Data poisoning attack method based on deep learning recommendation algorithm

Abstract

The invention discloses a data poisoning attack method based on a deep learning recommendation algorithm, and the method comprises the steps: precisely screening abnormal scoring users and interaction items thereof through a statistical method in combination with a non-consistency measurement NCM and P-value, and constructing a selection item set; secondly, injecting a forged user, endowing a selected item set and a target item set with the highest score, scoring a filling item set according to normal distribution, and forming a user-item score matrix R'with poisoning data; a double-layer iterative optimization framework is adopted, and an outer layer maximizes a target project hit rate through attack loss CWLoss, enhances loss SFALoss through spectral features and hits attack traces through regularization. And the inner layer uses the user-project scoring matrix R'of the poisoning data to update the model parameters based on the deep learning recommendation algorithm until the attack converges. According to the method, the recommendation result can be remarkably manipulated under the condition of only a small number of poisoning users, high concealment and high attack efficiency are both achieved, and an effective means is provided for evaluating and improving the robustness of a recommendation system.

Description

Technical Field

[0001] This invention belongs to the field of computer security, and more specifically, relates to a data poisoning attack method based on deep learning recommendation algorithms. Background Technology

[0002] Recommendation algorithms are shifting from traditional collaborative filtering methods to deep learning-based approaches. Deep learning models are highly dependent on data, and their complexity and lack of interpretability make recommendation algorithms less robust. This makes them vulnerable to poisoning attacks, which can manipulate recommendation results by using carefully designed malicious data to interfere with the model's learning process. This has attracted widespread attention. With the rapid development of the internet and e-commerce, the application of recommendation systems on various platforms has brought significant economic benefits. This has also made recommendation systems targets for poisoning attacks, allowing attackers to manipulate recommendation results for illicit gains.

[0003] Current research on data poisoning attacks in deep learning-based recommendation algorithms typically targets all users in the system. The essence of this attack lies in constructing poisoning users by learning the characteristics of ordinary rating users, thereby increasing the exposure of the target item. Traditional poisoning user and rating generation methods, such as random attacks, average attacks, popularity attacks, and segmented attacks, often have limited effectiveness and usually rely on a large-scale poisoning user group to achieve the attack goal. Under different attack strategies, the set of target items selected for the attack and the rating filling method will also be adjusted accordingly.

[0004] Therefore, there is an urgent need to provide a data poisoning attack method that can significantly manipulate recommendation results with only a small number of poisoning users, while possessing both high concealment and high attack efficiency. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a data poisoning attack method based on a deep learning recommendation algorithm. Abnormal users are calculated using the statistical inconsistency measure NCM and the P-value.

[0006] The technical solution of this invention is: A data poisoning attack method based on a deep learning recommendation algorithm includes the following steps: Step 1: Based on the user-item rating matrix R, perform rating segmentation statistics for each user u, calculate the number of ratings at each rating level, construct a normalized rating distribution vector, and then calculate the NCM value and P-value to filter out the extreme user set. Subsequently, count the high-frequency rating items of the extreme users, select k from the largest to the smallest as the selection item set of the poisoning user, and construct a false rating distribution vector for each poisoning user. Step 2: Perform a two-level iterative optimization on the user-item rating matrix R' containing the poisoner constructed in Step 1, simultaneously calculating the attack loss CWLoss and the spectral feature enhancement loss SFALoss, and merging them into the total loss Loss. all The recommendation model parameters are updated via backpropagation; the hit rate of target items is evaluated in real time, and the model parameters of the deep learning-based recommendation algorithm after training are stored selectively. Step 3: Use the poisoning attack metrics HitRate@N and NDCG@N to evaluate the poisoning attack model based on the deep learning recommendation algorithm; In step two, the total loss is... all The total loss is the weighted sum of CWLoss and SFALoss. all The calculation formula is

[0007] in , These are the weighting coefficients.

[0008] Furthermore, in step one, statistical methods are used, combining the non-consistency measure (NCM) and p-value, to find the set of selected items to fill in false ratings. First, the number of ratings given by users at each rating level is statistically analyzed. The rating levels for each item are represented by a set S. For example, under a 5-point rating system, the rating level set S = {s|s∈{1,2,3,4,5}}. For each user u, the number of ratings given at rating level s∈S is denoted as C. u,s ,

[0009] Where N represents the list of items, I(Ÿ) is an indicator function that takes the value 1 when the condition in parentheses is true, and 0 otherwise; let the user-item rating matrix be R, where R u,i Let R represent the rating value of user u for item i. If user u did not rate item i, then let R... u,i =0, and it is defined that 0∉S; Based on this, the rating distribution vector of user u can be statistically obtained: V u =(C u,1 C u,2 , … ,C u,|S| ) Where |S| represents the size of the rating level set, and to eliminate the influence of differences in the number of ratings from different users, the rating distribution vector V needs to be adjusted. u After normalization, the normalized vector P of the user u rating distribution is obtained. u , This represents the total number of times user u has given a score. (2) Here, ε is a local minimum value used to prevent the denominator from being zero, such as when a user has no rating, and to avoid the occurrence of log0 in subsequent calculations. Define vector P. u , P u =( P u,1 ,P u,2 , … ,P u,|S| ) P u This is the normalized distribution of user u across different rating levels, which reflects user u's relative preference characteristics across different rating registers; Define the population mean distribution Q i That is, the average normalized rating distribution of all users:

[0010] The normalized rating distribution vector P for each user u u Calculate its inconsistency metric NCM u NCM u As a weighted index, based on P u and Q i Calculate the weighted sum of entropy and JS divergence; Define H(P) u H(P) represents entropy, which measures the uniformity of the rating distribution. The smaller the entropy, the more concentrated the distribution, such as users only giving a single score, indicating more extreme user behavior. u Normalize to the [0,1] interval, and use E u E indicates u A larger value indicates a more concentrated distribution.

[0011]

[0012] JS divergence is a metric used to measure the difference in the number of ratings distributed. The larger the JS divergence value, the greater the difference between the user and the population, indicating more extreme user behavior. Conversely, a smaller JS divergence value indicates that the user's behavior is closer to the group's habits.

[0013] in, Q i M represents the average probability of all users at the i-th rating level. i This represents the user distribution P at the i-th rating level. u,i and global distribution Q i The average value; The normalized entropy E uBy weighting and fusing with JS divergence, and using an adjustable weighting coefficient α, the blind spot of a single indicator can be reduced, thereby improving the robustness of poisoning.

[0014] Using the weighted index NCM u Calculate the P-value for each user u u U represents all users, NCM v P-value represents the NCM score of all users v. u P-value is used to count how many people have a higher score than user u, thus providing information about the relative outlier of user u. u The smaller the value, the more abnormal the user is.

[0015] Given a threshold τ ext Threshold ∈(0,1], according to P-value u Find the extreme user set U ext ;

[0016] Statistical extreme user set U ext Number of times the project was rated f i I(Ÿ) is an indicator function; it takes the value 1 if the condition within the parentheses is true, and 0 otherwise.

[0017] Sort the items from largest to smallest, select the k items that are frequently rated by extreme users from the item list N, and exclude the target item set T. This set becomes the selection set for the poisoning user M, denoted as L.

[0018] For each poisoning user M u Constructing a fake rating vector T represents the target item set, F represents the fill item set, and L represents the selection item set.

[0019] Clip truncates continuous sampled values ​​to the interval [1, 5], and round maps them to a discrete rating level set S. Items not in T∪L∪F are kept at 0 points. The user-item rating matrix R and the rating matrix of the poisoning user M are merged to form the user-item rating matrix R′ with poisoning data.

[0020] Furthermore, in step two, the two-layer iterative optimization includes outer-layer optimization and inner-layer optimization, maximizing the target item's position in the user's Top-N recommendation list with less poisoning data: In the outer layer optimization, each iteration first copies the current deep learning-based recommendation algorithm model to obtain a model replica, and constructs an adjacency matrix based on the user-item rating matrix R′ containing the poisoning data to initialize the model replica structure; then, multiple iterations of training are performed, and the loss is calculated. all The target loss is to update the parameters of the model copy in several steps to obtain user embeddings and item embeddings that reflect the current poisoning settings, thereby forming a new interaction matrix with poisoning data. After completing the above steps, the Top-N poisoning hit rate HitRate@N of the target item is calculated on the validation set. When the current poisoning hit rate is better than the historical best, the current data and model state are retained as the starting point for the next iteration. The inner optimization process involves reconstructing the adjacency matrix under the user-item rating matrix R′ with poisoning data determined in the outer layer, and training the deep learning recommendation algorithm model for several rounds to ensure that its parameters are fully adapted to the current data distribution. During the training process, conventional reconstruction / ranking loss and regularization are used, and backpropagation and updates are performed on user embeddings, item embeddings, and related model weights to obtain stable predictions and reliable ranking feedback. This inner optimization process provides more accurate target evaluation and gradient signals for the outer optimization process.

[0021] Furthermore, in step two, the attack loss CWLoss calculation formula is as follows:

[0022] Let the set of triples be... ,in Embedded for users, For positive sample embeddings, the target item can be included. For negative sample embeddings, i.e., items that were not matched in the Top-N recommendations. The formula for calculating CWLoss is (13), which makes the target item score higher than the negative sample, thereby indirectly increasing the probability of the target item being recommended. The softplus function is a smooth activation function, where m≥0 is the interval hyperparameter. The formula for calculating the spectral feature enhancement loss SFALoss is as follows:

[0023]

[0024] Let H be the concatenated user-item embedding matrix, U be the user list, N be the item list, d be the embedding dimension, and E be the embedding dimension. (u)This is a user embedding table, where the u-th row is the embedding vector e of user u. u E (i) This is an item embedding table, where the i-th row is the embedding vector e of item i. i r represents a multivariate Gaussian random vector. I represents a mean vector of 0 and a covariance matrix that is the identity matrix. d Normal distribution, sampling H aug It is an embedded representation after spectral perturbation.

[0025] Furthermore, in step three, the calculation formulas for the poisoning attack metrics HitRate@N and NDCG@N are as follows:

[0026] U represents the list of users, |U| is its size, and |T| is the size of the target item set. Let I(Ÿ) be the model's Top-N recommendation list for the user, and let I(Ÿ) be the indicator function, which takes a value of 1 if the condition in parentheses is true, and 0 otherwise.

[0027]

[0028]

[0029] DCG N DCG represents cumulative gain, measuring the contribution of ranking position to hit rate. N The larger the value, the more likely the target item is to be hit, and the more likely it is to appear at the top of the search results. This is the nth recommendation result for user u, where n=1,…,N, and T is the set of target items, IDCG. N This represents the ideal cumulative gain, meaning that each user ideally occupies the top N positions for min(N, |T|) targets. NDCG@N is the normalized cumulative gain, using the actual DCG. N Divide by the corresponding IDCG N The value is normalized to the range [0,1]. The closer the value is to 1, the closer the sorting is to the ideal. When no target is hit, NDCG@N=0.

[0030] The beneficial effects of this invention are: (1) Using statistical methods, combining the non-consistent measure NCM and P-value, a set of users with extreme ratings is selected from real users, and their high-frequency interaction items are statistically analyzed to form a selection item set L, which is used to fill in the false ratings. This can produce a more significant poisoning effect with a smaller number of poisoning users, while improving the concealment of the attack and avoiding common consistency detection based on statistical features.

[0031] (2) Two-layer iterative optimization: The outer layer optimizes to maximize the HitRate@N of the target item by updating the interaction variable between the poisoning user and the item; the inner layer continues to train the recommendation model on the updated user-item rating matrix R′ with the poisoning data until convergence, so that the evaluation reflects the ranking effect under real training. The two-layer iterative optimization not only enhances the effectiveness of the attack, but also reduces the fluctuation caused by non-convergence through the convergence of the inner layer in multiple rounds, thereby improving the overall stability and concealment.

[0032] (3) The outer layer optimization combines the weighted regularization of CW loss and spectral feature enhancement loss SFALoss, which can flexibly adjust the loss function according to different recommendation models and datasets. The CW loss design ensures that the scores of target items are generally higher than those of negative samples, i.e., non-target items, thereby indirectly increasing the probability of target items being recommended. The introduction of spectral feature enhancement loss SFALoss makes the feature distribution of the poisoning user closer to that of the real user, improving the concealment of the attack and reducing the risk of detection. Attached Figure Description

[0033] The present invention will be further described below with reference to the accompanying drawings and embodiments: Figure 1 This is a schematic diagram illustrating the user rating profile used in the poisoning attack according to the present invention. Figure 2 This is a flowchart illustrating the poisoning attack method of the present invention. Figure 3 For this invention, a user-generated workflow diagram is selected; Figure 4 This is a flowchart of the two-layer iterative optimization process of the present invention. Detailed Implementation

[0034] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0035] This invention employs a poisoning rule targeting deep learning-based recommendation algorithms to generate a poisoning user attack method. The poisoning user injects a forged user profile into the recommendation system, falsifying partial item ratings to disguise themselves as a normal user. For example... Figure 1As shown, the recommendation system's item list is divided into four parts: the selected item set L, the filled item set F, the unrated item set U, and the target item set T. Target items are those to be promoted or suppressed in the poisoning attack; to effectively promote target items, their ratings are generally set to the highest score in the system. Selected items are those selected to make the poisoning attack more effective, chosen using statistical methods combined with non-consistent metrics (NCM) and p-value. The filled item set consists of items chosen by the poisoning user to make the attack harder to detect, used to hide their identity. After determining the selected and filled item sets, the poisoning user generates a batch of fake users who rate these sets according to the poisoning method of this invention, thus creating a batch of fake user profiles, increasing their similarity to the deceived users, and ultimately affecting the recommendation results of the recommendation system.

[0036] like Figure 2 The data poisoning attack method based on deep learning recommendation algorithm provided by this invention includes the following steps: Step 1: Based on the user-item rating matrix R, perform segmented rating statistics for each user u, calculate the number of ratings for each rating level, construct a normalized rating distribution vector, and then calculate the NCM value and P-value to filter out the extreme user set. Next, count the high-frequency rating items of the extreme users, select k from the largest to smallest as the selection set for the poisoning user, and construct a false rating distribution vector for each poisoning user.

[0037] Step 2: Perform a two-level iterative optimization on the user-item rating matrix R' containing the poisoner constructed in Step 1, simultaneously calculating the attack loss CWLoss and the spectral feature enhancement loss SFALoss, and merging them into the total loss Loss. all The recommendation model parameters are updated via backpropagation; the hit rate of target items is evaluated in real time, and the best-performing model parameters based on the deep learning recommendation algorithm are stored. The total loss is... all The weighted sum of CWLoss and SFALoss; Step 3: Use the poisoning attack metrics HitRate@N and NDCG@N to evaluate the poisoning attack model based on the deep learning recommendation algorithm.

[0038] According to the data poisoning attack method based on deep learning recommendation algorithm provided by this invention, step one employs statistical methods, combining the non-consistency metric NCM and P-value, to find the set of selected items used to fill in false ratings. See appendix. Figure 3First, we statistically analyze the number of user ratings at each rating level. We represent the user rating levels for a project using a set S. For example, under a 5-point rating system, the rating level set S = {s | s ∈ {1, 2, 3, 4, 5}}. For each user u, the number of ratings at rating level s ∈ S is denoted as C. u,s Let R be the user-item rating matrix, where R u,i Let R represent the rating value of user u for item i. If user u did not rate item i, then let R... u,i =0, and it is stipulated that 0∉S. Formula (1) is C u,s The calculation formula is given, where N represents the list of items. I(Ÿ) is an indicator function that takes the value 1 when the condition within the parentheses is true, and 0 otherwise.

[0039]

[0040] For each user u, based on the number of times C they rated each rating level... u,s The rating distribution vector V of user u can be obtained statistically. u =(C u,1 C u,2 , … ,C u,|S| V(S) represents the size of the rating level set S, for example, |S|=5 in a five-point scale. This vector reflects the number of ratings a user gives at each rating level. To obtain a normalized representation of the user u rating distribution, the vector V(S) is... u Normalize the scores based on the total number of ratings, and define the normalized score distribution vector P. u P u Calculated using formula (2), in formula (2) This represents the total number of ratings given by user u. ε is a very small positive number used to prevent the denominator from being zero, such as when a user has no ratings, and to avoid the occurrence of log0 in subsequent calculations. Based on the above definition, vector P... u =( P u,1 ,P u,2 ,… ,P u,|S| This represents the normalized distribution of user u's ratings, reflecting user u's relative preferences across different rating levels.

[0041] (2) Define the population mean distribution Q i That is, the average normalized rating distribution of all users:

[0042] The normalized rating distribution vector P for each user u u Calculate its inconsistency metric NCM u NCMu As a weighted index, based on P u and Q i Calculate the entropy H(P) u The weighted sum of the entropy H(P) and the JS divergence is obtained, and the formulas are (4)-(7). Formula (4) is the entropy H(P) u The formula for calculating entropy H(P) measures the uniformity of the score distribution. u The smaller the value of H(P), the more concentrated the distribution, such as only giving a certain score, and therefore the more extreme the user's behavior. Formula (5) for entropy H(P) u Normalize to the [0,1] interval, and use E u E indicates u A larger value indicates a more concentrated distribution.

[0043]

[0044]

[0045] Entropy ignores the global distribution and calculates the concentration of user u ratings. It does not compare the difference between users and the overall average distribution Q, and cannot distinguish between extreme but reasonable users. The formula for calculating JS divergence is (6), which is used to measure the difference in the number of rating distributions. The larger the JS divergence value, the greater the difference between the user and the overall population. Therefore, the more extreme the user's behavior, the smaller the value, and the closer it is to the group's habits.

[0046]

[0047] in, Q i M represents the average probability of all users at the i-th rating level. i This represents the user distribution P at the i-th rating level. u,i and global distribution Q i The average value.

[0048] By weighting and fusing entropy and JS divergence, and using an adjustable weighting coefficient α to reduce the blind spot of a single indicator, the robustness of poisoning can be improved. The weighted NCM... u Formula (7) is used.

[0049]

[0050] Using the weighted index NCM u Calculate the P-value for each user u u The calculation formula is (8), where U represents all users and NCM v P-value represents the NCM score of all users v. u P-value is used to count how many people have a higher score than user u, thus providing information about the relative outlier of user u.u The smaller the value, the more abnormal the user is.

[0051]

[0052] Given a threshold τ ext Threshold ∈(0,1], according to P-value u Find the extreme user set U ext The calculation formula is (9).

[0053]

[0054] Statistical extreme user set U ext Number of times the project was rated f i , f i The calculation formula is (10), where I(Ÿ) is an indicator function, and the value is 1 if the condition in parentheses is true, and 0 otherwise. S is the set of rating levels.

[0055]

[0056] Select the items that are frequently rated by extreme users from the item list N, and exclude the target item set T. The k items sorted from largest to smallest are taken as the selection set of the poisoning user M, denoted as L, and the formula is (11).

[0057]

[0058] For each poisoning user M u Constructing a fake rating vector T is the target item set, F is the fill item set, L is the selection item set, and the scoring fill formula is (12).

[0059]

[0060] The clip truncates continuous sampled values ​​to the interval [1, 5], and round maps them to the discrete rating level set S. Items not in T∪L∪F are kept at 0 points.

[0061] The user-item rating matrix R and the rating matrix of the poisoning user M are merged to form the user-item rating matrix R′ with poisoning data.

[0062] According to the data poisoning attack method based on deep learning recommendation algorithm provided by the present invention, in an embodiment of the present invention, step two performs a two-layer iterative optimization on the generated user-item rating matrix R′ containing the poisoning user. The two-layer iterative optimization includes outer-layer optimization and inner-layer optimization, such as... Figure 4 As shown.

[0063] In the outer layer optimization, each iteration first copies the current deep learning-based recommendation algorithm model to obtain a model replica, and constructs an adjacency matrix based on the user-item rating matrix R′ containing the poisoning data to initialize the model replica structure. This is followed by multiple iterations of training, calculating the loss. all The target loss is determined by updating the parameters of the model replica through several steps to obtain user embeddings and item embeddings that reflect the current poisoning settings, thus forming a new interaction matrix with poisoning data. After completing the above steps, the Top-N poisoning hit rate HitRate@N of the target item is calculated on the validation set. If the current poisoning hit rate is better than the historical best, the current data and model state are retained as the starting point for the next iteration.

[0064] The inner optimization process involves reconstructing the adjacency matrix under the user-item rating matrix R′ defined in the outer layer (containing poisoned data), and training the deep learning-based recommendation algorithm model for several rounds to ensure its parameters are well-suited to the current data distribution. During training, conventional reconstruction / ranking loss and regularization are employed, and backpropagation and updates are performed on user embeddings, item embeddings, and related model weights to obtain stable predictions and reliable ranking feedback. This inner optimization process provides more accurate target evaluation and gradient signals for the outer optimization.

[0065] In step two of this invention, the attack loss CWLoss, the spectral feature enhancement loss SFALoss, and the total loss Loss are calculated. all .

[0066] Carlini-Wagner type ranking loss, i.e., CWLoss, is given by the set of triples as follows: ,in Embedded for users, For positive sample embeddings, the target item can be included. For negative sample embeddings, i.e., items that were not matched in the Top-N recommendations. represents the vector inner product. The formula for calculating CWLoss is (13), which makes the target item score higher than the negative sample, indirectly increasing the probability of the target item being recommended. The softplus function is a smooth activation function, where m≥0 is the interval hyperparameter.

[0067]

[0068] Spectral Feature Augmentation Loss introduces a spectral (feature vector)-based perturbation into the feature space, performing a spectral perturbation. Then, the distance between the original features and the augmented features, i.e., the L1 norm, is used as a regularization loss to improve attack concealment, as shown in formulas (14) and (15). Let the concatenated user-item embedding matrix be H, U be the user list, N be the item list, d be the embedding dimension, and E be... (u) This is a user embedding table, where the u-th row is the embedding vector e of user u. u E (i) This is an item embedding table, where the i-th row is the embedding vector e of item i. i r represents a multivariate Gaussian random vector. I represents a mean vector of 0 and a covariance matrix that is the identity matrix. d Normal distribution, sampling H aug It is an embedded representation after spectral perturbation.

[0069]

[0070]

[0071] Total Loss all λ is the weighted sum of CWLoss and SFALoss. cw , λ sfa The weighting coefficients are calculated using formula (16): (16) In step three of this invention, the metrics for evaluating the poisoning attack model are HitRate@N and NDCG@N. HitRate@N is the poisoning attack hit rate metric, representing the proportion of the target item contained in the top N items of the user's recommendation list, and is calculated using formula (17).

[0072]

[0073] U represents the list of users, |U| is its size, and |T| is the size of the target item set. Let I(Ÿ) be the Top-N recommendation list for the user provided by the model. I(Ÿ) is an indicator function, which takes the value 1 if the condition in parentheses is true and 0 otherwise.

[0074] The NDCG@N metric measures the ranking of a target item in all users' Top-N recommendation lists, and the calculation formula is (18)-(20).

[0075]

[0076]

[0077]

[0078] DCG N DCG represents cumulative gain, measuring the contribution of ranking position to hit rate. N The larger the value, the more likely the target item is not only hit, but also appears more frequently in the higher positions. Definition Let T be the nth recommendation result for user u, where n=1,…,N, and T is the set of target items. N This represents the ideal cumulative gain, where each user ideally occupies the top N positions for min(N, |T|) targets. NDCG@N is the normalized cumulative gain, using the actual DCG. N Divide by the corresponding IDCG N The values ​​are normalized to the range [0,1]. The closer the value is to 1, the closer the sorting is to the ideal; when no target is hit, NDCG@N=0.

[0079] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All modifications made according to the spirit and essence of the main technical solution of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A data poisoning attack method based on a deep learning recommendation algorithm, comprising the following steps: Step 1: Based on the user-item rating matrix R, perform rating segmentation statistics for each user u, calculate the number of ratings at each rating level, construct a normalized rating distribution vector, and then calculate the NCM value and P-value to filter out the extreme user set. Subsequently, count the high-frequency rating items of the extreme users, select k from the largest to the smallest as the selection item set of the poisoning user, and construct a false rating distribution vector for each poisoning user. Step 2: Perform a two-level iterative optimization on the user-item rating matrix R′ containing the poisoning data constructed in Step 1: calculate the attack loss CWLoss and the spectral feature enhancement loss SFALoss, and merge them into the total loss Loss. all The backpropagation process updates the model parameters based on the deep learning recommendation algorithm; the hit rate of poisoning the target item is evaluated in real time, and the trained model parameters based on the deep learning recommendation algorithm are stored selectively. Step 3: Use the poisoning attack metrics HitRate@N and NDCG@N to evaluate the poisoning attack model based on the deep learning recommendation algorithm; Total loss in step two all The total loss is the weighted sum of CWLoss and SFALoss. all The calculation formula is in , These are the weighting coefficients.

2. The data poisoning attack method based on deep learning recommendation algorithm according to claim 1, characterized in that: In step one, statistical methods are used, combining the non-consistency measure NCM and p-value, to find the set of selected items to fill in fake ratings. First, the number of ratings given by users at each rating level is statistically analyzed. The rating levels of users for items are represented by a set S. For each user u, the number of ratings at rating level s∈S is denoted as C. u,s , Where N represents the list of items, I(Ÿ) is an indicator function that takes the value 1 when the condition in parentheses is true, and 0 otherwise; R u,i Let R represent the rating value of user u for item i. If user u did not rate item i, then let R... u,i =0, and stipulate ; Based on this, the rating distribution vector of user u is obtained statistically: V u =(C u,1 ,C u,2 , … ,C u,|S| ) Where |S| represents the size of the set of rating levels; To eliminate the impact of differences in the number of ratings from different users, the rating distribution vector V... u After normalization, the normalized vector P of the user u rating distribution is obtained. u , P u =( P u,1 ,P u,2 , … ,P u,|S| ) P u This is the normalized distribution of user u across different rating levels, reflecting user u's relative preference characteristics across different rating registers; Define the population mean distribution Q i That is, the average normalized rating distribution of all users: The normalized rating distribution vector P for each user u u Calculate its inconsistency metric NCM u NCM u As a weighted index, based on P u and Q i Calculate the weighted sum of entropy and JS divergence; Define H(P) u H(P) is the entropy, which measures the uniformity of the rating distribution. The smaller the entropy, the more concentrated the distribution. u Normalize to the [0,1] interval, and use E u E indicates u A larger value indicates a more concentrated distribution. JS divergence is a metric used to measure the difference in the number of ratings distributed. The larger the JS divergence value, the greater the difference between the user and the population, indicating more extreme user behavior. Conversely, a smaller JS divergence value indicates that the user's behavior is closer to the group's habits. Among them, Q i M represents the average probability of all users at the i-th rating level. i This represents the user distribution P at the i-th rating level. u,i and global distribution Q i The average value; The normalized entropy E u By weighting and fusing with JS divergence, and using an adjustable weighting coefficient α, the blind spot of a single indicator can be reduced, thereby improving the robustness of poisoning. Using the weighted index NCM u Calculate the P-value for each user u u U represents all users, NCM v P-value represents the NCM score of all users v. u P-value is used to count how many people have a higher score than user u, thus providing information about the relative outlier of user u. u The smaller the value, the more abnormal the user is. Given a threshold τ ext Threshold ∈(0,1], according to P-value u Find the extreme user set U ext , Statistical extreme user set U ext Number of times the project was rated f i I(Ÿ) is an indicator function; it takes the value 1 if the condition within the parentheses is true, and 0 otherwise. Sort the items from largest to smallest, select the k items that are frequently rated by extreme users from the item list N, and exclude the target item set T. This set becomes the selection set for the poisoning user M, denoted as L. For each poisoning user M u Constructing a fake rating vector T represents the target item set, F represents the fill item set, and L represents the selection item set. The clip truncates continuous sampled values ​​to the interval [1, 5], and the round maps them to the discrete rating level set S. Items not in T∪L∪F are kept at 0 points. The user-item rating matrix R and the constructed rating matrix of the poisoning user M are merged to form the user-item rating matrix R′ with poisoning data.

3. The data poisoning attack method based on deep learning recommendation algorithm according to claim 1, characterized in that: In step two, the two-layer iterative optimization includes outer-layer optimization and inner-layer optimization; In the outer layer optimization, each iteration first copies the current deep learning-based recommendation algorithm model to obtain a model replica, and constructs an adjacency matrix based on the user-item rating matrix R′ containing the poisoning data to initialize the model replica structure; then, multiple iterations of training are performed, and the loss is calculated. all The target loss is to update the parameters of the model copy in several steps to obtain user embeddings and item embeddings that reflect the current poisoning settings, thereby forming a new interaction matrix with poisoning data. After completing the above steps, the Top-N poisoning hit rate HitRate@N of the target item is calculated on the validation set. When the current poisoning hit rate is better than the historical best, the current data and model state are retained as the starting point for the next iteration. The inner optimization process involves reconstructing the adjacency matrix under the user-item rating matrix R′ with poisoning data determined in the outer layer, and training the deep learning recommendation algorithm model for several rounds to ensure that its parameters are fully adapted to the current data distribution. During the training process, conventional reconstruction / ranking loss and regularization are used, and backpropagation and updates are performed on user embeddings, item embeddings, and related model weights to obtain stable predictions and reliable ranking feedback. This inner optimization process provides more accurate target evaluation and gradient signals for the outer optimization process.

4. The data poisoning attack method based on deep learning recommendation algorithm according to claim 1, characterized in that: In step two, the attack loss CWLoss is calculated using the following formula: Let the set of triples be... ,in Embedded for users, For positive sample embeddings, containing the target item. For negative sample embeddings, i.e., items that were not matched in the Top-N recommendations. The softplus function represents the vector inner product and is a smooth activation function, where m≥0 is the margin hyperparameter. The formula for calculating the spectral feature enhancement loss SFALoss is as follows: Let H be the concatenated user-item embedding matrix, U be the user list, N be the item list, d be the embedding dimension, and E be the embedding dimension. (u) This is a user embedding table, where the u-th row is the embedding vector e of user u. u E (i) This is an item embedding table, where the i-th row is the embedding vector e of item i. i r represents a multivariate Gaussian random vector. I represents a mean vector of 0 and a covariance matrix that is the identity matrix. d Normal distribution, sampling H aug It is an embedded representation after spectral perturbation.

5. The data poisoning attack method based on deep learning recommendation algorithm according to claim 1, characterized in that: In step three, the calculation formulas for the poisoning attack metrics HitRate@N and NDCG@N are as follows: U represents the user list, |U| is its size, |T| is the size of the target item set, represents the model's Top-N recommendation list for each user, and I(Ÿ) is an indicator function, which takes a value of 1 if the condition within the parentheses is true, and a value of 0 otherwise. DCG N DCG represents cumulative gain, measuring the contribution of ranking position to hit rate. N The larger the value, the more likely the target item is to be hit, and the more likely it is to appear at the top of the search results. This is the nth recommendation result for user u, where n=1,…,N, and T is the set of target items, IDCG. N This represents the ideal cumulative gain, meaning that each user ideally occupies the top N positions for min(N, |T|) targets. NDCG@N is the normalized cumulative gain, using the actual DCG. N Divide by the corresponding IDCG N The values ​​are normalized to the range [0,1]. The closer the value is to 1, the closer the sorting is to the ideal. When no target is hit, NDCG@N=0.

6. The data poisoning attack method based on deep learning recommendation algorithm according to claim 2, characterized in that: The normalized vector P of the user rating distribution. u Calculated using the following formula in, This represents the total number of times user u has given a score, and ε is a very small value used to prevent the denominator from being zero.

Images