Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
- 13 September 2021
- conference paper
- conference paper
- Published by Association for Computing Machinery (ACM)
Abstract
We investigate whether model extraction can be used to ‘steal’ the weights of sequential recommender systems, and the potential threats posed to victims of such attacks. This type of risk has attracted attention in image and text classification, but to our knowledge not in recommender systems. We argue that sequential recommender systems are subject to unique vulnerabilities due to the specific autoregressive regimes used to train them. Unlike many existing recommender attackers, which assume the dataset used to train the victim model is exposed to attackers, we consider a data-free setting, where training data are not accessible. Under this setting, we propose an API-based model extraction method via limited-budget synthetic data generation and knowledge distillation. We investigate state-of-the-art models for sequential recommendation and show their vulnerability under model extraction and downstream attacks. We perform attacks in two stages. (1) Model extraction: given different types of synthetic data and their labels retrieved from a black-box recommender, we extract the black-box model to a white-box model via distillation. (2) Downstream attacks: we attack the black-box model with adversarial samples generated by the white-box recommender. Experiments show the effectiveness of our data-free model extraction and downstream attacks on sequential recommenders in both profile pollution and data poisoning settings.Keywords
This publication has 21 references indexed in Scilit:
- Neural Collaborative FilteringPublished by Association for Computing Machinery (ACM) ,2017
- Practical Black-Box Attacks against Machine LearningPublished by Association for Computing Machinery (ACM) ,2017
- Fake Co-visitation Injection Attacks to Recommender SystemsPublished by Internet Society ,2017
- Fusing Similarity Models with Markov Chains for Sparse Sequential RecommendationPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2016
- The MovieLens DatasetsACM Transactions on Interactive Intelligent Systems, 2015
- Image-Based Recommendations on Styles and SubstitutesPublished by Association for Computing Machinery (ACM) ,2015
- Shilling attacks against recommender systems: a comprehensive surveyArtificial Intelligence Review, 2012
- Factorizing personalized Markov chains for next-basket recommendationPublished by Association for Computing Machinery (ACM) ,2010
- Adversarial learningPublished by Association for Computing Machinery (ACM) ,2005
- Shilling recommender systems for fun and profitPublished by Association for Computing Machinery (ACM) ,2004