Knowledge-enhanced Shilling Attacks for Recommendation? (Discussion Paper)

Abstract

Collaborative ltering (CF) recommendation models lie at the core of most industrial engines due to their state-of-the-art performance. Their leading performance owes hugely on exploiting users' past feedbacks to identify similar user or item pairs. Unfortunately this similarity computation is vulnerable to shilling pro le injection attack, in which an attacker can insert fake user pro les into the system with the goal to alter the similarities and resulting recommendations in an engineered manner. In this work, we introduce SAShA, a new attack strategy that leverages semantic features extracted from a knowledge graph in order to strengthen the e cacy of the attack against standard CF models. Validation of the system is conducted across two publicly available datasets and various attacks, CF models and semantic information. Results underline the vulnerability of well-known CF models against the proposed semantic attacks compared with the baseline version.

Keywords

• Recommender System
• Knowledge Graph Shilling attack

-

With the increasing popularity of Internet commerce, online services, and the overwhelming volume of products, services, and multimedia content, recommender systems (RS) play a key role in mitigating the users' cognitive burden of over-choice. RS assist users' decision-making process by pointing them to a small set of items out of a large catalog (top-k recommendation list), based on users' past behaviors and preferences. The recommendation model can be broadly classi ed as content-based ltering (CBF), collaborative ltering (CF), and hybrid. CF models are the most popular choice in academic and industrial research (e.g.,

Amazon [ 19 ]) due to their high recommendation performance. Their key insight is that users' personal tastes correlate and then, from an algorithmic point of view, they mainly rely on the exploitation of user-user and item-item similarities. Di erent CF approaches can be classi ed into broad classes of memory-based and model-based. Memory-based approaches compute recommendations exclusively based on similarities in interaction patterns computed either across users (user-based CF) or items (item-based CF) [ 16 ]. Model-based exploits di erent machine learning techniques to compute a model, typically a latent representation of items and users [ 17 ], to generate recommendations. The most well-known example of a model-based approach is the matrix factorization (MF) model. Regardless of the type, both CF recommendation classes heavily rely on a su cient amount of user preference data in order to mine reliable similarity patterns. Unfortunately, due to the open nature of many online systems, a malicious agent can add fake pro les into the platform to leverage similar values and the following recommendation outcomes in an engineered manner. Such pro le injections are known as shilling attacks (or pro le injection attacks) [ 15 ] whose goal are often malicious, for example for pushing or nuking a target item into a the top-k recommendation list of users for market penetration or personal gain [ 10 ].

The other alternative approach CBF (or hybrid) relies on items' descriptive attributes in conjunction with the target user's previous preference over an item in order to create a pro le of the user characterizing the nature of her interest(s). While the earliest versions of CBF were purely textual using information such as metadata (tags, reviews) [ 21 ], modern versions utilize variety of other rich information sources such as social connections [ 6 ], audio and visual content [ 9,8 ] as well as users-item contextual data [ 2 ] to build more domain-dependent contextaware recommendations models. Another rich source of information and the one we exploit in this work has received increased attention from the community RS is the knowledge graph (KG). A KG can be viewed as a structured repository of knowledge, represented in the form of a graph, capable of encoding a diverse set of information: { Factual. General statements as Heraklion is the capital of Crete or Cyrus the Great was the founder of the rst Persian Empire in which an entity is described in term of a number of attributes, which are in turn connected with other entities in the KG; { Categorical. These statements bind an entity to a speci c category in the KG (i.e., the categories related to an article in Wikipedia pages), where the categories together form a hierarchy (can be general or speci c). { Ontological. We can classify entities in a more formal manner by utilizing a hierarchical structure of classes. In contrast to categories, here sub-classes and super-classes are connected through an IS-A relation.

In fact, KG constitute the foundation of the Semantic Web and are becoming increasingly important as they can represent data exploiting a manageable and inter-operable semantic structure. They are the pillars of well-known tools like IBM Watson [ 7 ], public decision-making systems [ 22 ], and advanced machine learning techniques [ 4 ]. For what concerns recommendation based on KG, they can be classi ed into: (i) path-based methods [ 14 ], which use meta-paths to evaluate the user-item similarities and, (ii) KG embedding-based techniques, that leverages KG embeddings to semantically regularize items latent representations [ 23,11 ].

The main contributions of this work are two-fold: 1. We build a novel type of shilling attacks against rating-based CF models that leverages the publicly available information resources from KG to build impactful shilling pro le attacks against CF models. 2. To investigate the relationship between semantic data characteristics and the robustness of CF models, we carried out extensive experiments involving two popular attack strategies against three well-known CF models across two real-world datasets. In total 84 simulation attacks were conducted to verify the impact of the semantic knowledge integration. 2

Our Proposed Approach - SAShA

When an attacker successfully inserts a malicious user pro le in the dataset, it needs to assign a set of rated items | besides the target item (it) | so that the pro le can be used in CF recommendation models. Table 1 shows the composition of the explored state-of-the-art attack pro les. For instance, IS (selected item set) is a set of items identi ed by the attacker to maximize the e ectiveness of the attack, while IF ( ller item set) includes a random set of items whose role is to make the attack imperceptible. Details about the attack pro le composition can be found in [ 15 ] and in the extended version of the current work [ 3 ].

In this work, we propose to foster the e cacy of state-of-the-art attack strategies by exploiting the semantic similarities between items using the information extracted from KGs. The key idea is that we can compute the semantic similarity between the target item it and all the items in the catalog using KG-derived features. Then, we use this information to select the ller items of each pro le to generate the set IF . A similarity value based on KG features leads to a more natural and coherent fake pro le, thanks to the semantic nature of KGs. Toward this goal, we propose two semantic-aware attacks by extended state-of-the art random and average attack: { Semantic-Aware Shilling Attack-random (SAShA-random) is an extension of Random Attack. The baseline version is a naive attack in which each fake user is composed only of random items. We modify this attack by extract items to ll IF from a subset of items that are most similar to it and use standard cosine similarity to compute item similarities by leveraging the semantic features [ 12 ]. Then, we build a set of most-similar items, considering the rst quartile of similarity values. Finally, we extract items from this set, adopting a uniform distribution. { Semantic-Aware Shilling Attack-average (SAShA-average) is an informed attack that extends the AverageBots attack [ 20 ]. It randomly samples the rating of each ller item from a normal distribution computed using the where ( , ) are the dataset average rating and rating variance, ( f , f ) are the ller item if rating average and variance, and min and max are respectively the minimum and maximum rating value. mean and the variance of the ratings. We extend the baseline by extracting the ller items from the sub-set of most similar items. We use as candidate items the ones in the rst quartile regarding their similarity with it. 3

Experimental Setting

In this section, we explain the experimental setting and results of the proposed attack framework (SAShA). We remind that full detail about the experimental procedure and evaluation can be found in [ 3 ].

Data: We conducted the proposed semantic average shilling attacks against rating-based CF models on three real-world datasets, LibraryThing [ 13 ] and Yahoo!Movies. The nal statistics of the dataset used for the experiment are summarized in Table 2.

Feature Extraction and Selection. We have extracted the semantic information to build SAShA exploiting the public available item-entity mapping to DBpedia. To analyze the impact of di erent feature types, we have performed experiments considering categorical (CS), ontological (OS) and factual (FS) features by utilizing single-hop (1H) and double-hop (2H) strategies.

{ CS-1H/2H, 1H includes having the property dcterms:subject, while 2H contains features with properties equal to either dcterms:subject or skos:broader; { OS-1H/2H, 1H considers the features with the property rdf:type, while in 2H the properties include rdf:type, rdf-schema:subClassOf or owl:equivalentClass; { FS-1H/2H, 1H uses all the features except ontological and categorical ones, while 2H choose features not included in the previous 2H categories.

Given the million-sized quantity of features obtained, we removed irrelevant features based on the sanity check procedure explained in [ 5 ].

Compared CF Recommendation Models: We have conducted experiments considering all the two attacks described in Section 2 against there most widely If some domain-speci c categorical/ontological features are not in the respective lists, we have considered them as factual features. used CF models: User-k NN and Item-k NN (Pearson Correlation, number or neighbors: 40), and SVD (a matrix factorization model trained by considering 100 latent factors) [ 3 ]. 1% 2.5% 5%

Evaluation Metrics Let IT be set of attacks item and UT the users that have not rated items in IT . We de ne the Overall Hit-Ratio@k denoted with (HR@k) as the average of hr@k for each attacked item according to HR@k(IT ; UT ) = Pi IT hjIrT@jk(i;UT ) where hr@k(i; UT ) measures the number of occurrences of the attacked item i in the top-k recommendation lists of the users in jUT j [ 1 ]. Evaluation Protocol. For each dataset, we have generated the recommendations concerning all users using the selected CF models (i.e., User-k NN, Itemk NN and MF). After computing baseline attacks, we have performed a series of SAShA attacks as described in Section 2 by considering di erent feature types (i.e., categorical, ontological and factual) extracted at 1 or 2 hops. each attack is a push attack. We have performed the attacks considering a di erent amount of added fake user pro les: 1%; 2:5% and 5% of the total number of users. We have tested the attacks considering 50 randomly sampled target items [ 20,10 ]. 4

Results and Discussion

In this section, we present the results of experiments carried out. Table 3 summarizes the results of the HR@10 regarding the considered dimensions. In particular, the inner elements in the Table are related to KG semantic dimension and include: feature types in the rows (CF, OS and FS) number of hops in the columns (1H, 2H). However, the outer elements (dimensions) in Table 3, are the attack strategies in the rows (SAShA-Rnd and SAShA-Avg), and CF recommendation models in the columns (User-kNN, Item-kNN and SVD). Finally, we report the results for three levels of attack power (1%, 2.5% and 5%) reported in the three panels of the Table.

The impact of semantics. By looking at the improvement percentages, the general trend is that, for each <attack, CF> pair, one of the values for 1H or 2H is better than baseline attack performance. For instance, for <Rnd, UserkNN> on LibraryThing, the relative improvements for 1H and 2H are 9.4% and 1.3%, both obtained for attacks integrated with ontological features setting (OS) features. Relative improvements on Yahoo!Movies tend to be larger e.g., consider 14.8% and 23.8% for the same <attack, CF> pair. Regarding the impact of each feature category, in the majority of cases, ontological features setting (OS) provides the best results, followed by categorical features setting (CS). The FS seems to have a little impact on the attack e ectiveness. We believe this may be due to a noise introduced by the exploitation of heterogeneous (factual) features. On the other side, ontological features make the similarity between items more evident. Finally, categorical features guarantee competing performance since CF recommendation relies on the a nity between items' categories. Analysis of the semantic-encoded variant of attacks. The second study is devoted to comparing the impact of semantics on the di erent attacks (Rnd, Avg) . The Rnd attack provides signi cant (or substantially high) improvement of attack e cacy on the base version in at least one semantic-con guration. However, regarding Avg attack, it is worth noticing that, even here, the injection of semantics is generally bene cial for the adversary. Nevertheless, the semantic integration, for Avg attack, has a lower impact than its use for Rnd version. We explain this behavior with the generally high performance of Avg attack, that leaves less room for improvements. Additionally, if we consider the di erent recommendation models, the semantics ensure attack performance improvement. Among all, the semantic-encoded variants of attacks are particularly e ective on User-kNN in both datasets. 5

Conclusion

The goal of this work is to investigate the e ect of integrating semantic information, obtained from KGs, to foster the shilling attack e cacy. The proposed attack strategy, SAShA, extends random and average attacks by integrating public available semantic information. In detail, SAShA takes advantage of semantics to create more e ective fake pro les. Toward this goal, extensive experiments were carried out by considering di erent collaborative recommendation models, di erent attack strategies, and three categories of semantic features (categorical, ontological, and factual). Results on two real-world datasets underline the signi cant vulnerability of standard recommendation models when semantics are integrated into the attack strategy. We plan to investigate di erent sources of publicly available knowledge (e.g., Wikidata), to semantically extend other state-of-the-art attacks. Finally, we are interested in investigating the possibility of semantics knowledge exploitation for defensive strategies.

Acknowledgments. The authors acknowledge partial support of the following projects: Innonetwork CONTACT, Innonetwork APOLLON, ARS01 00821 FLET4.0, Fincons Smart Digital Solutions for the Creative Industry.

References

1. Aggarwal , C.C. : Attack-resistant recommender systems . In: Recommender Systems . Springer ( 2016 )

2. Anelli , V.W. , Bellini , V. , Di Noia , T. , Bruna , W.L. , Tomeo , P. , Di Sciascio , E. : An analysis on time- and session-aware diversi cation in recommender systems . In: UMAP. ACM ( 2017 )

3. Anelli , V.W. , Deldjoo , Y. , Di Noia , T. , Di Sciascio , E. , Merra , F.A. : Sasha: Semantic-aware shilling attacks on recommender systems exploiting knowledge graphs . In: The Semantic Web - 17th International Conference, ESWC 2020 , Heraklion, Crete, Greece, May 31- June 4, 2020 , Proceedings ( 2020 )

4. Anelli , V.W. , Di Noia, T.: 2nd workshop on knowledge-aware and conversational recommender systems - kars . In: CIKM. ACM ( 2019 )

5. Anelli , V.W. , Noia , T.D., Sciascio , E.D. , Ragone , A. , Trotta , J.: How to make latent factors interpretable by feeding factorization machines with knowledge graphs . In: The Semantic Web - ISWC 2019 - 18th Int. Semantic Web Conf ., Auckland , New Zealand, October 26-30 , 2019 , Proceedings, Part I. vol . 11778 ( 2019 )

6. Backstrom , L. , Leskovec , J.: Supervised random walks: predicting and recommending links in social networks . In: Proceedings of the Forth International Conference on Web Search and Web Data Mining, WSDM 2011 , Hong Kong , China, February 9- 12 , 2011 ( 2011 )

7. Bhatia , S. , Dwivedi , P. , Kaur , A. : That's interesting, tell me more! nding descriptive support passages for knowledge graph relationships . In: International Semantic Web Conference (1). Lecture Notes in Computer Science , vol. 11136 . Springer ( 2018 )

8. Deldjoo , Y. , Constantin , M.G. , Eghbal-Zadeh , H. , Ionescu , B. , Schedl , M. , Cremonesi , P. : Audio-visual encoding of multimedia content for enhancing movie recommendations . In: Proceedings of the 12th ACM Conference on Recommender Systems, RecSys 2018 , Vancouver, BC, Canada, October 2- 7 , 2018 ( 2018 )

9. Deldjoo , Y. , Dacrema , M.F. , Constantin , M.G. , Eghbal-zadeh, H ., Cereda , S. , Schedl , M. , Ionescu , B. , Cremonesi , P. : Movie genome: alleviating new item cold start in movie recommendation . User Model. User-Adapt. Interact . 29 ( 2 ) ( 2019 )

10. Deldjoo , Y. , Di Noia , T. , Merra , F.A. : Assessing the impact of a user-item collaborative attack on class of users . In: ImpactRS@RecSys. CEUR Workshop Proceedings , vol. 2462 . CEUR-WS.org ( 2019 )

11. Di Noia , T. , Magarelli , C. , Maurino , A. , Palmonari , M. , Rula , A. : Using ontologybased data summarization to develop semantics-aware recommender systems . In: ESWC. Lecture Notes in Computer Science , vol. 10843 . Springer ( 2018 )

12. Di Noia , T. , Mirizzi , R. , Ostuni , V.C. , Romito , D. , Zanker , M. : Linked open data to support content-based recommender systems . In: Proc. of the 8th Int. Conf. on Semantic Systems. ACM ( 2012 )

13. Di Noia , T. , Ostuni , V.C. , Tomeo , P. , Di Sciascio , E.: Sprank: Semantic pathbased ranking for top-N recommendations using linked open data . ACM TIST 8 ( 1 ) ( 2016 )

14. Gao , L. , Yang , H. , Wu , J. , Zhou , C. , Lu , W. , Hu , Y. : Recommendation with multisource heterogeneous information . In: IJCAI. ijcai.org ( 2018 )

15. Gunes , I. , Kaleli , C. , Bilge , A. , Polat , H.: Shilling attacks against recommender systems: a comprehensive survey . Artif. Intell. Rev . 42 ( 4 ) ( 2014 )

16. Koren , Y. : Factor in the neighbors: Scalable and accurate collaborative ltering . TKDD 4 ( 1 ) ( 2010 )

17. Koren , Y. , Bell , R.M. , Volinsky , C. : Matrix factorization techniques for recommender systems . IEEE Computer 42(8) ( 2009 )

18. Lam , S.K. , Riedl , J.: Shilling recommender systems for fun and pro t . In: WWW. ACM ( 2004 )

19. Linden , G. , Smith , B. , York, J.: Amazon. com recommendations: Item-to-item collaborative ltering . IEEE Internet Computing 7 ( 1 ) ( 2003 )

20. Mobasher , B. , Burke , R.D. , Bhaumik , R. , Williams , C. : Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness . ACM Trans. Internet Techn . 7 ( 4 ) ( 2007 )

21. Ning , X. , Karypis , G.: Sparse linear methods with side information for top-n recommendations . In: Cunningham, P. , Hurley , N.J. , Guy , I. , Anand , S.S . (eds.) Sixth ACM Conference on Recommender Systems, RecSys '12 , Dublin, Ireland, September 9- 13 , 2012 . ACM ( 2012 )

22. Shadbolt , N., O'Hara , K. , Berners-Lee , T. , Gibbins , N. , Glaser , H. , Hall , W., m. c. schraefel: Linked open government data: Lessons from data . gov.uk. IEEE Intelligent Systems 27 ( 3 ) ( 2012 )

23. Wang , H. , Zhang , F. , Xie , X. , Guo , M.: DKN: deep knowledge-aware network for news recommendation . In: WWW. ACM ( 2018 )