{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T02:27:08Z","timestamp":1772159228545,"version":"3.50.1"},"reference-count":69,"publisher":"Association for Computing Machinery (ACM)","issue":"6","license":[{"start":{"date-parts":[[2024,8,19]],"date-time":"2024-08-19T00:00:00Z","timestamp":1724025600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"crossref","award":["FT210100624"],"award-info":[{"award-number":["FT210100624"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Discovery Early Career Researcher Award","award":["DE230101033 and DE200101465"],"award-info":[{"award-number":["DE230101033 and DE200101465"]}]},{"name":"Discovery Project","award":["DP240101108 and DP240101814"],"award-info":[{"award-number":["DP240101108 and DP240101814"]}]},{"name":"Industrial Transformation Training Centre","award":["IC200100022"],"award-info":[{"award-number":["IC200100022"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst."],"published-print":{"date-parts":[[2024,11,30]]},"abstract":"<jats:p>Visually-aware recommender systems have found widespread applications in domains where visual elements significantly contribute to the inference of users\u2019 potential preferences. While the incorporation of visual information holds the promise of enhancing recommendation accuracy and alleviating the cold-start problem, it is essential to point out that the inclusion of item images may introduce substantial security challenges. Some existing works have shown that the item provider can manipulate item exposure rates to its advantage by constructing adversarial images. However, these works cannot reveal the real vulnerability of visually-aware recommender systems because (1) the generated adversarial images are markedly distorted, rendering them easily detected by human observers; and (2) the effectiveness of these attacks is inconsistent and even ineffective in some scenarios or datasets. To shed light on the real vulnerabilities of visually-aware recommender systems when confronted with adversarial images, this article introduces a novel attack method, Item Promotion by Diffusion Generated Image (IPDGI). Specifically, IPDGI employs a guided diffusion model to generate adversarial samples designed to promote the exposure rates of target items (e.g., long-tail items). Taking advantage of accurately modeling benign images\u2019 distribution by diffusion models, the generated adversarial images have high fidelity with original images, ensuring the stealth of our IPDGI. To demonstrate the effectiveness of our proposed methods, we conduct extensive experiments on two commonly used e-commerce recommendation datasets (Amazon Beauty and Amazon Baby) with several typical visually-aware recommender systems. The experimental results show that our attack method significantly improves both the performance of promoting the long-tailed (i.e., unpopular) items and the quality of generated adversarial images.<\/jats:p>","DOI":"10.1145\/3666088","type":"journal-article","created":{"date-parts":[[2024,5,28]],"date-time":"2024-05-28T10:02:51Z","timestamp":1716890571000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["Adversarial Item Promotion on Visually-Aware Recommender Systems by Guided Diffusion"],"prefix":"10.1145","volume":"42","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-7351-7574","authenticated-orcid":false,"given":"Lijian","family":"Chen","sequence":"first","affiliation":[{"name":"The University of Queensland, Brisbane, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9400-842X","authenticated-orcid":false,"given":"Wei","family":"Yuan","sequence":"additional","affiliation":[{"name":"The University of Queensland, Brisbane, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7269-146X","authenticated-orcid":false,"given":"Tong","family":"Chen","sequence":"additional","affiliation":[{"name":"The University of Queensland, Brisbane, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1683-1875","authenticated-orcid":false,"given":"Guanhua","family":"Ye","sequence":"additional","affiliation":[{"name":"Deep Neural Computing Company Limited, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9687-1315","authenticated-orcid":false,"given":"Nguyen Quoc Viet","family":"Hung","sequence":"additional","affiliation":[{"name":"Griffith University, Gold Coast, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1395-261X","authenticated-orcid":false,"given":"Hongzhi","family":"Yin","sequence":"additional","affiliation":[{"name":"The University of Queensland, Brisbane, Australia"}]}],"member":"320","published-online":{"date-parts":[[2024,8,19]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Christian Bracher Sebastian Heinz and Roland Vollgraf. 2016. Fashion DNA: Merging content and sales data for recommendation and article mapping. arXiv:1609.02489. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1609.02489"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3077136.3080797"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00020"},{"key":"e_1_3_2_5_2","doi-asserted-by":"crossref","unstructured":"Yu Cheng Yunzhu Pan Jiaqi Zhang Yongxin Ni Aixin Sun and Fajie Yuan. 2023. An image dataset for benchmarking recommender systems with raw pixels. arXiv:2309.06789. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2309.06789","DOI":"10.1137\/1.9781611978032.49"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3437963.3441757"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413898"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219910"},{"key":"e_1_3_2_9_2","first-page":"8780","article-title":"Diffusion models beat gans on image synthesis","volume":"34","author":"Dhariwal Prafulla","year":"2021","unstructured":"Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems 34, 8780\u20138794.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_10_2","first-page":"1","volume-title":"Proceedings of the 50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W\u201920)","author":"Noia Tommaso Di","year":"2020","unstructured":"Tommaso Di Noia, Daniele Malitesta, and Felice Antonio Merra. 2020. Taamr: Targeted adversarial attack against multimedia recommender systems. In Proceedings of the 50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W\u201920). IEEE, 1\u20138."},{"key":"e_1_3_2_11_2","unstructured":"Hanwen Du Huanhuan Yuan Zhen Huang Pengpeng Zhao and Xiaofang Zhou. 2023. Sequential recommendation with diffusion models. arXiv:2304.04541. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2304.04541"},{"key":"e_1_3_2_12_2","unstructured":"Gintare Karolina Dziugaite Zoubin Ghahramani and Daniel M. Roy. 2016. A study of the effect of jpg compression on adversarial images. arXiv:1608.00853. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1608.00853"},{"key":"e_1_3_2_13_2","first-page":"3910","article-title":"Adversarial examples that fool both computer vision and time-limited humans","volume":"31","author":"Elsayed Gamaleldin","year":"2018","unstructured":"Gamaleldin Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, and Jascha Sohl-Dickstein. 2018. Adversarial examples that fool both computer vision and time-limited humans. Advances in Neural Information Processing Systems 31, 3910\u20133920.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3422622"},{"key":"e_1_3_2_15_2","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1412.6572"},{"key":"e_1_3_2_16_2","unstructured":"Chuan Guo Mayank Rana Moustapha Cisse and Laurens Van Der Maaten. 2017. Countering adversarial images using input transformations. arXiv:1711.00117. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1711.00117"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v30i1.9973"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052569"},{"key":"e_1_3_2_20_2","first-page":"25","article-title":"Gans trained by a two time-scale update rule converge to a local nash equilibrium","volume":"30","author":"Heusel Martin","year":"2017","unstructured":"Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in Neural Information Processing Systems 30, 25\u201335.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_21_2","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume":"33","author":"Ho Jonathan","year":"2020","unstructured":"Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems 33, 6840\u20136851.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623332"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00624"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/2461466.2461485"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2017.30"},{"key":"e_1_3_2_26_2","unstructured":"Diederik P. Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv:1412.6980. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1412.6980"},{"key":"e_1_3_2_27_2","unstructured":"Diederik P. Kingma and Max Welling. 2013. Auto-encoding variational bayes. arXiv:1312.6114. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1312.6114"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.279"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482448"},{"key":"e_1_3_2_31_2","unstructured":"Zihao Li Aixin Sun and Chenliang Li. 2023. DiffuRec: A diffusion model for sequential recommendation. arXiv:2304.00686. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2304.00686"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449891"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102847"},{"key":"e_1_3_2_34_2","first-page":"4244","volume-title":"International Conference on Machine Learning","author":"Magnusson M\u00e5ns","year":"2019","unstructured":"M\u00e5ns Magnusson, Michael Andersen, Johan Jonasson, and Aki Vehtari. 2019. Bayesian leave-one-out cross-validation for large data. In International Conference on Machine Learning. PMLR, 4244\u20134253."},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/2766462.2767755"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3539618.3591971"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3383313.3411476"},{"key":"e_1_3_2_38_2","unstructured":"Thanh Tam Nguyen Thanh Trung Huynh Phi Le Nguyen Alan Wee-Chung Liew Hongzhi Yin and Quoc Viet Hung Nguyen. 2022. A survey of machine unlearning. arXiv:2209.02299. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2209.02299"},{"key":"e_1_3_2_39_2","doi-asserted-by":"crossref","unstructured":"Thanh Toan Nguyen Quoc Viet Hung Nguyen Thanh Tam Nguyen Thanh Trung Huynh Thanh Thi Nguyen Matthias Weidlich and Hongzhi Yin. 2024. Manipulating recommender systems: A survey of poisoning attacks and countermeasures. arXiv:2404.14942. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2404.14942","DOI":"10.1145\/3677328"},{"key":"e_1_3_2_40_2","first-page":"8026","article-title":"Pytorch: An imperative style, high-performance deep learning library","volume":"32","author":"Paszke Adam","year":"2019","unstructured":"Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas K\u00f6pf, Edward Yang, Zach DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. 2019. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems 32, 8026\u20138037.","journal-title":"Advances in neural information processing systems"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3358010"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1145\/3397271.3401109"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583337"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467334"},{"key":"e_1_3_2_45_2","unstructured":"Steffen Rendle Christoph Freudenthaler Zeno Gantner and Lars Schmidt-Thieme. 2012. BPR: Bayesian personalized ranking from implicit feedback. arXiv:1205.2618. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1205.2618"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/564376.564421"},{"key":"e_1_3_2_48_2","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1409.1556"},{"key":"e_1_3_2_49_2","first-page":"2256","volume-title":"International Conference on Machine Learning","author":"Sohl-Dickstein Jascha","year":"2015","unstructured":"Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. 2015. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning. PMLR, 2256\u20132265."},{"key":"e_1_3_2_50_2","unstructured":"Yang Song Taesup Kim Sebastian Nowozin Stefano Ermon and Nate Kushman. 2017. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv:1710.10766. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1710.10766"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2019.2893638"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.527"},{"key":"e_1_3_2_53_2","doi-asserted-by":"crossref","unstructured":"Wenjie Wang Yiyan Xu Fuli Feng Xinyu Lin Xiangnan He and Tat-Seng Chua. 2023. Diffusion recommender model. arXiv:2304.04971. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2304.04971","DOI":"10.1145\/3539618.3591663"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/3477495.3532058"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","unstructured":"Weilin Xu David Evans and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv:1704.01155. DOI: 10.14722\/ndss.2018.23198","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/3626235"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1145\/2733373.2806339"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/2629461"},{"key":"e_1_3_2_59_2","unstructured":"Hongzhi Yin Liang Qu Tong Chen Wei Yuan Ruiqi Zheng Jing Long Xin Xia Yuhui Shi and Chengqi Zhang. 2024. On-device recommender systems: A comprehensive survey. arXiv:2401.11441. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2401.11441"},{"key":"e_1_3_2_60_2","unstructured":"Minglei Yin Bin Liu Neil Zhenqiang Gong and Xin Li. 2023. Securing visually-aware recommender systems: An adversarial image reconstruction and detection framework. arXiv:2306.07992. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2306.07992"},{"key":"e_1_3_2_61_2","doi-asserted-by":"crossref","unstructured":"Wei Yuan Quoc Viet Hung Nguyen Tieke He Liang Chen and Hongzhi Yin. 2023a. Manipulating federated recommender systems: poisoning with synthetic users and its countermeasures. arXiv:2304.03054. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2304.03054","DOI":"10.1145\/3539618.3591722"},{"key":"e_1_3_2_62_2","unstructured":"Wei Yuan Chaoqun Yang Liang Qu Guanhua Ye Quoc Viet Hung Nguyen and Hongzhi Yin. 2024. Robust federated contrastive recommender system against model poisoning attack. arXiv:2403.20107. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2403.20107"},{"issue":"3","key":"e_1_3_2_63_2","first-page":"64:1","article-title":"Manipulating visually-aware federated recommender systems and its countermeasures","volume":"42","author":"Yuan Wei","year":"2023","unstructured":"Wei Yuan, Shilong Yuan, Chaoqun Yang, Quoc Viet Hung Nguyen, and Hongzhi Yin. 2023b. Manipulating visually-aware federated recommender systems and its countermeasures. ACM Transactions on Information Systems 42, 3 (2023), 64:1\u201364:26.","journal-title":"ACM Transactions on Information Systems"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00443"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3092582"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449813"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/3488560.3498386"},{"issue":"2","key":"e_1_3_2_68_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3545796","article-title":"A revisiting study of appropriate offline evaluation for top-N recommendation algorithms","volume":"41","author":"Zhao Wayne Xin","year":"2022","unstructured":"Wayne Xin Zhao, Zihan Lin, Zhichao Feng, Pengfei Wang, and Ji-Rong Wen. 2022. A revisiting study of appropriate offline evaluation for top-N recommendation algorithms. ACM Transactions on Information Systems 41, 2 (2022), 1\u201341.","journal-title":"ACM Transactions on Information Systems"},{"key":"e_1_3_2_69_2","doi-asserted-by":"crossref","unstructured":"Ruiqi Zheng Liang Qu Tong Chen Kai Zheng Yuhui Shi and Hongzhi Yin. 2024. Poisoning decentralized collaborative recommender system and its countermeasures. arXiv:2404.01177. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2404.01177","DOI":"10.1145\/3626772.3657814"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1145\/3579355"}],"container-title":["ACM Transactions on Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3666088","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3666088","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:06Z","timestamp":1750295886000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3666088"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,8,19]]},"references-count":69,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2024,11,30]]}},"alternative-id":["10.1145\/3666088"],"URL":"https:\/\/doi.org\/10.1145\/3666088","relation":{},"ISSN":["1046-8188","1558-2868"],"issn-type":[{"value":"1046-8188","type":"print"},{"value":"1558-2868","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,8,19]]},"assertion":[{"value":"2023-12-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-05-22","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-08-19","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}