Abstract
Recent studies have shown that recommender systems (RSs) are highly vulnerable to data poisoning attacks, where malicious actors inject fake user profiles, including a group of well-designed fake ratings, to manipulate recommendations. Due to security and privacy constraints in practice, attackers typically possess limited knowledge of the victim system and thus need to craft profiles that have transferability across black-box RSs. To maximize the attack impact, the profiles often remains imperceptible. However, generating such high-quality profiles with the restricted resources is challenging. Some works suggest incorporating fake textual reviews to strengthen the profiles; yet, the poor quality of the reviews largely undermines the attack effectiveness and imperceptibility under the practical setting. To tackle the above challenges, in this paper, we propose to enhance the quality of the review text by harnessing in-context learning (ICL) capabilities of multimodal foundation models. To this end, we introduce a demonstration retrieval algorithm and a text style transfer strategy to augment the navie ICL. Specifically, we propose a novel practical attack framework named RAGAN to generate high-quality fake user profiles, which can gain insights into the robustness of RSs. The profiles are generated by a jailbreaker and collaboratively optimized on an instructional agent and a guardian to improve the attack transferability and imperceptibility. Comprehensive experiments on various real-world datasets demonstrate that RAGAN achieves the state-of-the-art poisoning attack performance.
Abstract (translated)
最近的研究表明，推荐系统（RS）极易受到数据投毒攻击的影响。在这种攻击中，恶意行为者会注入虚假用户资料，包括一组精心设计的假评分，以操纵推荐结果。由于实际操作中的安全性和隐私限制，攻击者通常对受害系统的了解有限，因此需要创建可以在黑盒推荐系统中通用的虚假用户档案。为了最大化攻击影响，这些虚假用户档案往往必须保持隐蔽性。然而，在资源受限的情况下生成高质量的虚假用户资料极具挑战性。一些研究建议通过加入虚假文本评论来增强这些资料的质量；但是，在实际设置下，这种低质量的评论会严重削弱攻击的有效性和隐蔽性。 为了解决上述挑战，本文提出利用多模态基础模型的上下文学习（ICL）能力来提高评论文本的质量。为此，我们引入了一个演示检索算法和一个文本风格转换策略来增强简单的ICL方法。具体来说，我们提出了一个新的实用攻击框架——RAGAN，用于生成高质量的虚假用户资料，以评估推荐系统的鲁棒性。这些假用户档案通过破狱者（jailbreaker）生成，并由指导代理（instructional agent）和守护者（guardian）共同优化，以此来提高攻击的通用性和隐蔽性。 在各种真实数据集上的全面实验表明，RAGAN实现了最先进的投毒攻击性能。
URL
https://arxiv.org/abs/2508.15252
