Visually-aware recommendation leverages visual signals of product images extracted through Deep Neural Networks to improve the recommendation performance. However, human-imperceptible adversarial noise can alter recommendation outcomes, e.g., pushing/nuking specific product categories. In this work, we provide 24 combinations of attack/defense strategies, and visual-based recommenders to 1) access performance alteration on recommendation and 2) empirically verify the efect on final users through ofline-visual metrics. The results suggest defense is not protecting recommender models as expected, and shed light on the importance of human evaluation to identify visual attacks on recommendations. Source code, data, and experimental parameters are available at https://github.com/sisinflab/ Perceptual-Rec-Mutation-of-Adv-VRs.
a. Clean Rec. Position: 68th
Given the set of users , items ℐ, the matrix of historical interactions , the recommendation
problem is defined as the task to suggest products by maximizing the user’s gain (). The
state-of-the-art RS, BPR-MF [
The dependence of a VRS from the visual signal in Equation 2 has been exploited by adversaries
to poison the training data with the insertion of adversarial samples [
∑︁ (,,)∈ − ln (^ − ^ ) + ‖ ‖22 max :‖ ‖≤
ℒ ( + , ) s.t. = where ℒ is the cost function of , is the -bounded perturbation of that will make the product image be misclassified by as the (more popular) product category , and ‖·‖ is the norm. For instance, the adversary can poison the data adding a perturbed image of “Jersey, T-shirt” misclassified as “ Brassiere” (Fig. 1) causing a variation in the VRS since will be extracted from = + .
Recently, studies on the robustification of DNNs have shown the adversarial training by
Goodfellow et al. [
max where ̃︀ represents the model parameters of the robustified network ( ̃︀).
Let ̃︀ the visual features of the image associated to a product image extracted from ̃︀.
In this work, we want to verify if the application of adversarial training methods can limit
poisoning attacks against VRSs [
Setup. The experiments are conducted on two fashion datasets, i.e., Amazon Women and
Amazon Men made publicly available by He and McAuley [
To empirically study the eficacy of defenses and evaluate the visual appearance of adversarial
samples, we tested two VRS: VBPR by He and McAuley [
Analyzing VBPR outcomes, PGD attack shows the highest variation of @20 in the defense-free experiments. For instance, PGD ( = 8) increases by more than 2.3 times the @20 of the source category in the <Amazon Women, VBPR, Traditional> setting. The same trend is not true for the defense contexts. C&W attacks have increased the @20 by 71.09%, while PGD ( = 8) by 69.35%. Furthermore, Table 1 confirms that the adversarial training strategies have failed in protecting VBPR since the data poisoning is always efective in any defended settings.
Investigating AMR results, the attacks are quite efective in the defense-free settings as much as in VBPR, and confirm PGD ( = 8) as the most powerful method. Interestingly, the joint usage of (1) adversarial training procedures on the DNN and (2) the adversarial regularization on the recommender embeddings (APR) significantly reduced the efectiveness of the dataset poisoning. Indeed, 75% of attacks have not increased the @20 of the low popular category of products.
Visual Evaluation. To investigate the eficacy of attacks in poisoning the VRS, we studied
the attack Success Rate (), the Feature Loss ( ), and the Learned Perceptual Image Patch
Similarity ( ) [
Table 2 reports the results, along with and values. It is worth recalling that a large (small) value stands for semantically diferent (similar) images from DNN’s point of view. Similarly, a large (small) value means the two compared images would likely be considered as visually diferent (similar) by humans.
Two general observations arise here. First, the is strictly correlated to the , i.e., an
attack is successful when the extracted features are noticeably shifted in the latent space. Second,
all attack combinations are able to keep values within low ranges, in accordance with
the imperceptible nature of adversarial perturbations on images [
Defense-free Setting. In the defense-free scenario, PGD ( = 4) is the least perceptible attack —with the lowest values— even considering a near-100% and a successful pushing of attacked products. On the other hand, FGSM ( = 8) fails to hide the produced perturbations, reaching the highest perceptible visual diference on Amazon Women (2.8505). Coherently, this setting also shows a low and a weak alteration of visual recommendations (see Table 1).
Defense Setting. Let us focus on the two defenses. Here, it becomes fundamental to consider the value along with its corresponding and recommendation variations. As a matter of fact, in a defense context, where all attacks averagely tend to perform worse at failing the DNN classifier, a measured low average value might trivially mean very few images were successfully attacked. For instance, the described situation occurs in the combination <Amazon Men, PGD ( = 4), Adversarial Training>. However, since these attacks have still been efective in pushing low ranked category products (as evident in Table 1), then adversaries could exploit their hardly-human perceptibility to craft even stronger perturbations (e.g., increasing ). An intriguing situation is when on the defended DNN is higher than the non-defended one. The worst case is <Amazon Men, FGSM ( = 8), Adversarial Training>, which shows a 34% increase of compared to the Traditional training. We explain this result considering that and attack might need to produce larger perturbations to move the category of the few correctly attacked images (about 24% in the cited example) towards the targeted one. Not only is the attack ineficient, but it risks human identification.
We have presented an empirical study to evaluate the eficacy of defenses (i.e., Adversarial Training and Free Adversarial Training) to protect DNNs on top of visually-aware recommender systems when poisoning product image datasets with adversarial attacks. Experiments on state-of-the-art visual recommenders VBPR and AMR trained on two datasets (i.e., Amazon Women and Amazon Men) demonstrated the alarming weakness of adversarial training in protecting the recommendation performance. Furthermore, the visual evaluation suggested defense scenarios with few successfully attacked images and barely perceptible visual artifacts that still keep breaking recommendation performance are blind spots that adversaries could explore deeper for their malicious purposes. Conclusively, we plan to study attack eficacy on overall recommendation performance (accuracy and beyond-accuracy), propose novel end-to-end defenses, provide a parallel in-depth study on the impact of perturbed images for humans, the users of the platforms.
The authors acknowledge partial support of the following projects: Innonetwork CONTACT, Innonetwork APOLLON, ARS01_00821 FLET4.0, Fincons Smart Digital Solutions for the Creative Industry, PON OK-INSAID.