Precision Profile Pollution Attack on Sequential Recommenders via Influence Function

Jinhui Tang; Xiaoyu Du; Yang Zhang; Yingying Chen

REVIEW 3 major objections 5 minor 60 references

Precision Profile Pollution Attack on Sequential Recommenders via Influence Function

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Influence functions pick the items that make sequential recommenders promote a target.

desk verdict Broad experiments and a sensible extension of influence functions to profile pollution, but the printed selection rule contradicts the paper's own sign convention, so the algorithm as written cannot be the source of the reported gains. read the letter →

arxiv 2412.01127 v1 pith:56WW3SBU submitted 2024-12-02 cs.IR

Xiaoyu Du , Yingying Chen , Yang Zhang , Jinhui Tang This is my paper · ORCID

classification cs.IR

keywords sequentialrecommendationprofilepollutionattackinfluencefunctiondatapoisoningrecommendersystemgreedyiteminjectionadversarialmachinelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a profile pollution attack on sequential recommender systems can be made both stronger and more reliable by choosing injected items with the influence function rather than with gradients, similarity, or randomness. In the attack, an adversary who knows the model and training loss appends a candidate item to a user's interaction history; the influence function—a robust-statistics estimate of how a small change to the training data moves the learned model—is used to predict, without retraining, how much that insertion would shift recommendations toward a target item. INFAttack greedily injects the highest-influence item per user up to a budget $K$ and repeats. On five datasets and four recommender backbones the paper reports that INFAttack raises target-item Recall@10 and NDCG@10 above three baseline attacks, and that unlike the baselines it keeps working when the target item is unpopular. If this is right, sequential recommenders are easier to manipulate than gradient-based attacks suggested, and influence functions deserve attention both as an attack tool and as a lens for auditing data influence.

What carries the argument

The machinery is the influence function from robust statistics, adapted to sequential recommenders. The paper defines the influence of replacing a user's sequence by one with an extra item as the change in model parameters implied by upweighting the loss difference, computes it through a damped inverse-Hessian-vector product, and approximates the inverse Hessian with a stochastic Taylor expansion. The resulting score estimates how much the polluted sequence would move the model toward recommending the target item. Greedy selection over all catalog items per user, repeated $K$ times, turns this score into an attack.

What would settle it

Take a set of users and candidate items; for each single-item injection, compute INFAttack's influence score, retrain the recommender from scratch on the polluted dataset, and measure the actual change in target-item Recall@10 relative to the clean model. If the rank correlation between predicted influence and actual gain is not positive and strong, the influence ranking is not what carries the attack.

Watch

Extended reading notes

Core claim

The central claim is that the first-order influence function, evaluated at the parameters of the clean model, gives a usable ranking of which item to inject next in order to promote a target item. For each user, INFAttack forms $m$ candidate polluted sequences by appending every item in the catalog and scores each by $I_{\epsilon,\mathrm{atk}}(x_u,x_u(\delta_p)) = -\nabla_\theta L_{\mathrm{atk}}(\hat{\theta}; v^*)^\top (H_{\hat{\theta}}+\lambda I)^{-1} \nabla_\theta [ L(x_u(\delta_p);\hat{\theta}) - L(x_u;\hat{\theta}) ]$, with the inverse Hessian estimated by a stochastic Taylor expansion. The item with the largest absolute score is appended, and the process repeats $K$ times. The authors report that this procedure outperforms RandomAlter, SimAlter, and Replace on NARM, SASRec, BERT4Rec, and Locker across ML-1M, Steam, Beauty, LastFM, and ML-20M, with relative NDCG@10 improvements over the best baseline averaging roughly 0.13 on three backbones, and that tail-item promotion succeeds where gradient and similarity attacks fail.

Load-bearing premise

The load-bearing premise is that an influence score computed at the original model parameters correctly ranks, for each user and each candidate item, how much injecting that item will promote the target item after the recommender is retrained on the polluted data, and that this ranking stays valid when injections are repeated $K$ times.

Editorial extensions

If this is right

If the paper is right, injecting one or two influence-selected items per user can lift target-item Recall@10 and NDCG@10 far above the clean model and above gradient, similarity, and random baselines on every tested backbone.
The attack keeps working for unpopular and long-tail target items, so attackers do not need to limit themselves to popular items to get reliable promotion.
Because the paper's setup assumes distillation can convert black-box attacks into white-box ones, a successful white-box influence attack also threatens deployed black-box sequential recommenders.
The injection budget $K$ controls a real tradeoff: more injected items strengthen the attack but degrade overall recommendation quality, so an attacker can stay plausible while still promoting the target.
The stochastic Hessian approximation makes the influence score computable at scale, avoiding the cost of full Hessian inversion during attack construction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper, the same influence scores could be used defensively: an operator could rank every possible single-item insertion by predicted effect on recommendations and flag the top-scoring injections as suspicious before retraining.
Beyond the paper, a direct validity check would measure the rank correlation between INFAttack's predicted influence and the actual target-item gain measured after retraining each candidate injection separately; this would separate the contribution of the influence estimate from the contribution of the greedy selection policy.
Beyond the paper, the recipe of scoring each single-item insertion by influence and greedily taking the maximum could be transferred to other differentiable recommendation objectives, such as demoting a target item out of the top-$K$ list.
Beyond the paper, because influence functions already support data attribution and unlearning, the same computations could be reused to audit or remove injected items once an attack is suspected.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The reader's sign objection is right, and it is the main thing you need to know. Equations (3)-(5) define a smaller L_att as better for the target item, so a useful injection should give a negative I in Eq. (10). Algorithm 1 then stops whenever all candidate influences are negative—exactly the case where every candidate helps—and otherwise picks by absolute value, which can prefer a candidate that hurts. As printed, the selection rule is the inverse of the paper's own objective. This is not a cosmetic typo; it is the entire screening mechanism, and it means the reported Recall@10/NDCG@10 gains cannot be attributed to the described method. The experiments must have used a different rule.

Credit where due: the idea is a reasonable, modest extension. Influence-based poisoning exists for top-N recommenders (Fang et al., Wu et al.) and gradient-based profile pollution exists (Replace), but nobody has used influence functions to pick injected items for profile pollution on sequential models. The evaluation is broad: five datasets, four backbones, popularity-stratified targets, and a side-effect check on HR@10. The results are consistently in one direction and often large. If the selection rule were fixed, this could be a useful attack for robustness evaluation.

The other soft spots are real but secondary. The 'more accurate estimation' claim is never checked directly: there is no comparison of predicted influence against actually retraining on one polluted sequence, so we only see final attack metrics. The damping term lambda is tuned on the attack metric, and the Hessian approximation has its own free parameters, none reported. There are no error bars, no code, and no ablation that isolates the influence ranking from the selection heuristic. Without code, the sign issue alone is enough to make the paper non-reproducible.

Who is it for? Someone building defense evaluations for sequential recommenders might get value from a corrected version; as written, no one should build on it. My recommendation to the editor: return, don't send to review in its current form. Ask for a corrected algorithm, code or detailed pseudo-code, and a direct validation of the influence proxy against true retraining. If the numbers survive that, it is a solid short contribution.

Referee Report

3 major / 5 minor

Summary. The paper proposes INFAttack, a profile pollution attack against sequential recommender systems that uses influence functions to select which items to inject into user interaction sequences. The method estimates, for each candidate one-item injection, the first-order influence of the resulting polluted sequence on the target item's cross-entropy loss, using a damped and stochastically approximated inverse Hessian. A greedy procedure inserts the selected item per user, repeated K times, and the polluted dataset is used to retrain the recommender. Experiments on ML-1M, Steam, Beauty, LastFM, and ML-20M with NARM, SASRec, BERT4Rec, and Locker claim that INFAttack outperforms RandomAlter, SimAlter, and Replace in target-item Recall@10 and NDCG@10, while roughly preserving overall recommendation quality.

Significance. If the central claim were supported, the paper would make a useful contribution to the study of poisoning attacks on sequential recommenders: it gives a clean threat model, applies a principled influence-function estimator to a practical attack setting, and evaluates across several datasets and backbones. The breadth of the experiments is a genuine strength. However, the manuscript's own Algorithm 1 contradicts the sign convention of the influence definition in Section 4.3, so the printed algorithm cannot be the source of the reported attack results. Because the central claim is about the proposed algorithm, this internal inconsistency is load-bearing. The paper also never validates the influence proxy against true retraining outcomes, leaving the claimed mechanism unsubstantiated even apart from the algorithmic contradiction.

major comments (3)

[Section 4.3.1, Section 4.3.3, Algorithm 1] There is a sign contradiction that makes Algorithm 1 unexecutable as a target-promotion method. In Eq. (4), L_att is a cross-entropy loss, so a lower L_att means a higher probability of recommending the target item. Eq. (3) defines R as L_att(theta_{1/n}) - L_att(theta_0), so a beneficial injection gives R < 0, and by Eq. (5) the influence I_{epsilon,att} in Eq. (10) is negative for candidates that promote the target. However, Section 4.3.3 and Algorithm 1 lines 8--11 select p' = argmax_p |I| and break when max_p I < 0. Under the paper's own convention, max_p I < 0 is exactly the situation in which every candidate is beneficial, so the loop should continue and choose the most negative influence, not break. Conversely, when some candidates have I > 0, selecting by absolute value can pick a candidate that increases L_att and suppresses the target. Thus the algorithm printed in the paper cannot be the selection rule behind the large Recall@10 and NDCG@10 gains reported in Table 2; the experiments must have used a different, unspecified rule, which invalidates the central claim as stated.
[Section 5.4, Section 5.5, Table 5, Figure 6] The paper never validates the influence proxy independently against true retraining outcomes. The only ablation, INFAttack-NINF in Table 5, compares influence-based selection with random selection; it does not show that the ranking produced by Eq. (10) correlates with the actual Recall@10/NDCG@10 improvement after retraining on the polluted dataset. This matters because the damping term lambda is tuned on the attack metric itself (Figure 6), so the reported gains could reflect hyperparameter tuning or the unspecified selection rule used in the experiments rather than the accuracy of the influence estimate. A direct validation experiment, e.g., correlating per-candidate I_{epsilon,att} with the measured target-item metric after retraining, and a sensitivity analysis showing that the conclusions hold for lambda values away from the tuned optimum, is needed to support the abstract's claim that INFAttack offers 'a more accurate estimation of the influence of polluting items.'
[Section 5.1.4 and Table 2] The experimental comparison reports only point estimates. Given that 15 target items are randomly sampled and that the claimed margins over Replace are sometimes small (e.g., Locker on Steam, Locker on Beauty in Table 2), the manuscript should report standard deviations or significance tests across target-item samples. Without these, the universal claim that INFAttack 'surpasses all baseline methods and consistently delivers stable attack performance' is not fully supported, particularly for the smaller margins in the Locker rows.

minor comments (5)

[Algorithm 1, line 5] Line 5 says 'Enumerate m possible combinations of v'_i (i<=K) from V,' which appears to enumerate combinations of up to K items, but Section 4.2 clearly states that one item is injected at a time, yielding m candidate sequences per step. This inconsistency should be resolved.
[Section 4.4] 'INFAttck' is a typo for 'INFAttack'; please correct it.
[Section 6] The conclusion says 'INFAtack has some limitations' but does not state what those limitations are. Please either specify the limitations or remove the unsupported statement.
[Table 1] The LastFM row reports an average sequence length of 9739 with 998 users and 57,638 items; the maximum sequence length used in preprocessing for LastFM and ML-20M is not stated in Section 5.1.5, so the reader cannot determine how truncation affects the attack setting.
[Figure 6] The x-axis range is given as {0.0001, 0.001, 0.005, 0.01, 0.05, 0.1}, but the figure axis is not labeled with these values; adding explicit tick labels would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical attack evaluation is self-contained; influence estimation is standard external methodology, and no load-bearing self-citations.

full rationale

The paper's central claim is that INFAttack outperforms baselines in promoting target items. The reported R@10 and NDCG@10 values are obtained by actually retraining the sequential recommender on the polluted dataset X' and then measuring target-item ranking, so the final metrics are not constructed from the influence values themselves. The influence-function estimator in Eqs. (8)-(10) is a first-order approximation from Koh and Liang [16], with a damping term borrowed from Bae et al. [1]; both are external prior works rather than self-citations. No uniqueness theorem, ansatz, or load-bearing premise is imported from the authors' own prior work. The damping hyperparameter lambda is tuned on the attack metric, but this is ordinary hyperparameter selection, not a fitted parameter renamed as a prediction, and the ablations and baseline comparisons all use real retraining. The INFAttack-NINF comparison further shows that the influence-based selection contributes beyond random selection. One caveat that is a correctness concern rather than circularity: the sign convention in Eqs. (3)-(5) implies that beneficial insertions have negative I_eps,att, yet Sec. 4.3.3 selects by absolute value and Algorithm 1 breaks when max(I) < 0. This internal inconsistency does not make the derivation equivalent to its inputs; it is a reproducibility issue. Accordingly, no significant circularity is present, and the score is 0.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the influence proxy being a valid ranking signal after repeated greedy insertions, plus tuned hyperparameters lambda and K and unstated Hessian-approximation settings. No new entities are introduced. The paper selects lambda on the attack metric and never validates the influence proxy against true retraining, which is the main burden.

free parameters (3)

lambda (damping term) = 0.005 or 0.01 across datasets
Added to the Hessian in Eq. (8) to ensure invertibility; tuned over {0.0001, 0.001, 0.005, 0.01, 0.05, 0.1} to maximize attack NDCG@10, so it is fitted to the evaluation metric.
K (number of injected items per user) = 2 for ML-1M, 1 for Steam and Beauty, unspecified for LastFM and ML-20M
Controls attack strength; chosen from the attack-versus-recommendation tradeoff, following previous work for some datasets but not stated for all.
Hessian approximation parameters (J, averaging runs) = not reported
Equation (10) uses a stochastic Taylor expansion of the inverse Hessian; the number of iterations J, number of averaging runs, and random seeds are never specified, so the influence values are not reproducible.

assumptions (5)

domain assumption The first-order Taylor expansion in Eq. (5) reliably approximates the change in target-item loss after replacing a training sequence.
Invoked in Section 4.3.1; the paper never validates the approximation against true retraining, and the models are non-convex transformer/GRU networks.
domain assumption The damped Hessian H_theta + lambda I is invertible and the truncated Taylor series H^{-1}_J approximates it well.
Used in Eqs. (8)-(10) and the stochastic estimation paragraph; relies on Bae et al. [1] but leaves J and averaging runs unspecified.
domain assumption Greedy per-user, one-item-at-a-time selection approximates the global attack objective.
Stated in Section 4.1 as a way to avoid the m^n search space; no optimality guarantee is given.
domain assumption The attacker has white-box access and can insert K items into every user's sequence before training.
Defined in the problem formulation in Section 3; restricts applicability to this threat model.
domain assumption The global attack loss L_atk summed over all users in Eq. (4) is the right surrogate for promoting the target item.
The selection is per user but the loss is summed over all users; the paper does not justify this mismatch.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Precision Profile Pollution Attack on Sequential Recommenders via Influence Function." pith.science (2026). https://pith.science/paper/56WW3SBU

@misc{pith2026241201127,
  author       = {Pith},
  title        = {Pith review of: Precision Profile Pollution Attack on Sequential Recommenders via Influence Function},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/56WW3SBU}},
  note         = {Machine review of arXiv:2412.01127}
}

read the original abstract

Sequential recommendation approaches have demonstrated remarkable proficiency in modeling user preferences. Nevertheless, they are susceptible to profile pollution attacks (PPA), wherein items are introduced into a user's interaction history deliberately to influence the recommendation list. Since retraining the model for each polluted item is time-consuming, recent PPAs estimate item influence based on gradient directions to identify the most effective attack candidates. However, the actual item representations diverge significantly from the gradients, resulting in disparate outcomes.To tackle this challenge, we introduce an INFluence Function-based Attack approach INFAttack that offers a more accurate estimation of the influence of polluting items. Specifically, we calculate the modifications to the original model using the influence function when generating polluted sequences by introducing specific items. Subsequently, we choose the sequence that has been most significantly influenced to substitute the original sequence, thus promoting the target item. Comprehensive experiments conducted on five real-world datasets illustrate that INFAttack surpasses all baseline methods and consistently delivers stable attack performance for both popular and unpopular items.

Figures

Figures reproduced from arXiv: 2412.01127 by the authors.

**Figure 2.** Profile pollution attack problem defined in this [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** The overall framework of the proposed INFAttack [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Illustration of generating candidate polluted se [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]

**Figure 5.** Figure 5: The performance change of attack methods compared to the ’Clean’ model regarding recommending the target items [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Attack performance of the proposed INFAttack with respect to the damping term (i.e., [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

**Figure 7.** Figure 7: The attack performance of the attack methods with [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

**Figure 8.** Figure 8: The recommendation performance of the attack [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 42 canonical work pages

[1]

Juhan Bae, Nathan Ng, Alston Lo, Marzyeh Ghassemi, and Roger B. Grosse

work page
[2]

Nicholas Carlini and David A. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy . IEEE Computer Society, 39–57

work page 2017
[3]

Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2021. A survey on adversarial recommender systems: from attack/defense strategies to generative adversarial networks. ACM Computing Surveys (CSUR) 54, 2 (2021), 1–38

2021
[4]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In NAACL-HLT (1). Association for Computational Linguistics, 4171–4186

work page 2019
[5]

Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. 2020. Influence function based data poisoning attacks to top-n recommender systems. In WWW. 3019–3025

work page 2020
[6]

Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. 2020. Influence Function based Data Poisoning Attacks to Top-N Recommender Systems. In WWW. ACM / IW3C2, 3019–3025

work page 2020
[7]

Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. 2018. Poisoning Attacks to Graph-Based Recommender Systems. In ACSAC. ACM, 381–392

work page 2018
[8]

Maxwell Harper and Joseph A

F. Maxwell Harper and Joseph A. Konstan. 2016. The MovieLens Datasets: History and Context. ACM Trans. Interact. Intell. Syst. 5, 4 (2016), 19:1–19:19

2016

Show all 60 references

[9]

Ruining He and Julian J. McAuley. 2016. Fusing Similarity Models with Markov Chains for Sparse Sequential Recommendation. In ICDM. IEEE Computer Society, 191–200

2016
[10]

Zhankui He, Handong Zhao, Zhe Lin, Zhaowen Wang, Ajinkya Kale, and Ju- lian J. McAuley. 2021. Locker: Locally Constrained Self-Attentive Sequential Recommendation. In CIKM. ACM, 3088–3092

2021
[11]

By Celma Herrada and Oscar. 2008. Music recommendation and discovery in the long tail. Ceedings of International Congress on Electron Microscopy Methods Enzymol– 11, 1 (2008), 7–8

2008
[12]

Balázs Hidasi, Alexandros Karatzoglou, Linas Baltrunas, and Domonkos Tikk
[13]

Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu
[14]

Juyong Jiang, Peiyan Zhang, Yingtao Luo, Chaozhuo Li, Jae Boum Kim, Kai Zhang, Senzhang Wang, Xing Xie, and Sunghun Kim. 2023. AdaMCT: Adaptive Mixture of CNN-Transformer for Sequential Recommendation. In CIKM. ACM, 976–986

2023
[15]

Wang-Cheng Kang and Julian J. McAuley. 2018. Self-Attentive Sequential Rec- ommendation. In ICDM. IEEE Computer Society, 197–206

2018
[16]

Pang Wei Koh and Percy Liang. 2017. Understanding Black-box Predictions via Influence Functions. In ICML (Proceedings of Machine Learning Research, Vol. 70) . PMLR, 1885–1894

2017
[17]

Pang Wei W Koh, Kai-Siang Ang, Hubert Teo, and Percy S Liang. 2019. On the accuracy of influence functions for measuring group effects. NeurIPS 32 (2019)

2019
[18]

Shuming Kong, Yanyan Shen, and Linpeng Huang. 2021. Resolving training biases via influence-based data relabeling. In ICLR

2021
[19]

Diane Lambert. 1981. Influence functions for testing. J Am Stat Assoc 76, 375 (1981), 649–657

1981
[20]

Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. 2019. Certified Robustness to Adversarial Examples with Differential Privacy. In IEEE Symposium on Security and Privacy . IEEE, 656–672

2019
[21]

Sungho Lee, Sungjae Hwang, and Sukyoung Ryu. 2017. All about activity injec- tion: threats, semantics, and detection. In ASE. IEEE Computer Society, 252–262

2017
[22]

Jing Li, Pengjie Ren, Zhumin Chen, Zhaochun Ren, Tao Lian, and Jun Ma. 2017. Neural Attentive Session-based Recommendation. In CIKM. ACM, 1419–1428

2017
[23]

Jinwei Luo, Mingkai He, Xiaolin Lin, Weike Pan, and Zhong Ming. 2022. Dual- Task Learning for Multi-Behavior Sequential Recommendation. In CIKM. ACM, 1379–1388

2022
[24]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR (Poster). OpenReview.net

2018
[25]

McAuley, Christopher Targett, Qinfeng Shi, and Anton van den Hengel

Julian J. McAuley, Christopher Targett, Qinfeng Shi, and Anton van den Hengel
[26]

Wei Meng, Xinyu Xing, Anmol Sheth, Udi Weinsberg, and Wenke Lee. 2014. Your online interests: Pwned! a pollution attack against targeted advertising. In CCS. 129–140

2014
[27]

Wei Meng, Xinyu Xing, Anmol Sheth, Udi Weinsberg, and Wenke Lee. 2014. Your Online Interests: Pwned! A Pollution Attack Against Targeted Advertising. In CCS. ACM, 129–140

2014
[28]

Martijn Millecamp, Nyi Nyi Htun, Cristina Conati, and Katrien Verbert. 2019. To explain or not to explain: the effects of personal characteristics when explaining music recommendations. In IUI. 397–407

2019
[29]

Toan Nguyen Thanh, Nguyen Duc Khang Quach, Thanh Tam Nguyen, Thanh Trung Huynh, Viet Hung Vu, Phi Le Nguyen, Jun Jo, and Quoc Viet Hung Nguyen. 2023. Poisoning GNN-based recommender systems with generative surrogate-based attacks. ACM Transactions on Information Systems 41, 3 ...

2023
[30]

Jianmo Ni, Jiacheng Li, and Julian J. McAuley. 2019. Justifying Recommendations using Distantly-Labeled Reviews and Fine-Grained Aspects. In EMNLP/IJCNLP (1). Association for Computational Linguistics, 188–197

2019
[31]

Fatemeh Rezaimehr and Chitra Dadkhah. 2021. A survey of attack detection approaches in collaborative filtering recommender systems. Artif. Intell. Rev. 54, 3 (2021), 2011–2066

2021
[32]

David Ruppert. 1987. What is kurtosis? An influence function approach. Am. Stat. 41, 1 (1987), 1–5

1987
[33]

Yanyan Shen, Baoyuan Ou, and Ranzhen Li. 2022. MBN: Towards Multi-Behavior Sequence Modeling for Next Basket Recommendation. ACM Transactions on Knowledge Discovery from Data 16, 5 (2022), 81:1–81:23

2022
[34]

Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, and Peng Jiang
[35]

Russomanno

Agnideven Palanisamy Sundar, Feng Li, Xukai Zou, Tianchong Gao, and Evan D. Russomanno. 2020. Understanding Shilling Attacks and Their Detection Traits: A Comprehensive Survey. IEEE Access 8 (2020), 171703–171715

2020
[36]

Jiaxi Tang and Ke Wang. 2018. Personalized Top-N Sequential Recommendation via Convolutional Sequence Embedding. In WSDM. ACM, 565–573

2018
[37]

Gomez, Lukasz Kaiser, and Illia Polosukhin

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is All you Need. In NIPS. 5998–6008

2017
[38]

Jialu Wang, Xin Eric Wang, and Yang Liu. 2022. Understanding instance-level impact of fairness constraints. In ICML. PMLR, 23114–23130

2022
[39]

Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck
[40]

Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. 2021. Triple adversarial learning for influence based poisoning attack in recommender sys- tems. In SIGKD. 1830–1840

2021
[41]

Snoeren, Nick Feamster, and Wenke Lee

Xinyu Xing, Wei Meng, Dan Doozan, Alex C. Snoeren, Nick Feamster, and Wenke Lee. 2013. Take This Personally: Pollution Attacks on Personalized Services. In USENIX Security Symposium. USENIX Association, 671–686

2013
[42]

Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. 2017. Fake Co-visitation Injection Attacks to Recommender Systems. In NDSS. The Internet Society

2017
[43]

Junliang Yu, Hongzhi Yin, Xin Xia, Tong Chen, Jundong Li, and Zi Huang. 2023. Self-supervised learning for recommender systems: A survey. IEEE Transactions on Knowledge and Data Engineering (2023)

2023
[44]

Jiangxing Yu, Hong Zhu, Chih-Yao Chang, Xinhua Feng, Bowen Yuan, Xiuqiang He, and Zhenhua Dong. 2020. Influence function for unbiased recommendation. In SIGIR. 1929–1932

2020
[45]

Fajie Yuan, Xiangnan He, Alexandros Karatzoglou, and Liguang Zhang. 2020. Parameter-efficient transfer from sequential behaviors for user modeling and recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retri...

2020
[46]

Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian J. McAuley. 2021. Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction. In RecSys. ACM, 44–54

2021
[47]

Zhenrui Yue, Huimin Zeng, Ziyi Kou, Lanyu Shang, and Dong Wang. 2022. Defending Substitution-Based Profile Pollution Attacks on Sequential Recom- menders. In RecSys. ACM, 59–70

2022
[48]

Hengtong Zhang, Yaliang Li, Bolin Ding, and Jing Gao. 2020. Practical Data Poisoning Attack against Next-Item Recommendation. In WWW. ACM / IW3C2, 2458–2464. Precision Profile Pollution Attack on Sequential Recommenders via Influence Function Conference’17, July 2017, Washingt...

2020
[49]

Hengtong Zhang, Yaliang Li, Bolin Ding, and Jing Gao. 2020. Practical data poisoning attack against next-item recommendation. In WWW. 2458–2464

2020
[50]

Hengyu Zhang, Enming Yuan, Wei Guo, Zhicheng He, Jiarui Qin, Huifeng Guo, Bo Chen, Xiu Li, and Ruiming Tang. 2022. Disentangling Past-Future Modeling in Sequential Recommendation via Dual Networks. In CIKM. ACM, 2549–2558

2022
[51]

Yubao Zhang, Jidong Xiao, Shuai Hao, Haining Wang, Sencun Zhu, and Sushil Jajodia. 2020. Understanding the Manipulation on Recommender Systems through Web Injection. IEEE Trans. Inf. Forensics Secur. 15 (2020), 3807–3818

2020
[52]

Kun Zhou, Hui Wang, Wayne Xin Zhao, Yutao Zhu, Sirui Wang, Fuzheng Zhang, Zhongyuan Wang, and Ji-Rong Wen. 2020. S3-rec: Self-supervised learning for se- quential recommendation with mutual information maximization. In Proceedings of the 29th ACM international conference on in...

2020
[53]

Kun Zhou, Hui Yu, Wayne Xin Zhao, and Ji-Rong Wen. 2022. Filter-enhanced MLP is all you need for sequential recommendation. In Proceedings of the ACM web conference 2022. 2388–2399

2022
[54]

Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial Attacks on Neural Networks for Graph Data. In KDD. ACM, 2847–2856

2018
[2015]

In SIGIR

Image-Based Recommendations on Styles and Substitutes. In SIGIR. ACM, 43–52
[2016]

In ICLR (Poster)

Session-based Recommendations with Recurrent Neural Networks. In ICLR (Poster)
[2019]

BERT4Rec: Sequential Recommendation with Bidirectional Encoder Repre- sentations from Transformer. In CIKM. ACM, 1441–1450
[2021]

Data Poisoning Attacks to Deep Learning Based Recommender Systems. In NDSS. The Internet Society
[2022]

If Influence Functions are the Answer, Then What is the Question? CoRR abs/2209.05364 (2022)

2022 arXiv
[2023]

Machine Unlearning of Features and Labels. In NDSS. The Internet Society

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Juhan Bae, Nathan Ng, Alston Lo, Marzyeh Ghassemi, and Roger B. Grosse

work page

[2] [2]

Nicholas Carlini and David A. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy . IEEE Computer Society, 39–57

work page 2017

[3] [3]

Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2021. A survey on adversarial recommender systems: from attack/defense strategies to generative adversarial networks. ACM Computing Surveys (CSUR) 54, 2 (2021), 1–38

2021

[4] [4]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In NAACL-HLT (1). Association for Computational Linguistics, 4171–4186

work page 2019

[5] [5]

Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. 2020. Influence function based data poisoning attacks to top-n recommender systems. In WWW. 3019–3025

work page 2020

[6] [6]

Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. 2020. Influence Function based Data Poisoning Attacks to Top-N Recommender Systems. In WWW. ACM / IW3C2, 3019–3025

work page 2020

[7] [7]

Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. 2018. Poisoning Attacks to Graph-Based Recommender Systems. In ACSAC. ACM, 381–392

work page 2018

[8] [8]

Maxwell Harper and Joseph A

F. Maxwell Harper and Joseph A. Konstan. 2016. The MovieLens Datasets: History and Context. ACM Trans. Interact. Intell. Syst. 5, 4 (2016), 19:1–19:19

2016