain adversarial network. φ and θ I To capture domain-invariant preferences;

[0146] S72. Iteratively update the parameters θ of the cross-domain adversarial example generation network. ψ and θ A By using joint perturbation, we can obtain offensive and imperceptible cross-domain adversarial samples to attack the recommender in the target domain;

[0147] S73. Update parameters with the help of the auxiliary domain. and To improve the adversarial robustness of the target domain while maintaining recommended performance.

[0148] S8: Input the test set data into the trained cross-domain recommendation model and evaluate its adversarial robustness.

[0149] The evaluation method for adversarial robustness adopts the classic adversarial attack method to attack the trained adversarial robust cross-domain recommendation system, obtain the recommendation results after the attack and evaluate them. If the evaluation of the recommendation results is no different from the evaluation of the results without the attack, it indicates that the cross-domain recommendation system has good adversarial robustness; otherwise, the adversarial robustness is insufficient.

[0150] Verification Example

[0151] like Figure 2 - Figure 4 As shown, this invention was experimentally evaluated on two publicly available datasets: Douban and Amazon. The Douban dataset includes three domains: movies, books, and music. The Amazon dataset includes two domains: television and CDs. This invention constructs two cross-domain scenarios and one cross-domain scenario in both the Douban and Amazon datasets by combining different domains. The cross-domain scenarios in the Douban dataset are movies-books and movies-music, while the cross-domain scenario in the Amazon dataset is television-CDs. The terms "books," "music," and "CDs" represent the target domains.

[0152] Table 1. Statistical data for three cross-domain scenarios after preprocessing.

[0153]

[0154]

[0155] As shown in Table 1, density is defined as the ratio of the number of observed interaction records to the total number of possible interaction records. Target domain interaction data under different scenarios are randomly divided into training and test sets. This invention randomly samples one interaction history record for each user and adds it to the test set. Interaction data from the auxiliary domain are used for training. This invention repeats this partitioning process three times and presents the average results with standard deviation.

[0156] This invention employs widely used evaluation metrics, Hit Ratio (HR) and Normalized Discounted Cumulative Gain (NDCG), to assess the quality of the recommendation list. HR measures whether the tested item is in the Top-k list. Meanwhile, NDCG is a position-aware metric, giving higher weight to hit items positioned higher in the list. In short, for both metrics, higher values ​​indicate better performance. This invention uses a leave-one-out evaluation method. Specifically, this invention sorts a positive item sample from a test user and 99 randomly sampled negative item samples.

[0157] This invention employs the Fast Signed Gradient Method (FGSM) and Projective Gradient Descent (PGD) to attack adversarially robust cross-domain recommendation systems trained using cross-domain distributed adversarial training. Based on perturbation constraints, this invention sets four different attack modes: FGSM-0.1, FGSM-1, PGD-0.1, and PGD-1.

[0158] This invention is D φ G I D ψ G A and Rec (τ) These different components are set with different learning rates in different scenarios to achieve their best results. See Table 2 for specific settings.

[0159] Table 2. Hyperparameter settings for different scenarios

[0160]

[0161]

[0162] As shown in Table 2, these components are implemented as multilayer perceptrons with the ReLU activation function. This invention uses Adam as the optimizer. The hyperparameters of the attack method FGSM are the perturbation constraint ε and the step size, which can be set to {0.1,1} and {0.1,1}, respectively. The hyperparameters of another attack method, PGD, are the perturbation constraint ε, the step size, and the number of iterations, which are set to {0.1,1}, {0.01,0.1}, and 20, respectively. The dimensions of the low-dimensional embedding, domain-invariant preferences, and cross-domain adversarial examples are set to 128, 64, and 64, respectively. In all scenarios, each user during the training phase has 5 negative samples.

[0163] To evaluate the adversarial robustness of the model, the test data obtained above was input into the model, and HR and NDCG were used as evaluation metrics, while FGSM and PGD were used as evaluation methods. Specific results are shown in Table 3. As shown in Table 3, the cross-domain distributed adversarial training of this invention is effective in improving the adversarial robustness of cross-domain recommendation systems.

[0164] Table 3 Model Performance Table

[0165]

[0166]

[0167] In different scenarios, the cross-domain distributed adversarial examples generated by this invention are close to the domain-invariant preference distribution, indicating that the generated cross-domain distributed adversarial examples have good undetectability.

[0168] like Figure 4 As shown, this is a list of recommendation results from a cross-domain recommendation system under different evaluation methods after cross-domain distributed adversarial training. Figure 4 It can be observed that for user ID 45, the recommended results under no-attack conditions are almost unchanged compared to those after FGSM-1 and PGD-1 attacks. Only during the FGSM-1 attack did two items appear, with their order swapped. This demonstrates that the present invention effectively improves the robustness of cross-domain recommendation systems, enabling robust cross-domain recommendation systems to produce almost identical recommended results even when facing adversarial attacks.

Claims

1. A robust cross-domain recommendation method, characterized in that, Includes the following steps: S1: Obtain user IDs, item IDs, and interaction records from two different domains to form a cross-domain dataset including the auxiliary domain and the target domain; S2: Divide the cross-domain dataset into training and test sets; S3: By looking up a table, the user ID and item ID are obtained through the queryable embedding matrix to obtain the low-dimensional embeddings of the user and item; S4: User low-dimensional embeddings are processed by a domain-invariant preference encoder, which then uses a domain discriminator to obtain domain-invariant preferences. The domain-invariant preferences and low-dimensional item embeddings are concatenated and fed into the recommender component to obtain a recommendation score, enabling the domain-invariant preference encoder to capture recommendation information. The process of obtaining domain-invariant preferences includes the following steps: S41, User-embedded Domain-invariant preferences are generated through a domain-invariant preference encoder. : , ;in, , Domain-invariant preference encoder Learnable parameters s For auxiliary domain, t For the target domain, The size of the field-invariant preference space; S42. By introducing a domain discriminator that takes domain-invariant preferences as input, the domain of the domain-invariant preferences is ensured to remain invariant, and the loss function is defined as follows: ； in, Domain discriminator Learnable parameters For domain-invariant preferences obtained from user embeddings based on auxiliary domains, Let the domain-invariant preferences obtained from user embeddings based on the target domain be... As a label, conversely, ; The mean, For probability distribution, For user embedding in auxiliary domains, Embedded for users in the target domain; S43. To enable the domain-invariant preference encoder to learn a preference that is difficult to discern with the help of the domain discriminator, the optimization objective is defined as the following mini-game: ； in, For domain adversarial loss function; S44, through auxiliary losses To maintain a user's preferences in two domains invariantly close within the same embedding space, the auxiliary loss... for: ； in, For domain-invariant preferences obtained from user embeddings based on auxiliary domains, Domain-invariant preferences obtained from user embeddings based on the target domain; For the user set of the auxiliary domain, For the set of users in the target domain; S45. Recommendation loss that combines an auxiliary domain with domain-invariant preferences as input. Recommendation loss for the target domain The optimization process is guided by the goal of ensuring that the domain-invariant preference encoder can capture recommendation information. The optimization objective of the domain adversarial network is: ； in, For domain adversarial network loss, i.e. , For the domain adversarial losses of domain adversarial networks, Auxiliary losses for domain adversarial networks; S5: Domain-invariant preferences generate imperceptible cross-domain adversarial samples through a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator; these cross-domain adversarial samples are then fed into the recommender component to obtain adversarial recommendation scores, thereby increasing the aggressiveness of the cross-domain adversarial samples. S6: Cross-domain distributed adversarial training feeds cross-domain adversarial samples into the thruster component, enabling the cross-domain adversarial sample generator and the thruster component to perform adversarial training in order to transfer the adversarial robustness of the auxiliary domain to the target domain. S7: A joint training method is used to train on the training set to obtain a cross-domain recommendation model with adversarial robustness; S8: Input the test set data into the trained cross-domain recommendation model and evaluate its adversarial robustness.

2. The anti-robust cross-domain recommendation method according to claim 1, characterized in that, S2 includes the following steps: First, duplicate interaction records and user IDs with fewer than 5 interaction records and their corresponding interaction records are removed; Secondly, the dataset is divided into training and test sets based on 70% and 30% of the number of interaction records for each user ID, respectively.

3. The anti-robust cross-domain recommendation method according to claim 1, characterized in that, In S3, the table lookup method is as follows: User low-dimensional embedding By querying a learnable embedding matrix To obtain, that is Low-dimensional embedding of items By querying a learnable embedding matrix To obtain, that is, ; One-hot encoding is used. and Each represents a user and a certain item , For users u The set, For items v A set; , , This refers to the size of the embedded space.

4. The anti-robust cross-domain recommendation method according to claim 1, characterized in that, In S5, the steps for generating offensive yet imperceptible cross-domain adversarial examples are as follows: S51. Using the domain-invariant preference distribution as input to the cross-domain adversarial example generator, generate cross-domain adversarial examples. : ； in, yes Learnable parameters As a cross-domain adversarial sample generator, Learnable parameters for cross-domain adversarial example generators; S52. To ensure the imperceptibility of cross-domain adversarial sample distribution, a method is introduced... Cross-domain adversarial sample discriminator with parameters With domain-invariant preferences and cross-domain adversarial examples as input, the loss of the cross-domain adversarial example generation network is: ； If cross-domain adversarial sample discriminant The input is domain-invariant preferences. Then set ,on the contrary, ; S53. The adversarial loss of the recommender, which uses cross-domain adversarial examples as input, guides the optimization of the cross-domain adversarial example generation network to ensure that the cross-domain adversarial examples are aggressive. The following maximum and minimum optimization objectives are set for the cross-domain adversarial example generation network: ； in, Hyperparameters for controlling the contribution of cross-domain distributed adversarial training. To improve the loss of cross-domain adversarial sample generation networks, For the adversarial losses of the auxiliary domain, The adversarial loss in the target domain.

5. The anti-robust cross-domain recommendation method according to claim 1, characterized in that, In S6, the process of cross-domain distributed adversarial training is as follows: S61. Predict the interaction probability of the attacked target domain recommender using the following formula. : ； in, For a certain attacked user Will be with a certain item The probability of interaction, Embed for items in the target domain. For the target domain recommender, This is a cross-domain adversarial example for the target domain. Embed for items in the target domain. These are the learnable parameters for the target domain recommender; S62. Guide the recommender parameter updates using the following objective function: ； in, For the adversarial training dataset, where and These are the positive and negative item samples corresponding to the attacked user, respectively. For the users who have been attacked; S63. To enhance the adversarial robustness of sparse target domains through cross-domain distributed adversarial training, a target domain recommender... The optimization objective is defined as the following max-min game: ; In this process, by updating parameters Maximize loss To destroy Performance; at the same time, through updates Minimize loss Make the recommender for the target domain It can defend against attacks.

6. The anti-robust cross-domain recommendation method according to claim 1, characterized in that, In S7, by combining , Recommended loss , , Confrontational network losses Loss of cross-domain adversarial example generation networks Recommendation loss in auxiliary domains Recommendation loss for the target domain The adversarial losses of the auxiliary domain The loss of adversarial power against the target domain Define the overall optimization objective: ； The joint training includes the following steps: S71. Iteratively update the parameters of the domain adversarial network. and To capture domain-invariant preferences; S72. Iteratively update the parameters of the cross-domain adversarial example generation network. and By using joint perturbation, we can obtain offensive and imperceptible cross-domain adversarial samples to attack the recommender in the target domain; S73. Update parameters with the help of the auxiliary domain. and To improve the adversarial robustness of the target domain while maintaining recommended performance.

7. The training method for an adversarially robust cross-domain recommendation model according to claim 1, characterized in that, In S8, the evaluation method for adversarial robustness adopts the classic adversarial attack method. The trained adversarial robust cross-domain recommendation system is attacked, and the recommendation results after the attack are obtained and evaluated. If the evaluation of the recommendation results is no different from the evaluation of the results without the attack, it indicates that the cross-domain recommendation system has good adversarial robustness; otherwise, the adversarial robustness is insufficient.

8. A robust cross-domain recommendation system, employing the method described in any one of claims 1-7, characterized in that, This includes domain adversarial network components, cross-domain adversarial sample generation networks, and recommender components; The domain adversarial network components include a user embedding component, a domain-invariant preference encoder, and a domain discriminator; The user embedding component transforms user ID features into low-dimensional dense embedding vectors. The domain-invariant preference encoder encodes the user embedding vector into a domain-invariant preference; The domain discriminator assists the domain-invariant preference encoder to perform domain adversarial operations against the domain-invariant preference encoder in order to capture the domain-invariant preference. The cross-domain adversarial sample generation network includes a cross-domain adversarial sample generator and a cross-domain adversarial sample discriminator; The cross-domain adversarial sample generator transforms user domain-invariant preferences into cross-domain adversarial samples to support cross-domain distributed adversarial training. The cross-domain adversarial sample discriminator assists the cross-domain adversarial sample generator, enabling it to generate adversarial samples against the cross-domain adversarial sample generator, thereby capturing cross-domain adversarial samples that are imperceptible and supporting cross-domain distributed adversarial training. The recommender component includes a target domain recommender and an auxiliary domain recommender; The target domain recommender and the auxiliary domain recommender are used for adversarial training against a cross-domain adversarial sample generator in order to transfer the adversarial robustness of the auxiliary domain to the target domain.

Images