Recommender systems (RSs) have attained exceptional performance in learning users’ preferences and helping them in finding the most suitable products. Recent advances in adversarial machine learning (AML) in the computer vision domain have raised interests in the security of state-of-the-art model-based recommenders. Recently, worrying deterioration of recommendation accuracy has been ac knowledged on several state-of-the-art model-based recommenders (e.g., BPR-MF) when machine-learned adversarial perturbations contaminate model parameters. However, while the single-step fast gradient sign method (FGSM) is the most explored perturbation strategy, multi-step (iterative) perturbation strategies, that demon strated higher efficacy in the computer vision domain, have been highly under-researched in recommendation tasks. In this work, inspired by the basic iterative method (BIM) and the projected gradient descent (PGD) strategies proposed in the CV do main, we adapt the multi-step strategies for the item recommenda tion task to study the possible weaknesses of embedding-based rec ommender models under minimal adversarial perturbations. Letting the magnitude of the perturbation be fixed, we illustrate the highest efficacy of the multi-step perturbation compared to the single-step one with extensive empirical evaluation on two widely adopted rec ommender datasets. Furthermore, we study the impact of structural dataset characteristics, i.e., sparsity, density, and size, on the perfor mance degradation issued by presented perturbations to support RS designer in interpreting recommendation performance variation due to minimal variations of model parameters. Our implementa tion and datasets are available at https://anonymous.4open.science/ r/9f27f909-93d5-4016-b01c-8976b8c14bc5

MSAP: Multi-Step Adversarial Perturbations on Recommender Systems Embeddings

Vito Walter Anelli;Yashar Deldjoo;Tommaso Di Noia;Felice Antonio Merra
2021

Abstract

Recommender systems (RSs) have attained exceptional performance in learning users’ preferences and helping them in finding the most suitable products. Recent advances in adversarial machine learning (AML) in the computer vision domain have raised interests in the security of state-of-the-art model-based recommenders. Recently, worrying deterioration of recommendation accuracy has been ac knowledged on several state-of-the-art model-based recommenders (e.g., BPR-MF) when machine-learned adversarial perturbations contaminate model parameters. However, while the single-step fast gradient sign method (FGSM) is the most explored perturbation strategy, multi-step (iterative) perturbation strategies, that demon strated higher efficacy in the computer vision domain, have been highly under-researched in recommendation tasks. In this work, inspired by the basic iterative method (BIM) and the projected gradient descent (PGD) strategies proposed in the CV do main, we adapt the multi-step strategies for the item recommenda tion task to study the possible weaknesses of embedding-based rec ommender models under minimal adversarial perturbations. Letting the magnitude of the perturbation be fixed, we illustrate the highest efficacy of the multi-step perturbation compared to the single-step one with extensive empirical evaluation on two widely adopted rec ommender datasets. Furthermore, we study the impact of structural dataset characteristics, i.e., sparsity, density, and size, on the perfor mance degradation issued by presented perturbations to support RS designer in interpreting recommendation performance variation due to minimal variations of model parameters. Our implementa tion and datasets are available at https://anonymous.4open.science/ r/9f27f909-93d5-4016-b01c-8976b8c14bc5
File in questo prodotto:
Non ci sono file associati a questo prodotto.

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11589/243861
 Attenzione

Attenzione! I dati visualizzati non sono stati sottoposti a validazione da parte dell'ateneo

Citazioni
  • Scopus 7
  • ???jsp.display-item.citation.isi??? ND
social impact