Controllable and Stealthy Shilling Attacks via Dispersive Latent Diffusion
This work exposes a critical vulnerability in recommender systems, showing they are more susceptible to stealthy attacks than previously thought, which is significant for platform security but incremental in attack methodology.
The paper tackles the problem of shilling attacks on recommender systems by introducing DLDA, a diffusion-based framework that generates fake user profiles to strongly promote target items while evading detection, achieving superior promotion and stealth compared to prior attacks in experiments on three real-world datasets and five RS models.
Recommender systems (RSs) are now fundamental to various online platforms, but their dependence on user-contributed data leaves them vulnerable to shilling attacks that can manipulate item rankings by injecting fake users. Although widely studied, most existing attack models fail to meet two critical objectives simultaneously: achieving strong adversarial promotion of target items while maintaining realistic behavior to evade detection. As a result, the true severity of shilling threats that manage to reconcile the two objectives remains underappreciated. To expose this overlooked vulnerability, we present DLDA, a diffusion-based attack framework that can generate highly effective yet indistinguishable fake users by enabling fine-grained control over target promotion. Specifically, DLDA operates in a pre-aligned collaborative embedding space, where it employs a conditional latent diffusion process to iteratively synthesize fake user profiles with precise target item control. To evade detection, DLDA introduces a dispersive regularization mechanism that promotes variability and realism in generated behavioral patterns. Extensive experiments on three real-world datasets and five popular RS models demonstrate that, compared to prior attacks, DLDA consistently achieves stronger item promotion while remaining harder to detect. These results highlight that modern RSs are more vulnerable than previously recognized, underscoring the urgent need for more robust defenses.