Preventing the Popular Item Embedding Based Attack in Federated Recommendations

2024-05-13

IEEE International Conference on Data Engineering

AI Summary

This work addresses a novel poisoning attack—Popularity-Induced Embedding Corruption Attack (PIECK)—in federated recommendation systems (FRS). PIECK is model-agnostic and requires no prior knowledge; it identifies popular items by exploiting embedding dynamics during training and maliciously amplifies exposure of target items and user embeddings. We propose the first dual-path attack paradigm: PIECK-IPE (Item Popularity Exploitation) and PIECK-UEA (User Embedding Amplification). To counter this threat, we design a robust dual-regularization defense combining embedding alignment and gradient regularization, balancing robustness and recommendation accuracy. Extensive experiments across two base models and three real-world datasets demonstrate that PIECK outperforms four state-of-the-art poisoning attacks. Moreover, our defense effectively mitigates PIECK while preserving recommendation performance, surpassing six mainstream defense methods in both robustness and utility.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Graph embeddings and representation learning for Web-related graphs

Abstract

Privacy concerns have led to the rise of federated recommender systems (FRS), which can create personalized models across distributed clients. However, FRS is vulnerable to poisoning attacks, where malicious users manipulate gradients to promote their target items intentionally. Existing attacks against FRS have limitations, as they depend on specific models and prior knowledge, restricting their real-world applicability. In our exploration of practical FRS vulnerabilities, we devise a model-agnostic and prior-knowledge-free attack, named PIECK (Popular Item Embedding based Attack). The core module of PIECK is popular item mining, which leverages embedding changes during FRS training to effectively identify the popular items. Built upon the core module, PIECK branches into two diverse solutions: The PIECKIPE solution employs an item popularity enhancement module, which aligns the embeddings of targeted items with the mined popular items to increase item exposure. The PIECKUEA further enhances the robustness of the attack by using a user embedding approximation module, which approximates private user embeddings using mined popular items. Upon identifying PIECK, we evaluate existing federated defense methods and find them ineffective against PIECK, as poisonous gradients inevitably overwhelm the cold target items. We then propose a novel defense method by introducing two regularization terms during user training, which constrain item popularity enhancement and user embedding approximation while preserving FRS performance. We evaluate PIECK and its defense across two base models, three real datasets, four top-tier attacks, and six general defense methods, affirming the efficacy of both PIECK and its defense.

Problem

• Addresses vulnerabilities in federated recommender systems.
• Proposes a model-agnostic attack method named PIECK.
• Introduces a novel defense against PIECK attacks.

Innovation

• Model-agnostic attack method
• Popular item mining technique
• Regularization-based defense strategy