• Nawara D, Aly A and Kashef R. Shilling Attacks and Fake Reviews Injection: Principles, Models, and Datasets. IEEE Transactions on Computational Social Systems. 10.1109/TCSS.2024.3465008. 12:1. (362-375).

    https://ieeexplore.ieee.org/document/10716004/

  • Qian F, Cui Y, Xu M, Chen H, Chen W, Xu Q, Wu C, Yan Y and Zhao S. (2025). IFM: Integrating and fine-tuning adversarial examples of recommendation system under multiple models to enhance their transferability. Knowledge-Based Systems. 10.1016/j.knosys.2025.113111. (113111). Online publication date: 1-Feb-2025.

    https://linkinghub.elsevier.com/retrieve/pii/S0950705125001583

  • Wang S, Fan W, Wei X, Mei X, Lin S and Li Q. (2024). Multi-Agent Attacks for Black-Box Social Recommendations. ACM Transactions on Information Systems. 43:1. (1-26). Online publication date: 31-Jan-2025.

    https://doi.org/10.1145/3696105

  • Nguyen T, Quoc Viet hung N, Nguyen T, Huynh T, Nguyen T, Weidlich M and Yin H. (2024). Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures. ACM Computing Surveys. 57:1. (1-39). Online publication date: 31-Jan-2025.

    https://doi.org/10.1145/3677328

  • G M, S N, K S, Gantela P, Bandi S and Samineni N. (2024). Performance Analysis of Classifiers in the Detection of Injection Attacks by the Association of Graph-Based Method and Generic Detection Attributes 2024 IEEE 16th International Conference on Computational Intelligence and Communication Networks (CICN). 10.1109/CICN63059.2024.10847403. 979-8-3315-0526-4. (695-701).

    https://ieeexplore.ieee.org/document/10847403/

  • Qian F, Cui Y, Chen H, Chen W, Yan Y and Zhao S. ReOP: Generating Transferable Fake Users for Recommendation Systems via Reverse Optimization. IEEE Transactions on Computational Social Systems. 10.1109/TCSS.2024.3451452. 11:6. (7830-7845).

    https://ieeexplore.ieee.org/document/10681321/

  • Oh S, Ustun B, Mcauley J and Kumar S. (2024). FINEST: Stabilizing Recommendations by Rank-Preserving Fine-Tuning. ACM Transactions on Knowledge Discovery from Data. 18:9. (1-22). Online publication date: 30-Nov-2024.

    https://doi.org/10.1145/3695256

  • Hao Y, Wang H, Zhao Q, Feng L and Wang J. (2024). Detecting the adversarially-learned injection attacks via knowledge graphs. Information Systems. 10.1016/j.is.2024.102419. 125. (102419). Online publication date: 1-Nov-2024.

    https://linkinghub.elsevier.com/retrieve/pii/S0306437924000772

  • Yang S, Wang C, Xu X, Zhu L and Yao L. Attacking Visually-aware Recommender Systems with Transferable and Imperceptible Adversarial Styles. Proceedings of the 33rd ACM International Conference on Information and Knowledge Management. (2900-2909).

    https://doi.org/10.1145/3627673.3679828

  • Oh S, Verma G and Kumar S. Adversarial Text Rewriting for Text-aware Recommender Systems. Proceedings of the 33rd ACM International Conference on Information and Knowledge Management. (1804-1814).

    https://doi.org/10.1145/3627673.3679592

  • Wu Y, Cao Q, Tao S, Zhang K, Sun F and Shen H. Accelerating the Surrogate Retraining for Poisoning Attacks against Recommender Systems. Proceedings of the 18th ACM Conference on Recommender Systems. (701-711).

    https://doi.org/10.1145/3640457.3688148

  • Zhang K, Cao Q, Wu Y, Sun F, Shen H and Cheng X. Improving the Shortest Plank: Vulnerability-Aware Adversarial Training for Robust Recommender System. Proceedings of the 18th ACM Conference on Recommender Systems. (680-689).

    https://doi.org/10.1145/3640457.3688120

  • Zhang K, Cao Q, Wu Y, Sun F, Shen H and Cheng X. LoRec: Combating Poisons with Large Language Model for Robust Sequential Recommendation. Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval. (1733-1742).

    https://doi.org/10.1145/3626772.3657684

  • Duan M, Li K, Zhang W, Qin J and Xiao B. (2024). Attacking Click-through Rate Predictors via Generating Realistic Fake Samples. ACM Transactions on Knowledge Discovery from Data. 18:5. (1-24). Online publication date: 30-Jun-2024.

    https://doi.org/10.1145/3643685

  • Concone F, Gaglio S, Giammanco A, Re G and Morana M. (2024). AdverSPAM: Adversarial SPam Account Manipulation in Online Social Networks. ACM Transactions on Privacy and Security. 27:2. (1-31). Online publication date: 31-May-2024.

    https://doi.org/10.1145/3643563

  • Wang W, Wang C, Feng F, Shi W, Ding D and Chua T. Uplift Modeling for Target User Attacks on Recommender Systems. Proceedings of the ACM Web Conference 2024. (3343-3354).

    https://doi.org/10.1145/3589334.3645403

  • Lu Q and Gao M. A Research on Shilling Attacks Based on Variational graph auto-encoders for Improving the Robustness of Recommendation Systems. Proceedings of the 2024 International Conference on Generative Artificial Intelligence and Information Security. (120-126).

    https://doi.org/10.1145/3665348.3665370

  • Li Y, Liu K, Satapathy R, Wang S and Cambria E. (2024). Recent Developments in Recommender Systems: A Survey [Review Article]. IEEE Computational Intelligence Magazine. 19:2. (78-95). Online publication date: 1-May-2024.

    https://doi.org/10.1109/MCI.2024.3363984

  • Lin C, Chen S, Zeng M, Zhang S, Gao M and Li H. Shilling Black-Box Recommender Systems by Learning to Generate Fake User Profiles. IEEE Transactions on Neural Networks and Learning Systems. 10.1109/TNNLS.2022.3183210. 35:1. (1305-1319).

    https://ieeexplore.ieee.org/document/9806457/

  • Lai Y, Zhu Y, Fan W, Zhang X and Zhou K. Toward Adversarially Robust Recommendation From Adaptive Fraudster Detection. IEEE Transactions on Information Forensics and Security. 10.1109/TIFS.2023.3327876. 19. (907-919).

    https://ieeexplore.ieee.org/document/10296883/

  • Yao X, He R, Hu X, Yang J, Guo Y and Huang Z. (2023). Improving Adversarially Robust Sequential Recommendation through Generalizable Perturbations 2023 IEEE International Conference on Big Data (BigData). 10.1109/BigData59044.2023.10386799. 979-8-3503-2445-7. (1299-1307).

    https://ieeexplore.ieee.org/document/10386799/

  • Fan W, Zhao X, Li Q, Derr T, Ma Y, Liu H, Wang J and Tang J. Adversarial Attacks for Black-Box Recommender Systems via Copying Transferable Cross-Domain User Profiles. IEEE Transactions on Knowledge and Data Engineering. 10.1109/TKDE.2023.3272652. 35:12. (12415-12429).

    https://ieeexplore.ieee.org/document/10114977/

  • Pereira R, Bono J, Ascensão J, Aparício D, Ribeiro P and Bizarro P. The GANfather: Controllable generation of malicious activity to improve defence systems. Proceedings of the Fourth ACM International Conference on AI in Finance. (133-140).

    https://doi.org/10.1145/3604237.3626882

  • Wang Q, Wu C, Lian D and Chen E. (2023). Securing recommender system via cooperative training. World Wide Web. 10.1007/s11280-023-01214-7. 26:6. (3915-3943). Online publication date: 1-Nov-2023.

    https://link.springer.com/10.1007/s11280-023-01214-7

  • Shang Y, Gao C, Chen J, Jin D, Ma H and Li Y. Enhancing Adversarial Robustness of Multi-modal Recommendation via Modality Balancing. Proceedings of the 31st ACM International Conference on Multimedia. (6274-6282).

    https://doi.org/10.1145/3581783.3612337

  • Guo S, Bai T and Deng W. Targeted Shilling Attacks on GNN-based Recommender Systems. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. (649-658).

    https://doi.org/10.1145/3583780.3615073

  • Qian F, Yuan B, Chen H, Chen J, Lian D and Zhao S. Enhancing the Transferability of Adversarial Examples Based on Nesterov Momentum for Recommendation Systems. IEEE Transactions on Big Data. 10.1109/TBDATA.2023.3248626. 9:5. (1276-1287).

    https://ieeexplore.ieee.org/document/10052726/

  • WANG C, Ye J, Wang W, Gao C, Feng F and He X. RecAD: Towards A Unified Library for Recommender Attack and Defense. Proceedings of the 17th ACM Conference on Recommender Systems. (234-244).

    https://doi.org/10.1145/3604915.3609490

  • Jia J, Liu Y, Hu Y and Gong N. PORE. Proceedings of the 32nd USENIX Conference on Security Symposium. (1703-1720).

    /doi/10.5555/3620237.3620333

  • Nguyen Thanh T, Quach N, Nguyen T, Huynh T, Vu V, Nguyen P, Jo J and Nguyen Q. (2023). Poisoning GNN-based Recommender Systems with Generative Surrogate-based Attacks. ACM Transactions on Information Systems. 41:3. (1-24). Online publication date: 31-Jul-2023.

    https://doi.org/10.1145/3567420

  • Chen Z, Silvestri F, Wang J, Zhang Y and Tolomei G. The Dark Side of Explanations: Poisoning Recommender Systems with Counterfactual Examples. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval. (2426-2430).

    https://doi.org/10.1145/3539618.3592070

  • Wang Y, Liu Y, Wang Q, Wang C and Li C. Poisoning Self-supervised Learning Based Sequential Recommendations. Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval. (300-310).

    https://doi.org/10.1145/3539618.3591751

  • Yeh C, Chen H, Yang D, Lee W, Yu P and Chen M. (2023). Planning Data Poisoning Attacks on Heterogeneous Recommender Systems in a Multiplayer Setting 2023 IEEE 39th International Conference on Data Engineering (ICDE). 10.1109/ICDE55515.2023.00193. 979-8-3503-2227-9. (2510-2523).

    https://ieeexplore.ieee.org/document/10184597/

  • Zeng M, Li K, Jiang B, Cao L and Li H. Practical cross-system shilling attacks with limited access to data. Proceedings of the Thirty-Seventh AAAI Conference on Artificial Intelligence and Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence and Thirteenth Symposium on Educational Advances in Artificial Intelligence. (4864-4874).

    https://doi.org/10.1609/aaai.v37i4.25612

  • Wu C, Lian D, Ge Y, Zhu Z and Chen E. Influence-Driven Data Poisoning for Robust Recommender Systems. IEEE Transactions on Pattern Analysis and Machine Intelligence. 10.1109/TPAMI.2023.3274759. (1-17).

    https://ieeexplore.ieee.org/document/10122715/

  • Cai H, Wang S, Zhang Y, Zhang M and Zhao A. (2023). A Poisoning Attack Based on Variant Generative Adversarial Networks in Recommender Systems. Advanced Data Mining and Applications. 10.1007/978-3-031-46674-8_26. (371-386).

    https://link.springer.com/10.1007/978-3-031-46674-8_26

  • Entezari N and Papalexakis E. (2022). Low-rank Defenses Against Adversarial Attacks in Recommender Systems 2022 IEEE International Conference on Big Data (Big Data). 10.1109/BigData55660.2022.10020712. 978-1-6654-8045-1. (5708-5714).

    https://ieeexplore.ieee.org/document/10020712/

  • Chen J, Fan W, Zhu G, Zhao X, Yuan C, Li Q and Huang Y. Knowledge-enhanced Black-box Attacks for Recommendations. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. (108-117).

    https://doi.org/10.1145/3534678.3539359

  • Wu C, Wu F, Qi T, Huang Y and Xie X. (2022). FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling KDD '22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 10.1145/3534678.3539119. 9781450393850. (4164-4172). Online publication date: 14-Aug-2022.

    https://dl.acm.org/doi/10.1145/3534678.3539119

  • Wu Z, Chen C and Huang S. (2021). Poisoning attacks against knowledge graph-based recommendation systems using deep reinforcement learning. Neural Computing and Applications. 34:4. (3097-3115). Online publication date: 1-Feb-2022.

    https://doi.org/10.1007/s00521-021-06573-8

  • Wang Q, Lian D, Wu C and Chen E. (2022). Towards Robust Recommender Systems via Triple Cooperative Defense. Web Information Systems Engineering – WISE 2022. 10.1007/978-3-031-20891-1_40. (564-578).

    https://link.springer.com/10.1007/978-3-031-20891-1_40

  • Anelli V, Deldjoo Y, DiNoia T and Merra F. (2022). Adversarial Recommender Systems: Attack, Defense, and Advances. Recommender Systems Handbook. 10.1007/978-1-0716-2197-4_9. (335-379).

    https://link.springer.com/10.1007/978-1-0716-2197-4_9

  • Zhang H, Tian C, Li Y, Su L, Yang N, Zhao W and Gao J. Data Poisoning Attack against Recommender System Using Incomplete and Perturbed Data. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. (2154-2164).

    https://doi.org/10.1145/3447548.3467233

  • Liu Z and Larson M. Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start. Proceedings of the Web Conference 2021. (3590-3602).

    https://doi.org/10.1145/3442381.3449891

  • Wang H, Zhong J and Tak U K. (2020). Matryoshka Attack: Research On An Attack Method Of Recommender System Based On Adversarial Learning And Optimization Solution 2020 International Conference on Wavelet Analysis and Pattern Recognition (ICWAPR). 10.1109/ICWAPR51924.2020.9494616. 978-1-7281-9985-6. (102-109).

    https://ieeexplore.ieee.org/document/9494616/