Generative adversarial network-based poisoning attack method in recommendation system

Abstract

The invention discloses a method for poisoning attack in a recommendation system based on a generative adversarial network, which relates to the technical field of data security, and comprises the following steps of: extracting embedding drift representation from a global article embedding table of a current round and a global article embedding table of a previous round, and executing state transition updating on generator parameters of the generative adversarial network, obtaining generator parameters of the current round; inputting generator parameters of the current round and the global article embedding table of the current round into a generator of the generative adversarial network, outputting candidate user agent representations, obtaining candidate interaction sequences through a tested recommendation model, synchronously executing target article disturbance processing and consistency constraint processing, and generating sequence pairs; and inputting the sequence pair into a discriminator of the generative adversarial network, and executing gating screening in combination with the hierarchical similarity threshold table to obtain a poisoning interaction sequence. According to the method, the stability and reproducibility of a poisoning interaction sequence screening process are improved, and continuous output of a data security evaluation result set is supported.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a poisoning attack method for a recommendation system based on generative adversarial networks. Background Technology

[0002] In e-commerce and content distribution scenarios, recommender systems have evolved from collaborative filtering to deep representation learning and sequential modeling. Generative adversarial networks (GANs) are used to characterize the risk patterns of training data in areas such as behavior distribution fitting, sample generation, and adversarial training. Federated training and multi-round parameter distribution enable the global item embedding table to be updated iteratively with each round. Data security assessment typically revolves around the construction of interaction sequences and the measurement of changes in recommendation results. Poisoning interaction sequences, which alter the interaction distribution and recommendation results by polluting the training data, are an important representation of data security risks.

[0003] When existing technologies are used to conduct poisoning security assessments on recommendation models that have been updated multiple times, the covert gating of poisoning interaction sequences often relies on fixed thresholds or static distribution assumptions. The thresholds are not sufficiently coupled with the distribution of local real interaction sequences, and the cross-round drift of the global item embedding table causes the output distribution of the generative adversarial network to shift. This affects the stability of gating and the reproducibility of the assessment, thereby weakening the continuity of the poisoning interaction sequence in representing security risks. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a poisoning attack method for recommendation systems based on generative adversarial networks to solve the problem of unstable and reproducible covert gating of poisoning interaction sequences under varying federation rounds.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a poisoning attack method for a recommendation system based on generative adversarial networks (GANs), comprising: hierarchically classifying and naturally perturbing local real interaction sequences to generate naturally perturbed sequence pairs, inputting them into the discriminator of the GAN, outputting hierarchical similarity scores, and obtaining a hierarchical similarity threshold table through distribution statistical value processing; extracting embedding drift representations from the global item embedding table of the current round and the global item embedding table of the previous round, and performing state transition updates on the generator parameters of the GAN to obtain the generator parameters of the current round; and updating the generator parameters of the current round. The generator of the generative adversarial network (GAN) is input with the global item embedding table of the current round, outputting candidate user agent representations. Candidate interaction sequences are obtained through the tested recommendation model. Target item perturbation processing and consistency constraint processing are performed simultaneously to generate sequence pairs. The sequence pairs are input into the discriminator of the GAN and gating is performed in conjunction with a hierarchical similarity threshold table to obtain poisoning interaction sequences. Within the hierarchical allowable range, statistical consistency checks are performed on the poisoning interaction sequences, and sequences with out-of-bounds deviations are removed to obtain the evaluation poisoning interaction sequences. The data security evaluation result set is obtained through the tested recommendation model.

[0008] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for generating naturally perturbed sequence pairs are as follows:

[0009] Local real interaction sequences are hierarchically categorized based on sequence length, item popularity, and time window characteristics to form a hierarchical bucket index.

[0010] Based on the hierarchical bucket index, the local real interaction sequence is grouped and aggregated to obtain the hierarchical sample sequence corresponding to the hierarchical bucket index;

[0011] The stratified sample sequences are naturally perturbed to generate naturally perturbed sequences, which are then combined with the stratified sample sequences to form naturally perturbed sequence pairs.

[0012] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for obtaining the hierarchical similarity threshold table are as follows:

[0013] The naturally perturbated sequence is input into the discriminator of the generative adversarial network, which outputs a similarity score. Then, hierarchical aggregation is performed based on the hierarchical bucket index to form a hierarchical similarity score.

[0014] The hierarchical similarity scores are sorted, extreme values ​​are removed, and lower quantiles are selected to obtain the hierarchical similarity threshold corresponding to the hierarchical bucket index.

[0015] The hierarchical similarity threshold and the hierarchical bucket index are written into the threshold record area in a one-to-one correspondence to form the hierarchical similarity threshold table.

[0016] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for extracting embedding drift representations from the global item embedding table of the current round and the global item embedding table of the previous round are as follows:

[0017] Perform item identifier alignment processing on the global item embedding table of the current round and the global item embedding table of the previous round to generate an embedding alignment mapping table;

[0018] Extract the current round embedding vector set and the previous round embedding vector set from the embedding alignment map table, and generate embedding alignment vector pairs.

[0019] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for obtaining the generator parameters for the current round are as follows:

[0020] The embedding alignment vectors are subjected to vector difference extraction, scale normalization, and variation magnitude aggregation to generate an embedding drift representation.

[0021] The embedded drift representation is written into the conditional input side of the generative adversarial network, and the transition identification information is written into the generator parameters of the generative adversarial network to obtain the state transition input set.

[0022] Perform sequence encoding on the naturally perturbed sequence pairs and combine them with the state transition input set to form a transition training batch;

[0023] Based on the transfer training batch, the generator parameters of the generative adversarial network are updated by performing state transfer processing to obtain the generator parameters for the current round.

[0024] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for outputting candidate user agent representations are as follows:

[0025] Load the current round generator parameters into the parameter storage area of ​​the generative adversarial network generator, and load the current round global item embedding table into the condition input side of the generative adversarial network generator to obtain the generator runtime context;

[0026] Generative adversarial network generator inference processing is performed on the generator runtime context to output candidate user agent representations.

[0027] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for generating sequence pairs are as follows:

[0028] The candidate user agent representation is mapped according to the input constraints of the tested recommendation model to generate an inference request, which is then input into the tested recommendation model to output a candidate interaction sequence.

[0029] The target item perturbation is applied to the candidate interaction sequence, and consistency constraints are applied synchronously to generate a poisoning candidate interaction sequence;

[0030] The candidate interaction sequences are paired with the poisoning candidate interaction sequences in a one-to-one correspondence to generate sequence pairs.

[0031] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for obtaining the poisoning interaction sequence are as follows:

[0032] The sequence pairs are written into the input buffer of the discriminator of the generative adversarial network, discriminator inference is performed, and the corresponding hierarchical bucket identifiers are retained to generate gated similarity scores.

[0033] Based on the hierarchical bucket identifier, the hierarchical similarity threshold is read from the hierarchical similarity threshold table, and gating screening is performed on the gating similarity score to obtain the poisoning interaction sequence.

[0034] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for obtaining the evaluation poisoning interaction sequence are as follows:

[0035] Extract sequence length features, item popularity features, repetition features, and adjacent transfer statistical features from each local real interaction sequence, and perform hierarchical aggregation processing to form a hierarchical reference statistical set;

[0036] The hierarchical reference statistical set is sorted and extreme value removal is performed, and boundary values ​​are taken on the sorted results after extreme value removal to form the hierarchical allowable range;

[0037] According to the hierarchical allowable range, the poisoning interaction sequence is subjected to consistency verification and elimination processing to form the poisoning interaction sequence for evaluation.

[0038] As a preferred embodiment of the poisoning attack method in the recommendation system based on generative adversarial networks described in this invention, the specific steps for obtaining the data security evaluation result set through the tested recommendation model are as follows:

[0039] The poisoning interaction sequence used for evaluation and the local real interaction sequence are batch-arranged according to the evaluation batch combination rules to form an evaluation batch set.

[0040] The evaluation batch set is input into the tested recommendation model to obtain the recommendation result set, and the difference measurement is performed to form the data security evaluation result set.

[0041] The beneficial effects of this invention are as follows: by performing hierarchical classification and natural perturbation on local real interaction sequences to obtain naturally perturbed sequence pairs, and inputting them into the discriminator of a generative adversarial network to obtain hierarchical similarity scores, and then performing distribution statistical value processing on the hierarchical similarity scores to form a hierarchical similarity threshold table, the hierarchical similarity threshold table is kept consistent with the distribution of local real interaction sequences and provides a self-consistent basis for subsequent gating screening, thereby improving the stability and reproducibility of the poisoning interaction sequence screening process, and supporting the continuous output of data security evaluation result sets. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of a poisoning attack method in a recommendation system based on generative adversarial networks.

[0044] Figure 2 A flowchart for generating a hierarchical similarity threshold table.

[0045] Figure 3 This is a flowchart for embedding drift representations and state transition updates.

[0046] Figure 4 This is a flowchart for gate screening and security assessment. Detailed Implementation

[0047] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0048] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0049] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0050] Reference Figures 1-4This is one embodiment of the present invention, which provides a poisoning attack method in a recommendation system based on generative adversarial networks, comprising the following steps:

[0051] S1: Perform hierarchical classification and natural perturbation on local real interaction sequences to generate naturally perturbed sequence pairs, and input them into the discriminator of the generative adversarial network to output hierarchical similarity scores. Through distribution statistical value processing, a hierarchical similarity threshold table is obtained.

[0052] S1.1: Perform hierarchical classification processing on local real interaction sequences according to sequence length features, item popularity features, and time window features to form a hierarchical bucket index;

[0053] Furthermore, the system reads local real interaction sequences and extracts sequence length features, item popularity features, and time window features for each sequence. The sequence length features are divided into sequence length categories by interval, the item popularity features are sorted by frequency of occurrence to form item popularity categories, and the time window features are divided into time window categories by the window to which the timestamp belongs. For each local real interaction sequence, a combined identifier of sequence length category, item popularity category, and time window category is recorded. Based on the combined identifier, the local real interaction sequences are categorized and aggregated, and a bucket identifier is assigned to each combined identifier. The system outputs a hierarchical bucket index.

[0054] It should be noted that when forming the popularity category of items, the item identifiers involved in the local real interaction sequence are sorted from smallest to largest according to their frequency of occurrence, and the ranking result of the item popularity feature is output. The ranking result of the item popularity feature includes the item identifier and its ranking number.

[0055] S1.2: Based on the hierarchical bucket index, perform grouping and aggregation on the local real interaction sequence to obtain the hierarchical sample sequence corresponding to the hierarchical bucket index;

[0056] Furthermore, the mapping relationship between the combined identifier and the bucket identifier corresponding to each bucket identifier in the hierarchical bucket index is read. The combined identifier is read one by one for the local real interaction sequence and the matching bucket identifier is retrieved in the hierarchical bucket index. The local real interaction sequence is written into the corresponding sequence set according to the bucket identifier and the writing order and the number of entries are recorded. The deduplication check is performed on the sequence set corresponding to each bucket identifier and duplicate entries are removed. The one-to-one correspondence between the bucket identifier and the sequence set is retained and output as a hierarchical sample sequence.

[0057] S1.3: Perform natural perturbation processing on the stratified sample sequences to generate natural perturbation sequences, and combine them with the stratified sample sequences to form natural perturbation sequence pairs;

[0058] Furthermore, for each stratified sample sequence, the intermediate interaction position is located and the corresponding item is extracted. Based on the ranking result of the item popularity feature of the stratified sample sequence, the replacement item adjacent to the item popularity feature of the item corresponding to the intermediate interaction position is retrieved. The replacement item replaces the item corresponding to the intermediate interaction position while keeping the sequence length feature and time window feature unchanged. The natural perturbation sequence is output. The natural perturbation sequence and the stratified sample sequence are paired and written into the natural perturbation sequence pair according to the one-to-one correspondence.

[0059] S1.4: Input the naturally perturbated sequence into the discriminator of the generative adversarial network, output a similarity score, and perform hierarchical aggregation based on the hierarchical bucket index to form a hierarchical similarity score;

[0060] Furthermore, the natural perturbation sequence pairs, the global item embedding table of the current round, and the embedding version record are read. The embedding version record is used to represent the correspondence between the round and the global item embedding table. At the beginning of the current round, the identification information of the global item embedding table of the current round is written into the embedding version record and the corresponding entry of the previous round is retained. If the discriminator parameters of the previous round of the generative adversarial network (GAN) are not available, the discriminator parameters of the GAN are generated randomly and used as the initial values ​​of the discriminator parameters of the GAN. The discriminator parameters of the previous round of the GAN are loaded as the initial values ​​of the discriminator parameters of the GAN. Sequence encoding is performed on the natural perturbation sequence and the hierarchical sample sequence within the natural perturbation sequence pair to form a pair representation. Positive class supervision labels are written on the pair representation. The pair representation and positive class supervision labels are written into the discriminator of the GAN in batches to perform forward inference and output similarity scores. Based on the positive class supervision labels, the discriminator loss is calculated on the similarity scores and the discriminator parameters of the GAN are updated in reverse. The batch update is repeated until the distribution of similarity scores enters the stable range, and the stable discriminator of the GAN is obtained.

[0061] The natural perturbation sequence and the hierarchical sample sequence are extracted one by one from the natural perturbation sequence pairs and sequence encoding is performed according to the input format of the discriminator of the generative adversarial network. The sequence encoding of the natural perturbation sequence pairs is input into the discriminator of the stabilized generative adversarial network to obtain similarity scores. The bucket identifiers corresponding to the hierarchical sample sequences in the hierarchical bucket index are read, and the similarity scores are written into the score set with the same bucket identifier according to the bucket identifier. The score set is then aggregated, and the hierarchical similarity score is output.

[0062] It should be noted that the stable interval is obtained by performing sliding window statistics on the similarity score sequence of the output using the natural perturbation sequence of the validation.

[0063] S1.5: Perform similarity score sorting, similarity score extreme value removal, and similarity score lower quantile selection on the hierarchical similarity scores to obtain the hierarchical similarity threshold corresponding to the hierarchical bucket index;

[0064] Furthermore, the corresponding hierarchical similarity scores are extracted one by one according to the hierarchical bucket index. The hierarchical similarity scores are sorted from smallest to largest. Based on the sorting results, extreme value removal is performed on a small number of similarity scores at both ends of the sorted sequence to obtain a truncated sorted sequence. In the truncated sorted sequence, the similarity scores are extracted according to the low-end quantile index as the hierarchical similarity threshold corresponding to the hierarchical bucket index and the hierarchical similarity threshold is output.

[0065] S1.6: Write the hierarchical similarity threshold and hierarchical bucket index into the threshold record area in a one-to-one correspondence to form a hierarchical similarity threshold table;

[0066] Furthermore, the hierarchical bucket index is read and the bucket identifiers are traversed according to the hierarchical bucket index. The hierarchical similarity threshold corresponding to the bucket identifier is read. The bucket identifier and the hierarchical similarity threshold are written into the threshold record area to form a threshold record entry. Based on the writing order of the threshold record entries, the threshold record entries are deduplicated and duplicate entries are removed. The threshold record entries are performed on the integrity of the threshold record entries and the threshold record entries corresponding to the missing bucket identifiers are filled in. All threshold record entries in the threshold record area are aggregated and output as a hierarchical similarity threshold table.

[0067] S2: Extract the embedding drift representation from the global item embedding table of the current round and the global item embedding table of the previous round, and perform state transition update on the generator parameters of the generative adversarial network to obtain the generator parameters of the current round.

[0068] S2.1: Perform item identifier alignment processing on the global item embedding table of the current round and the global item embedding table of the previous round to generate an embedding alignment mapping table;

[0069] Furthermore, the global item embedding table of the current round is read and the item identifier field is extracted to form the item identifier list of the current round. The global item embedding table of the previous round is read and the item identifier field is extracted to form the item identifier list of the previous round. The item identifier lists of the current round and the item identifier lists of the previous round are sorted and index records of item identifiers to row numbers are generated. The intersection matching process of the item identifier lists of the current round and the item identifier lists of the previous round is performed and the matching result records are written one by one. Based on the matching result records, the item identifiers, the corresponding row numbers of the global item embedding table of the current round and the corresponding row numbers of the global item embedding table of the previous round are written into the embedding alignment mapping table in a one-to-one correspondence.

[0070] S2.2: Extract the current round embedding vector set and the previous round embedding vector set from the embedding alignment map table, and generate embedding alignment vector pairs;

[0071] Furthermore, the item identifier record, the current round row number record, and the previous round row number record are read from the embedding alignment mapping table. Based on the current round row number record, the embedding vector is extracted from the global item embedding table of the current round and written into the current round embedding vector set. Based on the previous round row number record, the embedding vector is extracted from the global item embedding table of the previous round and written into the previous round embedding vector set. The current round embedding vector and the previous round embedding vector associated with the same item identifier record in the embedding alignment mapping table are paired and written into the embedding alignment vector pair according to a one-to-one correspondence.

[0072] S2.3: Perform vector difference extraction, scale normalization, and variation magnitude aggregation on the embedded alignment vector pairs to generate an embedded drift representation;

[0073] Furthermore, the embedding vectors of the current round and the previous round are read one by one from the embedding alignment vector pairs. Vector difference extraction is performed to obtain the difference vector. The magnitude of the difference vector is obtained and scale normalization is performed based on the magnitude to obtain the normalized difference vector. The absolute value of the normalized difference vector is taken dimension by dimension and the magnitude change aggregation is performed on the embedding alignment vector pairs to obtain the magnitude change aggregation vector. The magnitude change aggregation vector is written into the embedding drift representation.

[0074] Taking the absolute value of the normalized difference vector dimension by dimension and then performing change magnitude aggregation on the embedded alignment vector yields the change magnitude aggregated vector, expressed as:

[0075] ;

[0076] in, Aggregate vectors for the magnitude of change. The number of entries in the embedded alignment vector pairs. The absolute value of the normalized difference vector in each dimension. Index of entries for embedded alignment vector pairs.

[0077] S2.4: Write the embedded drift representation into the conditional input side of the generative adversarial network and write the transition identifier information into the generator parameters of the generative adversarial network to obtain the state transition input set.

[0078] Furthermore, the embedded drift representation is written into the conditional data buffer of the conditional input side of the generative adversarial network and a write completion flag is recorded. The generator parameters of the generative adversarial network are read and the migration identification information is written into the parameter storage area of ​​the generator parameters of the generative adversarial network and a write completion flag is recorded. The embedded drift representation reference information in the conditional input side of the generative adversarial network and the migration identification information reference information in the generator parameters of the generative adversarial network are aggregated and written into the state migration input set.

[0079] It should be noted that the migration identification information includes at least the current round identifier and the embedded version record reference information, which is used to characterize the correspondence between the generator parameters of the generative adversarial network and the global item embedding table of the current round.

[0080] S2.5: Perform sequence encoding processing on the naturally perturbed sequence pairs and combine them with the state transition input set to form a transition training batch;

[0081] Furthermore, the natural perturbation sequence pairs are read and the natural perturbation sequence and hierarchical sample sequence are extracted one by one. Based on the global item embedding table of the current round, the item identifiers in the natural perturbation sequence and hierarchical sample sequence are mapped to embedding vectors and arranged in the interaction order to obtain the natural perturbation sequence code and hierarchical sample sequence code. The natural perturbation sequence code and hierarchical sample sequence code are paired in a one-to-one correspondence to form a code sequence pair. The state transition input set is read and the code sequence pair and the state transition input set are combined in batches and written into the transfer training batch.

[0082] S2.6: Perform state transition update processing on the generator parameters of the generative adversarial network according to the transfer training batch to obtain the generator parameters for the current round;

[0083] Furthermore, the process reads the transfer training batch and loads the generator parameters and state transition input set of the generative adversarial network (GAN). Based on the transfer training batch, it performs forward inference of the GAN's generator and writes the output of the forward inference into the discriminator input of the stabilized GAN to obtain a similarity score. The discriminator parameters of the stabilized GAN remain unchanged during the state transition update process. Based on the similarity score, it performs generator loss calculation, where the generator loss is the inverse of the similarity score. Based on the generator loss, it performs reverse update of the GAN's generator parameters and repeats the generator parameter update in the order of the transfer training batch. After completing the transfer training batch processing, it writes the updated generator parameters of the GAN into the parameter storage area and outputs them as the generator parameters for the current round.

[0084] S3: Input the generator parameters of the current round and the global item embedding table of the current round into the generator of the generative adversarial network, output the candidate user agent representation, obtain the candidate interaction sequence through the tested recommendation model, and simultaneously perform target item perturbation processing and consistency constraint processing to generate sequence pairs;

[0085] S3.1: Load the current round generator parameters into the parameter storage area of ​​the generative adversarial network generator, and load the current round global item embedding table into the condition input side of the generative adversarial network generator to obtain the generator running context;

[0086] Furthermore, the parameter format consistency check is performed on the current round generator parameters, and the current round generator parameters are written into the parameter storage area of ​​the generative adversarial network generator in segments and a write completion flag is recorded. The global item embedding table of the current round is read and written into the embedding buffer of the condition input side of the generative adversarial network generator in the order of item identifiers and a write completion flag is recorded. Based on the write completion flag, the position index of the parameter storage area of ​​the generative adversarial network generator is associated with the position index of the condition input side of the generative adversarial network generator and the generator running context is output.

[0087] S3.2: Perform generator inference processing of generative adversarial network on the generator runtime context and output candidate user agent representations;

[0088] Furthermore, the parameter storage location index and conditional input side location index of the generative adversarial network (GAN) generator are read from the generator's runtime context. Based on the conditional input side location index, the embedding vector sequence corresponding to the global item embedding table of the current round is extracted from the embedding buffer and written into the GAN generator's input buffer. This triggers the GAN generator to perform forward inference processing and output candidate user agent representations. The candidate user agent representations are then written into the candidate user agent representation buffer and output. The candidate user agent representations contain candidate embedding vector sequences and time window features, which are used to support the generation of item identifier sequences and time window feature input elements for the tested recommendation model.

[0089] S3.3: Perform input mapping on the candidate user agent representation according to the input constraints of the tested recommendation model, generate inference requests, input them into the tested recommendation model, and output candidate interaction sequences;

[0090] Furthermore, the input constraints of the tested recommendation model are read, and based on these constraints, dimension alignment, field rearrangement, and format conversion are performed on the candidate user agent representations to form inference requests. Each candidate embedding vector sequence in the candidate user agent representation is matched against the item identifier embedding table of the tested recommendation model for similarity. The item identifier corresponding to the entry with the highest similarity is selected and written into the item identifier sequence. The time window features in the candidate user agent representations are written into the time window feature field of the inference request. The inference request is written into the input buffer of the tested recommendation model, triggering forward inference. The output of the tested recommendation model is read and arranged into a candidate interaction sequence according to the interaction order, and then the candidate interaction sequence is output.

[0091] It should be noted that the tested recommendation model refers to the target recommendation model driven by the poisoned sample, used to output recommendation results, and used for security evaluation; it is the recommendation system model that was attacked / evaluated. The recommendation system model uses item identifier sequences and time window features from local real-world interaction sequences as input elements. At the parameter level, it constructs user identifier embedding tables and item identifier embedding tables and completes index mapping. It concatenates the item identifier embedding vector sequence with the position encoding vector sequence to form a sequence representation. A sequence encoding network is used to extract contextual representations to obtain sequence latent vectors. Based on the sequence latent vectors and the item identifier embedding tables, a similarity score is calculated to output the candidate item ranking score, and a recommendation result set is formed accordingly.

[0092] The tested recommendation model plays two roles: one is to map the candidate user agent representations into inference requests according to the input constraints of the tested recommendation model after the generator outputs the candidate user agent representations and trigger forward inference to obtain the candidate interaction sequence; the other is to write the evaluation batch set into its offline inference interface to trigger forward inference during the evaluation stage, aggregate the recommendation result set, and perform difference measurement to form a data security evaluation result set.

[0093] The construction process of the tested recommendation model: Local real-world interaction sequences contain user identifier fields. When constructing the user identifier embedding table at the parameter level, the tested recommendation model reads the user identifier field and completes index mapping. The tested recommendation model uses the item identifier sequence and time window features of the local real-world interaction sequence as input elements. At the parameter level, it constructs user identifier embedding tables and item identifier embedding tables and completes index mapping. Based on the interaction order, it concatenates the item identifier embedding vector sequence and the positional encoding vector sequence to form a sequence representation. The tested recommendation model uses a sequence encoding network to perform context representation extraction on the sequence representation and outputs the sequence latent vector. Based on the sequence latent vector and the item identifier embedding table, the tested recommendation model performs similarity scoring and outputs candidate item ranking scores. The tested recommendation model arranges the candidate item ranking scores in descending order to form a recommendation result set, and uses the first few items of the recommendation result set as the output format of the candidate interaction sequence. The candidate interaction sequence is an ordered list of item identifiers corresponding to the first few items in the recommendation result set, used to represent the candidate output format of the tested recommendation model.

[0094] The training process of the tested recommendation model is as follows: The tested recommendation model constructs a training sample set from local real interaction sequences. The training sample set uses the sequence prefix as the input sequence and the real next interaction item identifier immediately following the input sequence as the supervision label. At the same time, negative sample item identifiers are extracted from the full set of items corresponding to the item identifier embedding table according to the item popularity feature constraint to form a comparison sample pair. The tested recommendation model performs batch forward inference on the training sample set to output the candidate item ranking score and calculates the loss value based on the supervision label and the negative sample item identifier. The tested recommendation model performs reverse update on the user identifier embedding table, the item identifier embedding table and the sequence coding network parameters and iterates for multiple training rounds. The tested recommendation model evaluates the hit rate index of the recommendation result set on the validation sample set and stops updating when the hit rate index enters the stable range to obtain the trained tested recommendation model.

[0095] S3.4: Perform target item perturbation on the candidate interaction sequence, synchronously execute consistency constraints, and generate poisoning candidate interaction sequences;

[0096] Furthermore, the target item identifier is input based on the poisoning safety assessment requirements and remains unchanged throughout the assessment. The interaction position filtering process includes avoiding the first and last interaction positions of the candidate interaction sequence and outputting a set of perturbation positions within the range of interaction positions in the middle of the sequence. The candidate interaction sequence and the target item identifier are read, and the interaction position filtering process is performed on the candidate interaction sequence to obtain a set of perturbation positions. The target item identifier is then written into the interaction positions corresponding to the perturbation position set to obtain a perturbation interaction sequence. Sequence length features, item popularity features, repetition features, and adjacent transfer statistics features are extracted from both the candidate interaction sequence and the perturbation interaction sequence. Consistency constraint verification is then performed. Based on the hierarchical bucket identifier associated with the candidate interaction sequence, the consistency constraint verification process extracts the allowed intervals for sequence length, item popularity, repetition, and adjacent transfer statistics from the hierarchical allowable range. A consistency constraint verification pass flag is written when the four types of features fall into their respective allowed intervals. The perturbation interaction sequence that satisfies the consistency constraint verification process is written into the poisoning candidate interaction sequence.

[0097] S3.5: Pair the candidate interaction sequences with the poisoning candidate interaction sequences according to a one-to-one correspondence to generate sequence pairs;

[0098] Furthermore, candidate interaction sequences and poisoning candidate interaction sequences are written into sequence identifiers, and an index record is created to store the sequence identifiers. Based on the sequence identifiers, a one-to-one match is performed between the candidate interaction sequences and the poisoning candidate interaction sequences to generate matching records. Based on the matching records, candidate interaction sequences and poisoning candidate interaction sequences are read one by one and combined according to a fixed field order to write into paired record entries. The hierarchical bucket identifiers of the candidate interaction sequences and poisoning candidate interaction sequences are read and written into the hierarchical bucket identifier field of the paired record entries, ensuring that the sequence pairs retain the hierarchical bucket identifiers. Deduplication checks are performed on the paired record entries, and duplicate entries are removed. The paired record entries are then aggregated and output as sequence pairs.

[0099] S4: Input the sequence pairs into the discriminator of the generative adversarial network and perform gating screening in combination with a hierarchical similarity threshold table to obtain the poisoning interaction sequence;

[0100] S4.1: Write the sequence pairs into the input buffer of the discriminator of the generative adversarial network, perform discriminator inference, retain the corresponding hierarchical bucket identifiers, and generate gated similarity scores;

[0101] Furthermore, the discriminator and sequence pairs of the stabilized generative adversarial network are read. The sequence pairs are read and candidate interaction sequences, poisoning candidate interaction sequences, and hierarchical bucket identifiers are extracted one by one. Based on the global item embedding table of the current round, sequence encoding processing is performed on the candidate interaction sequences and poisoning candidate interaction sequences to generate paired inputs. The paired inputs are written into the input buffer of the discriminator of the stabilized generative adversarial network and discriminator inference processing is performed. The gated similarity score output by the discriminator of the stabilized generative adversarial network is read, and the hierarchical bucket identifiers corresponding to the gated similarity scores are retained.

[0102] Read sequence pairs and extract candidate interaction sequences, poisoning candidate interaction sequences, and hierarchical bucket identifiers one by one. Based on the global item embedding table of the current round, perform sequence encoding processing on the candidate interaction sequences and poisoning candidate interaction sequences to generate paired inputs. Write the paired inputs into the input buffer of the discriminator of the updated generative adversarial network and perform discriminator inference processing. Read the gated similarity score output by the discriminator of the updated generative adversarial network.

[0103] S4.2: Read the hierarchical similarity threshold from the hierarchical similarity threshold table based on the hierarchical bucket identifier, and perform gating screening on the gating similarity score to obtain the poisoning interaction sequence;

[0104] Furthermore, the hierarchical bucket identifier, gating similarity score, and sequence pair association identifier are extracted one by one. Based on the hierarchical bucket identifier, the corresponding hierarchical similarity threshold is retrieved from the hierarchical similarity threshold table. Gating comparison processing is performed between the gating similarity score and the hierarchical similarity threshold. When the gating similarity score is not less than the hierarchical similarity threshold, a gating screening mark is generated as passed. When the gating similarity score is less than the hierarchical similarity threshold, a gating screening mark is generated as failed. Based on the gating screening mark, the poisoning candidate interaction sequence is extracted from the sequence pair and written into the poisoning interaction sequence according to the one-to-one correspondence with its hierarchical bucket identifier.

[0105] S5: Perform statistical consistency checks on the poisoning interaction sequences within the hierarchical allowable range and remove sequences with out-of-bounds deviations to obtain the poisoning interaction sequences for evaluation, and obtain the data security evaluation result set through the tested recommendation model;

[0106] S5.1: Extract sequence length features, item popularity features, repetition features, and adjacent transfer statistical features from local real interaction sequences one by one, and perform hierarchical aggregation processing to form a hierarchical reference statistical set;

[0107] Furthermore, the system reads local real interaction sequences and parses the order of interaction items one by one. For each local real interaction sequence, it calculates the number of interaction items to form a sequence length feature. Based on the item popularity category, it maps the item identifiers in the local real interaction sequence to form an item popularity feature. For each local real interaction sequence, it counts the continuous repetition segments of the same item identifier to form a repetition feature. For each local real interaction sequence, it extracts item identifier transfer pairs according to adjacent interaction items and counts the frequency of occurrence of transfer pairs to form an adjacent transfer statistical feature. Based on the hierarchical bucket index, it writes a hierarchical bucket identifier for each local real interaction sequence and aggregates the sequence length feature, item popularity feature, repetition feature, and adjacent transfer statistical feature according to the hierarchical bucket identifier and writes them into a hierarchical reference statistical set.

[0108] S5.2: Perform sorting and extreme value removal on the stratified reference statistical set, and perform boundary value selection on the sorting results after extreme value removal to form the stratified allowable range;

[0109] Furthermore, the hierarchical reference statistical set is read, and the sequence length feature item set, item popularity feature item set, repetition feature item set, and adjacent transfer statistical feature item set are extracted one by one according to the hierarchical bucket identifier. The sequence length feature item set, item popularity feature item set, repetition feature item set, and adjacent transfer statistical feature item set are sorted from smallest to largest, and extreme value removal is performed on the items at both ends of the sorted sequence to obtain a truncated sorted sequence. The low-end boundary value and high-end boundary value are extracted from the truncated sorted sequence (the low-end boundary value is extracted from the item corresponding to the low-end quantile index in the truncated sorted sequence, and the high-end boundary value is extracted from the item corresponding to the number of items in the truncated sorted sequence minus the low-end quantile index plus one). This forms the sequence length allowable interval, item popularity allowable interval, repetition allowable interval, and adjacent transfer statistical allowable interval. The sequence length allowable interval, item popularity allowable interval, repetition allowable interval, and adjacent transfer statistical allowable interval are written into the hierarchical allowable range along with the hierarchical bucket identifier and aggregated and output as the hierarchical allowable range.

[0110] S5.3: Extract sequence length features, item popularity features, repetition features, and adjacent transfer statistics from the poisoning interaction sequence, and combine them with the hierarchical bucket identifier to perform consistency verification and elimination processing on the poisoning interaction sequence according to the hierarchical allowable range, forming the poisoning interaction sequence for evaluation.

[0111] Furthermore, the order of interaction items is extracted from the poisoning interaction sequence. The number of interaction items is calculated for each poisoning interaction sequence to form a sequence length feature. The frequency of item identifiers is counted for each poisoning interaction sequence and sorted by the frequency of item identifiers to form an item popularity feature. Continuous repetition segments of the same item identifier are counted for each poisoning interaction sequence to form a repetition feature. Item identifier transfer pairs are extracted for each poisoning interaction sequence according to adjacent interaction items, and the frequency of transfer pairs is counted to form an adjacent transfer statistical feature. The hierarchical bucket identifier associated with the poisoning interaction sequence is read, and the allowed intervals for sequence length, item popularity, repetition, and adjacent transfer statistics are extracted from the hierarchical allowed range based on the hierarchical bucket identifier. The sequence length feature, item popularity feature, repetition feature, and adjacent transfer statistical feature are compared with the allowed intervals for sequence length, item popularity, repetition, and adjacent transfer statistics. Poisoning interaction sequences that exceed the allowed intervals are removed. The poisoning interaction sequences that pass the consistency check are aggregated and output as the evaluation poisoning interaction sequences.

[0112] S5.4: Perform batch arrangement processing on the poisoning interaction sequence used for evaluation and the local real interaction sequence according to the evaluation batch combination rules to form an evaluation batch set;

[0113] Furthermore, the evaluation poisoning interaction sequence and the local real interaction sequence are read and written with sequence identifiers respectively. The evaluation poisoning interaction sequence and the local real interaction sequence are matched with hierarchical bucket identifiers and sequence length features according to the evaluation batch combination rules to form a pairing list. Based on the pairing list, the evaluation poisoning interaction sequence and the local real interaction sequence are interleaved and written into batch record entries. The batch record entries are aggregated in the writing order and written into the evaluation batch set.

[0114] It should be noted that the evaluation batch combination rule uses the hierarchical bucket identifier as the primary key for arrangement. The evaluation poisoning interaction sequences that have passed the statistical consistency check and the local real interaction sequences are respectively grouped according to the hierarchical bucket identifier. Within each hierarchical bucket, a set of paired record entries is generated with the constraint of minimizing the difference in sequence length features. If the difference in sequence length features exceeds the allowable range of sequence length for that bucket, no paired record entries are created. Within each batch, only paired record entries corresponding to the same hierarchical bucket or not exceeding the upper limit of the number of hierarchical buckets determined by the data security evaluation requirements are selected to reduce distribution confounding. The batch size is obtained by testing the time consumption and resource consumption of the recommendation model under test on the current electronic device for single-batch inference. The proportion of evaluation poisoning interaction sequences is input by the data security evaluation requirements and written into the batch record entries. Within the batch, poisoning sequences are extracted from the set of paired record entries according to this proportion and alternately written into the same batch record entries with the corresponding real sequences. At the same time, each batch records the sequence identifier, hierarchical bucket identifier, pairing relationship, and extraction order. The extraction order is generated using a deterministic random seed generated by the combination of round identifier and batch number, so that the same set of evaluation batches can be reconstructed under the same embedded version record and the same batch parameters.

[0115] S5.5: Input the evaluation batch set into the tested recommendation model to obtain the recommendation result set, and perform difference measurement to form a data security evaluation result set;

[0116] Furthermore, the evaluation batch set is read and batch record entries are extracted one by one. The batch record entries are written into the offline inference interface of the tested recommendation model and the forward inference of the tested recommendation model is triggered. The output of the tested recommendation model is read and aggregated according to the sequence identifier in the batch record entries to form a recommendation result set. The recommendation result set is grouped according to the sequence identifier and a difference measurement process is performed. The difference measurement process includes the calculation of the change in ranking position within the recommendation result set and the calculation of the overlap of candidate entries within the recommendation result set. The results of the calculation of the change in ranking position and the calculation of the overlap of candidate entries are written into the data security evaluation result set.

[0117] It should be noted that the calculation of the change in ranking position uses the sequence identifier in the batch record entries as the pairing benchmark. The ranking positions of the target item identifiers in the recommendation result sets of the evaluation poisoning interaction sequences corresponding to the same sequence identifier and the recommendation result sets of the local real interaction sequences are read, and the absolute value of the difference between the two is written as the change in ranking position. The calculation of candidate item overlap uses the sequence identifier in the batch record entries as the pairing benchmark. The first K items of the two sets of recommendation result sets corresponding to the same sequence identifier are read, and the ratio of the number of intersection items to K is calculated and written as the candidate item overlap, where K is the number of the first few items output by the tested recommendation model.

[0118] In summary, this invention achieves hierarchical similarity scores by performing hierarchical classification and natural perturbation on local real interaction sequences to obtain naturally perturbed sequence pairs, inputting these pairs into the discriminator of a generative adversarial network, and then performing distribution statistical value processing on the hierarchical similarity scores to form a hierarchical similarity threshold table. This ensures that the hierarchical similarity threshold table is consistent with the distribution of local real interaction sequences and provides a self-consistent basis for subsequent gating screening, thereby improving the stability and reproducibility of the poisoning interaction sequence screening process and supporting the continuous output of data security evaluation result sets.

[0119] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A poisoning attack method in a recommender system based on generative adversarial networks, characterized in that: include, The local real interaction sequences are hierarchically classified and naturally perturbed to generate naturally perturbed sequence pairs. These pairs are then input into the discriminator of the generative adversarial network to output hierarchical similarity scores. Through distribution statistical value processing, a hierarchical similarity threshold table is obtained. Extract embedding drift representations from the global item embedding table of the current round and the global item embedding table of the previous round, and perform state transition updates on the generator parameters of the generative adversarial network to obtain the generator parameters of the current round. The generator parameters of the current round and the global item embedding table of the current round are input into the generator of the generative adversarial network, which outputs candidate user agent representations and obtains candidate interaction sequences through the tested recommendation model. Simultaneously, target item perturbation processing and consistency constraint processing are performed to generate sequence pairs. The sequence pairs are input into the discriminator of the generative adversarial network, and gating is performed using a hierarchical similarity threshold table to obtain the poisoning interaction sequence. Within the allowed range of stratification, statistical consistency checks are performed on the poisoning interaction sequences, and sequences with out-of-bounds deviations are removed to obtain the poisoning interaction sequences for evaluation. The data security evaluation result set is then obtained through the tested recommendation model.

2. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1, characterized in that, The specific steps for generating naturally perturbed sequence pairs are as follows: Local real interaction sequences are hierarchically categorized based on sequence length, item popularity, and time window characteristics to form a hierarchical bucket index. Based on the hierarchical bucket index, the local real interaction sequence is grouped and aggregated to obtain the hierarchical sample sequence corresponding to the hierarchical bucket index; The stratified sample sequences are naturally perturbed to generate naturally perturbed sequences, which are then combined with the stratified sample sequences to form naturally perturbed sequence pairs.

3. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1 or 2, characterized in that, The specific steps for obtaining the hierarchical similarity threshold table are as follows: The naturally perturbated sequence is input into the discriminator of the generative adversarial network, which outputs a similarity score. Then, hierarchical aggregation is performed based on the hierarchical bucket index to form a hierarchical similarity score. The hierarchical similarity scores are sorted, extreme values ​​are removed, and lower quantiles are selected to obtain the hierarchical similarity threshold corresponding to the hierarchical bucket index. The hierarchical similarity threshold and the hierarchical bucket index are written into the threshold record area in a one-to-one correspondence to form the hierarchical similarity threshold table.

4. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1, characterized in that, The specific steps for extracting the embedding drift representation from the global item embedding table of the current round and the global item embedding table of the previous round are as follows: Perform item identifier alignment processing on the global item embedding table of the current round and the global item embedding table of the previous round to generate an embedding alignment mapping table; Extract the current round embedding vector set and the previous round embedding vector set from the embedding alignment map table, and generate embedding alignment vector pairs.

5. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 4, characterized in that, The specific steps for obtaining the current round generator parameters are as follows: The embedding alignment vectors are subjected to vector difference extraction, scale normalization, and variation magnitude aggregation to generate an embedding drift representation. The embedded drift representation is written into the conditional input side of the generative adversarial network, and the transition identification information is written into the generator parameters of the generative adversarial network to obtain the state transition input set. Perform sequence encoding on the naturally perturbed sequence pairs and combine them with the state transition input set to form a transition training batch; Based on the transfer training batch, the generator parameters of the generative adversarial network are updated by performing state transfer processing to obtain the generator parameters for the current round.

6. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1 or 5, characterized in that, The specific steps for outputting the candidate user agent representation are as follows: Load the current round generator parameters into the parameter storage area of ​​the generative adversarial network generator, and load the current round global item embedding table into the condition input side of the generative adversarial network generator to obtain the generator runtime context; Generative adversarial network generator inference processing is performed on the generator runtime context to output candidate user agent representations.

7. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 6, characterized in that, The specific steps for generating sequence pairs are as follows: The candidate user agent representation is mapped according to the input constraints of the tested recommendation model to generate an inference request, which is then input into the tested recommendation model to output a candidate interaction sequence. The target item perturbation is applied to the candidate interaction sequence, and consistency constraints are applied synchronously to generate a poisoning candidate interaction sequence; The candidate interaction sequences are paired with the poisoning candidate interaction sequences in a one-to-one correspondence to generate sequence pairs.

8. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1 or 7, characterized in that, The specific steps for obtaining the poisoning interaction sequence are as follows: The sequence pairs are written into the input buffer of the discriminator of the generative adversarial network, discriminator inference is performed, and the corresponding hierarchical bucket identifiers are retained to generate gated similarity scores. Based on the hierarchical bucket identifier, the hierarchical similarity threshold is read from the hierarchical similarity threshold table, and gating screening is performed on the gating similarity score to obtain the poisoning interaction sequence.

9. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1, characterized in that, The specific steps for obtaining the poisoning interaction sequence for evaluation are as follows: Extract sequence length features, item popularity features, repetition features, and adjacent transfer statistical features from each local real interaction sequence, and perform hierarchical aggregation processing to form a hierarchical reference statistical set; The hierarchical reference statistical set is sorted and extreme value removal is performed, and boundary values ​​are taken on the sorted results after extreme value removal to form the hierarchical allowable range; According to the hierarchical allowable range, the poisoning interaction sequence is subjected to consistency verification and elimination processing to form the poisoning interaction sequence for evaluation.

10. The poisoning attack method in a recommendation system based on generative adversarial networks as described in claim 1 or 9, characterized in that, The specific steps for obtaining the data security evaluation result set through the tested recommendation model are as follows: The poisoning interaction sequence used for evaluation and the local real interaction sequence are batch-arranged according to the evaluation batch combination rules to form an evaluation batch set. The evaluation batch set is input into the tested recommendation model to obtain the recommendation result set, and the difference measurement is performed to form the data security evaluation result set.

Images