💻 computer science

Fairness Attacks on Recommender Systems

This paper proposes a novel structure-aware reinforcement learning-based attack method that jointly optimizes item and gender selection policies to generate fake user profiles, effectively exacerbating the unfairness of target recommender systems, including those designed with fairness-aware mechanisms.

Original authors: Yanan Wang, Yong Ge

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yanan Wang, Yong Ge

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a Recommender System (like the one on Netflix, Amazon, or YouTube) as a very smart, but slightly biased, personal shopper. Its job is to look at what you've liked in the past and suggest new things you might enjoy. The goal is to make sure everyone gets a fair shot at seeing interesting products, whether they are male, female, or any other group.

However, this paper asks a scary question: What if a bad actor could trick this personal shopper into becoming more unfair?

The authors call this a "Fairness Attack." Instead of trying to make the shopper recommend better movies (which is what most hackers try to do), they want to make the shopper treat different groups of people worse than before.

Here is how they did it, broken down into simple concepts:

1. The Goal: Making the Gap Wider

Imagine a playground where boys and girls are both trying to get the best toys. The "personal shopper" usually tries to give both groups a fair amount of good toys.
The attacker's goal is to widen the gap. They want the boys to get slightly better toys and the girls to get significantly worse ones (or vice versa), making the system look very unfair.

2. The Weapon: Fake Profiles (The "Trojan Horse" Army)

To trick the system, the attacker creates thousands of fake user profiles.

The Old Way: Previous hackers just picked random items to "like" to boost a specific product. It was like throwing darts blindfolded.
The New Way (This Paper): The authors built a smarter weapon called SRLFA. Think of this as a master chess player who doesn't just move one piece; they look at the whole board.

3. How the "Smart Weapon" Works

The paper uses two main "superpowers" to create these fake profiles:

Superpower A: The Map Reader (Structure-Aware)
Imagine the real users and items as a giant web of connections (a graph). When the attacker adds a fake user, they don't just drop a stone in a pond; they carefully place it where it will ripple through the whole web in a specific way.
- The Analogy: It's like a spy who knows exactly which friends of a target to befriend to influence the target's opinion, rather than just shouting from a megaphone. The system uses a "Graph Encoder" to understand how these fake connections change the shape of the whole network.
Superpower B: The Storyteller (Sequence-Aware)
The attacker doesn't just pick items randomly; they pick them in a specific order, like writing a story.
- The Analogy: If you are pretending to be a music fan, you don't just list 100 random songs. You listen to a rock song, then a pop song, then a jazz song, building a "personality." The system uses a "Recurrent Neural Network" (like a memory bank) to remember the order of items it has already "liked" to make the fake profile look real and strategic.

4. The Secret Sauce: Choosing the Gender

This is the most unique part of the paper. The attacker doesn't just decide what the fake user likes; they also decide who the fake user is.

The Analogy: Imagine the attacker is casting actors for a play. They have to decide: "Should this fake actor be a man or a woman?"
The system has a special "Gender Selection Policy." It calculates: "If I make this fake user a woman, will it hurt the fairness score more?" It then assigns a gender to the fake profile to maximize the damage to fairness.

5. The Training Ground: The "Surrogate" Shopper

The attacker doesn't know the secret code of the real system (it's a "black box"). So, they build a fake version of the system (a "surrogate") in their own lab.

They train their fake army on this practice system.
They even make their practice system try to be "fair" (just like the real one might be), so they can learn how to break fair systems, not just unfair ones.
Once the fake army learns how to break the practice system, they are sent to attack the real one.

What Did They Find?

The authors tested this method on real data (like movie ratings and music listening habits).

The Result: Their method was much better at making the system unfair than any previous method.
The Shock: Even when the target system was already trying to be fair (using special "fairness training"), the attacker could still break it and make the gap between groups much wider.
The Takeaway: It's like finding out that even a "fair" playground has a secret backdoor that a clever hacker can use to rig the game.

Summary

This paper introduces a new way to hack recommendation systems. Instead of just trying to sell a specific product, the hacker uses a smart, AI-driven strategy to create fake users who look real, act in a specific order, and are assigned specific genders. The goal is to break the fairness of the system, proving that even systems designed to be fair are vulnerable to these sophisticated attacks.

Technical Summary: Fairness Attacks on Recommender Systems

Problem Statement
Recommender systems, while essential for mitigating information overload, face a critical challenge regarding unfairness, where specific user groups (e.g., based on gender or race) are systematically discriminated against. While existing research has extensively studied adversarial attacks aimed at manipulating recommendation performance (e.g., promotion or demotion attacks), the vulnerability of recommendation fairness to such attacks remains largely under-explored. This paper addresses the problem of "fairness attacks," where an adversary aims to exacerbate the inherent unfairness of a target recommender system. The core challenge lies in the fact that target systems may employ fairness-aware training and utilize sensitive attributes (such as gender). Consequently, an effective attacker must not only select fake items to inject but also determine the sensitive attribute (gender) of the fake user profiles to maximize the degradation of fairness.

Methodology: Structure-Aware Reinforcement Learning-based Fairness Attack (SRLFA)
The authors propose a novel method, SRLFA, which frames the generation of fake user profiles as a sequential decision-making process modeled as a Markov Decision Process (MDP). The framework operates under a black-box setting, where the attacker does not know the target model's parameters but has access to training data. To optimize the attack, the authors employ a local surrogate recommender trained with fairness-aware objectives to provide reward feedback.

The SRLFA framework consists of five key modules:

Graph-based Structure Encoder: Recognizing that user-item interactions form a bipartite graph, the method uses a Graph Convolutional Network (GCN) to model the structural dependencies between the injected fake user-item interactions and the original interaction graph. This encoder learns structure-aware representations for both fake users and fake items, capturing how new edges alter the global graph structure.
Sequential Encoder: Since fake items are generated sequentially within a user profile, a Recurrent Neural Network (specifically LSTM) is used to model the sequential dependencies among the generated fake items, learning a sequence-aware representation.
Item Selection Policy: Based on the combined structure-aware and sequence-aware representations, a masked attention mechanism determines the next fake item to inject. This policy ensures that items within a single fake user profile are distinct.
Gender Selection Policy: To address the challenge of sensitive attributes, a separate policy network decides the gender (e.g., male or female) for each fake user profile. This decision is made at the profile level (every $M$ steps) using the aggregated structural and sequential representations of the profile.
Surrogate Recommender & Training: The attacker utilizes a surrogate model (Matrix Factorization with Bayesian Personalized Ranking) that incorporates a fairness regularization term to simulate potential fairness-aware training in the target system. Both the item selection and gender selection policies are jointly trained using Proximal Policy Optimization (PPO) to maximize the cumulative reward, defined as the increase in the unfairness metric ( $Unfair_F$ ).

Key Contributions

Novel Problem Exploration: The paper identifies and investigates the under-explored domain of adversarial attacks specifically targeting the fairness of recommender systems, highlighting the social implications of such vulnerabilities.
Structure-Aware Attack Method: Unlike previous RL-based performance attacks that overlook graph topology, SRLFA explicitly models the structural dependency between injected fake interactions and the original user-item graph using a graph encoder.
Joint Learning of Items and Attributes: The method introduces a hierarchical policy that jointly learns the selection of fake items and the assignment of sensitive attributes (gender) in an end-to-end manner, addressing the unique requirements of fairness attacks.
Comprehensive Evaluation: The study evaluates the method against four target models (NCF, LightGCN, and their fairness-aware variants) on two real-world datasets (MovieLens and Last.fm), demonstrating the method's efficacy in both standard and fairness-aware scenarios.

Experimental Results
Extensive experiments demonstrate that SRLFA significantly outperforms baseline methods (including adapted performance attacks and influence-based fairness attacks) in exacerbating unfairness:

Standard Recommenders: SRLFA increased the unfairness metric ( $Unfair_{NDCG}$ ) by an average of 297.24% across different models and datasets, significantly outperforming baselines. It also notably reduced recommendation performance for disadvantaged groups (e.g., female users), thereby widening the performance gap.
Fairness-Aware Recommenders: Even when the target system employs fairness-aware training (regularization), SRLFA successfully intensified unfairness, increasing $Unfair_{NDCG}$ by an average of 1259.66% on fairness-aware models.
Robustness: The method remained effective even when the attacker had access to only a subset (e.g., 30%) of the training data.
Parameter Sensitivity: The attack performance was found to be sensitive to the number of fake profiles ( $N$ ) and interactions per profile ( $M$ ), with optimal results observed at medium values of $N$ and $M$ approximating average user interaction counts.

Significance and Claims
The paper posits that the development of advanced fairness attack algorithms is a prerequisite for the "red-teaming" of recommender systems. The authors argue that without aggressive attack simulations, the robustness of fairness mechanisms may be substantially underestimated, leading to a false sense of security. By demonstrating that fairness-aware systems are still vulnerable to structural and attribute-based adversarial injections, the paper underscores the critical need for proactive vulnerability identification and the development of more resilient fairness mitigation strategies. The work serves as a foundational step in understanding the specific vulnerabilities of recommendation fairness.