{"id":2408,"url":"https://github.com/EdisonLeeeee/RS-Adversarial-Learning","name":"RS-Adversarial-Learning","description":"A curated collection of adversarial attack and defense on recommender systems.","projects_count":90,"last_synced_at":"2026-08-11T13:00:27.760Z","repository":{"id":40808472,"uuid":"280644245","full_name":"EdisonLeeeee/RS-Adversarial-Learning","owner":"EdisonLeeeee","description":"A curated collection of adversarial attack and defense on recommender systems.","archived":false,"fork":false,"pushed_at":"2022-04-29T02:22:29.000Z","size":64,"stargazers_count":137,"open_issues_count":0,"forks_count":8,"subscribers_count":2,"default_branch":"master","last_synced_at":"2026-07-23T04:02:34.537Z","etag":null,"topics":["adversarial-attacks","adversarial-machine-learning","awesome","recommender-system"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EdisonLeeeee.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-07-18T11:40:31.000Z","updated_at":"2026-03-24T18:04:29.000Z","dependencies_parsed_at":"2022-08-23T07:41:46.493Z","dependency_job_id":null,"html_url":"https://github.com/EdisonLeeeee/RS-Adversarial-Learning","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/EdisonLeeeee/RS-Adversarial-Learning","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EdisonLeeeee%2FRS-Adversarial-Learning","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EdisonLeeeee%2FRS-Adversarial-Learning/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EdisonLeeeee%2FRS-Adversarial-Learning/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EdisonLeeeee%2FRS-Adversarial-Learning/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EdisonLeeeee","download_url":"https://codeload.github.com/EdisonLeeeee/RS-Adversarial-Learning/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EdisonLeeeee%2FRS-Adversarial-Learning/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36521296,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-06T04:43:03.162Z","status":"online","status_checked_at":"2026-08-11T02:00:06.871Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-04T20:09:31.377Z","updated_at":"2026-08-11T13:00:27.760Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["2020","2016","2022","2021","2019","2018","2017"],"sub_categories":[],"readme":"\r\n# Awesome Adversarial Learning on Recommender System (Updating)\r\n[![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome)\r\n[![Contributions Welcome](https://img.shields.io/badge/Contributions-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)\r\n![](https://img.shields.io/github/license/EdisonLeeeee/RS-Adversarial-Learning)\r\n\r\n### 👉 Table of Contents 👈\r\n- [Attack](#attack)\r\n\t- [2022](#2022)\r\n\t- [2021](#2021)\r\n\t- [2020](#2020)\r\n\t- [2019](#2019)\r\n\t- [2018](#2018)\r\n\t- [2017](#2017)\r\n\t- [2016](#2016)\r\n- [Defense](#defense)\r\n\t- [2021](#2021-1)\r\n\t- [2020](#2020-1)\r\n\t- [2019](#2019-1)\r\n\t- [2018](#2018-1)\r\n\t- [2017](#2017-1)\r\n\t- [2016](#2016-1)\r\n- [Survey](#survey)\r\n- [Resource](#resource)\r\n- [Slides](#slides)\r\n\r\n\r\n# Attack\r\n\r\n## 2022\r\n+ **PipAttack: Poisoning Federated Recommender Systems for Manipulating Item Promotion**, *WSDM*,  [📝Paper](https://arxiv.org/abs/2110.10926)\r\n+ **Targeted Data Poisoning Attack on News Recommendation System**， *Arxiv*, [📝Paper](https://arxiv.org/abs/2203.03560)\r\n+ **FedRecAttack: Model Poisoning Attack to Federated Recommendation**, *ICDE*, [📝Paper](https://arxiv.org/abs/2204.01499), [:octocat:Code](https://github.com/rdz98/FedRecAttack)\r\n+ **Poisoning Deep Learning based Recommender Model in Federated Learning Scenarios**, *IJCAI*, [📝Paper](https://arxiv.org/abs/2204.13594)\r\n\r\n## 2021\r\n+ **A Black-Box Attack Model for Visually-Aware Recommender Systems**, *WSDM*, [📝Paper](https://arxiv.org/abs/2011.02701)\r\n+ **Ready for Emerging Threats to Recommender Systems? A Graph Convolution-based Generative Shilling Attack**, *Information Sciences*, [📝Paper](https://arxiv.org/abs/2107.10457)\r\n+ **Data Poisoning Attack against Recommender System Using Incomplete and Perturbed Data**, *KDD*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3447548.3467233)\r\n+ **Triple Adversarial Learning for Influence based Poisoning Attack in Recommender Systems**, *KDD*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3447548.3467335)\r\n+ **Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction**, *RecSys*,  [📝Paper](https://arxiv.org/abs/2109.01165)\r\n+ **Membership Inference Attacks Against Recommender Systems**, *Arxiv*,  [📝Paper](https://arxiv.org/abs/2109.08045)\r\n\r\n\r\n## 2020\r\n+ **Data Poisoning Attacks on Neighborhood-based Recommender Systems**, *ETT*, [📝Paper](https://arxiv.org/abs/1912.04109)\r\n+ **Attacking Black-box Recommendations via Copying Cross-domain User Profiles**, *Arxiv*, [📝Paper](https://arxiv.org/abs/2005.08147)\r\n+ **Adversarial Attacks and Detection on Reinforcement Learning-Based Interactive Recommender Systems**, *SIGIR*, [📝Paper](https://arxiv.org/abs/2006.07934)\r\n+ **Adversarial Attacks on Linear Contextual Bandits**, *Arxiv*, [📝Paper](https://arxiv.org/pdf/2002.03839)\r\n+ **Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start**, *Arxiv*, [📝Paper](https://arxiv.org/abs/2006.01888), [:octocat:Code](https://github.com/liuzrcc/AIP)\r\n+ **Influence Function based Data Poisoning Attacks to Top-N Recommender Systems**, *WWW*, [📝Paper](https://arxiv.org/abs/2002.08025)\r\n+ **TAaMR: Targeted Adversarial Attack against Multimedia Recommender Systems**, *Dependable and Secure Machine Learning (DSML)*, [📝Paper](http://sisinflab.poliba.it/publications/2020/DMM20/PID6442119.pdf), [:octocat:Code](https://github.com/sisinflab/TAaMR)\r\n+ **Adversarial Attacks on Time Series**, *IEEE Transactions on Pattern Analysis and Machine Intelligence*, [📝Paper](https://ieeexplore.ieee.org/abstract/document/9063523)\r\n+ **Attacking Recommender Systems with Augmented User Profiles**, *Arxiv*, [📝Paper](https://arxiv.org/abs/2005.08164)\r\n+ **Practical Data Poisoning Attack against Next-Item Recommendation**, *WWW*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3366423.3379992)\r\n+ **PoisonRec: An Adaptive Data Poisoning Framework for Attacking Black-box Recommender Systems**, *ICDE*, [📝Paper](https://ieeexplore.ieee.org/abstract/document/9101655)\r\n+ **Data Poisoning Attacks against Differentially Private Recommender Systems**, *SIGIR*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3397271.3401301)\r\n+ **Revisiting Adversarially Learned Injection Attacks Against Recommender Systems**, *RecSys*,  [📝Paper](https://arxiv.org/abs/2008.04876)\r\n\r\n\r\n\r\n\r\n\r\n## 2019\r\n+ **Adversarial Attacks on an Oblivious Recommender**, *RecSys*, [📝Paper](https://dl.acm.org/doi/10.1145/3298689.3347031)\r\n+ **Targeted Poisoning Attacks on Social Recommender Systems**, *IEEE Global Communications Conference (GLOBECOM)*, [📝Paper](https://ieeexplore.ieee.org/document/9013539)\r\n+ **Data Poisoning Attacks on Graph Convolutional Matrix Completion**，*International Conference on Algorithms and Architectures for Parallel Processing*,  [📝Paper](https://link.springer.com/chapter/10.1007/978-3-030-38961-1_38)\r\n+ **Data Poisoning Attacks on Stochastic Bandits**, *ICML*,  [📝Paper](https://arxiv.org/abs/1905.06494)\r\n+ **Data Poisoning Attacks on Cross-domain Recommendation**, *CIKM*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3357384.3358116)\r\n+ **Assessing the Impact of a User-Item Collaborative Attack on Class of Users**, *RecSys Workshop*, 📝[Paper](https://arxiv.org/abs/1908.07968)\r\n\r\n\r\n\r\n\r\n## 2018\r\n+ **Poisoning attacks to graph-based recommender systems**, *Annual Computer Security Applications Conference (ACSAC)*, [📝Paper](https://arxiv.org/abs/1809.04127), [:octocat:Code](https://github.com/alanefl/graph-based-recommender-attacks)\r\n\r\n\r\n\r\n## 2017\r\n+ **Fake Co-visitation Injection Attacks to Recommender Systems**, *NDSS*, [📝Paper](http://people.duke.edu/~zg70/papers/ndss17-attackRS.pdf)\r\n+ **Hybrid attacks on model-based social recommender systems**, *Physica A: Statistical Mechanics and its Applications*, [📝Paper](https://www.sciencedirect.com/science/article/abs/pii/S0378437117303436)\r\n\r\n## 2016\r\n+ **Data Poisoning Attacks on Factorization-Based Collaborative Filtering**, *NIPS*, [📝Paper](https://arxiv.org/abs/1608.08182), [:octocat:Code](https://github.com/fuying-wang/Data-poisoning-attacks-on-factorization-based-collaborative-filtering)\r\n+ **Segment-Focused Shilling Attacks against Recommendation Algorithms in Binary Ratings-based Recommender Systems**, *International Journal of Hybrid Information Technology*, [📝Paper](https://www.semanticscholar.org/paper/Segment-Focused-Shilling-Attacks-against-Algorithms-Zhang/5c7e96dcaf253f37904f91fdb6fdd6f486dba134)\r\n+ **Shilling attack models in recommender system**, *International Conference on Inventive Computation Technologies (ICICT)*, [📝Paper](https://ieeexplore.ieee.org/document/7824865)\r\n\r\n\r\n\r\n# Defense\r\n\r\n## 2021\r\n\r\n+ **Graph Embedding for Recommendation against Attribute Inference Attacks**, *WWW*,  [📝Paper](https://arxiv.org/pdf/2101.12549.pdf)\r\n+ **Understanding the Effects of Adversarial Personalized Ranking Optimization Method on Recommendation Quality**, *Arxiv*, 📝[Paper](https://arxiv.org/abs/2107.13876)\r\n\r\n## 2020\r\n+ **GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection**, *Arxiv*,  [📝Paper](https://arxiv.org/abs/2005.10150)\r\n+ **On Detecting Data Pollution Attacks On Recommender Systems Using Sequential GANs**, *ICML*,  [📝Paper](https://arxiv.org/abs/2012.02509)\r\n+ **A Robust Hierarchical Graph Convolutional Network Model for Collaborative Filtering**, *Arxiv*, [📝Paper](https://arxiv.org/abs/2004.14734)\r\n+ **Adversarial Collaborative Auto-encoder for Top-N Recommendation**, *Arxiv*, [📝Paper](https://arxiv.org/abs/1808.05361)\r\n+ **Adversarial Attacks and Detection on Reinforcement Learning-Based Interactive Recommender Systems**, *Arxiv*, [📝Paper](https://arxiv.org/abs/2006.07934)\r\n+ **Adversarial Learning to Compare: Self-Attentive Prospective Customer Recommendation in Location based Social Networks**, *WSDM*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3336191.3371841)\r\n+ **Certifiable Robustness to Discrete Adversarial Perturbations for Factorization Machines**, *SIGIR*, [📝Paper](http://jiyang3.web.engr.illinois.edu/files/fm-rt.pdf)\r\n+ **Directional Adversarial Training for Recommender Systems**, *ECAI*, [📝Paper](http://ecai2020.eu/papers/300_paper.pdf)\r\n+ **Shilling Attack Detection Scheme in Collaborative Filtering Recommendation System Based on Recurrent Neural Network**, *Future of Information and Communication Conference*, [📝Paper](https://link.springer.com/chapter/10.1007/978-3-030-39445-5_46)\r\n+ **Learning Product Rankings Robust to Fake Users**， *Arxiv*, [📝Paper](https://arxiv.org/abs/2009.05138)\r\n+ **Privacy-Aware Recommendation with Private-Attribute Protection using Adversarial Learning**, *WSDM*, [📝Paper](https://arxiv.org/abs/1911.09872)\r\n+ **Quick and accurate attack detection in recommender systems through user attributes**, *RecSys*,  [📝Paper](https://dl.acm.org/doi/10.1145/3298689.3347050)\r\n+ **Global and Local Differential Privacy for Collaborative Bandits**, *RecSys*,  [📝Paper](https://dl.acm.org/doi/pdf/10.1145/3383313.3412254)\r\n+ **Towards Safety and Sustainability: Designing Local Recommendations for Post-pandemic World**, *RecSys*,  [📝Paper](https://dl.acm.org/doi/pdf/10.1145/3383313.3412251)\r\n+ **GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection**, *RecSys*,  [📝Paper](https://dl.acm.org/doi/abs/10.1145/3397271.3401165)\r\n\r\n\r\n\r\n\r\n## 2019\r\n+ **Adversarial Training Towards Robust Multimedia Recommender System**, *TKDE*, [📝Paper](https://graphreason.github.io/papers/35.pdf), [:octocat:Code](https://github.com/duxy-me/AMR)\r\n+ **Adversarial Collaborative Neural Network for Robust Recommendation**, *SIGIR*, [📝Paper](https://www.researchgate.net/publication/332861957_Adversarial_Collaborative_Neural_Network_for_Robust_Recommendation)\r\n+ **Adversarial Mahalanobis Distance-based Attentive Song Recommender for Automatic Playlist Continuation**, *SIGIR*, [📝Paper](http://web.cs.wpi.edu/~kmlee/pubs/tran19sigir.pdf), [:octocat:Code](https://github.com/thanhdtran/MASR)\r\n+ **Adversarial tensor factorization for context-aware recommendation**, *RecSys*, [📝Paper](https://dl.acm.org/doi/10.1145/3298689.3346987), [:octocat:Code]\r\n+ **Adversarial Training-Based Mean Bayesian Personalized Ranking for Recommender System**, *IEEE Access*, [📝Paper](https://ieeexplore.ieee.org/document/8946325)\r\n+ **Securing the Deep Fraud Detector in Large-Scale E-Commerce Platform via Adversarial Machine Learning Approach**，*WWW*, [📝Paper](https://www.ntu.edu.sg/home/boan/papers/WWW19.pdf)\r\n+ **Shilling Attack Detection in Recommender System Using PCA and SVM**, *Emerging technologies in data mining and information security*, [📝Paper](https://link.springer.com/chapter/10.1007/978-981-13-1498-8_55)\r\n\r\n\r\n\r\n\r\n## 2018\r\n+ **Adversarial Personalized Ranking for Recommendation**, *SIGIR*, [📝Paper](https://dl.acm.org/citation.cfm?id=3209981),  [:octocat:Code](https://github.com/hexiangnan/adversarial_personalized_ranking)\r\n+ **A shilling attack detector based on convolutional neural network for collaborative recommender system in social aware network**, *The Computer Journal*, [📝Paper](https://academic.oup.com/comjnl/article-abstract/61/7/949/4835634)\r\n+ **Adversarial Sampling and Training for Semi-Supervised Information Retrieval**, *WWW*, [📝Paper](https://arxiv.org/abs/1506.05752)\r\n+ **Enhancing the Robustness of Neural Collaborative Filtering Systems Under Malicious Attacks**, *IEEE Transactions on Multimedia*, [📝Paper](https://ieeexplore.ieee.org/document/8576563)\r\n+ **An Obfuscated Attack Detection Approach for Collaborative Recommender Systems**, *Journal of computing and information technology*,  [📝Paper](https://hrcak.srce.hr/203982)\r\n\r\n\r\n## 2017\r\n+ **Detecting Abnormal Profiles in Collaborative Filtering Recommender Systems**, *Journal of Intelligent Information Systems*, [📝Paper](https://link.springer.com/article/10.1007/s10844-016-0424-5)\r\n+ **Detection of Profile Injection Attacks in Social Recommender Systems Using Outlier Analysis**, *IEEE Big Data*, [📝Paper](http://www.cs.ucf.edu/~anahita/08258235.pdf)\r\n+ **Prevention of shilling attack in recommender systems using discrete wavelet transform and support vector machine**, *Eighth International Conference on Advanced Computing (ICoAC)*, [📝Paper](https://ieeexplore.ieee.org/document/7951753)\r\n\r\n## 2016\r\n+ **Discovering shilling groups in a real e-commerce platform**, *Online Information Review*, [📝Paper](https://www.emerald.com/insight/content/doi/10.1108/OIR-03-2015-0073/full/html)\r\n+ **Shilling attack detection in collaborative filtering recommender system by PCA detection and perturbation**, *International Conference on Wavelet Analysis and Pattern Recognition (ICWAPR)*, [📝Paper](https://ieeexplore.ieee.org/document/7731644)\r\n+ **Re-scale AdaBoost for attack detection in collaborative filtering recommender systems**, *KBS*, [📝Paper](https://www.sciencedirect.com/science/article/pii/S0950705116000861)\r\n+ **SVM-TIA a shilling attack detection method based on SVM and target item analysis in recommender systems**, *Neurocomputing*, [📝Paper](https://www.sciencedirect.com/science/article/abs/pii/S0925231216306038)\r\n\r\n\r\n# Survey\r\n\r\n+ **A Survey on Adversarial Recommender Systems: From Attack/Defense Strategies to Generative Adversarial Networks**, *ACM Computing Surveys (CSUR) 2021*, [📝Paper](https://dl.acm.org/doi/abs/10.1145/3439729)\r\n+ **Adversarial Machine Learning in Recommender Systems: State of the art and Challenges**, *Arxiv2020*, [📝Paper](https://arxiv.org/abs/2005.10322)\r\n+ **A Survey of Adversarial Learning on Graphs**, *Arxiv2020*, [📝Paper](https://arxiv.org/abs/2003.05730)\r\n+ **Adversarial Attacks and Defenses on Graphs: A Review and Empirical Study**, *Arxiv2020*, [📝Paper](https://arxiv.org/abs/2003.00653)\r\n+ **Shilling attacks against collaborative recommender systems: a review**,  *Artificial Intelligence Review*, [📝Paper](https://link.springer.com/article/10.1007/s10462-018-9655-x)\r\n+ **Adversarial Attacks and Defenses in Images, Graphs and Text: A Review**, *Arxiv2019*, [📝Paper](https://arxiv.org/abs/1909.08072)\r\n+ **A Survey of Attacks in Collaborative Recommender Systems**, *Journal of Computational and Theoretical Nanoscience 2019*, [📝Paper](https://www.ingentaconnect.com/content/asp/jctn/2019/00000016/f0020005/art00029)\r\n+ **Adversarial Attack and Defense on Graph Data: A Survey**, *Arxiv2018*, [📝Paper](https://arxiv.org/abs/1812.10528)\r\n+ **Adversarial Machine Learning: The Case of Recommendation Systems**, *IEEE 19th International Workshop on Signal Processing Advances in Wireless Communications (SPAWC)*, [📝Paper](https://ieeexplore.ieee.org/abstract/document/8445767)\r\n+ **Recommender Systems: Attack Types and Strategies**, *AAAI*2005, 📝[Paper](https://www.aaai.org/Papers/AAAI/2005/AAAI05-053.pdf)\r\n+ **A Review of Attacks and Its Detection Attributes on Collaborative Recommender Systems**, *IJARCS2017*, 📝[Paper](http://www.ijarcs.info/index.php/Ijarcs/article/download/4550/4100)\r\n\r\n\r\n# Resource\r\n\r\n+ **Awesome Graph Adversarial Learning** [:octocat:Link](https://github.com/gitgiter/Graph-Adversarial-Learning)\r\n+ **Awesome Graph Attack and Defense Papers** [:octocat:Link](https://github.com/ChandlerBang/awesome-graph-attack-papers)\r\n+ **Graph Adversarial Learning Literature** [:octocat:Link](https://github.com/safe-graph/graph-adversarial-learning-literature)\r\n+ **A Complete List of All (arXiv) Adversarial Example Papers** [🌐Link](https://nicholas.carlini.com/writing/2019/all-adversarial-example-papers.html)\r\n+ **Robust Matrix Completion via Robust Gradient Descent** 🌐[Link](https://www.andrew.cmu.edu/user/andrewsi/)\r\n+ **Adversarial Machine Learning in Recommender Systems:Literature Review and Future Visions **  [:octocat:Link](https://github.com/sisinflab/adversarial-recommender-systems-survey)\r\n\r\n# Slides\r\n\r\n+ **UCI Lecture** 🌐[Link](https://www.math.uci.edu/~icamp/courses/math77b/lecture_12w/)\r\n+ **RecSys2020 Tutorial**  [:octocat:Link](https://github.com/sisinflab/amlrecsys-tutorial)\r\n\r\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/edisonleeeee%2Frs-adversarial-learning/projects"}