Research map / Adversarial robustness and security / Attacks on text and graphs
Understanding and Improving Adversarial Collaborative Filtering for Robust Recommendation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Gives a theoretical analysis of why adversarial collaborative filtering (ACF) improves both recommendation performance and robustness, and proposes PamaCF, which scales each user's adversarial perturbation magnitude by their embedding norm.
Problem
Adversarial collaborative filtering (ACF) is empirically effective against poisoning attacks and improves recommendation accuracy, but lacks a theoretical explanation, and it is unclear how to further improve it.
Approach
Theoretical analysis on a Gaussian single-item recommender shows ACF lowers recommendation error versus traditional CF in clean and poisoned settings, and error-reduction bounds grow with perturbation magnitude; this motivates personalized perturbation magnitudes proportional to each user's embedding norm (PamaCF).
Key results
- PamaCF increases Recall@20 and NDCG@20 on average by 13.84% and 22.04% over the MF backbone, per the paper's reported averages.
- PamaCF reduces target-item attack success (T-HR@50 and T-NDCG@50) by 49.92% and 43.73% on average versus the best baseline.
- On Gowalla with MF, PamaCF achieves 13.48 Recall@20 on clean data versus 11.35 for MF and 13.06 for APR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use personalized perturbation magnitudes based on user embedding scales instead of standard ACF perturbations | MF · Gowalla, Yelp2018, and MIND clean and attacked settings | Recall@20 and NDCG@20: +13.84% Recall@20 and +22.04% NDCG@20 on average vs. backbone model | Helped |
| Use personalized perturbation magnitudes based on user embedding scales instead of standard ACF perturbations | MF · Poisoning attacks across datasets | T-HR@50 and T-NDCG@50: 49.92% and 43.73% | Helped |
| Increase perturbation magnitude within the user-specific maximum constraint | ACF · Gaussian recommender system, clean data | recommendation error reduction | Helped |
| Increase perturbation magnitude within the user-specific maximum constraint | ACF · Gaussian recommender system, poisoned data | poisoned recommendation error reduction | Helped |
| Increase PamaCF magnitude ρ | PamaCF on MF · Recommendation performance and robustness | Recall/NDCG and attack success ratio | Helped |
| Set adversarial training weight λ too high | PamaCF on MF · Recommendation performance | Recall/NDCG | Hurt |
| Increase adversarial training weight λ beyond 1.0 | PamaCF on MF · Most poisoning attacks | defensive ability | No clear effect |
Surprising findings
- Adversarial training improves recommendation performance on clean data rather than trading it off, contrary to the robustness-accuracy trade-off seen in computer vision.
- Detection-based GraphRfi and LLM4Dec reduce recommendation performance due to misclassifying genuine users.
Limitations
- Theory relies on a simplified Gaussian single-item recommender system with assumptions that are not fully relaxed.
- Only adversarial training within CF is studied, not sequential or other recommendation scenarios.
- Rev Attack could not run on MIND due to out-of-memory errors, so some comparisons are incomplete.
Experimental setup
Datasets: Gowalla Yelp2018 MIND
Benchmarks: Gowalla Yelp2018 MIND
Metrics: Recall@20 NDCG@20 Recall@10 NDCG@10 T-HR@50 T-NDCG@50
Baselines: APR SharpCF StDenoise GraphRfi LLM4Dec
Builds on: Adversarial Personalized Ranking (APR) Bayesian Personalized Ranking (BPR) SharpCF
Closest papers by meaning
- Empowering Collaborative Filtering with Principled Adversarial Contrastive Loss (NeurIPS 2023 · similarity 0.88)
- DR-VAE: Debiased and Representation-enhanced Variational Autoencoder for Collaborative Recommendation (AAAI 2025 · similarity 0.85)
- Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off (AAAI 2024 · similarity 0.84)
- Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation (AAAI 2025 · similarity 0.84)
- Sparse Enhanced Network: An Adversarial Generation Method for Robust Augmentation in Sequential Recommendation (AAAI 2024 · similarity 0.84)
- Personalized Federated Collaborative Filtering: A Variational AutoEncoder Approach (AAAI 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.