Online shops, streaming services, and booking systems use algorithms to recommend items from their stock to users. These recommendations are often calculated based on the interactions of other users with the items, e.g., buying a product or watching a movie. This creates an attack point where the outcome of recommendation algorithms can be purposefully manipulated by manually or automatically created user interactions, aimed to raise or lower the relevance of speci c items. We study the attackability of recommender algorithms by simulating a series of attacks on six recommendation algorithms, using three attack strategies, and two opposing attack objectives. We run these experiments with varying numbers of co-ratings per attack and evaluate the overall item ranking and an average change in average rank. Our results show that the e ort required of and the e ciency reached by the attacks greatly depends on the strategy, objective, and recommendation algorithm. Additionally, the calculated average change in average rank provides an indicator about the attackability of recommendation algorithms. We nd that neighborhood- and cluster-based algorithms show a higher vulnerability against attacks compared to algorithms based on matrix factorization.
Recommender systems are ubiquitous in today's online
world as they provide users of, for instance, online shops,
video, and music streaming services with recommendations
of items that might be interesting to them [
rative ltering recommender algorithms, rating predictions
are frequently computed based on user similarity, which is
captured by co-rated items of a pair of users. This opens
a possibility for manipulations of the computed
recommendations, as the ratings stem from the user base and their
interactions with the system. One type of possible
manipulations is shilling attacks [
form of \Customers who viewed this article, also viewed ...". To manipulate these recommendations, a group of attackers interacted with two di erent books multiple times, aiming to make the second book appear in the recommendation section of the rst book, although it diverged in content and genre. It is unknown how many people were involved exactly and how often the two books were co-viewed, but this example shows vulnerabilities that can be abused to manipulate the outcome of recommender systems.
For this paper, we focus on co-rating attacks, a speci c form of shilling attacks. A co-rating attack means that a single attack in an attack series consists of two ratings, e.g., one rating of user B for item X and one rating of user B for item Y, to in uence the rating behavior of the targeted system, possibly for one speci c user A. We call user A the target user and user B the auxiliary user. Similarly, we call item X the target item and item Y the auxiliary item, and the attack aims to raise the predicted ratings for the target item X. The contribution of this work is two-fold: (i) we provide a systematic evaluation of the vulnerability of recommendation algorithms against co-rating attacks and the e ort required for such attacks to be successful, and (ii) we propose a new metric to measure the attackability and hence, the vulnerability (respective resilience) of recommendation algorithms against di erent co-rating attack strategies. 2.
recommender systems and measures that aim to quantify these attacks.
Lam et al. [
scope of this work, as they are more in the area of classic security topics. We focus on the manipulation of bias instead.
a higher relevance when calculating the recommendations, purely due to its popularity. This is in contrast with the main purpose of recommender systems, namely, to suggest items to users that t their personal taste.
mensions. They termed the rst category push attacks; their purpose is to increase the predicted ratings for a speci c item. The attacks in the second category are nuke attacks, which aim to lower the predicted ratings for a speci c item.
The last category described serves the purpose of rendering
the recommender system ine ective and unpredictable. One
additional dimension for attacks lies in the strategy when
selecting the auxiliary user and item. Mobasher et al. [
[
tionally consider algorithms based on matrix factorization
(MF) [
Burke et al. [
O'Mahony et al. [
The general idea of our work is to capture the e ort
required for an attack to be successful and the impact of
corating attacks on the predicted ratings. The required e ort
can be measured by the number of co-ratings used in an
attack, i.e., the number of interactions of the auxiliary user
with the target item and the auxiliary item in the form of
two rating entries in the dataset. We consider a push attack
to be successful if the targeted item reaches the top-10
recommendations, as this increases the visibility of the item and
previous research has shown that a list of ten
recommendations can be a sensible choice in regards to set attractiveness
and choice di culty [
dataset [
Our experiments are organized in individual steps. A step can be viewed as the current state of the experiment, including the dataset, the training of the algorithm, and the predicted ratings. For each recommender algorithm, we start with zero co-ratings, train the algorithm on the unmodi ed dataset, and calculate the rankings per item for each user and the average rank per item over all users. We refer to this as step 0, and subsequently, add a single co-rating to the dataset (and hence, run an attack); we refer to this as step 1 and repeat this procedure. In each step, we compute the change in the rank and the average rank for the target item. We hypothesize that a noticeable e ect should be reached within 100 iterations, therefore using this number as the maximum number of steps in our experiments.
recommendation algorithm, attack strategy, attack purpose, and the number of steps, where the attack purpose is de ned as whether the goal of the attack is to lower or raise the rank of the target item, whereas the attack strategy describes how the auxiliary user and the auxiliary item are selected.
3.1
di erent recommendation algorithms behave when exposed
to co-rating attacks, we evaluate six recommendation
algorithms3. We selected two k-Nearest Neighbor [
for a user A are computed using the ratings of other users who share rated items with A. E.g., user A rated item X and Y, and user B only rated item X. The rating di erence of user B is added to the rating of user A's rating for item
2https://grouplens.org/datasets/movielens/100k/
library https://github.com/NicolasHug/Surprise
all users.
Singular Value Decomposition (SVD) [
which is used by Net ix [
sen algorithms, the algorithms were evaluated using ve-fold cross-validation using the MovieLens dataset and the conguration parameters as they were used in our experiments.
KNNBasic KNNWithMeans SVD
NMF
SlopeOne CoClustering
In the following, we investigate three di erent co-rating
attack strategies. Our rst attack strategy is the baseline
approach (BASIC), where the auxiliary user is created as a
fresh new user, i.e., a user that has not provided any
ratings so far. The second attack strategy is the user activity
approach (ACT), where the auxiliary user is selected based
on the rating activity of the user|the dataset is analyzed
at runtime, and the most active user is determined and
misused as the auxiliary user, based on the data in step 0. The
third attack strategy is the user similarity approach (SIM),
where the user most similar to the target user is selected as
the auxiliary user. The core idea here is that user similarity
metrics are also used in collaborative ltering recommender
algorithms [
user|i.e., we aim to measure the impact of the co-rating attacks on the movie rankings for this user. For our experiments, the user with user-id 1 was picked as the target user. The movie \The Truth About Cats & Dogs (1996)" (movie id 111) was randomly selected as the auxiliary item from the set of movies the target user rated with ve stars. The movie \Scream of Stone (Schrei aus Stein) (1991)" (movie id 1682) was selected as the target item, because it was the newest movie in the dataset (highest movie id) and because the movie has not been rated by the target user yet. Table 2 shows some statistics about the data before co-ratings are added and the chosen user and movies. The data collected shows that the target-user is quite active, with more than double the number of ratings than the average user and more than four times the number of ratings than the median over all users. We can also see that the mean ratings and the standard deviation for the target user are higher than the mean rating for all users. The data for the auxiliary movie shows that the movie is rated more often, but only a little lower, than the average movie. The target movie has only a single rating in the original data, which should be bene cial for our attacks.
high ratings for both movies (and hence, co-rating these) until the target item appears in a prominent position in the target user's list of recommended movies.
For running the experiments, in the rst step, the raw dataset is used to train the recommender algorithms to be evaluated. These trained models are then used to predict the ratings for all items for all users, from which we infer a ranking of all items for each user. These per-user rankings are then used to compute the average rank for each item over all users. In the next step, one co-rating is added to the dataset. Subsequently, the extended dataset is used for computing updated rankings for all items for all users and the average rank over all users. This procedure is repeated 100 times for each algorithm, providing the rank of the target item for the target user and the average rank over all users, and also the change in rank between the individual steps, to show the e ect of the attack from one step to the next. 3.3
We evaluate the three attack strategies for both pull attacks (aiming to lower the predicted rating of the target item) and push attacks (aiming to raise the predicted rating of the target item). For push attacks, it is su cient to pick an item that has not been rated by the target user, as the target item. For pull attacks, in contrast, we computed the recommendation lists, based on the data in step 0, and chose the top-ranked item as target item. 3.4
takes into account the e ort and the e ect of an attack. We apply this metric to the data collected during our experiments and present the results in Section 4.3.
Besides investigating the manipulation of the rank of an item for a single user, we are also interested in the impact of the co-rating attacks on the average ratings of each item across all users. Thus, we compute an average ranking for all items (cf. Section 3.2), which is used to determine the average rank of the target item over all users. Furthermore, we aim to quantify the attackability of recommendation algorithms. Hence, we propose to consider the absolute average change in the average rank of the target item. Consider the target item being ranked at position 1000 at step 0, and in step 1 ranked at 100, then the change in ranks is 900. We compute this change across all steps and compute the average change in rank for the target item. Formally, we de ne
change in rank is then de ned as the di erence between two steps: ranki;i+1 = ranki+1 ranki. The average change in rank is computed based on the sum of all ranki;i+1 of the available steps, as shown in Equation 1, where n is the number of steps to be used.
rank = n 1 X i=0 ranki;i+1 n (1)
tiple dimensions, adding up to a total of 1,800 individual trained prediction models, which were used in 3,600 experiments. In the following, we present the results of these evaluations. 4.1
recommendation list for each step. Here, the best achievable rank in the ranking is zero. As stated in Section 3, we consider a push attack successful if the attack changes the rank prediction of the target item to be in the top-10 of the average item ranking.
strategy, where a new user is created as the auxiliary user and the auxiliary item was randomly selected from the set of movies that have not been rated by the target user.
Figure 1a shows that the average rank for CoClustering is in uenced most as the curve races directly to the top ranks within the rst few steps. The results for NMF and SVD show capricious behavior within a con ned area, but do not reach a high rank. The ranks for KNNBasic and KNNWithMeans show that they are only in uenced at the start but converge quickly. SlopeOne is una ected by the attack with no changes in the rank. For NMF and SVD, the attacks can be regarded as failed, but the ranking values have a high variance, which goes in the direction of sabotage, as introduced in Section 2. Only the attack on CoClustering was successful, showing a high attackability of the basic attack strategy.
shortly after reaching rank 200. CoClustering was attacked successfully again since a rank in the top ten was clearly reached. The attacks on KNNBasic and KNNWithMeans also reach a high rank but did not reach the top-10. NMF,
erally, we observe that the activity-based attack strategy reaches a higher attack e ect than the basic attack approach.
the users to select the target user; the results are shown in Figure 1c. We observe a tendency towards higher ranks for
early on. In addition to CoClustering, KNNBasic, and KN
4.2
tack is considered successful if the rank of the target item is consistently lowered by 10 or more ranks after an attack.
For the BASIC attack approach, a fresh user is used as the auxiliary user. As the target item, the movie with the highest id from the set of movies the target user has not rated was selected. Figure 2a shows the obtained results. SlopeOne is mostly una ected by the pull attack. The e ect on SVD was rather small and shows minor uctuations. The average rank for KNNWithMeans moves slowly and converges early around 110. CoClustering, KNNBasic, and NMF show high vulnerability against the attacks. Most interesting is the behavior of NMF showing a clear tendency towards the lower ranks when compared to SVD, the other MF-based algorithm, whose behavior showed to be stable and una ected by the attacks.
approach with pull attacks. Figure 2b shows that NMF and SVD are only marginally a ected as both algorithms show only minor uctuations. CoClustering, KNNBasic,
wards the lower ranks.
The last set of experiments used the similarity-based approach to launch pull attacks on the algorithms. In Figure 2c, we observe that the results are quite similar to the 20 40 60 80 100 20 40 60 80 100 20 40 60 80 100 Steps Steps Steps (a) Basic attack approach. (b) User activity approach. (c) User similarity approach. 200
00 1400 em1200 i-tt eg1000 tr a fko 800 n a eR600 g a r veA400 200 200
00 1400 1200 m e it -t1000 e g r a fto 800 k n aR600 e g a rve 400 A 200 item800 -t e g r a fto 600 k n a R eg 400 a r e v A 200
00 1200 m1000 e i-tt reg 800 a ft o kan 600 R e rag 400 e v A 200 00 20 40 60 80
100 Steps 00 20 40
60 Steps 80 100 00 20 40
60 Steps 80 100 (a) Basic attack strategy. (b) User activity strategy. (c) User similarity approach. outcome of the experiment with the activity-based approach.
Table 3 shows the attackability evaluation measured by the rank measure (cf. Section 3.4) for the data from our experiments for push and pull attacks, and each of the three attack strategies used.
For push attacks, we observe a relation between the attackability, i.e., if an algorithm could be attacked successfully, and the average change in average rank for the corresponding algorithms. The relation also holds for a lower observed attackability, i.e., whether an algorithm could not be attacked successfully, and lower values for the average change in average rank. For pull attacks, we also see the same relation between our observed attackability and the calculated average change in average rank. Even though the push attacks on SVD and NMF were mostly considered unsuccessful, the average change in average rank is still higher due to the erratic behavior the algorithms showed.
the average change in average rank, is an intuitive and feasible indicator for how vulnerable an algorithm is to a speci c attack strategy and attack purpose, hence describing the attackability of the algorithm against co-rating attacks.
CoClustering 7.14 7.14 7.14 KNNBasic 2.78 9.57 9.69 KNNWithMeans 1.15 9.45 9.45 NMF 4.09 7.40 10.50 SVD 3.50 5.91 6.13 SlopeOne 0.06 7.74 9.27
BASIC ACT 10.43 10.51 4.29 15.24 1.11 15.42 11.79 0.01 0.23 0.03 0.00 11.48
We investigated the attackability of recommendation algorithms against co-rating attacks. We ran experiments with a varying number of co-ratings, approaches, and types of attack for the chosen algorithms. This added up to a total of 1,800 prediction models, which were used in 3,600 experiments. In these experiments, we investigated the e ort, the number of co-ratings, and the e ect of the attacks on the results of the algorithm, where we also introduce a new metric to express the attackability from the collected data, by calculating the average change in average rank over all steps. We nd that the nearest neighbor and co-clustering algorithms were the least resilient algorithms. Furthermore, we observe that the matrix factorization-based algorithms show erratic behavior when attacked with push attacks, but generally showed a lower attackability when assaulted with pull attacks. Our results show that a handful of coordinated users are enough to manipulate the outcome of recommendation algorithms, thus having an impact on which products we may buy, movies we watch, or locations we visit for our next holiday. For future work, we aim to investigate the inuence of the number of ratings when choosing target-user and -movie, and auxiliary user. Furthermore, we aim to test the generalizability of our approach and metric by running the experiments using di erent target-users and -items, and on di erent and larger datasets.