Pith. sign in

REVIEW 4 major objections 7 minor 31 references

Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single fake user node can push target items into nearly every target user's top-10 list.

desk verdict A genuinely new single-node trigger attack for GNN recommenders, but the empirical claims are undercut by internal inconsistencies and unsupported quantile statements. read the letter →

arxiv 2506.08401 v1 pith:LVME2T2K submitted 2025-06-10 cs.AI

Runze Li , Di Jin , Xiaobao Wang , Dongxiao He , Bingdao Feng , Zhen Wang This is my paper
classification cs.AI
keywords graphneuralnetworksrecommendersystemsbackdoorattacksshillingsingle-nodetriggerLightGCNadversarialmachinelearningpoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a graph-based recommendation system can be taken over by inserting just one fake user node, in place of the many fake users that shilling attacks inject. The authors claim this single node acts as a backdoor: after joint end-to-end training, adding the trigger node puts the target items into the top-10 lists of at least 99% of the target users, with average target-item coverage above 80%, while the system's hit rate at top-20 declines by about 5% or less. If true, the attack is cheaper and harder to spot than previous injection attacks, and it would mean that mainstream graph recommenders are vulnerable to a very small structural footprint. The paper further claims that a constraint loss keeps the distribution of unrelated items stable, so the poisoned model still behaves like the clean model before the trigger is used.

What carries the argument

The central object is the single-node trigger: one fake user node $u^*$ whose feature is generated by Equation (3), $f_{u^*} = \sigma(f_{s^*}W_1 + b_1)W_2 + b_2$, where $f_{s^*}$ is the mean feature of the target item set. The trigger node is linked to all target items, and training minimizes the joint loss of Equation (9), $\mathcal{L} = \alpha\mathcal{L}_{\mathrm{trigger}} + \beta\mathcal{L}_{\mathrm{limit}} + \gamma\mathcal{L}_{\mathrm{rec}}$. Here $\mathcal{L}_{\mathrm{trigger}}$ (Equation (4)) pushes the model to rank each target item above a sampled negative item for each target user, $\mathcal{L}_{\mathrm{limit}}$ (Equation (5)) preserves the pre-attack distribution of non-candidate items so the attack stays covert, and $\mathcal{L}_{\mathrm{rec}}$ (Equation (8)) is the standard BPR loss that maintains clean recommendation quality. The argument runs through LightGCN's message passing, which propagates the single fake node's influence across the bipartite graph until target users and target items sit close together in embedding space.

What would settle it

Hold out a random fraction of target users (or a fresh set of target items) from the data used to optimize $\mathcal{L}_{\mathrm{trigger}}$, retrain the trigger generator on the remaining pairs, then insert the trigger and measure ACC and CVR on the held-out pairs. If these numbers collapse toward the random-attack baseline, the central backdoor claim is refuted; if they remain high, the attack transfers beyond its training pairs.

Watch

Extended reading notes

Core claim

The paper's central claim is that a single crafted fake user node, connected to the set of target items, suffices to make those items appear in the top-10 recommendation lists of at least 99% of target users on Gowalla, Amazon, Yelp, and MovieLens, while keeping average top-10 coverage of the target items above 80% and limiting the hit-rate drop at top-20 to roughly 5%. The fake user's feature is produced by an MLP from the average feature of the target items, and the trigger generator plus the LightGCN surrogate are trained together with a triple loss: a trigger loss that ranks target items above negative items for target users, a limit loss that anchors candidate-item distributions, and the ordinary BPR recommendation loss. At deployment, the authors argue, inserting the single trigger node into the target items is enough to execute the attack, making it an end-to-end backdoor rather than a large-scale graph poisoning.

Load-bearing premise

The load-bearing premise is that attack success is measured on the same target users and target items used to train the trigger loss; if the trigger does not transfer to unseen users or items, the reported 99% access rate and 80% coverage could be memorization of the training objective rather than a genuine backdoor mechanism.

Editorial extensions

If this is right

  • On all four datasets the reported ACC is at least 0.99 and average CVR tops 0.8, so the paper directly claims that target items surface in most target users' top-10 lists after trigger insertion.
  • The reported HR@20 stays within about 5% of the clean model, so the paper claims the attack leaves the overall recommendation quality nearly intact.
  • Because previous baselines inject fake users equal to several percent of the user base, the single-node design is claimed to achieve higher success with far less injected information, which the authors interpret as lower cost and better stealth.
  • The multi-trigger comparison supports the paper's claim that one shared trigger is preferable: larger trigger structures add only negligible coverage while spreading more false information through message passing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported ACC and CVR are measured on the same target user–item pairs used to optimize $\mathcal{L}_{\mathrm{trigger}}$. An untested implication is that the single-node trigger may not transfer to target users or target items held out from trigger training; a held-out split would settle whether the effect is a generalizable backdoor or memorization of the training pairs.
  • A fake user connected to every target item is a structural anomaly (a low-degree node with an unusually broad adjacency). Systems that monitor such graph statistics could detect the attack; measuring stealth against an anomaly detector is a natural next test that the paper does not run.
  • The method is built on LightGCN's aggregation rule; an open question is whether the same single-node trigger survives in other graph recommender architectures, such as attention-based or heterogeneous GNN recommenders.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes SNT-BA, a backdoor attack against graph-based recommendation systems (GRS) that uses a single injected fake user node to promote a fixed set of target items to a fixed set of target users. The attack is trained end-to-end with a joint loss (Eq. 9) comprising a trigger loss L_trigger (Eq. 4), a constraint loss L_limit (Eq. 5), and the standard BPR recommendation loss (Eq. 8). Experiments on Gowalla, Amazon, Yelp, and MovieLens compare against several shilling attacks and report ACC, CVR, and HR@20. The abstract claims that target-item exposure reaches at least 50% in 99% of target users while recommendation performance degrades by only about 5%.

Significance. If the central claims were fully supported, the paper would make a useful contribution: it demonstrates a concrete end-to-end framework for covert, low-cost attacks on GNN-based recommenders, and the constraint-loss idea for preserving recommendation quality is a sensible design principle. The paper is clearly organized, the method is reproducible from the equations, and the comparison against multiple shilling baselines is appropriate. However, the two headline quantitative claims (the 99% quantile exposure and the approximately 5% performance drop) are not established by the reported experiments, and one of them is internally contradicted by the paper's own tables. The evaluation also appears to measure performance on the same target users and items that were optimized during trigger training, leaving the generalizability of the backdoor an open question.

major comments (4)
  1. [§4.2, Table 2 and Table 3] The abstract's claim that the impact on recommendation performance is 'controlled within approximately 5%' is not supported by the paper's own numbers. Taking Table 2's 'Ours' HR@20 as the attacked performance and Table 3's 'Raw' as the clean performance, the relative drops are approximately 4.9% for Yelp, 6.1% for Gowalla, 15.1% for Amazon, and 3.7% for MovieLens; two of the four datasets violate the 5% bound. Moreover, the 'Decline Rate' row in Table 3 does not match (Raw - Attacked)/Raw for Yelp, Gowalla, or MovieLens (e.g., for Yelp, (0.3412 - 0.3372)/0.3412 = 0.0117 but the table reports 0.0394), indicating an arithmetic or setup inconsistency. Please clarify which comparison is meant to support the 5% claim and correct the numbers accordingly.
  2. [Abstract, §4.2, Eqs. (10)-(11)] The claim that 'the exposure of the target items reaches no less than 50% in 99% of the target users' is not established by the reported metrics. ACC (Eq. 10) is the fraction of target users who have at least one target item in the top-10 list, and CVR (Eq. 11) is the average coverage across all target users. Neither quantity bounds the per-user coverage distribution; for example, an average CVR of 0.71 is compatible with many users having coverage well below 0.5. The paper should report the empirical cumulative distribution of per-user coverage, or at least the fraction of target users with coverage at least 0.5, to support the quantile claim.
  3. [§3.2, Eq. (4), §4.1, §4.2] The evaluation appears to measure attack success on the same target users and target items that were used to optimize L_trigger (Eq. 4), which directly rewards high similarity between each target user t and each target item s. Consequently, high ACC and CVR values may largely reflect the training objective rather than a generalizable backdoor mechanism. The paper does not test whether the trigger can be applied to target items or target users that were not in the training set, even though the introduction and §3.1 state that the attack can promote 'any target item' for 'any target user'. Please provide held-out experiments (e.g., training the trigger on a subset of target pairs and evaluating on a disjoint set) or explicitly restrict the claims to the trained target set.
  4. [§3.3, §3.4, §4.1] The paper does not specify how the single trigger node is inserted at inference time. In LightGCN, node representations are computed by graph convolution (Eqs. 6-7) using learnable embeddings for each node; adding a new node after training requires defining its initial embedding and recomputing the aggregation. If the trigger node is present during training and is then connected to the same target items at inference, the procedure is straightforward but does not generalize to unseen items without additional training. The authors should describe the exact injection procedure for both training and inference and confirm that the reported results use a consistent procedure for all experiments.
minor comments (7)
  1. [§2.2, Eq. (2)] The notation 'max_{G in G_trigger}' is unclear; please define the set G_trigger and specify what is being maximized over.
  2. [§4.1] The number of target items is set to 20, but the number of target users and the selection criterion are not reported; please provide this information.
  3. [§4.2, Eq. (10)] The ACC definition should state explicitly that a target user is considered 'successfully attacked' if at least one target item appears in the top-10 recommendation list.
  4. [Table 3] The 'Decline Rate' values in the last row do not match the values in the 'Raw' and 'Attacked' rows; please provide the formula used and ensure it is consistent.
  5. [Figure 5] The text says the comparison is conducted on four datasets, but only two panels are shown; please include the remaining datasets or revise the text.
  6. [§4.3] The trigger-size comparison in Figure 5 uses a different trigger architecture (a fake user connected to a fake item) from the proposed single-node trigger, so it is unclear whether the comparison isolates the effect of trigger-node count.
  7. [Throughout] There are several typographical and formatting errors, including 'V ote' for 'Vote' and 'T Y elp' in the datasets list; a careful proofread is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the reported attack metrics are aligned with the training objective, but the external benchmarks and ablations are independent, and the ~5% claim is an internal-consistency issue rather than a circular one.

full rationale

The paper does not claim a first-principles derivation of its attack metrics; it trains a model end-to-end and reports the resulting attack performance. L_trigger (Eq. 4) indeed optimizes the same target-user/target-item ranking that ACC (Eq. 10) and CVR (Eq. 11) measure, so high ACC/CVR partly reflect the training objective rather than an independent prediction. That is a standard property of attack papers, not a circular reduction: the success metric is the definition of the attack goal, and the paper's independent content lies in the baseline comparisons (Table 2), the HR@20 impact check (Table 3), and the constraint-loss ablation (Table 4, Figure 4), none of which are determined by L_trigger. There is no load-bearing self-citation: LightGCN is an external surrogate model, and the authors' prior backdoor-attack references are contextual examples, not a uniqueness theorem or a justification for the proposed trigger. The abstract's 'approximately 5%' performance bound is internally inconsistent with Table 2's Ours HR@20 versus Table 3's Raw HR@20 (e.g., Amazon drops by about 15.1% relative), but that is a correctness/consistency flaw, not a circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The method relies on standard GNN recommendation assumptions and on attacker-side capabilities. The central free choices are the three loss weights and the unexplained target set selection; the fake trigger node is the only invented entity, and it has no out-of-paper falsifiable signature.

free parameters (3)
  • loss weights alpha, beta, gamma = not reported
    Equation (9) weights the trigger, constraint, and recommendation losses; no values are given, so the balance needed to achieve the reported tradeoff is unknown.
  • target user set size and selection = not specified
    Section 4.1 sets target items to 20 but never states how target users T are chosen, which determines the reported ACC and CVR.
  • trigger MLP dimensions = not specified
    Equation (3) defines a two-layer network without layer sizes or output activation; the 64-dimensional embedding is the only dimension anchor.
assumptions (4)
  • domain assumption LightGCN is a representative GRS surrogate
    Section 3.3 adopts LightGCN as the attack surrogate; if real deployed GRSs differ (for example, feature-based GNNs), the trigger mechanism and transferability are untested.
  • domain assumption Recommendation quality is measured by HR@20 on user-item history
    Equations (8) and (12) and Table 3 equate system performance with hit rate; a recommender could degrade in other ways the metric misses.
  • domain assumption Attacker can inject one fake user with edges to all target items unobserved
    The threat model in Sections 1 and 3.1 assumes the injection is not detected; no defense or anomaly detection is tested.
  • domain assumption An interaction edge exists when a rating exceeds the average
    Section 4.1 constructs bipartite graphs by thresholding ratings; results depend on this binarization choice.
invented entities (1)
  • Single fake user trigger node u*
    purpose: Acts as the backdoor trigger connected to all target items and as the carrier of the learned attack signal
    The trigger exists only within the attack construction; its efficacy is demonstrated only through the paper's own experiments, with no out-of-paper falsifiable handle such as a detectable artifact in real recommender logs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems." pith.science (2026). https://pith.science/paper/LVME2T2K

@misc{pith2026250608401,
  author       = {Pith},
  title        = {Pith review of: Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LVME2T2K}},
  note         = {Machine review of arXiv:2506.08401}
}
read the original abstract

Graph recommendation systems have been widely studied due to their ability to effectively capture the complex interactions between users and items. However, these systems also exhibit certain vulnerabilities when faced with attacks. The prevailing shilling attack methods typically manipulate recommendation results by injecting a large number of fake nodes and edges. However, such attack strategies face two primary challenges: low stealth and high destructiveness. To address these challenges, this paper proposes a novel graph backdoor attack method that aims to enhance the exposure of target items to the target user in a covert manner, without affecting other unrelated nodes. Specifically, we design a single-node trigger generator, which can effectively expose multiple target items to the target user by inserting only one fake user node. Additionally, we introduce constraint conditions between the target nodes and irrelevant nodes to mitigate the impact of fake nodes on the recommendation system's performance. Experimental results show that the exposure of the target items reaches no less than 50% in 99% of the target users, while the impact on the recommendation system's performance is controlled within approximately 5%.

Figures

Figures reproduced from arXiv: 2506.08401 by the authors.

Figure 1
Figure 1. We investigate the impact of the injected false user ratio [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The difference between (a) traditional single-entity back [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The framework of SNT-BA consists of two modules: the Trigger Generator and the Recommendation System Training Module. By [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: We conduct comparative experiments on different sizes of [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

31 extracted references · 31 canonical work pages

  1. [1]

    Matrix factorization techniques for context-aware collabo- rative filtering recommender systems: A survey.Comput

    [Abdiet al., 2018 ] Mohamed Hussein Abdi, George Onyango Okeyo, and Ronald Waweru Mwangi. Matrix factorization techniques for context-aware collabo- rative filtering recommender systems: A survey.Comput. Inf. Sci., 11(2):1–10,

    work page 2018

  2. [6]

    Backdoor attacks on unsu- pervised graph representation learning.Neural Networks, 180:106668,

    [Fenget al., 2024 ] Bingdao Feng, Di Jin, Xiaobao Wang, Fangyu Cheng, and Siqi Guo. Backdoor attacks on unsu- pervised graph representation learning.Neural Networks, 180:106668,

    work page 2024

  3. [7]

    Robustness of graph neural networks at scale

    [Geisleret al., 2021 ] Simon Geisler, Tobias Schmidt, Hakan Sirin, Daniel Z¨ugner, Aleksandar Bojchevski, and Stephan G¨unnemann. Robustness of graph neural networks at scale. InProceedings in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, pages 7637– 7649,

    work page 2021

  4. [8]

    Targeted shilling attacks on gnn-based recommender sys- tems

    [Guoet al., 2023 ] Sihan Guo, Ting Bai, and Weihong Deng. Targeted shilling attacks on gnn-based recommender sys- tems. InProceedings of the 32nd ACM International Conference on Information and Knowledge Management, CIKM 2023, pages 649–658. ACM,

    work page 2023

  5. [9]

    Lightgcn: Simplifying and powering graph convolution network for recommendation

    [Heet al., 2020 ] Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yong-Dong Zhang, and Meng Wang. Lightgcn: Simplifying and powering graph convolution network for recommendation. InProceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, SIGIR 2020, pages 639–648. ACM,

    work page 2020

  6. [14]

    Dual intent enhanced graph neural network for session- based new item recommendation

    [Jinet al., 2023b ] Di Jin, Luzhi Wang, Yizhen Zheng, Guo- jie Song, Fei Jiang, Xiang Li, Wei Lin, and Shirui Pan. Dual intent enhanced graph neural network for session- based new item recommendation. InProceedings of the ACM Web Conference 2023, WWW 2023, pages 684–693,

    work page 2023

  7. [15]

    Backdoor attack on propagation-based rumor detectors

    [Jinet al., 2025 ] Di Jin, Yujun Zhang, Bingdao Feng, Xi- aobao Wang, Dongxiao He, and Zhen Wang. Backdoor attack on propagation-based rumor detectors. InProceed- ings of the Thirty-Nineth AAAI Conference on Artificial In- telligence, AAAI, 2025, pages 17680–17688. AAAI Press,

    work page 2025

  8. [16]

    Bell, and Chris V olinsky

    [Korenet al., 2009 ] Yehuda Koren, Robert M. Bell, and Chris V olinsky. Matrix factorization techniques for rec- ommender systems.Computer, 42(8):30–37,

    work page 2009

Show all 31 references
  1. [19]

    O’Mahony, Neil J

    [O’Mahonyet al., 2004 ] Michael P. O’Mahony, Neil J. Hur- ley, and Guenole C. M. Silvestre. An evaluation of neigh- bourhood formation on the performance of collaborative filtering.Artif. Intell. Rev., 21(3-4):215–228,

    2004

  2. [20]

    Konstan, and John Riedl

    [Sarwaret al., 2001 ] Badrul Munir Sarwar, George Karypis, Joseph A. Konstan, and John Riedl. Item-based collabo- rative filtering recommendation algorithms. InProceed- ings of the Tenth International World Wide Web Confer- ence, WWW 10, pages 285–295. ACM,

    2001

  3. [22]

    Elevating knowledge-enhanced entity and relation- ship understanding for sarcasm detection.IEEE Transac- tions on Knowledge and Data Engineering,

    [Wanget al., 2025 ] Xiaobao Wang, Yujing Wang, Dongxiao He, Zhe Yu, Yawen Li, Longbiao Wang, Jianwu Dang, and Di Jin. Elevating knowledge-enhanced entity and relation- ship understanding for sarcasm detection.IEEE Transac- tions on Knowledge and Data Engineering,

    2025

  4. [23]

    Ready for emerging threats to recommender systems? A graph convolution- based generative shilling attack.Inf

    [Wuet al., 2021 ] Fan Wu, Min Gao, Junliang Yu, Zongwei Wang, Kecheng Liu, and Xu Wang. Ready for emerging threats to recommender systems? A graph convolution- based generative shilling attack.Inf. Sci., 578:683–701,

    2021

  5. [24]

    Graph backdoor

    [Xiet al., 2021 ] Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. Graph backdoor. In30th USENIX Security Symposium, USENIX Security 2021, pages 1523–1540,

    2021

  6. [25]

    Graph- based recommendation system

    [Yang and Toni, 2018] Kaige Yang and Laura Toni. Graph- based recommendation system. InProceedings of the 2018 IEEE Global Conference on Signal and Information Pro- cessing, GlobalSIP 2018, pages 798–802,

    2018

  7. [26]

    Backdoor attacks to graph neural networks

    [Zhanget al., 2021 ] Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. Backdoor attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technolo- gies,SACMAT 21, pages 15–26. ACM,

    2021

  8. [27]

    Rethinking graph backdoor at- tacks: A distribution-preserving perspective

    [Zhanget al., 2024c ] Zhiwei Zhang, Minhua Lin, Enyan Dai, and Suhang Wang. Rethinking graph backdoor at- tacks: A distribution-preserving perspective. InProceed- ings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2024, pages 4386–

    2024

  9. [28]

    Unifying graph contrastive learning with flexible contextual scopes

    [Zhenget al., 2022 ] Yizhen Zheng, Yu Zheng, Xiaofei Zhou, Chen Gong, Vincent CS Lee, and Shirui Pan. Unifying graph contrastive learning with flexible contextual scopes. In2022 IEEE International Conference on Data Mining (ICDM), pages 793–802. IEEE,

    2022

  10. [30]

    Large language models for scientific dis- covery in molecular property prediction.Nature Machine Intelligence, pages 1–11,

    [Zhenget al., 2025 ] Yizhen Zheng, Huan Yee Koh, Jiaxin Ju, Anh TN Nguyen, Lauren T May, Geoffrey I Webb, and Shirui Pan. Large language models for scientific dis- covery in molecular property prediction.Nature Machine Intelligence, pages 1–11,

    2025

  11. [31]

    A general black-box adversarial attack on graph-based fake news detectors

    [Zhuet al., 2024 ] Peican Zhu, Zechen Pan, Yang Liu, Jiwei Tian, Keke Tang, and Zhen Wang. A general black-box adversarial attack on graph-based fake news detectors. In Proceedings of the Thirty-Third International Joint Con- ference on Artificial Intelligence, IJCAI 2024, pages 568–

    2024

  12. [2001]

    Augment- ing affective dependency graph via iterative incongruity graph learning for sarcasm detection

    [Wanget al., 2023 ] Xiaobao Wang, Yiqi Dong, Di Jin, Yawen Li, Longbiao Wang, and Jianwu Dang. Augment- ing affective dependency graph via iterative incongruity graph learning for sarcasm detection. InProceedings of the Thirty-Seventh AAAI Conference on Artificial Intelli- gen...

    2023

  13. [2004]

    Poisoning gnn-based recommender systems with generative surrogate-based attacks.ACM Trans

    [Nguyenet al., 2023 ] Thanh Toan Nguyen, Nguyen Duc Khang Quach, Thanh Tam Nguyen, Thanh Trung Huynh, Viet Hung Vu, Phi Le Nguyen, Jun Jo, and Quoc Viet Hung Nguyen. Poisoning gnn-based recommender systems with generative surrogate-based attacks.ACM Trans. Inf. Syst., 41(3):58...

    2023

  14. [2008]

    Local-global defense against unsupervised adversarial attacks on graphs

    [Jinet al., 2023a ] Di Jin, Bingdao Feng, Siqi Guo, Xiaobao Wang, Jianguo Wei, and Zhen Wang. Local-global defense against unsupervised adversarial attacks on graphs. InPro- ceedings of the Thirty-Seventh AAAI Conference on Arti- ficial Intelligence, AAAI, 2023, pages 8105–811...

    2023

  15. [2009]

    Lam and John Riedl

    [Lam and Riedl, 2004] Shyong K. Lam and John Riedl. Shilling recommender systems for fun and profit. InPro- ceedings of the 13th international conference on World Wide Web, WWW 2004, pages 393–402. ACM,

    2004

  16. [2016]

    Collaborative filtering for implicit feedback datasets

    [Huet al., 2008 ] Yifan Hu, Yehuda Koren, and Chris V olin- sky. Collaborative filtering for implicit feedback datasets. InProceedings of the 8th IEEE International Conference on Data Mining (ICDM 2008), pages 263–272. IEEE Computer Society,

    2008

  17. [2018]

    P ´erez-Jim´enez

    [Baiet al., 2024 ] Xinzhu Bai, Yanping Huang, Hong Peng, Jun Wang, Qian Yang, David Orellana-Mart ´ın, Antonio Ram´ırez-de-Arellano, and Mario J. P ´erez-Jim´enez. Se- quence recommendation using multi-level self-attention network with gated spiking neural P systems.Inf. Sci.,...

    2024

  18. [2020]

    Hypergraph attacks via injecting homoge- neous nodes into elite hyperedges

    [Heet al., 2025 ] Meixia He, Peican Zhu, Keke Tang, and Yangming Guo. Hypergraph attacks via injecting homoge- neous nodes into elite hyperedges. InProceedings of the Thirty-Nineth AAAI Conference on Artificial Intelligence, AAAI, 2025, pages 282–290. AAAI Press,

    2025

  19. [2021]

    Unnoticeable backdoor attacks on graph neural networks

    [Daiet al., 2023 ] Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Confer- ence 2023, WWW 2023, Austin, pages 2263–2273. ACM,

    2023

  20. [2022]

    Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs.IEEE Trans

    [Zhenget al., 2024 ] Haibin Zheng, Haiyang Xiong, Jinyin Chen, Haonan Ma, and Guohan Huang. Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs.IEEE Trans. Comput. Soc. Syst., 11(2):2479– 2493,

    2024

  21. [2023]

    Mixed augmentation contrastive learning for graph recommendation system

    [Donget al., 2024 ] Zhuolun Dong, Yan Yang, and Yingli Zhong. Mixed augmentation contrastive learning for graph recommendation system. InProceedings of Web and Big Data - 8th International Joint Conference, APWeb-WAIM 2024, pages 130–143,

    2024

  22. [2024]

    Understanding structural vulnerability in graph convolutional networks

    [Chenet al., 2021 ] Liang Chen, Jintang Li, Qibiao Peng, Yang Liu, Zibin Zheng, and Carl Yang. Understanding structural vulnerability in graph convolutional networks. InProceedings of the Thirtieth International Joint Confer- ence on Artificial Intelligence, IJCAI 2021, pages ...

    2021

  23. [2025]

    Session- based recommendations with recurrent neural networks

    [Hidasiet al., 2016 ] Bal´azs Hidasi, Alexandros Karat- zoglou, Linas Baltrunas, and Domonkos Tikk. Session- based recommendations with recurrent neural networks. InProceedings of the 4th International Conference on Learning Representations, ICLR 2016,

    2016

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.