{"id":"9d1dd100-558c-49e2-be38-53485a52e59e","arxiv_id":"2412.20802","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A robust discrete matrix completion method, RDMC, reduces the impact of fake-profile attacks on recommender systems while keeping competitive prediction accuracy on discrete rating data.","lead":"The paper introduces RDMC, a matrix completion method for discrete rating scales that combines a robust loss function with low-rank regularization to limit the influence of fake profiles. It compares RDMC with Soft-Impute variants in simulations and two real datasets, finding that RDMC stays stable under shilling attacks while paying a small accuracy cost when no attack occurs.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness gap may be largely due to median centering: SI is mean-centered while RDMC is median-centered, so the robust-loss/discreteness contribution is not isolated.","rationale":"The reader's verdict is CONDITIONAL, with the stated weakest assumption being that the attack schemes tested (nuke attacks only, target selection tied to popularity, MPS as the harm metric) may not generalize to other real manipulation modes. That is a legitimate domain-representativeness concern. However, I find a more directly load-bearing technical gap: the comparison between RDMC and SI-discretized changes two things at once. RDMC uses median centering and SI uses mean centering, so the robustness gap could be a preprocessing artifact rather than evidence for the robust loss or the discreteness/low-rank coupling highlighted in the paper's central claim. This is not a contradiction of any internal result; the reported numbers may be exactly as stated. But the causal attribution in the conclusion—that the method's components are what provide protection—is underdetermined by the current experiments. The proposed ablation would settle this by holding centering fixed while varying the robust loss, and vice versa. The paper does provide independent support in the form of a public R package (RMCLab) and detailed simulation designs, which is credit where due. Still, the ablation is necessary before the central claim can be accepted as a statement about the robust loss mechanism. Since the reader already flagged the centering confound as one of three requested fixes and assigned CONDITIONAL, my stress-test does not move the verdict; it sharpens the reason why the verdict should remain CONDITIONAL rather than ACCEPT.","tokens_in":20686,"tokens_out":5559,"duration_ms":63632,"concrete_test":"Re-run the Section 3.3 attack simulations with four additional configurations: (1) SI-discretized on median-centered training data; (2) RDMC-pHuber on mean-centered training data with categories recentered accordingly; (3) SI-discretized with median centering but no robust loss; (4) RDMC with median centering but squared-error loss instead of the robust loss. Compare MPS under the average, reverse bandwagon, and love/hate attacks for K=3, 5, and 10, and also compare no-attack MAE. If SI-median-discretized matches RDMC's MPS, the robustness advantage is attributable to centering. If RDMC with squared error still shows the stability, the robust loss is not the active ingredient.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim attributes RDMC's stability to its robust loss and discreteness constraint, but the evaluation never isolates the preprocessing. RDMC centers columns by the observed median (Section 2.3), while SI is run on mean-centered training data (Section 3.4). Under the nuke attacks, 20% of the target item's observed ratings are replaced with minimum ratings (Section 3.3). Mean centering is fragile to this contamination: the target column mean shifts downward, dragging all SI predictions for that item down, and the post-hoc discretization step of SI-discretized inherits this shift. Median centering is resistant to up to 50% contamination, so RDMC's target column center barely moves. Figure 2 shows that even plain median imputation is stable for K=3 and K=5, and only degrades for K=10. Thus the large MPS gap between RDMC and SI-discretized in Figures 2 and 5 may be substantially due to the centering choice, not to the robust loss or the low-rank/discreteness coupling that are the paper's claimed contributions. The no-attack 'small price' comparison is similarly confounded because SI and RDMC use different centering. Without an ablation, the mechanism underlying the central robustness claim is unidentified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Robust Discrete Matrix Completion (RDMC), an ADMM-based matrix completion method for discrete rating-scale data that combines a robust loss on observed ratings, a discreteness constraint on predictions, and a nuclear-norm low-rank constraint on an ancillary continuous matrix. Rating columns are centered by their observed median. The method is evaluated against Soft-Impute, a discretized Soft-Impute variant, and simple imputation benchmarks in simulations and two case studies (MovieLens 100K, Yahoo! Music), under nuke attacks and MNAR/MCAR missingness. The authors report that RDMC is substantially more stable than Soft-Impute under attacks, with mean prediction shifts near zero, while paying a small accuracy price in the absence of attacks. A CRAN package RMCLab is provided, and the paper proposes the simulation design as a reproducibility blueprint.","tokens_in":20942,"tokens_out":4884,"duration_ms":47909,"significance":"If the central claim is confirmed, the paper makes a useful contribution: it jointly addresses discreteness, robustness to fake profiles, and MNAR missingness, and it provides a concrete, reproducible evaluation design with public code. The method is clearly described, the regularization parameter is selected by repeated holdout validation, and the robust loss tuning parameters are tied to the rating scale rather than to evaluation outcomes. The empirical work is extensive: simulations across K=3,5,10 categories and two real datasets. However, the main robustness result is currently confounded by a preprocessing difference between RDMC and Soft-Impute, and the no-attack accuracy claim is not uniform across rating scales. These issues are fixable and do not undermine the algorithmic contribution itself, but they determine whether the stated reliability mechanism is actually identified.","major_comments":[{"comment":"The comparison underlying the central robustness claim is confounded by the choice of column centering. RDMC centers each column by the observed median and initializes L by median imputation (Section 2.3), whereas Soft-Impute is run on mean-centered training data (Section 3.4). In the nuke attacks, ε=0.2 of the target item's observed ratings are replaced by the minimum rating (Section 3.3); this shifts the target column mean but leaves the median unchanged at contamination below 50%. The large negative MPS of SI and SI-discretized in Figures 2 and 5 can therefore be driven by the centering step alone, before the robust loss or discreteness/low-rank coupling plays any role, and indeed plain median imputation is itself stable for K=3 and K=5 in Figure 2. No ablation varying centering while holding the method fixed is reported, so the paper's Section 5 claim that RDMC's robustness stems from its robust loss and discreteness constraint is not identified. Please add RDMC with mean centering and SI/median imputation with median centering, or otherwise isolate the centering contribution.","section":"§2.3 and §3.4, Figures 2 and 5"},{"comment":"The robustness evidence covers only nuke attacks aimed at demoting a single popular target item, with attack size ε=0.2 in simulations and ε∈{0.10,0.15,0.20} in MovieLens, and MPS measured on missing cells of that target item. The concluding claim that RDMC 'protects well against adversarial manipulation' is therefore broader than the evidence: push or bandwagon attacks, attacks on multiple items, model-aware attacks, and metrics that track actual recommendation harm (e.g., ranking displacement or exposure) are not considered. This does not invalidate the method, but the scope of the reliability claim should be stated as applying to the studied nuke attack family and target-item definition, or additional attack settings should be reported.","section":"§3.3 and §5"},{"comment":"The statement that RDMC pays 'only a small price' in the absence of corrupted observations is not uniformly supported by Figure 1. With K=3 rating categories, RDMC-pHuber is close to median-discretized imputation and clearly worse than SI-discretized; with K=5 in the MNAR setting it lies between SI and SI-discretized; only for K=10 does it dominate both SI variants. The discussion in Section 5 should qualify the no-attack comparison by the number of rating categories and should not present the price as uniformly small.","section":"§5 and Figure 1"}],"minor_comments":[{"comment":"The text says 'median regression is stable for three and five rating categories'; this should be 'median imputation' or 'median-discretized imputation', and the sentence should state which benchmark is being referred to.","section":"§3.6"},{"comment":"The convergence criterion is a relative change in the objective function, but for the nonconvex truncated absolute loss there is no convergence guarantee; the paper states that tmax=100 sufficed in all experiments, yet it should explicitly acknowledge the lack of a guarantee and report how often the iteration limit was reached.","section":"§2.2"},{"comment":"The text says the MCAR attack results are 'qualitatively similar' to MNAR, but Figure A.3 shows a small number of large negative MPS instances for RDMC that are not present in the MNAR setting; this difference should be acknowledged in the main text rather than only in the appendix.","section":"§3.6 and Figure A.3"},{"comment":"The replication files are promised to be made public upon acceptance, but for a reproducibility-focused paper they should be available at review time; please provide a repository link or an anonymized copy in the current version.","section":"Data availability"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about median versus mean centering is the strongest point and is confirmed by reading Sections 2.3, 3.3, and 3.4: the MPS comparison does not isolate the robust loss or discreteness contribution. I would prioritize a centering ablation and a qualified no-attack statement. The external-validity limitation to nuke attacks is also worth addressing explicitly, although it is a scope issue rather than an internal error. The paper is otherwise well organized and the software contribution is a genuine strength."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: RDMC is a sensible extension of Huang et al. (2013), and the simulation setup is genuinely useful, but the paper's headline robustness result is not yet nailed down because the comparison confounds median centering with the robust loss.\n\nWhat's new: Equation (2) explicitly generalizes Huang et al.'s robust discrete matrix completion to a wider class of robust losses and to column-specific rating categories after median centering. The authors are honest about that lineage. The evaluation blueprint—discrete scales, MNAR mechanisms, profile-injection attacks, repeated holdout lambda selection—is a real contribution, and the CRAN package RMCLab ships working code. The simulations and case studies are internally coherent; Figures 2 and 5 do show RDMC's mean prediction shift near zero under nuke attacks while Soft-Impute shifts by a category or more.\n\nThe soft spots, in order of seriousness. First, the median-centering confound. RDMC centers each column by the observed median (Section 2.3); SI is run on mean-centered data (Section 3.4). Under a 20% nuke attack on the target item, the column mean moves, the median does not. Figure 2 shows that even plain median imputation is stable for K=3 and K=5. So the large MPS gap between RDMC and SI-discretized may be substantially explained by the centering choice rather than the robust loss or the low-rank/discreteness coupling that are the paper's claimed contributions. An ablation—median-centered SI, or mean-centered RDMC—is needed before the mechanism is identified. The no-attack \"small price\" comparison is similarly confounded.\n\nSecond, replication files are promised \"upon acceptance,\" which slows verification; the case-study MAE numbers come from a single train/test split with no error bars; and attack coverage is limited to three nuke schemes on a single target. Those are fixable and don't break the central claim. The attack-representativeness concern is real but secondary.\n\nNone of this kills the paper. The method is clearly explained, the authors know the relevant literature, and the experiments are reproducible in principle. The paper deserves a serious referee. I'd send it out and ask for the centering ablation, public replication files, and a small repeated-splits analysis for the case studies before treating it as a benchmark.","headline":"Useful robust-discrete matrix completion paper whose headline robustness claim is confounded by median versus mean centering and needs an ablation before the mechanism is clear.","tokens_in":21467,"tokens_out":2286,"would_cite":true,"duration_ms":22670,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62F35","62H12","68T05"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper shows that robust discrete matrix completion (RDMC) keeps recommender predictions stable under fake-profile attacks, while sacrificing little accuracy in clean data.","keywords":["robust matrix completion","discrete rating-scale data","recommender systems","adversarial attacks","fake profiles","missing not at random","ADMM","low-rank matrix completion"],"falsifier":"Re-run the simulation with a push attack that tries to promote an unpopular item, or with fake profiles that know the RDMC model's parameters; if the mean prediction shift on the attacked item becomes as large as Soft-Impute's, the claimed reliability advantage does not generalize to that attack class.","tokens_in":20460,"feed_emoji":"⭐","tokens_out":8341,"duration_ms":75128,"temperature":0.7,"pith_summary":"Recommender systems need matrix completion methods that work with discrete star ratings, survive fake-user manipulation, and handle ratings that are missing not at random. This paper proposes robust discrete matrix completion (RDMC), which fits predictions to the rating scale while using a robust loss that downweights corrupted observations and a separate continuous low-rank matrix that carries the underlying structure. The central empirical claim is that under the three standard nuke attack schemes—average, reverse bandwagon, and love/hate—RDMC keeps the mean prediction shift on the target item close to zero, whereas Soft-Impute shifts by a full rating category or more. In attack-free settings RDMC pays only a small accuracy price compared with discretized Soft-Impute, and it often matches or beats it. The paper also offers its simulation and case-study protocol as a reproducible template for evaluating recommender methods under realistic conditions.","feed_headline":"Matrix completion that respects star ratings resists fake profiles","feed_subtitle":"Under fake-profile attacks the target item's predicted ratings barely move, and clean-data accuracy stays high.","key_machinery":"The engine is an alternating direction method of multipliers over two coupled matrices: a discrete matrix whose entries are restricted to the column-specific rating categories, and a continuous auxiliary matrix that absorbs the nuclear-norm low-rank regularization. Each iteration alternates a soft-thresholded singular value decomposition for the continuous matrix with an elementwise categorical argmin for the discrete matrix, then updates the discrepancy multiplier and penalty. The robust loss—pseudo-Huber, absolute, or truncated absolute—replaces the squared error on observed cells so that fake profiles with extreme ratings do not dominate the fit, and the same loss is used in repeated holdout validation to choose the regularization parameter.","core_discovery":"The central claim is that the combination of a robust loss, a discreteness constraint, and a low-rank constraint in one objective is enough to keep a recommender system stable under profile-injection attacks while staying competitive when no attack occurs. RDMC minimizes a robust loss on the observed rating residuals subject to predictions lying on the rating categories, with a nuclear-norm-regularized continuous auxiliary matrix kept close to the discrete solution through an augmented Lagrangian. In the simulations, RDMC's mean prediction shift stays near zero across all three nuke attack schemes and both missing-data mechanisms, while Soft-Impute's predictions for the target item drop by at least one rating category in many settings. On MovieLens 100K the mean prediction shift of RDMC is close to zero for attack sizes up to 20 percent of the target item's observed ratings, and on the Yahoo! Music data RDMC has the lowest test-set mean absolute error under both missing-not-at-random and missing-completely-at-random mechanisms.","pith_inferences":["The paper's attack generator covers nuke attacks against one popular item; a natural stress test is to repeat the protocol with push attacks, attacks on several items, or model-aware attacks to see whether the robustness generalizes.","Mean prediction shift is an average over missing target cells; an implicit assumption is that this tracks how much user-facing recommendations change, so a sharper test would examine ranking changes or simulated click-through.","In the survey simulations the truncated absolute loss is the best choice when many respondents are careless, suggesting the loss function should be tuned to the expected type and concentration of corruption rather than fixed once.","The discreteness constraint could also be exploited in strategic missing-data settings, where withholding unfavorable values is the manipulation; the paper sketches this direction but does not test it."],"forward_implications":["Under average, reverse bandwagon, and love/hate attacks, RDMC keeps the target item's mean prediction shift close to zero, while Soft-Impute shifts by a full rating category or more in many settings.","Discretizing Soft-Impute's continuous predictions improves its attack-free accuracy, especially with five or fewer rating categories, but leaves it as vulnerable to fake profiles as the original.","A liberal stopping criterion of about ten iterations can reduce RDMC's computation time by more than a factor of three with little loss in prediction accuracy, except under love/hate attacks where the strict criterion is better.","RDMC's accuracy is competitive with or better than Soft-Impute variants on real data under both missing-not-at-random and missing-completely-at-random missingness.","The same robust discrete completion procedure shows preliminary promise for imputing rating-scale survey data with careless or bot respondents."],"supporting_citations":[{"why":"Supplies the robust discrete matrix completion formulation and ADMM template that RDMC generalizes to a wider class of robust losses and column-specific rating categories.","marker":"Huang et al. (2013)"},{"why":"Introduces Soft-Impute, the main low-rank matrix completion baseline whose discretized variant RDMC is compared against.","marker":"Mazumder et al. (2010)"},{"why":"Provides the fast alternating least-squares Soft-Impute implementation and stopping-criterion strategy used for the baseline.","marker":"Hastie et al. (2015)"},{"why":"Gives the singular value thresholding step that solves RDMC's update for the continuous auxiliary matrix.","marker":"Cai et al. (2010)"},{"why":"Supplies the ADMM framework that underlies the algorithm.","marker":"Boyd et al. (2011)"},{"why":"Defines the nuke attack schemes (average, reverse bandwagon, love/hate) and the mean prediction shift measure used in the evaluation.","marker":"Mobasher et al. (2007)"},{"why":"Provides MovieLens 100K, one of the two empirical datasets used for the case studies.","marker":"Harper & Konstan (2015)"},{"why":"Motivates replacing the squared Frobenius loss with a robust loss in matrix completion, which RDMC adopts.","marker":"Tang & Guan (2020)"}],"fun_headline_variants":["Robust matrix completion shrugs off fake-profile attacks","Discrete stars, robust loss: recommender immune to fake users","RDMC: stable recommendations despite manipulative profiles","Reliable recommender: handles star scales and malicious users","Fake-profile defense meets discrete ratings in matrix completion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The robustness evidence rests on three specific fake-profile schemes that demote a single popular item, so if real attackers use other strategies the protection shown here may not carry over.","fun_headline_variants_meta":{"raw":{"variants":["Robust matrix completion shrugs off fake-profile attacks","Discrete stars, robust loss: recommender immune to fake users","RDMC: stable recommendations despite manipulative profiles","Reliable recommender: handles star scales and malicious users","Fake-profile defense meets discrete ratings in matrix completion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000696,"raw_usage":{"total_tokens":3145,"prompt_tokens":940,"completion_tokens":2205,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":556,"completion_tokens_details":{"reasoning_tokens":2126}},"tokens_in":556,"tokens_out":2205,"duration_ms":14791,"temperature":1.0,"reasoning_tokens":2126,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:10:19.641389+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the simulation with a push attack that tries to promote an unpopular item, or with fake profiles that know the RDMC model's parameters; if the mean prediction shift on the attacked item becomes as large as Soft-Impute's, the claimed reliability advantage does not generalize to that attack class.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the robust discrete matrix completion formulation and ADMM template that RDMC generalizes to a wider class of robust losses and column-specific rating categories."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces Soft-Impute, the main low-rank matrix completion baseline whose discretized variant RDMC is compared against."},{"cited_title":"D., & Zadeh, R","cited_arxiv_id":null,"evidence_quote":"Provides the fast alternating least-squares Soft-Impute implementation and stopping-criterion strategy used for the baseline."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the nuke attack schemes (average, reverse bandwagon, love/hate) and the mean prediction shift measure used in the evaluation."},{"cited_title":"& Guan, W","cited_arxiv_id":null,"evidence_quote":"Motivates replacing the squared Frobenius loss with a robust loss in matrix completion, which RDMC adopts."}],"review_version":1}