{"type":"ScholarlyArticle","title":"Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios","authors":[{"name":"Dazhong Rong","slug":"dazhong-rong","given":"Dazhong","family":"Rong","affiliation":"College of Computer Science and Technology , Zhejiang University"},{"name":"Qinming He","slug":"qinming-he","given":"Qinming","family":"He","affiliation":"College of Computer Science and Technology , Zhejiang University"},{"name":"Jianhai Chen","slug":"jianhai-chen","given":"Jianhai","family":"Chen","affiliation":"College of Computer Science and Technology , Zhejiang University"}],"abstract":"Various attack methods against recommender systems have been proposed in the past years, and the security issues of recommender systems have drawn considerable attention.\r\nTraditional attacks attempt to make target items recommended to as many users as possible by poisoning the training data.\r\nBenifiting from the feature of protecting users' private data, federated recommendation can effectively defend such attacks.\r\nTherefore, quite a few works have devoted themselves to developing federated recommender systems.\r\nFor proving current federated recommendation is still vulnerable, in this work we probe to design attack approaches targeting deep learning based recommender models in federated learning scenarios.\r\nSpecifically, our attacks generate poisoned gradients for manipulated malicious users to upload based on two strategies (i.e., random approximation and hard user mining).\r\nExtensive experiments show that our well-designed attacks can effectively poison the target models, and the attack effectiveness sets the state-of-the-art.","doi":"10.24963/ijcai.2022/306","url":"https://ijcai.org/proceedings/2022/306","pdf":"https://ijcai.org/proceedings/2022/0306.pdf","markdown":"https://ijcai.org/proceedings/2022/306.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/306","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Data Mining","track":"Main Track","number":306,"pages":{"first":2204,"last":2210},"keywords":["Data Mining: Collaborative Filtering","Data Mining: Recommender Systems","Data Mining: Federated Learning","Machine Learning: Adversarial Machine Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986877","length_sec":82,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985020","length_sec":288,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Ammad-Ud-Din et al., 2019] Muhammad Ammad-Ud- Din, Elena Ivannikova, Suleiman A Khan, Were Oyomno, Qiang Fu, Kuan Eeik Tan, and Adrian Flanagan. Fed- erated collaborative filtering for privacy-preserving personalized recommendation system. arXiv preprint arXiv:1901.09888, 2019.","title":"Muhammad Ammad-Ud-Din","authors":"Ammad-Ud-Din","year":"2019","venue":"Federated collaborative filtering for privacy-preserving personalized recommendation system","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bagdasaryan et al., 2020] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, pages 2938-2948. PMLR, 2020.","title":"How to backdoor federated learning","authors":"Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, Vitaly Shmatikov","year":"2020","venue":"International Conference on Artificial Intelligence and Statistics","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bai et al., 2017] Ting Bai, Ji-Rong Wen, Jun Zhang, and Wayne Xin Zhao. A neural collaborative filtering model with interaction-based neighborhood. In Proceedings of the 2017 ACM on Conference on Information and Knowl- edge Management, pages 1979-1982, 2017.","title":"A neural collaborative filtering model with interaction-based neighborhood","authors":"Ting Bai, Ji-Rong Wen, Jun Zhang, Wayne Xin Zhao","year":"2017","venue":"Proceedings of the 2017 ACM on Conference on Information and Knowledge Management","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Fang et al., 2018] Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. Poisoning attacks to graph-based recommender systems. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 381-392, 2018.","title":"Poisoning attacks to graph-based recommender systems","authors":"Fang","year":"2018","venue":"Proceedings of the 34th Annual Computer Security Applications Conference","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Fang et al., 2020] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In 29th {USENIX} Security Symposium ({USENIX} Security 20), pages 1605-1622, 2020.","title":"Local model poisoning attacks to byzantine-robust federated learning","authors":"Fang","year":"2020","venue":"29th {USENIX} Security Symposium ({USENIX} Security 20)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Gu et al., 2017] Tianyu Gu, Brendan Dolan-Gavitt, and Sid- dharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017.","title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","authors":"Tianyu Gu, Brendan Dolan-Gavitt, Siddharth Garg","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Gunes et al., 2014] Ihsan Gunes, Cihan Kaleli, Alper Bilge, and Huseyin Polat. Shilling attacks against recommender systems: a comprehensive survey. Artificial Intelligence Review, 42(4):767-799, 2014.","title":"Shilling attacks against recommender systems: a comprehensive survey","authors":"Ihsan Gunes, Cihan Kaleli, Alper Bilge, Huseyin Polat","year":"2014","venue":"Artificial Intelligence Review","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[He et al., 2017] Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. Neural collab- orative filtering. In Proceedings of the 26th international conference on world wide web, pages 173-182, 2017.","title":"Neural collaborative filtering","authors":"He","year":"2017","venue":"Proceedings of the 26th international conference on world wide web","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[He et al., 2018] Xiangnan He, Xiaoyu Du, Xiang Wang, Feng Tian, Jinhui Tang, and Tat-Seng Chua. Outer product-based neural collaborative filtering. In Jérôme Lang, editor, Proceedings of the Twenty-Seventh Interna- tional Joint Conference on Artificial Intelligence, IJCAI 2018, July 13-19, 2018, Stockholm, Sweden, pages 2227- 2233. ijcai.org, 2018.","title":"Outer product-based neural collaborative filtering","authors":"He","year":"2018","venue":"Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018","doi":null,"url":null,"internal_url":"/proceedings/2018/308"},{"position":10,"raw":"[Huang et al., 2021] Hai Huang, Jiaming Mu, Neil Zhen- qiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data poi- soning attacks to deep learning based recommender sys- tems. In 28th Annual Network and Distributed System Se- curity Symposium, NDSS 2021, virtually, February 21-25, 2021. The Internet Society, 2021.","title":"Data poisoning attacks to deep learning based recommender systems","authors":"Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, Mingwei Xu","year":"2021","venue":"28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kapoor et al., 2017] Saakshi Kapoor, Vishal Kapoor, and Rohit Kumar. A review of attacks and its detection at- tributes on collaborative recommender systems. Interna- tional Journal of Advanced Research in Computer Science, 8(7), 2017.","title":"A review of attacks and its detection attributes on collaborative recommender systems","authors":"Saakshi Kapoor, Vishal Kapoor, Rohit Kumar","year":"2017","venue":"Interna-tional Journal of Advanced Research in Computer Science","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Li et al., 2016] Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-based collaborative filtering. Advances in neural information processing systems, 29:1885-1893, 2016.","title":"Data poisoning attacks on factorization-based collaborative filtering","authors":"Bo Li, Yining Wang, Aarti Singh, Yevgeniy Vorobeychik","year":"2016","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Liang et al., 2021] Feng Liang, Weike Pan, and Zhong Ming. Fedrec++: Lossless federated recommendation with explicit feedback. In Proceedings of the AAAI Con- ference on Artificial Intelligence, volume 35, pages 4224- 4231, 2021.","title":"Fedrec++: Lossless federated recommendation with explicit feedback","authors":"Liang","year":"2021","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Lin et al., 2020] Guanyu Lin, Feng Liang, Weike Pan, and Zhong Ming. Fedrec: Federated recommendation with ex- plicit feedback. IEEE Intelligent Systems, 2020.","title":"Fedrec: Federated recommendation with explicit feedback","authors":"Guanyu Lin, Feng Liang, Weike Pan, Zhong Ming","year":"2020","venue":"IEEE Intelligent Systems","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[McMahan et al., 2017] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Ar- cas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282. PMLR, 2017.","title":"Communication-efficient learning of deep networks from decentralized data","authors":"Brendan Mcmahan, Eider Moore, Daniel Ramage, Seth Hampson, Blaise Aguera Y Arcas","year":"2017","venue":"Artificial intelligence and statistics","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Rendle et al., 2009] Steffen Rendle, Christoph Freuden- thaler, Zeno Gantner, and Lars Schmidt-Thieme. BPR: bayesian personalized ranking from implicit feedback. In","title":"BPR: bayesian personalized ranking from implicit feedback","authors":"Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, Lars Schmidt-Thieme","year":null,"venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"Jeff A. Bilmes and Andrew Y. Ng, editors, UAI 2009, Pro- ceedings of the Twenty-Fifth Conference on Uncertainty in Artificial Intelligence, Montreal, QC, Canada, June 18-21, 2009, pages 452-461. AUAI Press, 2009.","title":"UAI 2009, Proceedings of the Twenty-Fifth Conference on Uncertainty in Artificial Intelligence","authors":null,"year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Rong et al., 2022] Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. Fedrecat- tack: Model poisoning attack to federated recommenda- tion. arXiv preprint arXiv:2204.01499, 2022.","title":"Fedrecattack: Model poisoning attack to federated recommendation","authors":"Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, Qinming He","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Shrivastava et al., 2016] Abhinav Shrivastava, Abhinav Gupta, and Ross Girshick. Training region-based object detectors with online hard example mining. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 761-769, 2016.","title":"Training region-based object detectors with online hard example mining","authors":"Abhinav Shrivastava, Abhinav Gupta, Ross Girshick","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Wu et al., 2021] Jiancan Wu, Xiang Wang, Fuli Feng, Xi- angnan He, Liang Chen, Jianxun Lian, and Xing Xie. Self- supervised graph learning for recommendation. In Pro- ceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 726-735, 2021.","title":"Selfsupervised graph learning for recommendation","authors":"Jiancan Wu, Xiang Wang, Fuli Feng, Xiangnan He, Liang Chen, Jianxun Lian, Xing Xie","year":"2021","venue":"Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Yao et al., 2021] Tiansheng Yao, Xinyang Yi, Derek Zhiyuan Cheng, Felix Yu, Ting Chen, Aditya Menon, Lichan Hong, Ed H Chi, Steve Tjoa, Jieqi Kang, et al. Self-supervised learning for large-scale item recommendations. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 4321-4330, 2021.","title":"Self-supervised learning for large-scale item recommendations","authors":"Yao","year":"2021","venue":"Proceedings of the 30th ACM International Conference on Information & Knowledge Management","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zhang et al., 2022] Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Quoc Viet Hung Nguyen, and Lizhen Cui. Pi- pattack: Poisoning federated recommender systems for manipulating item promotion. In Proceedings of the Fif- teenth ACM International Conference on Web Search and Data Mining, pages 1415-1423, 2022.","title":"Pipattack: Poisoning federated recommender systems for manipulating item promotion","authors":"Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Quoc Viet, Hung Nguyen, Lizhen Cui","year":"2022","venue":"Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}