Pith. sign in

REVIEW 6 major objections 6 minor 51 references

AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS

T0 review · 6 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AUV-Fusion claims that fusing genuine user interaction signals with diffusion-generated visual perturbations exposes cold-start items in top-k rankings without injecting fake user profiles.

desk verdict Plausible new combination of graph-based user modeling and diffusion-based image perturbation for attacking VARS, but missing training details and an unvalidated proxy-alignment assumption keep it from being fully convincing. read the letter →

arxiv 2507.22880 v1 pith:OSPN7VLC submitted 2025-07-30 cs.IR

Hai Ling , Tianchi Wang , Xiaohao Liu , Zhulin Tao , Lifang Yang , Xianglin Huang This is my paper
classification cs.IR
keywords adversarialattackvisually-awarerecommendersystemscold-startpromotiondiffusionmodelcross-modalfusionuserpreferencemodelingitemrepresentationblack-boxthreat
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Visual-aware recommender systems rank items using both user clicks and product images; AUV-Fusion is an attack that aims to raise a chosen cold-start item into the top-k lists of many users by altering only that item's image. The paper's central claim is that this can be done without creating fake user accounts, by combining genuine interaction data with visually plausible perturbations generated in a diffusion model's latent space. If the claim holds, it closes a gap between shilling attacks, which are expensive and detectable, and visual-only attacks, which do not encode who the target users are. The paper argues the fusion produces adversarial images that both match user preferences and survive detection, and it supports this with experiments on VBPR, DVBPR, and AMR across two fashion datasets.

What carries the argument

The load-bearing mechanism is the cross-modal adversary generation pipeline: high-order user embeddings $e_u = e_{u,id} + e_{u,v}$ are learned by LightGCN propagation on the user-item graph plus convolution on a KNN-sparsified item-item affinity graph; an MLP with multi-head attention maps $e_u$ to a $4\times28\times28$ perturbation $\delta$; and $\delta$ is added to the noisy VAE latent $z_t$ during the forward diffusion process before deterministic DDIM sampling reconstructs the adversarial image. The optimization is driven by a composite loss $\mathcal{L}_{total}=\lambda_1\mathcal{L}_{CLIP}+\lambda_2\mathcal{L}_{SSIM}+\lambda_3\mathcal{L}_{align}$, where the user alignment term $\mathcal{L}_{align}=-\cos(f(x^{adv}),e_u)$ uses an off-the-shelf pretrained image encoder to pull the image toward the user embedding. This injection mechanism is what converts behavioral signals into pixel-level changes while the CLIP and SSIM terms keep the image plausible.

What would settle it

Run AUV-Fusion against a victim whose visual encoder is far from ImageNet features, such as DVBPR's custom CNN, and compare it with the variant that removes the user alignment loss; the paper's mechanism predicts a large drop when the loss is removed, so observing no drop, or no gain over visual-only baselines, would falsify the claim that user preference alignment drives the attack.

Watch

Extended reading notes

Core claim

The core discovery claimed is that user preference information can be transferred across modalities into an adversarial image: a multi-hop graph encoder converts observed user-item interactions into a user embedding, an MLP turns that embedding into a latent perturbation, and the perturbation is injected into a pretrained VAE latent during DDIM sampling so that the reconstructed image is both semantically close to the original and aligned with the embedding of the users the attacker wants to influence. The result, according to the paper, is a black-box attack that substantially increases the hit rate of target cold-start items without injecting a single fake user profile. The paper reports the largest gains on VBPR and AMR, smaller but positive gains on DVBPR, and strong cross-domain transfer from Tradesy to Amazon, with a human study and SSIM/CLIP losses used to support the claim of imperceptibility.

Load-bearing premise

The attack's success rests on the assumption that an off-the-shelf ImageNet-trained image encoder is close enough to the victim recommender's visual encoder that maximizing cosine similarity in that space shifts the victim's rankings; if the two feature spaces diverge, the alignment loss breaks and the exposure gain should shrink.

Editorial extensions

If this is right

  • An adversary with no knowledge of the recommender's parameters can promote cold-start items at roughly an order of magnitude higher hit rate than visual-only baselines on VBPR (HR@5 from 0.00241 to 0.02047 on Amazon Men).
  • Robustly trained victim models such as AMR are not immune: AUV-Fusion still roughly doubles the best baseline's HR@20 on Amazon Men (0.01518 vs 0.00865).
  • The attack transfers across domains when the source domain's interaction signal is informative, with Tradesy-to-Amazon HR@5 reaching 0.01881.
  • Removing either the user alignment loss or the adversarial injection step sharply reduces both effectiveness and stability, identifying both components as necessary.
  • Fifty diffusion steps strike the reported balance: fewer steps under-deliver exposure gain, and more steps add cost without improving the result.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same modality-transfer recipe should apply to other multimodal recommenders that fuse text, audio, or video features, since any encoder that accepts a user embedding and an item representation could be attacked by injecting user-derived perturbations into a generative model's latent space.
  • A defender could exploit the surrogate-encoder dependency: if the victim's visual encoder diverges from ImageNet-trained features, the alignment loss in Eq. (16) may stop transferring, so measuring the attack across victim encoders with growing domain shift would map the boundary of the threat.
  • The reliance on visible-item images from observed users means the attack's power should scale with how much of the interaction graph the adversary sees; sweeping the observation ratio $p$ would make that dependency explicit.
  • Because the perturbations are optimized per user embedding, the same framework could adapt to personalized targeting rather than a single cold-start item, raising the stakes for detection methods that look for per-item anomalies.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper proposes AUV-Fusion, a black-box adversarial attack against visual-aware recommender systems (VARS). It combines a LightGCN-based user preference model built on user-item and item-item graphs with a diffusion-based image generator: user embeddings are mapped by an MLP to a latent-space perturbation that is injected into the VAE latent during DDIM sampling. A composite loss of CLIP, SSIM, and a user-alignment cosine loss is minimized to train the MLP. Experiments on Amazon Men and Tradesy against VBPR, DVBPR, and AMR report HR@k gains over INSA, EXPA, and SPAF, plus a human study and semantic heatmaps for imperceptibility. The central claim is that integrating genuine user interaction data with visually plausible perturbations significantly boosts the exposure of cold-start target items while remaining stealthy.

Significance. If the reported gains are reproducible, AUV-Fusion would be a novel and practically relevant attack because it avoids fake-profile injection and uses interaction data to guide visual perturbations. The ablation study (Table 4) supports the contribution of the user alignment loss and the adversarial injection. However, the manuscript currently lacks the training details needed for reproduction, and the black-box transfer of the surrogate feature space is not validated; the DVBPR results in Table 2 are much weaker than the text claims. The core idea is defensible and the missing evidence is obtainable, so the paper deserves a major revision rather than rejection.

major comments (6)
  1. [Section 4.2.2, Eq. (16) and Table 2] The black-box transfer claim depends on an unvalidated proxy alignment. The feature extractor f is an off-the-shelf torchvision ResNet, while the victim models VBPR, DVBPR, and AMR use different visual encoders; no measurement is provided that maximizing cosine similarity in the ResNet space increases the victim's ranking score. The DVBPR results in Table 2 are consistent with weak transfer: on Tradesy, AUV-Fusion's HR@5, HR@10, and HR@20 (0.00204±0.00044, 0.00386±0.00054, 0.00756±0.00074) overlap with SPAF's (0.00175±0.00032, 0.00359±0.00049, 0.00729±0.00083), which contradicts the conclusion's claim of notable gains on DVBPR. A sensitivity analysis over f (e.g., different ResNet depths, a victim-encoder surrogate, or a direct alignment metric) is needed to establish that the reported gains are not an artifact of the chosen proxy.
  2. [Sections 4.1 and 4.2] Several load-bearing training details are missing. No loss function or update rule is specified for the LightGCN trainable embeddings e(0)_u,id and e(0)_i,id; the diffusion model backbone (which VAE and UNet, and on what data they were pretrained) is not identified; and exact values for the loss weights λ1, λ2, λ3, the perturbation scale η, the KNN sparsity K, and the observed-user ratio p (beyond the two used values) are not reported. RQ4 only varies the number of diffusion steps, so the sensitivity of the method to its announced free parameters is not established. These omissions prevent reproduction and make it impossible to assess how robust the reported HR@k values are.
  3. [Section 4.2.2, Eq. (16)] The user alignment loss is dimensionally under-specified. f(xadv) for a torchvision ResNet is a fixed high-dimensional vector, while eu has dimension d; cosine similarity requires equal dimensions, and the sentence "projecting image features into the user embedding space" does not describe an actual projection layer or its training. If a projection exists, it must be specified; if not, Eq. (16) is undefined.
  4. [Table 3 and Section 5.2] The cross-system setting is labeled p=0, but the method's core component is user-preference-guided perturbation built from observed interactions. It is unclear whether the user embeddings come from the source dataset's interactions (in which case the caption should say so and the domain-transfer behavior of eu should be analyzed) or whether no interaction data are used at all (in which case the mechanism behind the reported Tradesy-to-Amazon gains is unexplained). Please clarify the exact data available to the adversary in this experiment.
  5. [Section 5.3 and Eq. (1)] The detection risk D(·) is never reported quantitatively. The attack objective includes D, and stealth is a central claim, but the experiments provide only a human study (Figure 3, no confidence intervals or significance tests) and qualitative heatmaps (Figure 5). Reporting quantitative imperceptibility metrics (e.g., SSIM, LPIPS, or detection rates under a simple detector) alongside HR@k would make the stealth claim testable.
  6. [Section 4.1] The item visual features Ei,v used to construct the item-item affinity graph are not defined; no extractor is named. Since these features also feed into eu, the alignment in Eq. (16) is between two proxy spaces (the item-feature extractor and the torchvision ResNet), and neither is validated against the victim encoder. This should be clarified and, ideally, the choice of item-feature extractor should be varied in the experiments.
minor comments (6)
  1. [Throughout] There are typos and inconsistent formatting, such as "AUV-fusion" in the Introduction and "V ARS" with irregular spacing; please standardize these.
  2. [Section 5.1] The sentence "we employed the leave-one-out method to partition the training and test sets of both datasets in a 9:1 ratio" conflates leave-one-out with a random 9:1 split; please clarify the actual splitting protocol.
  3. [Section 5.3, Figures 3 and 4] The figures are referenced but not described with axis labels, error bars, or numerical values; without these the human-study result cannot be verified.
  4. [Section 5.3] The human study lacks a statistical test or confidence intervals; please report these or qualify the conclusion accordingly.
  5. [Table 1] Dataset statistics should include the number of cold-start items and the image resolution used, as both affect the cold-start evaluation.
  6. [References] Reference [50] is incomplete (no year), and the Introduction's "first cross-modal attack framework" claim should be checked against Ref. [9], which also uses guided diffusion, to avoid overclaiming.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claim is tested against independently trained victim recommenders, and the surrogate alignment in Eq. (16) is an empirical transfer mechanism, not a definitional reduction.

full rationale

The paper's central derivation is the cross-modal attack objective: user embeddings eu from Eq. (8) are computed from observed interactions and image features, mapped by an MLP to a latent perturbation, and optimized with Lalign = -cosine(f(xadv), eu) using an off-the-shelf torchvision ResNet for f (Eq. 16). The evaluated quantity is HR@k on victim models VBPR, DVBPR, and AMR, which use their own visual encoders and are not used in the attack's optimization. There is no equation or fitted parameter that makes the victim score equal to the attack objective by construction; whether the ResNet surrogate transfers to those encoders is an empirical question, and the paper reports mixed transfer results (e.g., smaller gains on DVBPR, second place in one cross-domain direction) that are consistent with such a test. The only self-citations (refs [11], [21], [22], [30], [31]) appear in background lists and do not carry the load of the central claim; no uniqueness theorem, ansatz, or fitted prediction is imported from them. The ablation (Table 4) and cross-domain experiments (Table 3) further show held-out evaluation, so the results are externally falsifiable rather than circular.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several unstated implementation choices: the loss weights and perturbation scale are undisclosed, the diffusion backbone is not identified, and the transferability of a ResNet-based surrogate to unknown victim encoders is assumed. These are not new physical or mathematical entities, but they are load-bearing choices that a reader would need to reproduce the method.

free parameters (5)
  • loss weights λ1, λ2, λ3 = not reported
    Balance CLIP preservation, SSIM, and user alignment in Eq. (17); values are chosen by hand and not disclosed.
  • perturbation injection scale η = not reported (zero in ablation)
    Controls the strength of latent-space perturbation in Section 4.2.2; ablation sets it to zero, but the full value is not given.
  • observed user ratio p = 0.1
    Threat model in Section 3.2 sets p=0.1, but p=0 is used for cross-system evaluation without sensitivity analysis.
  • KNN graph sparsity K = not reported
    Top-K neighbors in Eq. (5) sparsify the affinity graph; the value is not specified.
  • diffusion steps = 50
    Chosen via Figure 6 as a balance between performance and stability; 25 and 100 steps are also tested.
assumptions (4)
  • domain assumption A torchvision ResNet is a valid proxy for any victim's visual encoder under black-box transfer.
    Eq. (16) uses f(xadv) with a frozen pretrained ResNet; success depends on feature-space alignment with VBPR/DVBPR/AMR encoders.
  • domain assumption Partial observed interaction data (p=0.1) yields user embeddings representative enough to drive effective perturbations.
    Section 3.2 caps observations at 10% of users; LightGCN embeddings are trained on this subset and must approximate full-data preferences.
  • domain assumption A pretrained VAE/UNet diffusion model can reconstruct adversarial images with preserved semantics after latent perturbation.
    Section 4.2.2 assumes the diffusion model remains valid under injected δ and that decoded images are visually plausible and consistent.
  • standard math Graph convolution and DDIM sampling operate as standard.
    Equations (2)-(6) and (12)-(13) rely on established LightGCN and DDIM formulations without further justification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS." pith.science (2026). https://pith.science/paper/OSPN7VLC

@misc{pith2026250722880,
  author       = {Pith},
  title        = {Pith review of: AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OSPN7VLC}},
  note         = {Machine review of arXiv:2507.22880}
}
read the original abstract

Modern Visual-Aware Recommender Systems (VARS) exploit the integration of user interaction data and visual features to deliver personalized recommendations with high precision. However, their robustness against adversarial attacks remains largely underexplored, posing significant risks to system reliability and security. Existing attack strategies suffer from notable limitations: shilling attacks are costly and detectable, and visual-only perturbations often fail to align with user preferences. To address these challenges, we propose AUV-Fusion, a cross-modal adversarial attack framework that adopts high-order user preference modeling and cross-modal adversary generation. Specifically, we obtain robust user embeddings through multi-hop user-item interactions and transform them via an MLP into semantically aligned perturbations. These perturbations are injected onto the latent space of a pre-trained VAE within the diffusion model. By synergistically integrating genuine user interaction data with visually plausible perturbations, AUV-Fusion eliminates the need for injecting fake user profiles and effectively mitigates the challenge of insufficient user preference extraction inherent in traditional visual-only attacks. Comprehensive evaluations on diverse VARS architectures and real-world datasets demonstrate that AUV-Fusion significantly enhances the exposure of target (cold-start) items compared to conventional baseline methods. Moreover, AUV-Fusion maintains exceptional stealth under rigorous scrutiny.

Figures

Figures reproduced from arXiv: 2507.22880 by the authors.

Figure 1
Figure 1. Illustration of how a Visual-Aware Recommendation System faces different vulnerabilities. Shilling attacks require numerous fake user profiles, whereas item representation attacks operate directly on item features, incurring lower costs and potentially higher stealth. attacks bypass user profile creation and instead exploit visual or textual item representations, making them harder to detect with typical shilling-ba… view at source ↗
Figure 2
Figure 2. AUV-Fusion: A Cross-modal adversarial attack framework for Visual-Aware Recommender Systems. Our method integrates two key modules: the upper layer leverages a graph convolutional network to model high-order user preferences by capturing collaborative interactions and visual semantics, while the lower layer utilizes a diffusion￾based adversary generation process that injects user-driven perturbations into the latent… view at source ↗
Figure 3
Figure 3. A human study shows that a value close to [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 6
Figure 6. Figure 6: The influence of diffusion steps on the VBPR of the AUV-Fusion model on the Amazon. complete indistinguishability between original and adversarial samples. As shown in [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 38 canonical work pages

  1. [1]

    Deep neural networks for youtube recommendations

    Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for youtube recommendations. InProceedings of the 10th ACM conference on recommender systems, pages 191–198, 2016

    2016

  2. [2]

    Parameter-efficient transfer from sequential behaviors for user modeling and recommendation

    Fajie Yuan, Xiangnan He, Alexandros Karatzoglou, and Liguang Zhang. Parameter-efficient transfer from sequential behaviors for user modeling and recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages 1469–1478, 2020

    work page 2020

  3. [3]

    Matrix factorization techniques for recommender systems

    Yehuda Koren, Robert Bell, and Chris V olinsky. Matrix factorization techniques for recommender systems. Computer, 42(8):30–37, 2009

    2009

  4. [4]

    A review of modern fashion recommender systems

    Yashar Deldjoo, Fatemeh Nazary, Arnau Ramisa, Julian Mcauley, Giovanni Pellegrini, Alejandro Bellogin, and Tommaso Di Noia. A review of modern fashion recommender systems. ACM Computing Surveys, 56(4):1–37, 2023

    work page 2023

  5. [5]

    Vbpr: visual bayesian personalized ranking from implicit feedback

    Ruining He and Julian McAuley. Vbpr: visual bayesian personalized ranking from implicit feedback. In Proceedings of the AAAI conference on artificial intelligence, volume 30, 2016

    work page 2016

  6. [6]

    Aesthetic-based clothing recommen- dation

    Wenhui Yu, Huidi Zhang, Xiangnan He, Xu Chen, Li Xiong, and Zheng Qin. Aesthetic-based clothing recommen- dation. In Proceedings of the 2018 world wide web conference, pages 649–658, 2018. 11 A PREPRINT

    work page 2018

  7. [7]

    Attacking visually-aware recommender systems with transferable and imperceptible adversarial styles

    Shiyi Yang, Chen Wang, Xiwei Xu, Liming Zhu, and Lina Yao. Attacking visually-aware recommender systems with transferable and imperceptible adversarial styles. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, pages 2900–2909, 2024

    work page 2024

  8. [8]

    Adversarial item promotion: Vulnerabilities at the core of top-n recommenders that use images to address cold start

    Zhuoran Liu and Martha Larson. Adversarial item promotion: Vulnerabilities at the core of top-n recommenders that use images to address cold start. In Proceedings of the Web Conference 2021, pages 3590–3602, 2021

    work page 2021

Show all 51 references
  1. [9]

    Adversarial item promotion on visually-aware recommender systems by guided diffusion

    Lijian Chen, Wei Yuan, Tong Chen, Guanhua Ye, Nguyen Quoc Viet Hung, and Hongzhi Yin. Adversarial item promotion on visually-aware recommender systems by guided diffusion. ACM Transactions on Information Systems, 42(6):1–26, 2024

    2024

  2. [10]

    Attacking click-through rate predictors via generating realistic fake samples

    Mingxing Duan, Kenli Li, Weinan Zhang, Jiarui Qin, and Bin Xiao. Attacking click-through rate predictors via generating realistic fake samples. ACM Transactions on Knowledge Discovery from Data, 18(5):1–24, 2024

    2024

  3. [11]

    Toda: Target-oriented diffusion attacker against recommendation system

    Xiaohao Liu, Zhulin Tao, Ting Jiang, He Chang, Yunshan Ma, Yinwei Wei, and Xiang Wang. Toda: Target-oriented diffusion attacker against recommendation system. arXiv preprint arXiv:2401.12578, 2024

    2024 arXiv

  4. [12]

    Adver- sarial attacks for black-box recommender systems via copying transferable cross-domain user profiles

    Wenqi Fan, Xiangyu Zhao, Qing Li, Tyler Derr, Yao Ma, Hui Liu, Jianping Wang, and Jiliang Tang. Adver- sarial attacks for black-box recommender systems via copying transferable cross-domain user profiles. IEEE Transactions on Knowledge and Data Engineering, 35(12):12415–12429, 2023

    2023

  5. [13]

    Influence-driven data poisoning for robust recommender systems

    Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. Influence-driven data poisoning for robust recommender systems. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(10):11915–11931, 2023

    2023

  6. [14]

    Poisoning gnn-based recommender systems with generative surrogate-based attacks

    Toan Nguyen Thanh, Nguyen Duc Khang Quach, Thanh Tam Nguyen, Thanh Trung Huynh, Viet Hung Vu, Phi Le Nguyen, Jun Jo, and Quoc Viet Hung Nguyen. Poisoning gnn-based recommender systems with generative surrogate-based attacks. ACM Transactions on Information Systems, 41(3):1–24, 2023

    2023

  7. [15]

    Poisoning attacks to graph-based recommender systems

    Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. Poisoning attacks to graph-based recommender systems. In Proceedings of the 34th annual computer security applications conference, pages 381–392, 2018

    2018

  8. [16]

    Shilling attacks against recommender systems: a comprehensive survey

    Ihsan Gunes, Cihan Kaleli, Alper Bilge, and Huseyin Polat. Shilling attacks against recommender systems: a comprehensive survey. Artificial Intelligence Review, 42:767–799, 2014

    2014

  9. [17]

    Data poisoning attacks to deep learning based recommender systems

    Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data poisoning attacks to deep learning based recommender systems. arXiv preprint arXiv:2101.02644, 2021

    2021 arXiv

  10. [18]

    Triple adversarial learning for influence based poisoning attack in recommender systems

    Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. Triple adversarial learning for influence based poisoning attack in recommender systems. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, KDD ’21, page 1830–1840, New York, NY ,...

    2021

  11. [19]

    Fight fire with fire: Towards robust recommender systems via adversarial poisoning training

    Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, Enhong Chen, and Senchao Yuan. Fight fire with fire: Towards robust recommender systems via adversarial poisoning training. In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Ret...

    2021

  12. [20]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICML, pages 8748–8763. PmLR, 2021

    2021

  13. [21]

    Towards modality generalization: A benchmark and prospective analysis

    Xiaohao Liu, Xiaobo Xia, Zhuo Huang, See-Kiong Ng, and Tat-Seng Chua. Towards modality generalization: A benchmark and prospective analysis. arXiv preprint arXiv:2412.18277, 2024

    2024 arXiv

  14. [22]

    Continual multimodal contrastive learning

    Xiaohao Liu, Xiaobo Xia, See-Kiong Ng, and Tat-Seng Chua. Continual multimodal contrastive learning. arXiv preprint arXiv:2503.14963, 2025

    2025

  15. [23]

    Getting the look: clothing recognition and segmentation for automatic product suggestions in everyday photos

    Yannis Kalantidis, Lyndon Kennedy, and Li-Jia Li. Getting the look: clothing recognition and segmentation for automatic product suggestions in everyday photos. In Proceedings of the 3rd ACM conference on International conference on multimedia retrieval, pages 105–112, 2013

    2013

  16. [24]

    Large scale visual recommendations from street fashion images

    Vignesh Jagadeesh, Robinson Piramuthu, Anurag Bhardwaj, Wei Di, and Neel Sundaresan. Large scale visual recommendations from street fashion images. In Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 1925–1934, 2014

    1925

  17. [25]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  18. [26]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 12 A PREPRINT

    2014 arXiv

  19. [27]

    Bpr: Bayesian personalized ranking from implicit feedback

    Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. Bpr: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618, 2012

    2012 arXiv

  20. [28]

    Neural collaborative filtering

    Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. Neural collaborative filtering. In Proceedings of the 26th international conference on world wide web, pages 173–182, 2017

    2017

  21. [29]

    Image-based recommendations on styles and substitutes

    Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel. Image-based recommendations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pages 43–52, 2015

    2015

  22. [30]

    Elimrec: Eliminating single-modal bias in multimedia recommendation

    Xiaohao Liu, Zhulin Tao, Jiahong Shao, Lifang Yang, and Xianglin Huang. Elimrec: Eliminating single-modal bias in multimedia recommendation. In Proceedings of the 30th ACM international conference on multimedia, pages 687–695, 2022

    2022

  23. [31]

    Self- supervised learning for multimedia recommendation

    Zhulin Tao, Xiaohao Liu, Yewei Xia, Xiang Wang, Lifang Yang, Xianglin Huang, and Tat-Seng Chua. Self- supervised learning for multimedia recommendation. IEEE Transactions on Multimedia, 25:5107–5116, 2022

    2022

  24. [32]

    Fashion dna: merging content and sales data for recommendation and article mapping

    Christian Bracher, Sebastian Heinz, and Roland V ollgraf. Fashion dna: merging content and sales data for recommendation and article mapping. arXiv preprint arXiv:1609.02489, 2016

    2016 arXiv

  25. [33]

    Visually-aware fashion recommendation and design with generative image models

    Wang-Cheng Kang, Chen Fang, Zhaowen Wang, and Julian McAuley. Visually-aware fashion recommendation and design with generative image models. In 2017 IEEE international conference on data mining (ICDM), pages 207–216. IEEE, 2017

    2017

  26. [34]

    Adversarial training towards robust multimedia recommender system

    Jinhui Tang, Xiaoyu Du, Xiangnan He, Fajie Yuan, Qi Tian, and Tat-Seng Chua. Adversarial training towards robust multimedia recommender system. IEEE Transactions on Knowledge and Data Engineering, 32(5):855–867, 2019

    2019

  27. [35]

    Shilling black-box recommender systems by learning to generate fake user profiles

    Chen Lin, Si Chen, Meifang Zeng, Sheng Zhang, Min Gao, and Hui Li. Shilling black-box recommender systems by learning to generate fake user profiles. IEEE Transactions on Neural Networks and Learning Systems, 35(1):1305–1319, 2024

    2024

  28. [36]

    Diffcl: A diffusion-based contrastive learning framework with semantic alignment for multimodal recommendations

    Qiya Song, Jiajun Hu, Lin Xiao, Bin Sun, Xieping Gao, and Shutao Li. Diffcl: A diffusion-based contrastive learning framework with semantic alignment for multimodal recommendations. IEEE Transactions on Neural Networks and Learning Systems, pages 1–11, 2025

    2025

  29. [37]

    Robust privacy-preserving recommendation systems driven by multimodal federated learning

    Chenyuan Feng, Daquan Feng, Guanxin Huang, Zuozhu Liu, Zhenzhong Wang, and Xiang-Gen Xia. Robust privacy-preserving recommendation systems driven by multimodal federated learning. IEEE Transactions on Neural Networks and Learning Systems, 36(5):8896–8910, 2025

    2025

  30. [38]

    A survey on federated recommendation systems

    Zehua Sun, Yonghui Xu, Yong Liu, Wei He, Lanju Kong, Fangzhao Wu, Yali Jiang, and Lizhen Cui. A survey on federated recommendation systems. IEEE Transactions on Neural Networks and Learning Systems, 36(1):6–20, 2025

    2025

  31. [39]

    Multi-view graph convolutional network for multimedia recommendation

    Penghang Yu, Zhiyi Tan, Guanming Lu, and Bing-Kun Bao. Multi-view graph convolutional network for multimedia recommendation. In Proceedings of the 31st ACM international conference on multimedia, pages 6576–6585, 2023

    2023

  32. [40]

    Llmrec: Large language models with graph augmentation for recommendation

    Wei Wei, Xubin Ren, Jiabin Tang, Qinyong Wang, Lixin Su, Suqi Cheng, Junfeng Wang, Dawei Yin, and Chao Huang. Llmrec: Large language models with graph augmentation for recommendation. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining, pages ...

    2024

  33. [41]

    Mentor: multi-level self- supervised learning for multimodal recommendation

    Jinfeng Xu, Zheyu Chen, Shuo Yang, Jinze Li, Hewei Wang, and Edith C-H Ngai. Mentor: multi-level self- supervised learning for multimodal recommendation. arXiv preprint arXiv:2402.19407, 2024

    2024 arXiv

  34. [42]

    Lightgcn: Simplifying and powering graph convolution network for recommendation

    Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. Lightgcn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages...

    2020

  35. [43]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, June 2022

    2022

  36. [44]

    Taamr: Targeted adversarial attack against multimedia recommender systems

    Tommaso Di Noia, Daniele Malitesta, and Felice Antonio Merra. Taamr: Targeted adversarial attack against multimedia recommender systems. In The 3rd International Workshop on Dependable and Secure Machine Learning – DSML 2020 Co-located with the 50th IEEE/IFIP International Con...

    2020

  37. [45]

    The youtube video recommendation system

    James Davidson, Benjamin Liebald, Junning Liu, Palash Nandy, Taylor Van Vleet, Ullas Gargi, Sujoy Gupta, Yu He, Mike Lambert, Blake Livingston, and Dasarathi Sampath. The youtube video recommendation system. In Proceedings of the Fourth ACM Conference on Recommender Systems, R...

    2010

  38. [46]

    Billion-scale commodity embedding for e-commerce recommendation in alibaba

    Jizhe Wang, Pipei Huang, Huan Zhao, Zhibo Zhang, Binqiang Zhao, and Dik Lun Lee. Billion-scale commodity embedding for e-commerce recommendation in alibaba. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , KDD ’18, page 839–...

    2018

  39. [47]

    Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and D. A. Forsyth. Unrestricted adversarial examples via semantic manipulation. In International Conference on Learning Representations, 2020

    2020

  40. [48]

    Richard Zhang, Phillip Isola, and Alexei A. Efros. Colorful image colorization. In Computer Vision – ECCV 2016, pages 649–666, Cham, 2016. Springer International Publishing

    2016

  41. [49]

    Detecting adversarial examples via reconstruction-based semantic inconsistency

    Chi Zhang, Wenbo Zhou, Kui Zhang, Jie Zhang, Weiming Zhang, and Nenghai Yu. Detecting adversarial examples via reconstruction-based semantic inconsistency. InProceedings of the ACM Turing Award Celebration Conference - China 2024, ACM-TURC ’24, page 126–131, New York, NY , USA...

    2024

  42. [50]

    Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra

    Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra. Grad-cam: Why did you say that? visual explanations from deep networks via gradient-based localization. CoRR, 2016

    2016

  43. [51]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander M ˛ adry. Adversarial examples are not bugs, they are features. Curran Associates Inc., Red Hook, NY , USA, 2019. 14

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.