{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,8]],"date-time":"2026-02-08T15:54:08Z","timestamp":1770566048787,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,5,13]]},"DOI":"10.1145\/3589334.3645492","type":"proceedings-article","created":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T07:08:13Z","timestamp":1715152093000},"page":"3555-3565","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":19,"title":["Poisoning Federated Recommender Systems with Fake Users"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-9844-4447","authenticated-orcid":false,"given":"Ming","family":"Yin","sequence":"first","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1094-4206","authenticated-orcid":false,"given":"Yichang","family":"Xu","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1365-3911","authenticated-orcid":false,"given":"Minghong","family":"Fang","sequence":"additional","affiliation":[{"name":"Duke University, Durham, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9900-9309","authenticated-orcid":false,"given":"Neil Zhenqiang","family":"Gong","sequence":"additional","affiliation":[{"name":"Duke University, Durham, USA"}]}],"member":"320","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"[n.d.]. Amazon Personalize. www.amazonaws.com\/personalize."},{"key":"e_1_3_2_2_2_1","volume-title":"Kuan Eeik Tan, and Adrian Flanagan","author":"Muhammad","year":"2019","unstructured":"Muhammad Ammad-ud-din, Elena Ivannikova, Suleiman A. Khan,Were Oyomno, Qiang Fu, Kuan Eeik Tan, and Adrian Flanagan. 2019. Federated Collaborative Filtering for Privacy-Preserving Personalized Recommendation System. arXiv preprint arXiv:1901.09888 (2019)."},{"key":"e_1_3_2_2_3_1","unstructured":"Moran Baruch Gilad Baruch and Yoav Goldberg. 2019. A Little Is Enough: Circumventing Defenses For Distributed Learning. In NeurIPS."},{"key":"e_1_3_2_2_4_1","volume-title":"Rachid Guerraoui, and Julien Stainer.","author":"Blanchard Peva","year":"2017","unstructured":"Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS."},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"crossref","unstructured":"Ricardo J. G. B. Campello Davoud Moulavi and Joerg Sander. 2013. Density-Based Clustering Based on Hierarchical Density Estimates. In PAKDD.","DOI":"10.1007\/978-3-642-37456-2_14"},{"key":"e_1_3_2_2_6_1","volume-title":"Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS.","author":"Cao Xiaoyu","year":"2021","unstructured":"Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2021. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS."},{"key":"e_1_3_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW56347.2022.00383"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179336"},{"key":"e_1_3_2_2_9_1","volume-title":"Flcert: Provably secure federated learning against poisoning attacks","author":"Cao Xiaoyu","year":"2022","unstructured":"Xiaoyu Cao, Zaixi Zhang, Jinyuan Jia, and Neil Zhenqiang Gong. 2022. Flcert: Provably secure federated learning against poisoning attacks. IEEE Transactions on Information Forensics and Security (2022)."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"crossref","unstructured":"Liang Chen Yangjun Xu Fenfang Xie Min Huang and Zibin Zheng. 2021. Data poisoning attacks on neighborhood-based recommender systems. In Transactions on Emerging Telecommunications Technologies.","DOI":"10.1002\/ett.3872"},{"key":"e_1_3_2_2_11_1","volume-title":"Recommender Systems for Online Video Game Platforms: the Case of STEAM. In The Web Conference.","author":"Cheuque Germ\u00e1n","year":"2019","unstructured":"Germ\u00e1n Cheuque, Jose Antonio Guzman Gomez, and Denis Parra. 2019. Recommender Systems for Online Video Game Platforms: the Case of STEAM. In The Web Conference."},{"key":"e_1_3_2_2_12_1","volume-title":"USENIX Security Symposium.","author":"Fang Minghong","year":"2020","unstructured":"Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2020. Local Model Poisoning Attacks to Byzantine-Robust Federated Learning. In USENIX Security Symposium."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380072"},{"key":"e_1_3_2_2_14_1","volume-title":"Neil Zhenqiang Gong, and Elizabeth S Bentley","author":"Fang Minghong","year":"2022","unstructured":"Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Elizabeth S Bentley. 2022. AFLGuard: Byzantine-robust Asynchronous Federated Learning. In ACSAC."},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450066"},{"key":"e_1_3_2_2_16_1","volume-title":"Neil Zhenqiang Gong, and Jia Liu","author":"Fang Minghong","year":"2018","unstructured":"Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. 2018. Poisoning Attacks to Graph-Based Recommender Systems. In ACSAC."},{"key":"e_1_3_2_2_17_1","volume-title":"Random-Walk Computation of Similarities between Nodes of a Graph with Application to Collaborative Recommendation","author":"Fouss Francois","unstructured":"Francois Fouss, Alain Pirotte, Jean-michel Renders, and Marco Saerens. 2007. Random-Walk Computation of Similarities between Nodes of a Graph with Application to Collaborative Recommendation. In IEEE Transactions on Knowledge and Data Engineering."},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"crossref","unstructured":"Ihsan Gunes Cihan Kaleli Alper Bilge and Huseyin Polat. 2013. Shilling attacks against recommender systems: A comprehensive survey. In Artificial Intelligence Review.","DOI":"10.1007\/s10462-012-9364-9"},{"key":"e_1_3_2_2_19_1","article-title":"The MovieLens Datasets: History and Context. In ACM","author":"Maxwell Harper F.","year":"2015","unstructured":"F. Maxwell Harper and Joseph A. Konstan. 2015. The MovieLens Datasets: History and Context. In ACM Trans. Interact. Intell. Syst.","journal-title":"Trans. Interact. Intell. Syst."},{"key":"e_1_3_2_2_20_1","unstructured":"Xiangnan He Kuan Deng Xiang Wang Yan Li YongDong Zhang and Meng Wang. 2020. LightGCN: Simplifying and Powering Graph Convolution Network for Recommendation. In SIGIR."},{"key":"e_1_3_2_2_21_1","volume-title":"Qi Li, Bin Liu, and Mingwei Xu.","author":"Huang Hai","year":"2021","unstructured":"Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. 2021. Data Poisoning Attacks to Deep Learning Based Recommender Systems. In NDSS."},{"key":"e_1_3_2_2_22_1","unstructured":"Saakshi Kapoor. 2017. A REVIEW OF ATTACKS AND ITS DETECTION ATTRIBUTES ON COLLABORATIVE RECOMMENDER SYSTEMS. In International Journal of Advanced Research in Computer Science."},{"key":"e_1_3_2_2_23_1","unstructured":"Sai Praneeth Karimireddy Lie He and Martin Jaggi. 2021. Learning from history for byzantine robust optimization. In ICML."},{"key":"e_1_3_2_2_24_1","volume-title":"Federated Learning: Strategies for Improving Communication Efficiency. In NeurIPS Workshop on Private Multi-Party Machine Learning.","author":"Konecn\u00fd Jakub","year":"2016","unstructured":"Jakub Konecn\u00fd, H. Brendan McMahan, Felix X. Yu, Peter Richtarik, Ananda Theertha Suresh, and Dave Bacon. 2016. Federated Learning: Strategies for Improving Communication Efficiency. In NeurIPS Workshop on Private Multi-Party Machine Learning."},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"crossref","unstructured":"Yehuda Koren Robert Bell and Chris Volinsky. 2009. Matrix Factorization Techniques for Recommender Systems. In Computer.","DOI":"10.1109\/MC.2009.263"},{"key":"e_1_3_2_2_26_1","unstructured":"Bo Li YiningWang Aarti Singh and Yevgeniy Vorobeychik. 2016. Data poisoning attacks on factorization-based collaborative filtering. In NeurIPS."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"crossref","unstructured":"Tan Li Linqi Song and Christina Fragouli. 2020. Federated recommendation system via differential privacy. In ISIT.","DOI":"10.1109\/ISIT44484.2020.9174297"},{"key":"e_1_3_2_2_28_1","volume-title":"FedRec: Federated Recommendation With Explicit Feedback","author":"Lin Guanyu","unstructured":"Guanyu Lin, Feng Liang, Weike Pan, and Zhong Ming. 2021. FedRec: Federated Recommendation With Explicit Feedback. In IEEE Intelligent Systems."},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"crossref","unstructured":"Tropa Mahmood and Muhammad Abdullah Adnan. 2022. Detecting Fake Co-Visitation Injection Attack in Graph-Based Recommendation Systems. In NSysS.","DOI":"10.1145\/3569551.3569556"},{"key":"e_1_3_2_2_30_1","unstructured":"H. B. McMahan Eider Moore Daniel Ramage Seth Hampson and Blaise Ag\u00fcera y Arcas. 2016. Communication-Efficient Learning of Deep Networks from Decentralized Data. In AISTATS."},{"key":"e_1_3_2_2_31_1","volume-title":"Fedfast: Going beyond average for faster training of federated recommender systems. In KDD.","author":"Muhammad Khalil","year":"2020","unstructured":"Khalil Muhammad, QinqinWang, Diarmuid O'Reilly-Morgan, Elias Tragos, Barry Smyth, Neil Hurley, James Geraci, and Aonghus Lawlor. 2020. Fedfast: Going beyond average for faster training of federated recommender systems. In KDD."},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"crossref","unstructured":"Yitong Pang Lingfei Wu Qi Shen Yiming Zhang Zhihua Wei Fangli Xu Ethan Chang Bo Long and Jian Pei. 2022. Heterogeneous Global Graph Neural Networks for Personalized Session-based Recommendation. In WSDM.","DOI":"10.1145\/3488560.3498505"},{"key":"e_1_3_2_2_33_1","volume-title":"BPR: Bayesian personalized ranking from implicit feedback. In UAI.","author":"Rendle Steffen","year":"2009","unstructured":"Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. 2009. BPR: Bayesian personalized ranking from implicit feedback. In UAI."},{"key":"e_1_3_2_2_34_1","volume-title":"Jianhai Chen, and Qinming He.","author":"Rong Dazhong","year":"2022","unstructured":"Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. 2022. FedRecAttack: model poisoning attack to federated recommendation. In ICDE."},{"key":"e_1_3_2_2_35_1","volume-title":"Item-Based Collaborative Filtering Recommendation Algorithms. In The Web Conference.","author":"Sarwar Badrul","year":"2001","unstructured":"Badrul Sarwar, George Karypis, Joseph Konstan, and John Riedl. 2001. Item-Based Collaborative Filtering Recommendation Algorithms. In The Web Conference."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2740908.2742726"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"crossref","unstructured":"Junshuai Song Zhao Li Zehong Hu Yucheng Wu Zhenpeng Li Jian Li and Jun Gao. 2020. Poisonrec: an adaptive data poisoning framework for attacking black-box recommender systems. In ICDE.","DOI":"10.1109\/ICDE48307.2020.00021"},{"key":"e_1_3_2_2_38_1","volume-title":"A Survey on Federated Recommendation Systems. arXiv preprint arXiv:2301.00767","author":"Sun Zehua","year":"2022","unstructured":"Zehua Sun, Yonghui Xu, Yong Liu, Wei He, Yali Jiang, Fangzhao Wu, and Lizhen Cui. 2022. A Survey on Federated Recommendation Systems. arXiv preprint arXiv:2301.00767 (2022)."},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"crossref","unstructured":"Jiaxi Tang Hongyi Wen and Ke Wang. 2020. Revisiting adversarially learned injection attacks against recommender systems. In RecSys.","DOI":"10.1145\/3383313.3412243"},{"key":"e_1_3_2_2_40_1","unstructured":"Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. In Journal of machine learning research."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"crossref","unstructured":"Qinyong Wang Hongzhi Yin Tong Chen Junliang Yu Alexander Zhou and Xiangliang Zhang. 2021. Fast-adapting and privacy-preserving federated recommender system. In The VLDB Journal.","DOI":"10.1007\/s00778-021-00700-6"},{"key":"e_1_3_2_2_42_1","volume-title":"Influence-Driven Data Poisoning for Robust Recommender Systems","author":"Wu Chenwang","unstructured":"Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. 2023. Influence-Driven Data Poisoning for Robust Recommender Systems. In IEEE Transactions on Pattern Analysis and Machine Intelligence."},{"key":"e_1_3_2_2_43_1","unstructured":"Chenwang Wu Defu Lian Yong Ge Zhihao Zhu Enhong Chen and Senchao Yuan. 2021. Fight fire with fire: towards robust recommender systems via adversarial poisoning training. In SIGIR."},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"crossref","unstructured":"Yao Wu Christopher DuBois Alice X Zheng and Martin Ester. 2016. Collaborative denoising auto-encoders for top-n recommender systems. In WSDM.","DOI":"10.1145\/2835776.2835837"},{"key":"e_1_3_2_2_45_1","volume-title":"Neil Zhenqiang Gong, and Ying Cai","author":"Yang Guolei","year":"2017","unstructured":"Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. 2017. Fake Co-visitation Injection Attacks to Recommender Systems. In NDSS."},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"crossref","unstructured":"Liu Yang Ben Tan VincentWZheng Kai Chen and Qiang Yang. 2020. Federated recommendation systems. In Federated Learning: Privacy and Incentive.","DOI":"10.1007\/978-3-030-63076-8_16"},{"key":"e_1_3_2_2_47_1","unstructured":"Yelp. 2004. Yelp Dataset. Available at https:\/\/www.yelp.com\/dataset."},{"key":"e_1_3_2_2_48_1","unstructured":"Dong Yin Yudong Chen Kannan Ramchandran and Peter Bartlett. 2018. Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. In ICML."},{"key":"e_1_3_2_2_49_1","volume-title":"An efficient hybrid music recommender system using an incrementally trainable probabilistic generative model","author":"Yoshii Kazuyoshi","unstructured":"Kazuyoshi Yoshii, Masataka Goto, Kazunori Komatani, Tetsuya Ogata, and Hiroshi G Okuno. 2008. An efficient hybrid music recommender system using an incrementally trainable probabilistic generative model. In IEEE Transactions on Audio, Speech, and Language Processing."},{"key":"e_1_3_2_2_50_1","volume-title":"Tieke He, Liang Chen, and Hongzhi Yin.","author":"Yuan Wei","year":"2023","unstructured":"Wei Yuan, Quoc Viet Hung Nguyen, Tieke He, Liang Chen, and Hongzhi Yin. 2023. Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasures. In SIGIR."},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3379992"},{"key":"e_1_3_2_2_52_1","volume-title":"Wayne Xin Zhao, and Jing Gao","author":"Zhang Hengtong","year":"2021","unstructured":"Hengtong Zhang, Changxin Tian, Yaliang Li, Lu Su, Nan Yang, Wayne Xin Zhao, and Jing Gao. 2021. Data poisoning attack against recommender system using incomplete and perturbed data. In KDD."},{"key":"e_1_3_2_2_53_1","volume-title":"Quoc Viet Hung Nguyen, and Lizhen Cui","author":"Zhang Shijie","year":"2022","unstructured":"Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Quoc Viet Hung Nguyen, and Lizhen Cui. 2022. Pipattack: Poisoning federated recommender systems for manipulating item promotion. In WSDM."},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"crossref","unstructured":"Yihe Zhang Xu Yuan Jin Li Jiadong Lou Li Chen and Nian-Feng Tzeng. 2021. Reverse attack: Black-box attacks on collaborative recommendation. In CCS.","DOI":"10.1145\/3460120.3484805"},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539231"}],"event":{"name":"WWW '24: The ACM Web Conference 2024","location":"Singapore Singapore","acronym":"WWW '24","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2024"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645492","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3589334.3645492","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:29:01Z","timestamp":1755822541000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645492"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":55,"alternative-id":["10.1145\/3589334.3645492","10.1145\/3589334"],"URL":"https:\/\/doi.org\/10.1145\/3589334.3645492","relation":{},"subject":[],"published":{"date-parts":[[2024,5,13]]},"assertion":[{"value":"2024-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}