🤖 machine learning

Sharpness-Aware Poisoning: Enhancing Transferability of Injective Attacks on Recommender Systems

To enhance the transferability of injective attacks on recommender systems, this paper proposes **Sharpness-Aware Poisoning (SharpAP)**, a method that utilizes sharpness-aware minimization to optimize poisoned data against an approximately worst-case victim model, thereby mitigating overfitting to surrogate models and improving attack success across diverse model architectures.

Original authors: Junsong Xie, Yonghui Yang, Pengyang Shao, Le Wu

Published 2026-04-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Junsong Xie, Yonghui Yang, Pengyang Shao, Le Wu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The "Master Mimic" Problem: How to Trick a System You’ve Never Seen

Imagine you are a professional prankster trying to trick a high-tech security system into letting you into a VIP club. The problem? You don’t know exactly which security system the club uses. One club might use a fingerprint scanner, another uses facial recognition, and a third uses a voice sensor.

Most pranksters (the "attackers" in this paper) pick one system they know well—let's say a fingerprint scanner—and spend all their time practicing how to trick that specific one. They become masters at faking a fingerprint. But the moment they walk into a club that uses facial recognition, their "fake fingerprint" is useless. They failed because they practiced too hard for one specific lock and didn't prepare for the idea of a lock.

In the world of Recommender Systems (like the algorithms that suggest movies on Netflix or products on Amazon), this is called a Transferability Problem.

The Paper’s Discovery: The "Overfitting" Trap

The researchers found that current "poisoning attacks" (where bad actors create fake user profiles to make certain items look popular) are too "narrow-minded."

If an attacker uses a "Surrogate Model" (a practice dummy) to design their fake profiles, they end up creating profiles that are perfect for that dummy but terrible for the real system. They have "overfitted" to the practice dummy. It’s like studying only one specific math textbook for a final exam; if the teacher changes the wording of the questions, you're stuck.

The Solution: SharpAP (The "Worst-Case Scenario" Trainer)

The authors proposed a new method called SharpAP (Sharpness-Aware Poisoning). Instead of practicing against a single, easy-to-please dummy, SharpAP uses a much smarter training method.

The Analogy: The "Grumpy Judge" Method
Imagine you are practicing a speech.

The Old Way: You practice in front of a friend who smiles and nods at everything you say. You become very good at making that friend happy, but you haven't actually improved your speech.
The SharpAP Way: You practice in front of a "Grumpy Judge." This judge is designed to find every tiny flaw in your speech. Every time you think you’ve done well, the judge says, "What if I were even harder to please? What if I hated your tone even more?"

By constantly trying to satisfy the "worst-case version" of the judge, you are forced to make your speech incredibly robust, clear, and powerful. If you can satisfy the grumpiest, most difficult version of the judge, you will easily impress any regular person who walks into the room later.

How it Works (The "Tri-Level" Trick)

In technical terms, they turned a two-step process into a three-step "tri-level" optimization:

The Mimic: First, they train a model to act like a normal user.
The Grump (The New Part): They intentionally "shake" or "perturb" that model to find its weakest, most difficult point (the "sharpness"). They look for the version of the model that is hardest to trick.
The Masterpiece: They design the fake user profiles specifically to work against that "Grumpy" version.

Why Does This Matter?

The researchers tested this on real-world data (like movie and book datasets) and found that SharpAP is a much better "universal key."

Because the fake profiles were designed to work against a "worst-case" scenario, they "transferred" much better to different types of recommendation systems. Whether the system was a simple math-based model or a complex AI-driven graph model, the SharpAP profiles still managed to trick them.

In short: Instead of practicing to beat one specific lock, SharpAP teaches the attacker how to beat the very concept of a lock.

Technical Summary: Sharpness-Aware Poisoning (SharpAP)

1. Problem Statement

Recommender Systems (RS) are vulnerable to injective attacks, where attackers register fake user profiles to manipulate the system into promoting specific "target items." In real-world "gray-box" scenarios, attackers do not know the exact architecture of the victim model (e.g., whether it uses Matrix Factorization, GCNs, or Ranking-based losses).

Current state-of-the-art gradient-based attacks rely on a fixed surrogate model to generate poisoned data. The authors identify a critical flaw in this approach: overfitting to the surrogate model. Because the surrogate model's structure differs from the actual victim model, the poisoned data often fails to transfer effectively, leading to a significant drop in attack success when the victim model changes.

2. Methodology

The paper proposes Sharpness-Aware Poisoning (SharpAP), a method designed to generate poisoned data that is robust to model structure shifts.

Core Intuition: Instead of optimizing against a single fixed surrogate model, the attack should optimize against the worst-case victim model (the model within a plausible parameter space that yields the lowest attack success).
Mathematical Formulation: The authors reformulate the attack from a standard bi-level optimization problem into a sharpness-aware min-max-min tri-level optimization problem:
1. Inner Min: Mimic the retraining process of the surrogate model on poisoned data.
2. Max (The Sharpness Step): Perform a bounded perturbation ( $\theta_\Delta$ ) on the surrogate model's parameters to find the "sharpest" or "worst-case" local region. This approximates the most difficult victim model the attacker might encounter.
3. Outer Min: Optimize the fake user profiles ( $R_f$ ) to minimize the attack loss specifically against this worst-case model.
Optimization Technique: To keep the computational cost low, the authors use a first-order Taylor expansion to approximate the maximization step, making the method nearly as efficient as existing gradient-based attacks.

3. Key Contributions

Identification of Overfitting: They are the first to formally point out that injective attacks suffer from overfitting to surrogate models due to structural discrepancies.
Novel Optimization Framework: They introduce the tri-level optimization framework using the Sharpness-Aware Minimization (SAM) principle, adapted for the discrete and complex nature of recommender systems.
Theoretical Guarantee: They provide a mathematical proof (via Lipschitz smoothness and Taylor expansion) showing that minimizing the loss against a worst-case perturbed model effectively minimizes the upper bound of the attack loss on any unseen victim model.
Seamless Integration: SharpAP is designed as a plug-and-play module that can be integrated into existing attacks (like RevAdv, RAPU, or DADA) to enhance their transferability.

4. Experimental Results

The method was evaluated on three real-world datasets (MovieLens-1M, Gowalla, and Amazon-book) against various victim models (WRMF, BPR, LightGCN, SGL, SimGCL).

Enhanced Transferability: SharpAP consistently outperformed all baseline attacks across all datasets. Notably, when applied to the RevAdv backbone, it significantly boosted performance on models like BPR and LightGCN, which previously saw diminished gains.
Versatility: The method proved effective for both full-user attacks (promoting items to everyone) and group attacks (targeting specific demographics, such as gender).
Robustness to Defenses: Even when victim models employed defense mechanisms (like PCA or PamaCF), SharpAP maintained higher attack success rates than standard methods.
Efficiency: The computational overhead is marginal (approximately 5% increase in running time), making it practical for real-world use.
Loss Landscape: Visualization confirmed that SharpAP produces a smoother loss landscape, meaning the attack remains effective even if the victim model's parameters deviate from the surrogate's.

5. Significance

This work shifts the paradigm of poisoning attacks in RS from "optimizing for a specific model" to "optimizing for model robustness/generalization." By treating attack transferability as a learning objective, SharpAP provides a more realistic and potent model of how adversarial entities might exploit black-box recommendation platforms. It highlights a critical security gap in current RS architectures and provides a theoretical foundation for understanding the limits of surrogate-based attacks.