When Graph Contrastive Learning Backfires: Spectral Vulnerability and Defense in Recommendation

TL;DR

Graph contrastive learning, while improving recommendation systems, can inadvertently increase vulnerability to targeted promotion attacks due to spectral smoothing effects, but spectral irregularity mitigation can counteract this issue.

Contribution

This paper uncovers the spectral vulnerability of GCL in recommendation systems and proposes a mitigation framework called SIM to enhance robustness against targeted attacks.

Findings

GCL increases susceptibility to targeted promotion attacks.

Spectral smoothing disperses item embeddings, exposing target items.

SIM effectively detects and suppresses targeted items.

Abstract

Graph Contrastive Learning (GCL) has demonstrated substantial promise in enhancing the robustness and generalization of recommender systems, particularly by enabling models to leverage large-scale unlabeled data for improved representation learning. However, in this paper, we reveal an unexpected vulnerability: the integration of GCL inadvertently increases the susceptibility of a recommender to targeted promotion attacks. Through both theoretical investigation and empirical validation, we identify the root cause as the spectral smoothing effect induced by contrastive optimization, which disperses item embeddings across the representation space and unintentionally enhances the exposure of target items. Building on this insight, we introduce CLeaR, a bi-level optimization attack method that deliberately amplifies spectral smoothness, enabling a systematic investigation of the susceptibility of GCL-based recommendation models to targeted promotion attacks. Our findings highlight the urgent need for robust countermeasures; in response, we further propose SIM, a spectral irregularity mitigation framework designed to accurately detect and suppress targeted items without compromising model performance. Extensive experiments on multiple benchmark datasets demonstrate that, compared to existing targeted promotion attacks, GCL-based recommendation models exhibit greater susceptibility when evaluated with CLeaR, while SIM effectively mitigates these vulnerabilities.