Preventing the Popular Item Embedding Based Attack in Federated Recommendations

Privacy concerns have led to the rise of federated recommender systems (FRS), which can create personalized models across distributed clients. However, FRS is vulnerable to poisoning attacks, where malicious users manipulate gradients to promote their target items intentionally. Existing attacks against FRS have limitations, as they depend on specific models and prior knowledge, restricting their real-world applicability. In our exploration of practical FRS vulnerabilities, we devise a model-agnostic and prior-knowledge-free attack, named PIECK (Popular Item Embedding based Attack). The core module of PIECK is popular item mining, which leverages embedding changes during FRS training to effectively identify the popular items. Built upon the core module, PIECK branches into two diverse solutions: The PIECKIPE solution employs an item popularity enhancement module, which aligns the embeddings of targeted items with the mined popular items to increase item exposure. The PIECKUEA further enhances the robustness of the attack by using a user embedding approximation module, which approximates private user embeddings using mined popular items. Upon identifying PIECK, we evaluate existing federated defense methods and find them ineffective against PIECK, as poisonous gradients inevitably overwhelm the cold target items. We then propose a novel defense method by introducing two regularization terms during user training, which constrain item popularity enhancement and user embedding approximation while preserving FRS performance. We evaluate PIECK and its defense across two base models, three real datasets, four top-tier attacks, and six general defense methods, affirming the efficacy of both PIECK and its defense.

I. Introduction

Growing concerns about privacy protection have sparked the advent of federated recommendation as a novel paradigm for creating personalized recommender models across distributed clients [22], [25], [26], [33]. In Federal Recommendation Systems (FRS), the model is bifurcated: the non-shareable client component, housing the user's embedding¹

A term used synonymously with 'embedding vectors' in this paper.

, a.k.a. sensitive personalized data; and the shareable component interchanges the public items' embeddings with the server, along with an interaction function designed to predict user-item pairs. Nevertheless, FRS remains susceptible to targeted poisoning attacks [30], [31], [41], which use malicious clients to poison the shared model by uploading manipulated gradients. These attacks aim to boost the exposure of selected items in users' recommendation lists. Although these tactics may seem neg-ligible due to the minor impact on model performance, they inflict more harm on users than those untargeted attacks (only aiming for performance degradation) [4], [10], [18]. Fig. 1:

Targeted model poisoning attacks against FRS.