{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T03:31:57Z","timestamp":1772595117102,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,9,13]],"date-time":"2022-09-13T00:00:00Z","timestamp":1663027200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,9,18]]},"DOI":"10.1145\/3523227.3546770","type":"proceedings-article","created":{"date-parts":[[2022,9,13]],"date-time":"2022-09-13T14:13:46Z","timestamp":1663078426000},"page":"59-70","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":22,"title":["Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders"],"prefix":"10.1145","author":[{"given":"Zhenrui","family":"Yue","sequence":"first","affiliation":[{"name":"University of Illinois Urbana-Champaign, United States"}]},{"given":"Huimin","family":"Zeng","sequence":"additional","affiliation":[{"name":"University of Illinois Urbana-Champaign, United States"}]},{"given":"Ziyi","family":"Kou","sequence":"additional","affiliation":[{"name":"University of Illinois Urbana-Champaign, United States"}]},{"given":"Lanyu","family":"Shang","sequence":"additional","affiliation":[{"name":"University of Illinois Urbana-Champaign, United States"}]},{"given":"Dong","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Illinois Urbana-Champaign, United States"}]}],"member":"320","published-online":{"date-parts":[[2022,9,13]]},"reference":[{"key":"e_1_3_2_2_1_1","doi-asserted-by":"crossref","unstructured":"Moustafa Alzantot Yash Sharma Ahmed Elgohary Bo-Jhang Ho Mani Srivastava and Kai-Wei Chang. 2018. Generating natural language adversarial examples. arXiv preprint arXiv:1804.07998(2018).","DOI":"10.18653\/v1\/D18-1316"},{"key":"e_1_3_2_2_2_1","volume-title":"Music Recommendation and Discovery in the Long Tail","author":"Celma O.","unstructured":"O. Celma. 2010. Music Recommendation and Discovery in the Long Tail. Springer."},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3298689.3346987"},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3298689.3347031"},{"key":"e_1_3_2_2_5_1","volume-title":"Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751(2017).","author":"Ebrahimi Javid","year":"2017","unstructured":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751(2017)."},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380072"},{"key":"e_1_3_2_2_7_1","volume-title":"Bae: Bert-based adversarial examples for text classification. arXiv preprint arXiv:2004.01970(2020).","author":"Garg Siddhant","year":"2020","unstructured":"Siddhant Garg and Goutham Ramakrishnan. 2020. Bae: Bert-based adversarial examples for text classification. arXiv preprint arXiv:2004.01970(2020)."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-020-00257-z"},{"key":"e_1_3_2_2_9_1","unstructured":"Ian\u00a0J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572(2014)."},{"key":"e_1_3_2_2_10_1","unstructured":"Sven Gowal Krishnamurthy Dvijotham Robert Stanforth Rudy Bunel Chongli Qin Jonathan Uesato Relja Arandjelovic Timothy Mann and Pushmeet Kohli. 2018. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715(2018)."},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"crossref","unstructured":"F\u00a0Maxwell Harper and Joseph\u00a0A Konstan. 2015. The movielens datasets: History and context. Acm transactions on interactive intelligent systems (tiis) 5 4(2015) 1\u201319.","DOI":"10.1145\/2827872"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3209978.3209981"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482136"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"crossref","unstructured":"Hai Huang Jiaming Mu Neil\u00a0Zhenqiang Gong Qi Li Bin Liu and Mingwei Xu. 2021. Data Poisoning Attacks to Deep Learning Based Recommender Systems. arXiv preprint arXiv:2101.02644(2021).","DOI":"10.14722\/ndss.2021.24525"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00035"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115638"},{"key":"e_1_3_2_2_17_1","volume-title":"Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.05271(2018).","author":"Li Jinfeng","year":"2018","unstructured":"Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.05271(2018)."},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132847.3132926"},{"key":"e_1_3_2_2_19_1","volume-title":"Bert-attack: Adversarial attack against bert using bert. arXiv preprint arXiv:2004.09984(2020).","author":"Li Linyang","year":"2020","unstructured":"Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. Bert-attack: Adversarial attack against bert using bert. arXiv preprint arXiv:2004.09984(2020)."},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2959100.2959147"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2766462.2767755"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2687258"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1"},{"key":"e_1_3_2_2_24_1","unstructured":"Sejoon Oh and Srijan Kumar. 2022. Robustness of Deep Recommendation Systems to Untargeted Interaction Perturbations. arXiv preprint arXiv:2201.12686(2022)."},{"key":"e_1_3_2_2_25_1","unstructured":"Michael\u00a0P O\u2019Mahony Neil\u00a0J Hurley and Gu\u00e9nol\u00e9\u00a0CM Silvestre. 2005. Recommender systems: Attack types and strategies. In AAAI. 334\u2013339."},{"key":"e_1_3_2_2_26_1","volume-title":"24th {USENIX} Security Symposium ({USENIX} Security 15). 945\u2013959.","author":"Ren Chuangang","unstructured":"Chuangang Ren, Yulong Zhang, Hui Xue, Tao Wei, and Peng Liu. 2015. Towards discovering and understanding task hijacking in android. In 24th {USENIX} Security Symposium ({USENIX} Security 15). 945\u2013959."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"crossref","unstructured":"Motoki Sato Jun Suzuki Hiroyuki Shindo and Yuji Matsumoto. 2018. Interpretable adversarial perturbation in input embedding space for text. arXiv preprint arXiv:1805.02917(2018).","DOI":"10.24963\/ijcai.2018\/601"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE48307.2020.00021"},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3357895"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2019.2893638"},{"key":"e_1_3_2_2_32_1","volume-title":"Revisiting Adversarially Learned Injection Attacks Against Recommender Systems. In Fourteenth ACM Conference on Recommender Systems. 318\u2013327","author":"Tang Jiaxi","year":"2020","unstructured":"Jiaxi Tang, Hongyi Wen, and Ke Wang. 2020. Revisiting Adversarially Learned Injection Attacks Against Recommender Systems. In Fourteenth ACM Conference on Recommender Systems. 318\u2013327."},{"key":"e_1_3_2_2_33_1","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Xing Xingyu","year":"2013","unstructured":"Xingyu Xing, Wei Meng, Dan Doozan, Alex\u00a0C Snoeren, Nick Feamster, and Wenke Lee. 2013. Take this personally: Pollution attacks on personalized services. In 22nd USENIX Security Symposium (USENIX Security 13). 671\u2013686."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"crossref","unstructured":"Guolei Yang Neil\u00a0Zhenqiang Gong and Ying Cai. 2017. Fake Co-visitation Injection Attacks to Recommender Systems.. In NDSS.","DOI":"10.14722\/ndss.2017.23020"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3331184.3331321"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460231.3474275"},{"key":"e_1_3_2_2_37_1","volume-title":"Cross-site request forgeries: Exploitation and prevention. Bericht","author":"Zeller William","year":"2008","unstructured":"William Zeller and Edward\u00a0W Felten. 2008. Cross-site request forgeries: Exploitation and prevention. Bericht, Princeton University(2008)."},{"key":"e_1_3_2_2_38_1","unstructured":"Huimin Zeng Jiahao Su and Furong Huang. 2021. Certified Defense via Latent Space Randomized Smoothing with Orthogonal Encoders. arXiv preprint arXiv:2108.00491(2021)."},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i12.17292"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341161.3342885"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.5555\/3382225.3382303"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3379992"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2954737"},{"key":"e_1_3_2_2_44_1","unstructured":"Yi Zhou Xiaoqing Zheng Cho-Jui Hsieh Kai-wei Chang and Xuanjing Huang. 2020. Defense against adversarial attacks in nlp via dirichlet neighborhood ensemble. arXiv preprint arXiv:2006.11627(2020)."},{"key":"e_1_3_2_2_45_1","volume-title":"Freelb: Enhanced adversarial training for language understanding.","author":"Zhu Chen","year":"2019","unstructured":"Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. 2019. Freelb: Enhanced adversarial training for language understanding. (2019)."}],"event":{"name":"RecSys '22: Sixteenth ACM Conference on Recommender Systems","location":"Seattle WA USA","acronym":"RecSys '22","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web","SIGAI ACM Special Interest Group on Artificial Intelligence","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data","SIGIR ACM Special Interest Group on Information Retrieval","SIGCHI ACM Special Interest Group on Computer-Human Interaction"]},"container-title":["Proceedings of the 16th ACM Conference on Recommender Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3523227.3546770","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3523227.3546770","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:03:00Z","timestamp":1750186980000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3523227.3546770"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9,13]]},"references-count":45,"alternative-id":["10.1145\/3523227.3546770","10.1145\/3523227"],"URL":"https:\/\/doi.org\/10.1145\/3523227.3546770","relation":{},"subject":[],"published":{"date-parts":[[2022,9,13]]},"assertion":[{"value":"2022-09-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}