Research map / Adversarial robustness and security / Attacks on text and graphs
Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Sim4Rec, a data-free model extraction attack on sequential recommenders that pre-trains a GRU sequence generator with penalized sampling and then runs reinforced adversarial distillation against a hard-label top-K target.
Problem
Model extraction of sequential recommenders in a data-free, black-box setting with limited target queries, where the attacker has no training data, parameters, or architecture knowledge; prior methods either need prior knowledge or extract poorly.
Approach
Controllable sequence generation uses item-level and sequence-level penalty factors during autoregressive sampling to make synthetic sequences resemble real data (more long-tail items, less repetition) for MLE pre-training; reinforced adversarial distillation then treats the generator as adversary (REINFORCE reward = model discrepancy) and the surrogate as distilling via listwise permutation loss
Key results
- Under Q=1k, Sim4Rec achieves Agr@10 of 0.710 on ML-1M N-N versus 0.689 for DFME (best baseline) and 0.568 for Random.
- On Beauty S-N, Sim4Rec reaches Agr@10 0.192 vs 0.066 (DFKD) and 0.075 (DFME) for the same setting; ablations show removing CSG causes an average Agr@10 decline of 0.147.
- Sim4Rec with 2k queries reaches 0.374 Agr@10 under N-S on Beauty, which DFME needs 5k queries to match.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-NARM extraction · ML-1M | Agr@10: 0.708 -> 0.710 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-NARM extraction · Steam | Agr@10: 0.611 -> 0.642 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-NARM extraction · Beauty | Agr@10: 0.364 -> 0.398 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-SASRec extraction · ML-1M | Agr@10: 0.514 -> 0.723 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-SASRec extraction · Steam | Agr@10: 0.502 -> 0.645 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-SASRec extraction · Beauty | Agr@10: 0.125 -> 0.242 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-SASRec extraction · ML-1M | Agr@10: 0.563 -> 0.585 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-SASRec extraction · Steam | Agr@10: 0.525 -> 0.561 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | NARM-to-SASRec extraction · Beauty | Agr@10: 0.334 -> 0.369 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-NARM extraction · ML-1M | Agr@10: 0.372 -> 0.644 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-NARM extraction · Steam | Agr@10: 0.187 -> 0.579 | Helped |
| Use Sim4Rec instead of the strongest listed baseline | SASRec-to-NARM extraction · Beauty | Agr@10: 0.075 -> 0.192 | Helped |
Surprising findings
- Extraction from a SASRec target into a simpler NARM surrogate (S-N) often yields better results than the reverse direction, which the authors attribute to higher-quality synthetic data generated from the transformer target.
Limitations
- Evaluated only on two sequential architectures (NARM, SASRec) and three datasets.
- Relies on a GRU generator and hard-label top-K outputs; performance is weaker on some settings such as S-S on Beauty (0.242 Agr@10 with the gap to the target still large).
Experimental setup
Datasets: MovieLens-1M Steam Beauty
Benchmarks: MovieLens-1M Steam Beauty
Metrics: Recall@10 NDCG@10 Agr@1 Agr@10 attack recall@10 of target item
Baselines: Random DFKD DFME
Builds on: DFME DFKD SeqGAN listwise ranking distillation LOKI
Closest papers by meaning
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.84)
- Sparse Enhanced Network: An Adversarial Generation Method for Robust Augmentation in Sequential Recommendation (AAAI 2024 · similarity 0.84)
- Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation (NeurIPS 2024 · similarity 0.84)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.84)
- Beyond Slow Signs in High-fidelity Model Extraction (NeurIPS 2024 · similarity 0.84)
- Confidence Elicitation: A New Attack Vector for Large Language Models (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.