{"id":"26ab1c9e-fa74-4b2d-8ef0-a66cb47931b3","arxiv_id":"2412.01127","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"INFAttack uses influence functions to greedily pick injected items for profile pollution, reporting better target-item promotion than gradient and similarity based attacks on five datasets.","lead":"This paper presents INFAttack, a method that uses a mathematical estimate of how much each inserted item would change a recommender model's output, and injects the most influential items into user histories to promote a chosen product. The authors report consistent gains over three existing profile pollution attacks on five datasets and four sequential recommender models.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm as printed cannot produce the reported attacks: Eq. (5) implies beneficial insertions have negative influence, but Algorithm 1 breaks when all influences are negative and otherwise selects by absolute value.","rationale":"The reader's REJECT verdict is correct. I focused on the printed algorithm's sign logic rather than only the proxy-validation gap because it is a direct internal contradiction and does not depend on external assumptions about influence-function quality. The paper may have intended a different sign convention, but as written Eqs. (5)-(10) and Algorithm 1 cannot be the method that produced Table 2. Fixing the sign is not cosmetic: line 8 changes whether any injection is performed, and Section 4.3.3's absolute-value rule can select harmful items. Even after fixing the sign, the central 'more accurate estimation' claim would still need a direct check of the influence ranking against true retraining, as the reader notes; but the sign error alone is sufficient to reject the submission in its current form. No code or error bars are provided, so Table 2 cannot be audited independently. The verdict therefore remains REJECT, unchanged from the reader's assessment.","tokens_in":19955,"tokens_out":8711,"duration_ms":84464,"concrete_test":"Run the printed Algorithm 1 on one setting, e.g., SASRec on ML-1M with K=2 and the same 15 target items as Section 5.2, using Eq. (10) and the written stopping/selection rules: stop if max_p I < 0, otherwise pick p = argmax_p |I|. After constructing X' and retraining, measure target-item R@10 and NDCG@10 and compare with Table 2 (INFAttack: 0.487/0.302 for SASRec/ML-1M). The expected outcome is that the loop breaks before K injections for most users because all candidates have negative I, or injects items with positive I, so the reproduced attack strength will be far below the reported values; that would confirm the reported numbers do not come from the stated algorithm.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that the printed INFAttack algorithm actually selects items that promote the target item after retraining. The filtering step contradicts the paper's own influence definition. Eq. (4) defines L_att as cross-entropy loss, with lower values meaning higher target-item probability. Eq. (5) then approximates R = L_att(theta_{1/n}) - L_att(theta_0) by (1/n) * dL_att/depsilon, so a candidate that promotes the target item must produce a negative I_epsilon,att in Eq. (10). However, Section 4.3.3 selects p' = argmax_p |I|, and Algorithm 1 line 8 breaks whenever max_p I < 0. Under the paper's sign convention, max_p I < 0 is exactly the situation where every candidate is beneficial; the loop should continue and select the most negative influence. Conversely, when some candidates have I > 0, selecting by absolute value can prefer a candidate that increases L_att and suppresses the target item. Thus the described algorithm cannot be the source of the large Recall@10/NDCG@10 gains in Table 2; the experiments must have used a different, unspecified selection rule. This internal inconsistency is more basic than the proxy-validity question: even a perfect influence estimate would not help if the filtering step uses the wrong sign.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes INFAttack, a profile pollution attack against sequential recommender systems that uses influence functions to select which items to inject into user interaction sequences. The method estimates, for each candidate one-item injection, the first-order influence of the resulting polluted sequence on the target item's cross-entropy loss, using a damped and stochastically approximated inverse Hessian. A greedy procedure inserts the selected item per user, repeated K times, and the polluted dataset is used to retrain the recommender. Experiments on ML-1M, Steam, Beauty, LastFM, and ML-20M with NARM, SASRec, BERT4Rec, and Locker claim that INFAttack outperforms RandomAlter, SimAlter, and Replace in target-item Recall@10 and NDCG@10, while roughly preserving overall recommendation quality.","tokens_in":20242,"tokens_out":3836,"duration_ms":36592,"significance":"If the central claim were supported, the paper would make a useful contribution to the study of poisoning attacks on sequential recommenders: it gives a clean threat model, applies a principled influence-function estimator to a practical attack setting, and evaluates across several datasets and backbones. The breadth of the experiments is a genuine strength. However, the manuscript's own Algorithm 1 contradicts the sign convention of the influence definition in Section 4.3, so the printed algorithm cannot be the source of the reported attack results. Because the central claim is about the proposed algorithm, this internal inconsistency is load-bearing. The paper also never validates the influence proxy against true retraining outcomes, leaving the claimed mechanism unsubstantiated even apart from the algorithmic contradiction.","major_comments":[{"comment":"There is a sign contradiction that makes Algorithm 1 unexecutable as a target-promotion method. In Eq. (4), L_att is a cross-entropy loss, so a lower L_att means a higher probability of recommending the target item. Eq. (3) defines R as L_att(theta_{1/n}) - L_att(theta_0), so a beneficial injection gives R < 0, and by Eq. (5) the influence I_{epsilon,att} in Eq. (10) is negative for candidates that promote the target. However, Section 4.3.3 and Algorithm 1 lines 8--11 select p' = argmax_p |I| and break when max_p I < 0. Under the paper's own convention, max_p I < 0 is exactly the situation in which every candidate is beneficial, so the loop should continue and choose the most negative influence, not break. Conversely, when some candidates have I > 0, selecting by absolute value can pick a candidate that increases L_att and suppresses the target. Thus the algorithm printed in the paper cannot be the selection rule behind the large Recall@10 and NDCG@10 gains reported in Table 2; the experiments must have used a different, unspecified rule, which invalidates the central claim as stated.","section":"Section 4.3.1, Section 4.3.3, Algorithm 1"},{"comment":"The paper never validates the influence proxy independently against true retraining outcomes. The only ablation, INFAttack-NINF in Table 5, compares influence-based selection with random selection; it does not show that the ranking produced by Eq. (10) correlates with the actual Recall@10/NDCG@10 improvement after retraining on the polluted dataset. This matters because the damping term lambda is tuned on the attack metric itself (Figure 6), so the reported gains could reflect hyperparameter tuning or the unspecified selection rule used in the experiments rather than the accuracy of the influence estimate. A direct validation experiment, e.g., correlating per-candidate I_{epsilon,att} with the measured target-item metric after retraining, and a sensitivity analysis showing that the conclusions hold for lambda values away from the tuned optimum, is needed to support the abstract's claim that INFAttack offers 'a more accurate estimation of the influence of polluting items.'","section":"Section 5.4, Section 5.5, Table 5, Figure 6"},{"comment":"The experimental comparison reports only point estimates. Given that 15 target items are randomly sampled and that the claimed margins over Replace are sometimes small (e.g., Locker on Steam, Locker on Beauty in Table 2), the manuscript should report standard deviations or significance tests across target-item samples. Without these, the universal claim that INFAttack 'surpasses all baseline methods and consistently delivers stable attack performance' is not fully supported, particularly for the smaller margins in the Locker rows.","section":"Section 5.1.4 and Table 2"}],"minor_comments":[{"comment":"Line 5 says 'Enumerate m possible combinations of v'_i (i<=K) from V,' which appears to enumerate combinations of up to K items, but Section 4.2 clearly states that one item is injected at a time, yielding m candidate sequences per step. This inconsistency should be resolved.","section":"Algorithm 1, line 5"},{"comment":"'INFAttck' is a typo for 'INFAttack'; please correct it.","section":"Section 4.4"},{"comment":"The conclusion says 'INFAtack has some limitations' but does not state what those limitations are. Please either specify the limitations or remove the unsupported statement.","section":"Section 6"},{"comment":"The LastFM row reports an average sequence length of 9739 with 998 users and 57,638 items; the maximum sequence length used in preprocessing for LastFM and ML-20M is not stated in Section 5.1.5, so the reader cannot determine how truncation affects the attack setting.","section":"Table 1"},{"comment":"The x-axis range is given as {0.0001, 0.001, 0.005, 0.01, 0.05, 0.1}, but the figure axis is not labeled with these values; adding explicit tick labels would improve readability.","section":"Figure 6"}],"recommendation":"reject","confidential_remarks":"The sign inconsistency in Algorithm 1 versus Eqs. (3)--(6) is severe: the printed method cannot produce the reported results, so the experimental numbers cannot be attributed to the described algorithm. This is not a presentation issue; it affects the validity of the central claim. If the authors correct the algorithm, specify the actual selection rule, and add a direct validation of the influence proxy, a resubmission may be worth considering, but the current manuscript does not meet the bar for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The reader's sign objection is right, and it is the main thing you need to know. Equations (3)-(5) define a smaller L_att as better for the target item, so a useful injection should give a negative I in Eq. (10). Algorithm 1 then stops whenever all candidate influences are negative—exactly the case where every candidate helps—and otherwise picks by absolute value, which can prefer a candidate that hurts. As printed, the selection rule is the inverse of the paper's own objective. This is not a cosmetic typo; it is the entire screening mechanism, and it means the reported Recall@10/NDCG@10 gains cannot be attributed to the described method. The experiments must have used a different rule.\n\nCredit where due: the idea is a reasonable, modest extension. Influence-based poisoning exists for top-N recommenders (Fang et al., Wu et al.) and gradient-based profile pollution exists (Replace), but nobody has used influence functions to pick injected items for profile pollution on sequential models. The evaluation is broad: five datasets, four backbones, popularity-stratified targets, and a side-effect check on HR@10. The results are consistently in one direction and often large. If the selection rule were fixed, this could be a useful attack for robustness evaluation.\n\nThe other soft spots are real but secondary. The 'more accurate estimation' claim is never checked directly: there is no comparison of predicted influence against actually retraining on one polluted sequence, so we only see final attack metrics. The damping term lambda is tuned on the attack metric, and the Hessian approximation has its own free parameters, none reported. There are no error bars, no code, and no ablation that isolates the influence ranking from the selection heuristic. Without code, the sign issue alone is enough to make the paper non-reproducible.\n\nWho is it for? Someone building defense evaluations for sequential recommenders might get value from a corrected version; as written, no one should build on it. My recommendation to the editor: return, don't send to review in its current form. Ask for a corrected algorithm, code or detailed pseudo-code, and a direct validation of the influence proxy against true retraining. If the numbers survive that, it is a solid short contribution.","headline":"Broad experiments and a sensible extension of influence functions to profile pollution, but the printed selection rule contradicts the paper's own sign convention, so the algorithm as written cannot be the source of the reported gains.","tokens_in":20745,"tokens_out":3618,"would_cite":false,"duration_ms":33796,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Influence functions pick the items that make sequential recommenders promote a target.","keywords":["sequential recommendation","profile pollution attack","influence function","data poisoning attack","recommender system attack","greedy item injection","adversarial machine learning"],"falsifier":"Take a set of users and candidate items; for each single-item injection, compute INFAttack's influence score, retrain the recommender from scratch on the polluted dataset, and measure the actual change in target-item Recall@10 relative to the clean model. If the rank correlation between predicted influence and actual gain is not positive and strong, the influence ranking is not what carries the attack.","tokens_in":19778,"feed_emoji":"🎯","tokens_out":10722,"duration_ms":89481,"temperature":0.7,"pith_summary":"This paper tries to establish that a profile pollution attack on sequential recommender systems can be made both stronger and more reliable by choosing injected items with the influence function rather than with gradients, similarity, or randomness. In the attack, an adversary who knows the model and training loss appends a candidate item to a user's interaction history; the influence function—a robust-statistics estimate of how a small change to the training data moves the learned model—is used to predict, without retraining, how much that insertion would shift recommendations toward a target item. INFAttack greedily injects the highest-influence item per user up to a budget $K$ and repeats. On five datasets and four recommender backbones the paper reports that INFAttack raises target-item Recall@10 and NDCG@10 above three baseline attacks, and that unlike the baselines it keeps working when the target item is unpopular. If this is right, sequential recommenders are easier to manipulate than gradient-based attacks suggested, and influence functions deserve attention both as an attack tool and as a lens for auditing data influence.","feed_headline":"Influence functions reveal the best items for polluting a recommender","feed_subtitle":"It beats gradient and similarity baselines on five datasets, and keeps working for unpopular targets.","key_machinery":"The machinery is the influence function from robust statistics, adapted to sequential recommenders. The paper defines the influence of replacing a user's sequence by one with an extra item as the change in model parameters implied by upweighting the loss difference, computes it through a damped inverse-Hessian-vector product, and approximates the inverse Hessian with a stochastic Taylor expansion. The resulting score estimates how much the polluted sequence would move the model toward recommending the target item. Greedy selection over all catalog items per user, repeated $K$ times, turns this score into an attack.","core_discovery":"The central claim is that the first-order influence function, evaluated at the parameters of the clean model, gives a usable ranking of which item to inject next in order to promote a target item. For each user, INFAttack forms $m$ candidate polluted sequences by appending every item in the catalog and scores each by $I_{\\epsilon,\\mathrm{atk}}(x_u,x_u(\\delta_p)) = -\\nabla_\\theta L_{\\mathrm{atk}}(\\hat{\\theta}; v^*)^\\top (H_{\\hat{\\theta}}+\\lambda I)^{-1} \\nabla_\\theta [ L(x_u(\\delta_p);\\hat{\\theta}) - L(x_u;\\hat{\\theta}) ]$, with the inverse Hessian estimated by a stochastic Taylor expansion. The item with the largest absolute score is appended, and the process repeats $K$ times. The authors report that this procedure outperforms RandomAlter, SimAlter, and Replace on NARM, SASRec, BERT4Rec, and Locker across ML-1M, Steam, Beauty, LastFM, and ML-20M, with relative NDCG@10 improvements over the best baseline averaging roughly 0.13 on three backbones, and that tail-item promotion succeeds where gradient and similarity attacks fail.","pith_inferences":["Beyond the paper, the same influence scores could be used defensively: an operator could rank every possible single-item insertion by predicted effect on recommendations and flag the top-scoring injections as suspicious before retraining.","Beyond the paper, a direct validity check would measure the rank correlation between INFAttack's predicted influence and the actual target-item gain measured after retraining each candidate injection separately; this would separate the contribution of the influence estimate from the contribution of the greedy selection policy.","Beyond the paper, the recipe of scoring each single-item insertion by influence and greedily taking the maximum could be transferred to other differentiable recommendation objectives, such as demoting a target item out of the top-$K$ list.","Beyond the paper, because influence functions already support data attribution and unlearning, the same computations could be reused to audit or remove injected items once an attack is suspected."],"forward_implications":["If the paper is right, injecting one or two influence-selected items per user can lift target-item Recall@10 and NDCG@10 far above the clean model and above gradient, similarity, and random baselines on every tested backbone.","The attack keeps working for unpopular and long-tail target items, so attackers do not need to limit themselves to popular items to get reliable promotion.","Because the paper's setup assumes distillation can convert black-box attacks into white-box ones, a successful white-box influence attack also threatens deployed black-box sequential recommenders.","The injection budget $K$ controls a real tradeoff: more injected items strengthen the attack but degrade overall recommendation quality, so an attacker can stay plausible while still promoting the target.","The stochastic Hessian approximation makes the influence score computable at scale, avoiding the cost of full Hessian inversion during attack construction."],"supporting_citations":[{"why":"Supplies the influence-function definition and the stochastic Hessian-inverse estimation that INFAttack adapts to sequential recommenders.","marker":"[16]"},{"why":"Defines the substitution-based profile pollution setting and provides the state-of-the-art gradient baseline Replace that INFAttack must beat.","marker":"[47]"},{"why":"Provides the similarity-based attack SimAlter used as a baseline and motivates attack transfer across white-box and black-box settings.","marker":"[46]"},{"why":"Motivates adding the damping term lambda I to the Hessian so the influence computation stays valid for sequential models.","marker":"[1]"},{"why":"Provides the classical expression for the influence of a training point on model parameters used in the paper's derivation.","marker":"[6]"},{"why":"Supplies the BERT4Rec backbone and the dataset preprocessing protocol with the last two items held out for validation and testing.","marker":"[34]"}],"fun_headline_variants":["Influence functions pick better poisoning items for recommenders","Influence-based attack beats gradient methods on five datasets","INFAttack: precise profile pollution via influence functions","Targeted poisoning for recommender systems, powered by influence"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that an influence score computed at the original model parameters correctly ranks, for each user and each candidate item, how much injecting that item will promote the target item after the recommender is retrained on the polluted data, and that this ranking stays valid when injections are repeated $K$ times.","fun_headline_variants_meta":{"raw":{"variants":["Influence functions pick better poisoning items for recommenders","Influence-based attack beats gradient methods on five datasets","INFAttack: precise profile pollution via influence functions","Targeted poisoning for recommender systems, powered by influence"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000804,"raw_usage":{"total_tokens":3542,"prompt_tokens":967,"completion_tokens":2575,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":583,"completion_tokens_details":{"reasoning_tokens":2512}},"tokens_in":583,"tokens_out":2575,"duration_ms":18715,"temperature":1.0,"reasoning_tokens":2512,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:40:29.246749+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of users and candidate items; for each single-item injection, compute INFAttack's influence score, retrain the recommender from scratch on the polluted dataset, and measure the actual change in target-item Recall@10 relative to the clean model. If the rank correlation between predicted influence and actual gain is not positive and strong, the influence ranking is not what carries the attack.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the influence-function definition and the stochastic Hessian-inverse estimation that INFAttack adapts to sequential recommenders."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the substitution-based profile pollution setting and provides the state-of-the-art gradient baseline Replace that INFAttack must beat."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the similarity-based attack SimAlter used as a baseline and motivates attack transfer across white-box and black-box settings."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates adding the damping term lambda I to the Hessian so the influence computation stays valid for sequential models."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the classical expression for the influence of a training point on model parameters used in the paper's derivation."}],"review_version":1}