Research map / Graph learning / GNN architectures
Trust-GRS: A Trustworthy Training Framework for Graph Neural Network Based Recommender Systems Against Shilling Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Trust-GRS, a zero-knowledge two-stage training framework that uses training-loss dynamics and PageRank-based Shilling-Rank to estimate fake-data probabilities, then applies trustworthy neighborhood aggregation and contrastive learning to defend GNN recommenders against shilling attacks.
Problem
GNN-based recommender systems are vulnerable to shilling (fake profile injection) attacks, and existing defenses need prior knowledge or work only in white-box settings and struggle with multiple attacks.
Approach
Fake users exhibit faster early training-loss decrease and share common target items, so a PageRank-based Shilling-Rank over low-loss anchor data yields fake-probabilities for users and items, which weight neighborhood aggregation and a modified contrastive loss/distance without any prior knowledge.
Key results
- Trust-GRS reduces target-item HR@50 to 0 under all 12 shilling attacks on DouBan, ML-1M, and Epinions with LightGCN.
- Against Ara and CLeaR on XSimGCL (ML-1M), Trust-GRS brings HR@50 from 0.087/0.090 under attack to 0.0, while AntiFU and Degree-SAD remain at higher values.
- Baseline defenses PCA, FAP, and Semi-SAD give negligible reduction in target-item metrics against SOTA attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Trust-GRS training to LightGCN | LightGCN · ML-1M, DouBan, and Epinions under 12 attacks | HR@50 (target items): Trust-GRS: 0.0 across all attacks and datasets | Helped |
| Apply Trust-GRS to SSL4Rec, SGL, SimGCL, or XSimGCL | CL-based recommender systems · ML-1M, DouBan, and Epinions; A_ra and CLeaR | HR@50 (target items): 0.018 / 0.0; 0.045 / 0.0; 0.034 / 0.0; 0.037 / 0.0; 0.061 / 0.0; 0.095 / 0.0; 0.087 / 0.0; 0.090 / 0.0 | Helped |
| Add trustworthy neighborhood aggregation (ablation) | Trust-GRS on XSimGCL · ML-1M, A_ra | HR@50 (target items): 0.0023 -> 0.008 | Helped |
| Add trustworthy neighborhood aggregation (ablation) | Trust-GRS on XSimGCL · ML-1M, CLeaR | HR@50 (target items): 0.0029 -> 0.017 | Helped |
| Add trustworthy contrastive learning (ablation) | Trust-GRS on XSimGCL · ML-1M, A_ra | HR@50 (target items): 0.087 -> 0.003 | Helped |
| Add trustworthy contrastive learning (ablation) | Trust-GRS on XSimGCL · ML-1M, CLeaR | HR@50 (target items): 0.090 -> 0.0009 | Helped |
| Combine trustworthy neighborhood aggregation and trustworthy contrastive learning (ablation) | Trust-GRS on XSimGCL · ML-1M, A_ra and CLeaR | HR@50 (target items): A_ra: 0.003 -> 0.0; CLeaR: 0.0009 -> 0.0 | Helped |
| Lower the confidence threshold α (ablation) | Trust-GRS · ML-1M, A_ra, Bi B, and CLeaR | HR@50 (target items): A_ra: 0.0021 -> 0.0; Bi B: 0.0012 -> 0.0; CLeaR: 0.0022 -> 0.0 | Helped |
| Lower α (ablation) | Trust-GRS · ML-1M recommendation performance | HR@50: up to 31% | Hurt |
| Increase β (ablation) | Trust-GRS trustworthy contrastive learning · ML-1M, A_ra, Bi B, and CLeaR | HR@50 (target items): A_ra: 0.034 -> 3e-5; Bi B: 0.037 -> 0.0022; CLeaR: 0.072 -> 0.0026 | Helped |
| Set β too high (100) (ablation) | Trust-GRS trustworthy contrastive learning · ML-1M | training convergence: NaN | Hurt |
| Use heuristic deletion of lowest-loss data instead of Trust-GRS (ablation) | LightGCN on DouBan under GOAT · DouBan | recommendation performance: 41% | Hurt |
Surprising findings
- Heuristic deletion of lowest-loss data reduces recommendation performance by up to 41% while attacks still succeed, showing naive removal is inadequate.
- Lowering the confidence threshold alpha to defend strong attacks (Ara, BiB, CLeaR) can cause recommendation performance declines of up to 31% for CLeaR.
Limitations
- Defense relies on a low-loss anchor set; when strong attacks make fake data look real, fake probabilities drop and a confidence threshold must be tuned, trading off recommendation accuracy.
- Hyperparameters alpha and beta require dataset/attack-specific tuning; large beta makes CL loss NaN.
- Evaluated only on promoting attacks with 5% injection rate and 5 target items.
Experimental setup
Datasets: DouBan ML-1M Epinions
Benchmarks: DouBan ML-1M Epinions
Metrics: HR@50 Recall@50 NDCG@50
Baselines: PCA FAP Degree-SAD Semi-SAD AntiFU
Builds on: LightGCN SGL SimGCL XSimGCL BPR InfoNCE PageRank
Closest papers by meaning
- DiG-In-GNN: Discriminative Feature Guided GNN-Based Fraud Detector against Inconsistencies in Multi-Relation Fraud Graph (AAAI 2024 · similarity 0.84)
- Tail-STEAK: Improve Friend Recommendation for Tail Users via Self-Training Enhanced Knowledge Distillation (AAAI 2024 · similarity 0.83)
- Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach (NeurIPS 2024 · similarity 0.83)
- Redundancy Undermines the Trustworthiness of Self-Interpretable GNNs (ICML 2025 · similarity 0.83)
- Unveiling the Threat of Fraud Gangs to Graph Neural Networks: Multi-Target Graph Injection Attacks Against GNN-Based Fraud Detectors (AAAI 2025 · similarity 0.82)
- Behavior Importance-Aware Graph Neural Architecture Search for Cross-Domain Recommendation (AAAI 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.