Introduction

The advent of Knowledge Graphs (𝒦𝒢𝑠) has changed the way structured information is stored. It has become much more than that developed to make the Semantic Web a concrete idea. The core idea of building a semantic network in which information is represented as directed labeled graphs (RDF graphs) is disarmingly simple. Nevertheless, thanks to the possibilities it paves, it has been welcomed with several promises and expectancies. Complete interoperability, the ability to link knowledge across domains, and the possibility to exploit Logical inference and proofs are just a few of them. In numerous domains, the exploitation of the 𝒦𝒢 information has become the norm. Thanks to the appearance of wide-ranging Linked Datasets like DBpedia and Wikidata, we have witnessed the flourishing of novel techniques in several research fields, like Machine Learning, Information Retrieval, and Recommender Systems. To date, Recommender Systems (RSs) are considered the focal solution to assist users' decision-making process. Since the volume of the available products on the Web overwhelms the users, RSs support and ease the decision process. Among them, collaborative filtering (CF) recommendation techniques have shown very high performance in real-world applications (e.g., Amazon [1]). Their rationale is to analyze products experienced by similar users to produce tailored recommendations. Algorithmically speaking, they take advantage of user-user and item-item similarities. Regrettably, malicious users may want to jeopardize the operation of the recommendation platform. For example, they might be a rival company or agents who want to increase (or decrease) the visibility of a particular product. Whatever they are motivated by, the problem is that these similarities are vulnerable to the insertion of fake profiles. This kind of attack is called the shilling attack [2], which aims to push or nuke the probabilities to recommend an item. The malicious agent (or adversary) can rely on an extensive list of techniques to conduct the attack. Researchers and companies have classified them into two broad categories [3]: low-knowledge and informed attack strategies. In the former attacks, the adversary has poor system-specific knowledge [4,5]. In the latter, the attacker has an accurate knowledge of the recommendation model and the data distribution [4,6].

Interestingly, despite the astonishing spread of 𝒦𝒢𝑠, little attention has been paid to knowledge-aware strategies to mine RS's security. Since 𝒦𝒢𝑠 provide comprehensive information on numerous knowledge domains, a malicious agent can decide to attack RSs making use of the items' semantic descriptions. One work exploiting publicly available information obtained from 𝒦𝒢 to generate more influential fake profiles to threaten CF models' performance is named semantics-aware shilling attack SAShA [7]. This work extended state-of-the-art shilling attack approaches such as Random, BandWagon, and Average profiting from publicly available semantic information without supposing any additional knowledge about the system. While the previous study modified these attacks considering the cosine vector similarity between the semantic description of items, in this work, we identify that SAShA only considers the cosine similarity across the semantic details, which is not particularly suited to bring out semantic relatedness.

In this work, we have overcome this limitation by going beyond the cosine similarity by considering Katz centrality and Exclusivity-based relatedness. Finally, to provide a more fine-grained analysis, we have grouped the semantic relations into three classes: ontological, categorical, and factual relations.

In detail, this study extends the state-of-the-art approach for the integration of semantics in the shilling attacks [7] in numerous directions:

1. two novel graph topological and semantic approaches to build the set of items from which the adversary can craft the fake profiles; We have conducted extensive experiments to evaluate the impact of proposed attacks against the recommendation models. To this end, we have exploited two real-world recommender system datasets (LibraryThing and Yahoo!Movies). Experimental results sharply indicate that 𝒦𝒢 information is a valuable source of knowledge that improves attacks' effectiveness. Moreover, adopting semantic relatedness measures can unleash the full potential of the semantics-aware attacks.

The remainder of the paper proceeds as follows. In Section 2, we provide an overview of the state-of-the-art recommendation models and shilling attacks. Section 3 describes the proposed extensions to the SAShA by introducing the semantic relatedness measures, and formalizes the semantic attack strategies. Section 4 focuses on the experimental validation of the proposed attack scenarios. We also provide an in-depth discussion of the experimental results analyzing the several dimensions of the study. Finally, in Section 6, we draw some conclusions and introduce the open challenges.

Related Work

Recommender Systems

A recommendation problem can be stated as finding a utility function to automatically predict how much users will like unknown items.

Definition 1 (Recommendation Problem).

Let 𝒰 and ℐ denote a set of users and items in a system, respectively. Each user 𝑢 ∈ 𝒰 is related to ℐ + 𝑢 , the set of items she has consumed, or her user profile. Given a utility function 𝑔 : 𝒰 × ℐ → R a Recommendation Problem is defined as

∀𝑢 ∈ 𝒰, 𝑖 ′ 𝑢 = argmax 𝑖∈ℐ 𝑔(𝑢, 𝑖)

where 𝑖 ′ 𝑢 denotes an item not consumed by the user 𝑢 before. We assume that the preference of user 𝑢 ∈ 𝒰 on item 𝑖 ∈ ℐ is encoded with a continuous-valued preference score 𝑟 𝑢𝑖 ∈ ℛ, where ℛ represent the set of (𝑢, 𝑖) pairs for which 𝑟 𝑢𝑖 is known.

The major class of recommendation models includes content-based filtering (CBF), collaborative filtering (CF), and hybrid [8,9]. CBF models build a profile of user interests based on the content features of the items preferred by that user (liked or consumed), characterizing the nature of her interests. CF models compute recommendations based on similarities in preference patterns of like-minded users. They can be classified according to neighborhood-based and model-based. Neighborhood-based models compute recommendations exclusively based on correlations in interactions across users (user-based CF [10,11]) or items (item-based CF [12,11]), while model-based approaches learn a model that can be queried in the production phase to generate recommendations for a given user profile, e.g., MF [13].

Knowledge-aware RSs

RSs exploit various side information such as metadata (e.g., tags, reviews) [14], social connections [15], image and audio signal features [16], and users-items contextual data [17] to build more in-domain [18] (i.e., domain-dependent), cross-domain [19], or context-aware [20,21] recommendation models. Among the diverse information sources, Knowledge Graphs (𝒦𝒢𝑠) are one of the most relevant. A 𝒦𝒢 is a heterogeneous network that encodes multiple relationships, edges, nodes, and links items at high-level relationships, making them a strong item representation technique. Thanks to the heterogeneous domains that 𝒦𝒢𝑠 cover, the design of knowledge-based recommendation systems has arisen as a specific research field of its own in the community of RSs, usually referred to by Knowledge-aware Recommender Systems (KaRS [22,23]). Knowledge-aware Recommender Systems have been particularly impactful for several research domains: 𝑚𝑎𝑡ℎ𝑐𝑎𝑙𝐾𝐺/graph-embeddings [24,25,26,27,28,29,30], hybrid collaborative/content-based recommendation [25,31], knowledge-completion, link-prediction, knowledge-discovery [32,33,34,30,35,36,37,38], knowledge-transfer, cross-domain recommendation [39,19,40], interpretable/explainable-recommendation [41,42,43,44,31], graph-based recommendation [45,46,47,48,49,50], content-based recommendation [51,52].

All the former advances have been shown to enhance the recommendation quality or the overall user experience. Although the algorithms differ on many levels, we can still classify recommendation techniques into two broad approaches: Path-based methods [45,46,47,50,53,54], which employ paths and meta-paths to estimate the user-item similarities or the nearest items; and KG embedding-based techniques [45,26,31,55,21,56], which leverage 𝒦𝒢 embeddings (usually obtained through matrix factorization or neural network encoding) for items' representation.

Security of RSs

Malicious users, the adversaries, can meticulously craft fake profiles to poison the data and alter the recommendation behavior toward malicious goals [57,58,59]. An adversary may execute a shilling attack (injection of malicious profiles) to achieve a whole different set of objectives. To name a few, she may want to demote competitor products [4], misuse the underlying recommendation system [2], or increase the recommendability of specific products [60,61].

The research works on shilling attacks explored two main research perspectives: proposing and investigating attack strategies with their effects on the recommendation performance [4,62,63,64] and exploring defensive mechanisms [59,65,66,67,68,69].

A typical characteristic of the first line of research on shilling attacks is that the adversary's knowledge is related only to the recommender system's user-item interaction matrix. Furthermore, Anelli et al. [7] demonstrate that publicly available 𝒦𝒢 improves adversary's efficacy, also in the case of low-informed attacks (e.g., Random). In this work, we extend the SAShA framework to verify the possible improvement of the adversary's efficacy when processing the 𝒦𝒢 information with semantic similarity measures.

Note that this work focuses on shilling attacks, that are hand-engineered strategies to study recommender systems' security. This research line is different from machine-learned data poisoning attack [70,71,72,73,74] and adversarial machine-learned attacks [75,76,61,77,78,79] where adversaries adopt optimization techniques to create perturbations.

Method

This section introduces the reader to the notations and formalisms that may help understand the design of shilling attacks against targeted items integrating information obtained from a knowledge graph (𝒦𝒢).

Knowledge Graph Content Extraction

A knowledge graph is a structured repository of knowledge, designed in the form of a graph, that encodes various kinds of information:

• Factual. General statements as Rika Dialina was born in Crete or Heraklion is the capital of Crete that describe an entity by using a controlled vocabulary of predicates that connect the entity to other entities (or literal values).

• Categorical. These statements connect the entity to a particular category (i.e., the categories associated with a Wikipedia page). Often, categories are in turn organized as a hierarchy.

• Ontological. These are formal statements that describe the entity's nature and its ontological membership to a specific class. Classes are often organized in a hierarchical structure. In contrast to categories, sub-classes and super-classes are connected through IS-A relations.

In a knowledge graph, we can express statements through triplets 𝜎 𝜌 − → 𝜔, with a subject (𝜎), a predicate (or relation) (𝜌), and an object (𝜔). There are several ways to transform the knowledge coming from a knowledge graph into a feature. We have chosen to represent each distinct path as an explicit feature [31].

Given a set of items 𝐼 = {ℐ 1 , ℐ 2 , . . . , ℐ 𝑁 } in a collection and the corresponding triples ⟨𝑖, 𝜌, 𝜔⟩ in a knowledge graph, the set of 1-hop features is defined as 1-𝐻𝑂𝑃 -𝐹 = {⟨𝜌, 𝜔⟩ | ⟨𝑖, 𝜌, 𝜔⟩ ∈ 𝒦𝒢 with 𝑖 ∈ 𝐼}.

Entity Similarity/Relatedness in KGs

The keystone of the Knowledge Graph representation is the semantics enclosed in the resource description and the predicates that connect the different resources. Nevertheless, if the metric to compute similarities between the resources is not carefully chosen, this piece of information is lost irretrievably. Motivated by this awareness, we decided to consider a broad spectrum of diverse similarity/relatedness metrics in addition to the cosine vector similarity [80] (used in 𝑆𝐴𝑆𝐻𝐴 [7]: Katz centrality [81] and Exclusivity-based semantic relatedness [82]. In general, the three metrics cover different aspects of the similarity between the resource a signal of the overlap of the descriptions and a semantics-aware signal that highlights the specificity of the relations between the resources. Cosine Vector Similarity is a well-known similarity that is very popular in recommendation systems. The idea is to measure how similar the two different representations are. Suppose a numerical vector can represent the resource description, with the number of the predicate-object chains observed in the 𝒦𝒢 being the vector's cardinality. Mathematically, it measures the cosine of the angle between two vectors that represent two different resources. The smaller the angle, the higher the cosine similarity is, and thus the similarity. Suppose 𝑖 and 𝑗 are two items in the 𝒦𝒢, and 𝐹 (•) is a function that returns the features associated with an entity in the 𝒦𝒢. Hence 𝑖𝑛(𝑖, 𝑓 ) is a function that returns 1 if entity 𝑖 is associated with feature 𝑓 , else 0. The Cosine Vector Similarity has been already formulated for 𝒦𝒢 as follows [80]:

𝑠𝑖𝑚(𝑖, 𝑗) = ∑︀ 𝑓 ∈𝐹 (𝑖)∪𝐹 (𝑗) 𝑖𝑛(𝑖,𝑓 )•𝑖𝑛(𝑗,𝑓 ) √︁ ∑︀ 𝑓 ∈𝐹 (𝑖) 𝑖𝑛(𝑖,𝑓 ) 2 • √︁ ∑︀ 𝑓 ∈𝐹 (𝑗) 𝑖𝑛(𝑗,𝑓 ) 2(1)

This is the baseline method used in 𝑆𝐴𝑆ℎ𝐴 [7]/ Katz centrality [81] is a famous graph-centrality measure that inspired several semanticsaware metrics [83,82]. Katz suggests that the probability of the path between two nodes can indicate the effectiveness of the link. Given a constant probability for a single-hop path, called 𝛼, the whole path's overall probability is 𝛼 𝑦 , where 𝑦 is the number of the nodes involved.

Hulpus [82] exploits the rationale to build a relatedness measure. Therefore, he defined the Katz relatedness between two items 𝑖 and 𝑗 as the accumulated score over the top-𝑡 shortest paths between them.

𝑟𝑒𝑙 (𝑡) 𝐾𝑎𝑡𝑧 (𝑖, 𝑗) = ∑︀ 𝑝∈𝑆𝑃 (𝑡) 𝑖𝑗 𝛼 𝑙𝑒𝑛𝑔𝑡ℎ(𝑝) 𝑡(2)

where 𝑆𝑃

(𝑡)

𝑖𝑗 is the set of the top-𝑡 shortest paths between items 𝑖 and 𝑗. This is the first novel similarity metric tested in this work. Note that the shortest path has a larger implication in multi-hops experiments; results on these have been reported in . Exclusivity-based semantic relatedness [82] is a semantic relatedness measure that takes into account the type of relations that connect two nodes. The idea is that two concepts are strongly connected if the type of relations between them is different from the type of relations they have with other concepts. This property of relations, named exclusivity, is defined as follows.

Suppose a predicate 𝜌 of type 𝜏 between two items 𝑖 and 𝑗, directed from 𝑖 to 𝑗. The exclusivity of predicate 𝜌 is the probability of selecting, with a uniform random distribution, a predicate 𝜌 ′ of type 𝜏 among the predicates of type 𝜏 that exit resource 𝑖 and enter node 𝑗, such that predicate 𝜌 ′ is exactly the predicate 𝜌: − →, . . . , 𝑛 𝑘 with 𝜏 𝑖 ∈ 𝒯 ∓ , the weight of the path is defined as:

𝑒𝑥𝑐𝑙𝑢𝑠𝑖𝑣𝑖𝑡𝑦(𝑖 𝜏 − → 𝑗) = 1 |𝑖 𝜏 − → *| + |* 𝜏 − → 𝑗| − 1(3)𝑤𝑒𝑖𝑔ℎ𝑡(𝒫) = 1 ∑︀ 𝑖 1 𝑒𝑥𝑐𝑙𝑢𝑠𝑖𝑣𝑖𝑡𝑦(𝑛 𝑖 𝜏 𝑖 − →𝑛 𝑖+1 ) (4)

Finally, the relatedness between two resources can be computed as the sum of the path weights of the top-𝑡 paths between the resources with the highest weights. To penalize longer paths, a constant length decay factor, 𝛼 ∈ (0, 1], can be introduced. The overall exclusivity-based relatedness measure is therefore defined as follows:

𝑟𝑒𝑙 (𝑡) 𝐸𝑥𝑐𝑙 (𝑖, 𝑗) = ∑︁ 𝒫𝑛∈𝑃 𝑡 𝑖𝑗 𝛼 𝑙𝑒𝑛𝑔ℎ𝑡(𝒫𝑛) 𝑤𝑒𝑖𝑔ℎ𝑡(𝒫 𝑛 )(5)

This is the second novel similarity metric tested in this work. where (𝜇, 𝜎) are the dataset average rating and rating variance, (𝜇𝑓 , 𝜎𝑓 ) are the filler item ℐ𝐹 rating average and variance, and 𝑚𝑖𝑛 and 𝑚𝑎𝑥 are the minimum and maximum rating value. 𝑟𝑛𝑑 function generates one integer (i.e., rating) from a discrete uniform distribution.

Attacks[4] ∅ Random ∑︀ 𝑢∈𝒰 |ℐ𝑢| |𝒰 | − 1 𝑟𝑛𝑑(𝑁 (𝜇, 𝜎 2 )) ℐ − ℐ𝐹 𝑚𝑎𝑥 Love-Hate [84] ∅ Random ∑︀ 𝑢∈𝒰 |ℐ𝑢| |𝒰 | − 1 𝑚𝑖𝑛 ℐ − ℐ𝐹 𝑚𝑎𝑥 Popular [85] ∑︀ 𝑢∈𝒰 |ℐ𝑢| |𝒰 | − 1 𝑚𝑖𝑛 if 𝜇𝑓 < 𝜇 else 𝑚𝑖𝑛 + 1 ∅ ℐ − ℐ𝑆 𝑚𝑎𝑥 Average [4] ∅ Random ∑︀ 𝑢∈𝒰 |ℐ𝑢| |𝒰 | − 1 𝑟𝑛𝑑(𝑁 (𝜇𝑓 , 𝜎

Given a Recommendation Problem, a Shilling Profile (𝒮𝒫) is a rating profile partitioned into four sets:

𝒮𝒫 = ℐ 𝑆 + ℐ 𝐹 + ℐ 𝜑 + ℐ 𝑇(6)

where ℐ 𝑆 denotes the selected item set containing items identified by the attacker to maximize the effectiveness of the attack, ℐ 𝐹 is the filler item set, containing a set of randomly selected items to which rating scores are assigned to make them imperceptible. ℐ 𝑇 is the target item, for which the recommendation model will make a prediction, aimed to be maximal (for push attack) or minimum (for nuke attack). Finally, ℐ 𝜑 is the unrated item set, holding a number of items without any ratings. Note that ℐ 𝑆 and ℐ 𝐹 are chosen depending on the attack strategy, and the attack size is the number of injected fake user profiles. Throughout this paper, we use 𝜑 = |ℐ 𝐹 | to represent the filler size, 𝛼 = |ℐ 𝑆 | the selected item set size and 𝜒 = |ℐ ∅ | to show the size of unrated items. Table 1 summarizes the main parameters involved in the implementation of most prominent shilling attacks against rating-based CF models. For instance, it can be seen that 𝑆𝐴𝑆ℎ𝐴 attacks are the extension of state-of-the-art shilling attacks, with the difference that selection of the filler item set (ℐ 𝐹 ) is chosen semantically, not randomly.

Semantics-aware Random Attack is an extension of the baseline Random Attack [4]. The baseline version is a naive attack, which uses randomly chosen items (𝛼 = 0, 𝜑 = profile-size) to create a fake user profile. The ratings attributed to ℐ 𝜑 are sampled from a uniform distribution (see Table 1). 𝑆𝐴𝑆ℎ𝐴 modify this attack by selecting the items to complete ℐ 𝐹 with the cosinesimilarity. In this work, we exploit semantic similarities/relatedness between the items in the catalog e the target item using 𝒦𝒢-based features (cf. Section 3.1). Afterward, we identify the most similar items (ℐ 𝑇 ) by considering the first quartile of most similar items, and we extract 𝜑 items from this set by adopting a uniform distribution.

Semantics-aware Average Attack is an informed attack strategy that extends the Aver-ageBots attack [5]. The baseline attack leverages the mean and variance of the ratings, which is then used to sample each filer item's rating from a normal distribution built using these values. Similar to the previous semantics-aware attack extension, we extract the filler items by exploiting semantic similarities derived from a 𝒦𝒢. Finally, as before, we consider the items in the first quartile of the most semantically similar/related to ℐ 𝑇 as the candidate filler items (ℐ 𝐹 ).

Semantics-aware BandWagon Attack is a low-knowledge attack that extends the standard BandWagon attack [62]. We leave unchanged the injection of the selected items (ℐ 𝑆 ), which are the most popular ones and on which we associate the maximum possible rating (see Table 1). However, similarly to the previous two semantic attack extensions, we complete ℐ 𝐹 by taking into account the semantic similarity/relatedness between the target item ℐ 𝑇 and the rest of the catalog.

Experimental Setting

Dataset

We tested the proposed approaches on two datasets. The first is LibraryThing [50] and it is a popular dataset whose interactions originate from librarything.com, a social cataloging web application. The dataset contains user-item rating scores ranging from a minimum of 1 to a maximum of 10. As presented in [7], we use a reduced version by randomly extracting the 25% of products in the catalog. Furthermore, we apply a 5-core filtering by removing all the users with less than five interactions to focus the study on active users. These users are of adversaries' interest since they could more likely buy the pushed products.

The second is Yahoo!Movies which is a recommendation dataset released by research.yahoo.com with ratings collected up to November 2003. The dataset also provides mappings to the MovieLens and EachMovie catalogs. The recorded interactions consist of ratings ranging from 1 to 5.

Both datasets have a mapping between the items in the catalogs and DBpedia knowledge-base entities. In particular, we use the mappings publicly available at https://github.com/sisinflab/ LinkedDatasets. Table 2 reports the statistics of both datasets. Once the items are semantically reconciled with DBpedia entities, we remove the noisy features whose triples contain one of the following predicates: owl:sameAs, dbo:thumbnail, foaf:depiction, prov:wasDerivedFrom, foaf:isPrimaryTopicOf. The feature denoising procedure follows the methodology proposed in [42,31].

Feature Selection

To perform the analysis of the groups (or types) of semantic features, we implement our proposed semantics-aware attacks by considering three different types of features, i.e., categorical (CS), ontological (OS), and factual (FS), a feature taxonomy commonly adopted in the Semantic Web community [31]. We apply the following policies Categorical-1H, we use the features with the property dcterms:subject, Ontological-1H, we select the features containing the property rdf:type, and Factual-1H, we consider all the features except ontological and categorical features.

Feature Filtering

This work aims to study the attack performance differences up to the first hop. Addressing this aim, we obtain thousands of features for both LibraryThing and Yahoo!Movies as reported in the last two columns of Table 2. Measuring semantic similarities across the item catalog would quickly become unfeasible. However, some features only occur once and provide no useful informative or collaborative information. Therefore, we decided to drop off irrelevant features following the filtering technique proposed by Di Noia et al. [50], Paulheim and Fürnkranz [86]. In detail, we removed all the features with more than 99.74% of missing values and distinct values. Table 3 shows the remaining features' statistics after applying the extraction, selection, and filtering.

Recommender Models

In this work, we test our attack proposal (see Section 3.3) against four baseline collaborative RSs. Two neighborhood-based: User-kNN, on which we [10,11] set the size of the neighborhood 𝑘 to 40, and Item-kNN [12,11], where 𝑘 = 40 too. Two model-based: Matrix Factorization (MF) [13], where we set the size of latent vectors to 100, and Neural Matrix Factorization (NeuMF) [87], on which we used a deep neural network composed by 4 fully connected dense layers with {64, 32, 16, 8} hidden units.

Evaluation Metrics

We evaluate the attack performance using 𝐻𝑅@𝑁 . The metric describes the average presence of target items in the top-𝑁 recommendation lists generated for all the users after the attack. Since we will experiment with the case of push attacks, it follows that the adversary's goal is to increase/maximize the HR of the attacked/targeted items.

Evaluation Protocol

We perform 180 experiments for each dataset, totaling 720 experiments. Following the evaluation procedure used in [60,4], we generate the list of recommendations for each recommendation model before executing the attack. After having measured the position and predicted score for each target item-user pair, we simulated the attack. Each attack is performed against 50 randomly selected items in each dataset. Furthermore, we perform each attack using three different amounts of injected shilling profiles: 1%, 2.5%, and 5% of the total number of users, as adopted in [7,63,5]. Regarding the relatedness measures, we set the 𝛼 = 0.25 and the 𝑡-path length to 10 for both metrics. Datasets and code will be made publicly available.

Experimental Results

Table 4 and Table 5 report the results. Across the next sections, we identify an attack combination using the format <dataset, recommender, attack strategy, feature type, similarity measures, granularity>, e.g., <Yahoo!Movies, User-𝑘NN, Average, Categorical, Katz, 1%>.

First, we observe that the results obtained on the Yahoo!Movies dataset (Table 5) are more indicative of attacks' effectiveness independently of the attack dimensions, confirming the findings in the previous work by Anelli et al. [7]. Furthermore, Table 4 confirms the semanticsaware strategy's efficacy over the baseline, either for the average or random attacks. For instance, the semantic strategies outperformed all the <LibraryThing, Random> and <LibraryThing, Average> baseline attacks independently of the recommender model and the size of attacks. However, differently from the results on Yahoo!Movies, on <LibraryThing, BandWagon>, the baseline attack's effectiveness did not improve. This behavior might be justified by the fact that a bandwagon attack builds profiles by filling the 50% of the profile with the most popular items, it might make the semantic strategy that identifies the informative filler items ineffective.

In addition to the general results, we provide a more in-depth discussion answering three research questions.

Table 4

Hit Ratio (𝐻𝑅) result values evaluated on top-10 recommendation lists for the LibraryThing dataset. We report in bold the highest value of each column given an adversary budget and knowledge. The usage of Cosine similarity is the baseline approach proposed in SAShA. We can observe that the adoption of graph-based relatedness generally leads to an attack efficacy improvement over the baseline, which adopts the cosine similarity metric. For instance, the random attack largely benefits from the topological information. The same happens for Yahoo!Movies too in Table 5. Indeed, HR for < User-𝑘NN, Random, Categorical, Katz> is 10% better than the baseline, i.e., 0.3725 vs. 0.3512. Beyond random attacks, we can observe some general trends also for informed attacks. In detail, Table 4 (LibraryThing), we note that categorical information improves both User-𝑘NN and Item-𝑘NN. It is worth noticing that the same consideration does not hold for latent factor-based models. MF and NeuMF suit better cosine vector similarity. This phenomenon is probably due to the significant difference in how the two recommendation families exploit the additional information.

User

Finally, we can focus on the BandWagon attack. In that case, the attack already exploits the most influential knowledge source for collaborative filtering algorithms: popularity. It follows that the integration with other knowledge sources, e.g., 𝒦𝒢𝑠, does not provide any significant improvement. However, the influence of popularity is so high in this attack that the final recommendation lists are subject to a strong popularity bias [88]. Indeed, adding fake profiles with the maximum ratings, e.g., 5 in Yahoo!Movies and 10 in LibraryThing, placed on the most popular/rated items that will form the ℐ 𝑆 (see Table 1) will amplify, even more, the probability that these items will be recommended in the highest positions of top-𝑁 recommendation lists making ineffective the adversaries' pushing goal toward the target items. As a consequence, it even prevents the attacked recommendation system from suggesting the target item. All the experimental datasets and all the recommendation models clearly show this effect.

Another aspect that we want to underline is that increasing the number of fake profiles injected into the systems unleashes the potential of different semantic knowledge types. Let us take as an example the <LibraryThing, Average, MF>. With 1% injected fake profiles, we observe the best results with Factual knowledge and Katz centrality. With 2%, the best results are with Factual knowledge and cosine similarity. Finally, with 5%, the best results come with Ontological knowledge and cosine similarity. This behavior suggests that the graph-based similarities have a big impact even in a very sparse scenario. In contrast, with the increase of fake profiles, the cosine similarity starts leveraging interesting correlations. On the other dimension, the factual information is massive by nature, and it is crucial in sparse scenarios. However, when the number of fake profiles increases, the knowledge at a higher level of abstraction (Categorical and Ontological) finds its way to improve the attack efficacy further.

RQ2: What is the most impactful type of semantic information? We start focusing on Categorical knowledge. The experiments on LibraryThing show that Exclusivity is probably the relatedness that best suits this information type. However, the results are not that clear for the Yahoo!Movies dataset. This behavior suggests that semantic information type and relatedness are not the only members of the equation. Indeed, the extension and the quality of the item descriptions seem to have a role. Afterward, we focus on Ontological information. Here, we can draw a general consideration since, for both datasets, it is the cosine similarity metric that leads to the best results. Lastly, Factual information respects all the general remarks we have drawn before showing that relatedness is a better source of adversaries' knowledge to perform more effective attacks.

In detail, we found that with low-knowledge attacks, the best relatedness is Exclusivity for LibraryThing and Katz for Yahoo!Movies. With informed attacks, the best relatedness metric is the cosine similarity. However, for the sake of electing a similarity that better suits Factual information, we can note that Exclusivity generally leads to better results with LibraryThing.

RQ3: What are the most vulnerable recommendation models> Since the neighborhood-based models directly exploit a similarity to compute the recommendation lists, they are the privileged victim models to effectively alter the recommendation performance. Slightly more robust are latent factor models on which the new semantic attacks will still produce an improvement in the attacker's performance. Finally, the most robust model is NeuMF. This result is probably due to the nonlinearity of NeuMF that helps the model avoid learning from the pretended profiles. In detail, the neural network may learn more sophisticated correlations that the other models do not capture. We believe that this ability deserves specific further investigation since it may lead to developing a new line of research on Deep Learning-based semantics-aware attacks that might exploit non-linear item-item similarities to build more impactful attack methods.

Conclusions

In this work, we verified how the adoption of stronger semantic similarity measures of structured and freely accessible knowledge can further improve malicious agents' ability to attack a recommendation platform. Starting from the state-of-the-art semantics-aware shilling attacks (SAShA), this work investigated the impact of graph-based metrics (Katz centrality and Exclusivity-based relatedness) and semantic information type. As a result, we verified that: (1) the adoption of structured knowledge generally improves by a large margin the attacker's performance, (2) the graph-based metrics can efficiently deal with very sparse scenarios capturing similarities that are otherwise imperceptible, (3) the type of semantic information to feed the attacking system with has a significant function in enhancing the adversaries' effectiveness, (4) neural models are the sole recommendation techniques to be more robust to semantic attacks. The latter finding suggests that there is still room for improvements in the semantics-aware attacks investigating Deep Learning-based semantic attacks.