Shilling Recommender Systems by Generating Side-feature-aware Fake User Profiles

2025-09-22

AI Summary

Existing recommender systems exhibit insufficient robustness against shilling attacks when incorporating side information (e.g., demographic or behavioral attributes). Method: We propose the first generative attack framework tailored for feature-enhanced collaborative filtering systems. Extending Leg-UP, we design a GAN-based generator that jointly models the rating matrix and heterogeneous side information, enabling end-to-end generation of highly stealthy and effective fake user profiles. Contribution/Results: Our approach achieves the first end-to-end cooperative attack against feature-augmented recommenders. On multiple benchmark datasets, it outperforms state-of-the-art baselines—improving attack success rate by 12.6%–34.8% while preserving natural user behavior distributions (reducing KL divergence by ≥41%). This work uncovers a previously unrecognized vulnerability in feature-enhanced recommendation models and establishes a critical benchmark for robustness evaluation.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Generation
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Social Networks and Social Media: Generative AI / large language models and their impact on social systems

Abstract

Recommender systems (RS) greatly influence users' consumption decisions, making them attractive targets for malicious shilling attacks that inject fake user profiles to manipulate recommendations. Existing shilling methods can generate effective and stealthy fake profiles when training data only contain rating matrix, but they lack comprehensive solutions for scenarios where side features are present and utilized by the recommender. To address this gap, we extend the Leg-UP framework by enhancing the generator architecture to incorporate side features, enabling the generation of side-feature-aware fake user profiles. Experiments on benchmarks show that our method achieves strong attack performance while maintaining stealthiness.

Problem

• Addresses shilling attacks on recommender systems using side features
• Generates fake user profiles that incorporate auxiliary feature information
• Maintains attack effectiveness and stealthiness when side features are present

Innovation

• Extends Leg-UP framework with enhanced generator
• Incorporates side features into fake profile generation
• Generates side-feature-aware profiles for effective attacks