IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion

TL;DR

This paper introduces IndirectAD, a data poisoning attack that effectively manipulates recommender systems using fewer controlled accounts by promoting trigger items to indirectly boost target items, posing a significant security threat.

Contribution

The paper presents a novel indirect poisoning attack method that reduces the required poisoning ratio by leveraging trigger items, demonstrating its effectiveness on multiple datasets and systems.

Findings

Effective with only 0.05% user base poisoned

Remains potent in large-scale recommender systems

Significantly impacts recommendation outcomes

Abstract

Recommender systems play a central role in digital platforms by providing personalized content. They often use methods such as collaborative filtering and machine learning to accurately predict user preferences. Although these systems offer substantial benefits, they are vulnerable to security and privacy threats, especially data poisoning attacks. By inserting misleading data, attackers can manipulate recommendations for purposes ranging from boosting product visibility to shaping public opinion. Despite these risks, concerns are often downplayed because such attacks typically require controlling at least 1% of the platform's user base, a difficult task on large platforms. We tackle this issue by introducing the IndirectAD attack, inspired by Trojan attacks on machine learning. IndirectAD reduces the need for a high poisoning ratio through a trigger item that is easier to recommend to the target users. Rather than directly promoting a target item that does not match a user's interests, IndirectAD first promotes the trigger item, then transfers that advantage to the target item by creating co-occurrence data between them. This indirect strategy delivers a stronger promotion effect while using fewer controlled user accounts. Our extensive experiments on multiple datasets and recommender systems show that IndirectAD can cause noticeable impact with only 0.05% of the platform's user base. Even in large-scale settings, IndirectAD remains effective, highlighting a more serious and realistic threat to today's recommender systems.