# Investigation of generalised uncertainty principle effects on FRW cosmology

Özgür Ökcüa,b
aDepartment of Physics, Faculty of Science, Istanbul University,
Istanbul, 34134, Türkiye
bTheoretical and Computational Physics Research Laboratory, Istanbul
University,
Istanbul, 34134, Türkiye

##  1 Introduction

Thermodynmaical aspects of gravity have been an attractive research field in
theoretical physics since the discovery of black hole thermodynamics [1, 2, 3,
4, 5, 6]. Black hole as a thermodynamic system has entropy and temperature
proportional to its horizon area and surface gravity, respectively.
Considering a black hole as a thermodynamic system transforms an absolute
absorber into a perfect laboratory to investigate the deep connection between
the gravitation, quantum mechanics, and thermodynamics. Based on the notion of
black hole thermodynamics, Jacobson obtained the Einstein field equation from
thermodynamical arguments [7]. Employing the entropy$-$area relation with
Clausius relation $\delta Q=TdS$, he derived the field equation as an equation
of state. Here, $\delta Q$, $T$ and $dS$ are energy flux, Unruh temperature
and the changes in entropy, respectively. After the pioneering work of
Jacobson, there have been many studies targeted the thermodynamical aspects of
gravity in the literature [8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
21, 24, 22, 23, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 42, 43, 44, 45, 46,
47, 48, 35, 36, 37, 38, 39, 40, 41, 50, 51, 49]. The studies aimed to
understand obtaining Einstein field equation from the first law of
thermodynamics can be found in Refs. [8, 9, 10, 11, 12]. Inspired by
Jacobson’s paper, $(n+1)-$dimensional Friedmann equations were obtained from
the first law of thermodynamics, $-dE=T_{h}dS_{h}$ , at apparent horizon by
Cai and Kim [13]. Here $-dE$ is the energy flux crossing the apparent horizon
for the infinitesimal time interval at fixed horizon radius. The temperature
and entropy of the apparent horizon are given by [13]

$T_{h}=\frac{1}{2\pi\tilde{r_{A}}},\qquad\qquad S_{h}=\frac{A_{h}}{4},$ (1)

where $A_{h}$ and $\tilde{r_{A}}$ correspond to area and apparent horizon,
respectively 111We adopt the units $\hbar=c=G_{N}=L^{2}_{Pl}=1$ throughout the
paper.. Furthermore, in the rest of their seminal paper [13], they also
derived the Friedmann equations from the entropy$-$area relations of Gauss-
Bonnet gravity and Lovelock gravity theories, where the standard
entropy$-$area relation is break down. In Ref. [14], Akbar and Cai obtained
the Friedmann equations in scalar$-$tensor and $f(R)$ gravity theories by
following the arguments of Ref. [13]. Although the Friedmann equations can
successfully be obtained in Eq.(1), the temperature is an approximation for a
fixed apparent horizon. Thus the temperature is not proportional to the
surface gravity at appaerent horizon. Moreover, the equation of state is only
limited with the vacuum energy or de Sitter spacetime for this approximation.
The surface gravity of apparent horizon is given by [13, 52]

$\kappa=-\frac{1}{\tilde{r_{A}}}\left(1-\frac{\dot{\tilde{r_{A}}}}{2H\tilde{r_{A}}}\right),$
(2)

where dot denotes the derivative with respect to time and $H$ corresponds to
Hubble parameter. Assuming temperature is proportional to surface gravity [15]

$T_{h}=\frac{\kappa}{2\pi}=-\frac{1}{2\pi\tilde{r_{A}}}\left(1-\frac{\dot{\tilde{r_{A}}}}{2H\tilde{r_{A}}}\right),$
(3)

with the standard entropy$-$area relation, Akbar and Cai showed that the first
law of thermodynamics at apparent horizon defined as

$dE=T_{h}dS_{h}+WdV,$ (4)

where $E=\rho V$ and $W$ correspond to the total energy in volume $V$ enclosed
by the apparent horizon and the work density, respectively. Then, many papers
devoted to Friedmann equations and apparent horzion thermodynamics have been
intesively studied in the Refs. [16, 17, 18, 19, 20, 21, 24, 22, 23, 25, 26,
27, 28, 29, 30, 31, 32, 33, 34, 42, 43, 44, 45, 46, 47, 48, 35, 36, 37, 38,
39, 40, 41, 50, 51, 49].

It is widely known that the standard entropy$-$area relation is not valid and
should be corrected in the case of various theories. For example, it is
well$-$known that logarithmic correction to black hole entropy arises due to
quantum gravity effects at the Planck scale [53, 54, 55]. The various quantum
gravity approaches to the modifications of Friedmann equations such as loop
quantum gravity [18, 19], modified Heisenberg principle [20, 21, 24, 22, 23,
25] were investigated in the literature. Other interesting modifications of
entropy$-$area relation are considered in the context of generalised
statistics such as Tsallis statistics [56] and Kaniadakis statistics [57, 58].
Moreover, inspired by COVID-19, Barrow proposed that the area of horizon may
be deformed in the context of quantum gravity effects and entropy is the power
law function of its area [59]. Recently, the effects of fractional quantum
mechanics were investigated on black hole thermodynamics in Ref. [60].
Interestingly, the fractional entropy [60] is similar to Tsallis [56] and
Barrow [59] entropies although all entropies have different origins. The
extensions of Refs. [56, 57, 58, 59, 60] to cosmological cases, namely
modified Friedmann equations can be found for Tsallis entropy in Refs. [30,
31, 32], Kaniadakis entropy in Refs. [39, 40], Barrow entropy in Refs. [42,
43, 44, 45, 46, 47, 48, 49] and fractional entropy in Ref. [51].

Modifications of standard uncertainty principle may provide defining the
physics both at Planck scale and large distance scales. GUP takes into account
the momentum uncertainty correction while the extended uncertainty principle
(EUP) takes into account the position uncertainty correction. GUP predicts a
minimum measurable length at Planck scale while EUP may predict a minimum
measurable momentum. Taking into account effects of GUP and EUP leads to third
kind of modified uncertainty principle known as generalized and extended
uncertainty principle (GEUP). It predicts the notions of minimum measurable
length and minimum measurable momentum. Numerous models of modified
uncertainty principle were suggested in Refs. [61, 62, 63, 64, 65, 66, 67, 68,
69, 70, 71, 72, 73, 74, 75]. Both GUP and EUP provide new insights on black
thermodynamics [75, 76, 77, 79, 80, 81, 82, 83, 87, 88, 89, 90, 91, 92, 93,
94, 96, 97, 98, 95, 99, 100, 101, 102, 78, 84, 85, 86]. For example, the black
holes are prevented from total evaporation in the GUP case and a black hole
remnant occurs at the final stage [76]. On the other hand, EUP implies a
minimum temperature for black holes [95]. Extensions of modified uncertainty
principle to cosmological scenario lead to modified Friedmann equations [20,
21, 24, 22, 23, 25]. Based on the simplest form of GUP, the modified Friedmann
equations were derived in Ref. [20]. They found an upper bound energy density
of universe at minimal length. In Ref. [21], a cyclic universe model was
defined from the GUP modified Friedmann equations. In Ref. [22], we obtained
the modified Friedmann equations from a GUP model obtained in doubly special
relativity [67]. Similarly, we obtain a maximum and finite energy density due
to minimal length at Planck scale. We also invesigated the effects of GUP on
the deceleration parameter. The authors of Ref. [23] investigated the baryon
asymmetry for the EUP modified Friedmann equations. They also obtained the
constraints on EUP parameter from observations. Modified Friedmann equations
in GEUP case can be found in Ref. [24] where the author obtained the bounds
for GEUP parameters from observations. Recently, GEUP corrected Friedmann
equations were investigated in Ref. [25]. The authors studied the deceleration
parameters and showed that GEUP may be an alternative to dark energy at late
time expansion222For a recent review on GUP, the reader may refer to Ref.
[103]..

In this paper, our aim is to obtain the GUP modified Friedmann equations from
the first law of thermodynamics at apparent horizon. The modified Friedmann
equations reveal that the initial singularity is removed since GUP implies the
minimal measurable length at Planck scale. Moreover, a detailed investigation
on GSL is crucial to understand the GUP effects. Especially, we would like to
understand how GUP affects the GSL in the $\Lambda CDM$ cosmology. In order to
modify the Friedmann equations, we use Nouicer’s GUP [75] whose details are
given in the next section.

The paper is organised as follows. In Section 2, we start a brief review on
Nouicer’s GUP. Then, we obtained the modified entropy$-$area relation from
Nouicer’s GUP. In Section 3, using modified entropy$-$area relation, we obtain
the Friedmann equations. In Section 4, GUP effects on deceleration parameter
are investigated. In Section 5, we check the validity of GSL and explore the
GUP effects on GSL in the $\Lambda CDM$ cosmology. Finally, we discuss our
results in Section 6.

##  2 Noucier’s GUP and entropy$-$area relation

In this section, we first begin to review Nouicer’s GUP [75]. Then, we obtain
the modified entropy$-$area relation based on the methods of Xiang and Wen
[88]. We start to consider the nonlinear relation $p=f(k)$ between the
momentum $p$ and the wave vector $k$ of particle [104, 105]. This relation
must satisfy the following conditions:

  * •

The relation $p=f(k)$ reduces to usual relation $p=k$ for the lower energies
than the Planck energy.

  * •

The relation $p=f(k)$ approaches to maximum value at Planck scale for the
higher energies.

Following the above conditions, Nouicer proposed the modified position and
momentum operators

$X=ie^{\alpha^{2}P^{2}}\frac{\partial}{\partial p},\quad\quad P=p,$ (5)

where $\alpha$ is a dimensionless positive GUP parameter. These operators lead
to modified commutator

$\left[X,P\right]=ie^{\alpha^{2}P^{2}}.$ (6)

Using the relations $\left\langle P^{2n}\right\rangle\geq\left\langle
P^{2}\right\rangle^{n}$, $\left(\Delta P\right)^{2}=\left\langle
P^{2}\right\rangle-\left\langle P\right\rangle^{2}$ with the above equation,
one can obtain the GUP

$\Delta X\Delta P\geq\frac{1}{2}e^{\alpha^{2}\Delta P^{2}},$ (7)

for the physical state $\left\langle P\right\rangle=0$. The square of above
relation can be written by

$W(u)e^{W(u)}=u,$ (8)

where $W$ is the Lambert function [106] and we define $W(u)=-2\alpha^{2}\Delta
P^{2}$ and $u=-\frac{\alpha^{2}}{2\Delta X^{2}}$. For $0\geq u\geq-1/e$, using
Eq. (7), the momentum uncertainty is given

$\Delta P=\frac{1}{2\Delta
X}\exp\left\\{-\frac{1}{2}W\left(-\frac{1}{e}\frac{\Delta X_{0}^{2}}{\Delta
X^{2}}\right)\right\\},$ (9)

where $\Delta X_{0}$ is the minimum position uncertainty and is given by

$\Delta X_{0}=\sqrt{\frac{e}{2}}\alpha.$ (10)

It is obtained from the condition $u\geq-1/e$.

Following the arguments of Ref. [88], let us start to obtain the modified
entropy$-$area relation. When a black hole absorbs a particle, the change in
area is defined by [2]

$\Delta A\sim bm,$ (11)

where $b$ and $m$ are the particle’s size and mass. We consider two
limitations on particle’s size and mass. The particle is defined by a wave
packet in quantum mechanics. We have $b\sim\Delta X$ since the width of the
wave packet is defined by the particle’s size. The second limitation comes
from the fact that the momentum uncertainty is not bigger than the particle
size. Thus we have $m\geq\Delta P$. With these two limitations, we can write

$\Delta A\sim bm\geq\Delta X\Delta P.$ (12)

Using Eqs. (9), (10) and $\Delta X\sim 2r_{h}$ event horizon, the change in
area is given by

$\Delta
A\geq\frac{\gamma}{2}\exp\left\\{-\frac{1}{2}W\left(-\frac{1}{8}\frac{\alpha^{2}}{r_{h}^{2}}\right)\right\\},$
(13)

where $\gamma$ is a calibration factor. Using above expression with minimum
increase of entropy, $(\Delta S)_{min}=\ln 2$, the GUP modified entropy$-$area
relation is given by

$\frac{dS_{h}}{dA}=\frac{\Delta S_{min}}{\Delta
A_{min}}=\frac{1}{4}\exp\left\\{\frac{1}{2}W\left(\frac{-\alpha^{2}}{8r_{h}^{2}}\right)\right\\},$
(14)

where we find $\gamma=8\ln 2$ since the above equation must give
$dS_{h}/dA=1/4$ in the limit $\alpha\rightarrow 0$. In the next section, we
use Eq. (14) to modify the Friedmann equations.

##  3 Modified Friedmann equations from the first law of thermodynamics

We first begin a concise review on the basic elements of Friedmann-Robertson-
Walker (FRW) universe. The line element of FRW universe is defined by [13]

$ds^{2}=h_{ab}dx^{a}dx^{b}+\tilde{r}^{2}d\Omega^{2},$ (15)

where $\tilde{r}=a(t)r$, $a(t)$ is the scale factor, $x^{a}=(t,r)$, and
$h_{ab}=diag\left(-1,a^{2}/(1-kr^{2})\right)$ is the two$-$dimensional metric.
$k=$ $-1$, $0$, and $1$ present to the open, flat, and closed universe,
respectively. The expression of apparent horizon $\tilde{r_{A}}$ is given by
[13]

$\tilde{r_{A}}=ar=\frac{1}{\sqrt{H^{2}+k/a^{2}}},$ (16)

where the Hubble parameter is defined by $H=\dot{a}/a$. In the following, we
consider the matter and energy of universe as a perfect fluid. So we have

$T_{\mu\nu}=(\rho+p)u_{\mu}u_{\nu}+pg_{\mu\nu},$ (17)

where $\rho$, $p$ and $u_{\mu}$ correspond to energy density, pressure and
four$-$velocity of the fluid. The conservation of energy$-$momentum tensor
($\nabla_{\mu}T^{\mu\nu}=0$) gives the continuity equation as

$\dot{\rho}+3H(\rho+p)=0.$ (18)

The work by the volume change of universe is defined by work density [52]

$W=-\frac{1}{2}T^{ab}h_{ab}=\frac{1}{2}(\rho-p),$ (19)

and the corresponding volume is given by [15]

$V=\frac{4}{3}\pi\tilde{r_{A}}^{3}.$ (20)

Employing the Eqs. (18) and (20), the differential of the total energy of
universe is given by

$dE=\rho
dV+Vd\rho=4\pi\rho\tilde{r_{A}}^{2}d\tilde{r_{A}}-4\pi(\rho+p)\tilde{r_{A}}^{3}Hdt.$
(21)

From Eqs. (19) and (20), we can obtain

$WdV=2\pi(\rho-p)\tilde{r_{A}}^{2}d\tilde{r_{A}}.$ (22)

Since entropy is defined by the area, $S=S(A)$, one can give the general
expressions of entropy as follows [20]:

$S_{h}=\frac{f(A_{h})}{4},$ (23)

and its differential can be written by

$\frac{dS_{h}}{dA_{h}}=\frac{f^{\prime}(A_{h})}{4},$ (24)

where prime denotes derivative with respect to the apparent horizon area
$A_{h}=4\pi\tilde{r_{A}}$. Comparing Eq. (14) with the above equation, we find

$f^{\prime}(A_{h})=\exp\left\\{\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)\right\\}.$
(25)

Finally, we find $T_{h}dS_{h}$ as

$T_{h}dS_{h}=-\left(1-\frac{\dot{\tilde{r_{A}}}}{2H\tilde{r_{A}}}\right)f^{\prime}(A_{h})d\tilde{r_{A}}.$
(26)

Now, we can obtain the modified Friedmann equations since we have all the
necessary ingredients. Substituting Eqs. (21)-(26) into Eq. (4) and using the
differential form of apparent horizon

$d\tilde{r_{A}}=-H\tilde{r_{A}}^{3}\left(\dot{H}-\frac{k}{a^{2}}\right)dt,$
(27)

we find

$4\pi(\rho+p)\tilde{r_{A}}^{3}Hdt=f^{\prime}(A_{h})d\tilde{r_{A}}.$ (28)

Employing the continuity equation (18) with the above equation, the
differential form of Friedmann equation is given by

$\frac{f^{\prime}(A_{h})}{\tilde{r_{A}}^{3}}d\tilde{r_{A}}=-\frac{4\pi}{3}d\rho.$
(29)

Integrating the above equation with Eq. (25) gives the first Friedmann
equation

$\frac{8}{9\alpha^{2}}\left[e^{\frac{3}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}\left(1+3W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)\right)-1\right]=-\frac{4\pi}{3}\rho-\frac{\Lambda}{6},$
(30)

where we have set the integration constant
$C=-\frac{8}{9\alpha^{2}}+\frac{\Lambda}{6}$ in the limit
$\tilde{r_{A}}\rightarrow\infty$. Finally, combining Eqs. (25) and (27) with
Eq. (28), the dynamical equation can be obtained

$e^{\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}\left(\dot{H}-\frac{k}{a^{2}}\right)=-4\pi(\rho+p).$
(31)

These equations reduce to standard Friedmann equations in the limit
$\alpha\rightarrow 0$.

The striking feature of the first Friedmann equation (30) comes from the
argument of Lambert function, i.e., the condition
$\frac{\alpha^{2}}{8\tilde{r_{A}}^{2}}\leq\frac{1}{e}$ gives the minimal
apparent horizon

$\tilde{r_{A}}^{min}=\sqrt{\frac{e}{8}}\alpha.$ (32)

This minimal apparent horizon appears due to minimal length notion of GUP [20,
21, 22, 25]. It implies that the singularity is removed at the beginning of
the Universe. Moreover, the energy density does not diverge anymore since the
minimum apparent horizon has a finite value. Using Eq. (32) in the first
Friedmann equation (30) and neglecting the cosmological constant, the maximum
energy density is given by

$\rho^{max}=\frac{2\left(2+e^{3/2}\right)}{3\pi e^{3/2}\alpha^{2}}.$ (33)

It is clear that both $\tilde{r_{A}}^{min}$ and $\rho^{max}$ recover the
standard results in the limit $\alpha\rightarrow 0$, i.e.,
$\tilde{r_{A}}^{min}$ approaches zero while $\rho^{max}$ diverges. Using Eq.
(16), the Friedmann equations can be expressed in term of Hubble parameter

$\displaystyle-\frac{4\pi}{3}\rho-\frac{\Lambda}{6}=\frac{8}{9\alpha^{2}}\left[e^{\frac{3}{2}W\left(\frac{-\alpha^{2}}{8}\left(H^{2}+\frac{k}{a^{2}}\right)\right)}\left(1+3W\left(\frac{-\alpha^{2}}{8}\left(H^{2}+\frac{k}{a^{2}}\right)\right)\right)-1\right],$
$\displaystyle-4\pi(\rho+p)=e^{\frac{1}{2}W\left(\frac{-\alpha^{2}}{8}\left(H^{2}+\frac{k}{a^{2}}\right)\right)}\left(\dot{H}-\frac{k}{a^{2}}\right).$
(34)

When the GUP effects are tiny, these equations can be expanded in powers of
$\alpha$

$\displaystyle\frac{8\pi}{3}\rho+\frac{\Lambda}{3}=\left(H^{2}+\frac{k}{a^{2}}\right)-\frac{1}{32}\left(H^{2}+\frac{k}{a^{2}}\right)^{2}\alpha^{2}+...,$
$\displaystyle-4\pi(\rho+p)=\left(\dot{H}-\frac{k}{a^{2}}\right)\left[1-\frac{1}{16}\left(H^{2}+\frac{k}{a^{2}}\right)\alpha^{2}+...\right].$
(35)

Neglecting the GUP correction, one can easily recover the usual Friedmann
equations.

##  4 Deceleration parameter

We would like to analyse the effects of GUP on the deceleration parameter. It
is defined by

$q=-1-\frac{\dot{H}}{H^{2}}.$ (36)

The positivity of $q$ means the decelerated expansion while the negativity of
$q$ means the accelerated expansion. We choose the equation of state as
$p=\omega\rho$. We restrict our analysis with the flat case $k=0$ since it is
consistent with cosmological observations [107]. Combining Friedmann equations
in (3) with the deceleration parameter, we can obtain

$q=-1-\frac{4(1+\omega)}{H^{2}e^{\frac{1}{2}W\left(\frac{-\alpha^{2}H^{2}}{8}\right)}}\left\\{\frac{2}{3\alpha^{2}}\left[e^{\frac{3}{2}W\left(\frac{-\alpha^{2}H^{2}}{8}\right)}\left(1+3W\left(\frac{-\alpha^{2}H^{2}}{8}\right)\right)-1\right]+\frac{\Lambda}{8}\right\\}.$
(37)

Now, we can investigate the deceleration parameter at the beginning of the
Universe. Remembering the arguments of Lambert function, i.e., the condition
$\frac{\alpha^{2}H^{2}}{8}\leq\frac{1}{e}$ yields the maximum $H$

$H_{max}=\frac{2\sqrt{2}}{e\alpha},$ (38)

at the initial stage. For the maximum value of Hubble parameter, the
deceleration parameter at the initial stage is given by

$q(H_{max})=\omega+(1+\omega)\left(\frac{\exp\left\\{2-\frac{1}{2}W\left(-\frac{1}{e^{2}}\right)\right\\}}{3}+\frac{1}{3W\left(-\frac{1}{e^{2}}\right)}\right),$
(39)

or equivalently

$q(H_{max})\approx\omega+0.564(1+\omega).$ (40)

Equation of state parameter $\omega$ must satisfy the condition
$\omega<-0.361$ for the acceleration at the inflationary stage. Since GUP
effects are negligible for the radiation and matter dominated eras, the
deceleration parameter can be expanded

$q=\frac{1+3\omega}{2}-\frac{(1+\omega)\Lambda}{2H^{2}}+\frac{3H^{2}(1+\omega)\alpha^{2}}{64}-\frac{1(1+\omega)\Lambda\alpha^{2}}{32}+...$
(41)

Thus, the deceleration parameters for radiation ($\omega=1/3$) and matter
($\omega=0$) dominated eras can be expressed as

$q_{rad}=1+\frac{H^{2}\alpha^{2}}{16},\qquad
q_{m}=\frac{1}{2}+\frac{3H^{2}\alpha^{2}}{64},$ (42)

respectively. The results imply that the universe is more decelerated for the
radiation and matter dominated eras when the GUP effects are considered.

##  5 Generalised second law

In this section, we want to confirm the validity of GSL, which states the
total entropy of matter fields and horizon cannot decrease with time, for the
GUP effects. We start to reorganise Eq. (28) as follows:

$\dot{r_{A}}=4\pi(\rho+p)H\tilde{r_{A}}^{3}e^{-\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}.$
(43)

From Eqs. (25), (26) and (43), we can find

$T_{h}\dot{S_{h}}=4\pi(\rho+p)H\tilde{r_{A}}^{3}\left[1-2\pi(\rho+p)\tilde{r_{A}}^{2}e^{-\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}\right].$
(44)

The second law at apparent horizon may be violated for the accelerated
expansion phase. Therefore, we must also consider the entropy of matter field
inside the horizon, i.e., we must check the GSL. The Gibbs equation is given
by [108]

$T_{f}dS_{f}=d(\rho V)+pdV=Vd\rho+(\rho+p)dV,$ (45)

where $T_{f}$ and $S_{f}$ are the temperature and entropy of matter fields,
respectively. In order to avoid nonequilibrium thermodynamics and spontaneous
energy flow between horizon and matter, thermal equilibrium condition
($T_{h}=T_{f}$) is assumed. Otherwise, the deformation of FRW geometry is
unavoidable [108]. From Eqs. (18), (20), (43) and (45), the change in entropy
of matter fields can be expressed by

$T_{h}\dot{S_{f}}=-4\pi(\rho+p)H\tilde{r_{A}}^{3}\left(1-4\pi(\rho+p)\tilde{r_{A}}^{2}e^{-\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}\right).$
(46)

At last, combining Eqs. (44) and (46), the total entropy evolution is written
by

$T_{h}(\dot{S_{h}}+\dot{S_{f})}=8\pi^{2}(\rho+p)^{2}H\tilde{r_{A}}^{5}e^{-\frac{1}{2}W\left(\frac{-\alpha^{2}}{8\tilde{r_{A}}^{2}}\right)}.$
(47)

The right hand side of the above expression never decreases with respect to
time. Therefore, we conclude that the GSL is always satisfied for all eras of
the universe for any spatial curvature.

Now, in order to understand how GUP affects the total evolution of entropy, we
focused on a more specific case, namely the $\Lambda CDM$ scenario. We first
begin to solve the first Friedmann equation (3). So we find

$H^{2}=\frac{8\exp\left\\{\frac{1}{3}\left(2W\left(\frac{\sqrt{e}}{4}\left(2-3\pi\alpha^{2}\rho\right)\right)-1\right)\right\\}\left(1-2W\left(\frac{\sqrt{e}}{4}\left(2-3\pi\alpha^{2}\rho\right)\right)\right)}{3\alpha^{2}},$
(48)

for $k=0$. Let us simplify the above equation. The total energy density is
defined by

$\rho=\rho_{m}+\rho_{r}+\rho_{\Lambda},$ (49)

where the matter density $\rho_{m}$, the radiation density $\rho_{r}$ and the
cosmological constant energy density $\rho_{\Lambda}$ have the dependencies
$\rho_{m}=\frac{\rho_{m0}}{a^{3}}$, $\rho_{r}=\frac{\rho_{r0}}{a^{4}}$ and
$\rho_{\Lambda}=\rho_{\Lambda 0}$ [109]. Zero subscript denotes the current
value. On the other hand, the matter, radiation and cosmological constant
density parameters are defined by
$\Omega_{m0}=\frac{\rho_{m0}}{\rho_{c0}},\Omega_{r0}=\frac{\rho_{r0}}{\rho_{c0}},\Omega_{\Lambda
0}=1-\Omega_{m0}-\Omega_{r0}$, respectively. Here, the current critical
density $\rho_{c0}$ is given by $\rho_{c0}=\frac{3H_{0}^{2}}{8\pi}$ and
$H_{0}$ is the current Hubble parameter. Using the above definitions with
redshift parameter $1+z=\frac{a_{0}}{a}$ and taking the present scale factor
$a_{0}=1$, one can write

$\frac{\rho}{\rho_{c0}}=\frac{\Omega_{m0}}{a^{3}}+\frac{\Omega_{r0}}{a^{4}}+\Omega_{\Lambda
0}=\Omega_{m0}(1+z)^{3}+\Omega_{r0}(1+z)^{4}+\Omega_{\Lambda 0}.$ (50)

[width=11cm]ClassTotEnt.eps

Figure 1: Total entropy change versus the redshift parameter. We take
$\Omega_{m}=0.3$, $\Omega_{r}=0.0001$, $H_{0}=1$ and $\alpha=0$.

[width=11cm]GUPTotEnt.eps

Figure 2: Total entropy change versus the redshift parameter. From top to
bottom, the curves correspond to $\alpha=1.4,1.2,1,0.8,0.6$. We take
$\Omega_{m}=0.3$, $\Omega_{r}=0.0001$ and $H_{0}=1$.

Using Eq. (50) in the arguments of Lambert function (48), we get

$x=\frac{\sqrt{e}}{4}\left(2-3\pi\alpha^{2}\rho\right)=\frac{\sqrt{e}}{4}\left(2-\frac{9H_{0}^{2}\alpha^{2}}{8}\left[\Omega_{r0}(1+z)^{4}+\Omega_{m0}(1+z)^{3}+\Omega_{\Lambda
0}\right]\right).$ (51)

Finally, we can express the GUP modified Hubble function for the $\Lambda CDM$
cosmology as follows:

$H_{\Lambda
CDM}(z)=\frac{2\sqrt{2}e^{\frac{2W(x)-1}{6}}\sqrt{1-2W(x)}}{\sqrt{3}\alpha}$
(52)

Substituting Eqs. (3), (16) and the second Friedmann equation (3) into Eq.
(47), we find

$\dot{S_{h}}+\dot{S_{f}}=\pi\dot{H}^{2}H^{-5}\left(1+\frac{\dot{H}}{2H^{2}}\right)^{-1}e^{\frac{1}{2}W\left(\frac{-\alpha^{2}H^{2}}{8}\right)}$
(53)

Finally, using $\dot{H}=-(1+z)H(dH/dz)$, we obtain

$\dot{S_{h}}+\dot{S_{f}}=\pi(1+z)^{2}H^{-3}\left(\frac{dH}{dz}\right)^{2}\left(1-\frac{(1+z)}{2H}\frac{dH}{dz}\right)^{-1}e^{\frac{1}{2}W\left(\frac{-\alpha^{2}H^{2}}{8}\right)}.$
(54)

Combining Eq. (52) with the above equation, we plotted total entropy change
with respect to redshift. In Fig. 1, we plot the evolution of total entropy
for the standard case. In Fig. 2, the total entropy change is represented for
the different values of GUP parameter $\alpha$. Comparing Figs. 1 with 2
reveals the dramatic effects on the evolution of total entropy. As can be seen
in Fig. 2, the redshift parameter has an upper bound. In contrast to GUP case,
the redshift parameter is allowed to go infinity in the standard cosmology.
Since $z$ reaches infinity, the total entropy change vanishes in the standard
cosmology. On the other hand, the total entropy change has an upper bound
since $z$ has a maximum value in the presence of GUP effects.

Finally, we finish this section with comments on different values of GUP
parameter. In Table 1, we numerically give the maximum values of the redshift
parameter, Hubble parameter and total entropy change for the various values of
GUP parameter $\alpha$. From Fig. 2 and Table 1, one can see that $z_{max}$
decrease while $\alpha$ increases. The same behaviour can also be seen for the
maximum values of $H$ and total entropy change. Maximum values of Hubble
parameter and total entropy changes decrease while $\alpha$ increases.

| $\alpha=0.6$ | $\alpha=0.8$ | $\alpha=1$ | $\alpha=1.2$ | $\alpha=1.4$
---|---|---|---|---|---
$z_{max}$ | $1.779$ | $1.227$ | $0.840$ | $0.535$ | $0.268$
$H(z_{max})$ | $2.859$ | $2.114$ | $1.716$ | $1.430$ | $1.125$
$\dot{S_{h}}+\dot{S_{f}}$ | $100.173$ | $26.276$ | $12.861$ | $6.707$ | $3.185$
Table 1: The maximum values of redshift parameter, Hubble parameter and the
total entropy change for the different values of $\alpha$.

##  6 Conclusions and discussions

In this section, using the entropy$-$area relation obtained from Nouicer’s GUP
[75], we obtained the GUP modified Friedmann equations from the fisrt law of
thermodynamics at apparent horizon [15]. We found a minimum apparent horizon
due to the minimal length notion of GUP. We showed that the energy density of
universe is finite and maximum at the minimum apparent horizon. Then, in order
to see the effects of GUP, we computed the deceleration parameter for flat
case and the equation of state $p=\omega\rho$. We found that $\omega$ must
satisfy the condition $\omega<-0.361$ for the initial acceleration. For the
radiation and matter dominated eras, the expansion of universe is more
decelerated since the GUP effects give the positive contribution to
deceleration parameter. Moreover, we checked the validity of GSL. We showed
that the GSL is always valid for the all eras of universe in the presence of
GUP effects. At last, we consider the GSL for the specific case, i.e.,
$\Lambda CDM$ cosmology. In contrast to standard cosmology, the redshift
parameter has a finite and maximum value. GUP also affects the total entropy
change. The total entropy change has a finite and maximum value at maximum
redshift value.

Our results indicate that there is no Big Bang singularity due to the minimal
apparent horizon and maximum energy density. Therefore, GUP provides more
reasonable solution at the Planck scale where the classical general relativity
fails. This feature is a well$-$known in the literature [20, 21, 22, 25]. So
our results are consistent with the recent studies. Interestingly, we found
the total entropy change has a maximum value at maximum and finite redshift
for $\Lambda CDM$ cosmology. In fact, the maximum and finite value of $z$ is
expected since the Big Bang singularity is removed. However, the modified
uncertainty effects on total entropy change in $\Lambda CDM$ need further
investigation.

## Acknowledgments

The author thanks Ekrem Aydiner for valuable and fruitful discussion. This
work was supported by Istanbul University Post-Doctoral Research Project:
MAB-2021-38032.

## References

  * [1] J. D. Bekenstein, J. Lett. Nuovo Cimento  4 (1972) 737.
  * [2] J. D. Bekenstein, Phys. Rev. D 7 (1973) 2333.
  * [3] J. M. Bardeen, B. Carter, S. W. Hawking, Commun. Math. Phys. 31 (1973) 161.
  * [4] S. W. Hawking, Nature 248 (1974) 30.
  * [5] J. D. Bekenstein, Phys. Rev. D 9 (1974) 3292.
  * [6] S. W. Hawking, Commun. Math. Phys. 43 (1975) 199.
  * [7] T. Jacobson, Phys. Rev. Lett. 75 (1995) 1260.
  * [8] T. Padmanabhan, Class. Quantum Grav. 19 (2002) 5387.
  * [9] C. Eling, R. Guedens, T. Jacobson, Phys. Rev. Lett. 96 (2006) 121301.
  * [10] A. Paranjape, S. Sarkar, T. Padmanabhan, Phys. Rev. D 74 (2006) 104015.
  * [11] D. Kothawala, S. Sarkar, T. Padmanabhan, Phys. Lett. B 652 (2007) 338.
  * [12] T. Padmanabhan, A. Paranjape, Phys. Rev. D 75 (2007) 064004.
  * [13] R. G. Cai, S. P. Kim, JHEP 02 (2005) 050.
  * [14] M. Akbar, R. G. Cai, Phys. Lett. B 635 (2006) 7.
  * [15] M. Akbar, R. G. Cai, Phys. Rev. D 75 (2007) 084003.
  * [16] R. G. Cai, L. M. Cao, Phys. Rev. D 75 (2007) 064008.
  * [17] R. G. Cai, L. M. Cao, Nucl. Phys. B 785 (2007) 135.
  * [18] R. G. Cai, L. M. Cao, Y. P. Hu, JHEP 08 (2008) 090.
  * [19] A. Sheykhi, Eur. Phys. J. C 69 (2010) 265.
  * [20] A. Awad, A. F. Ali, JHEP 2014 (2014) 093.
  * [21] M. Salah, F. Hammad, M. Faizal, A. F. Ali, JCAP 02 (2017) 35.
  * [22] Ö. Ökcü, C. Corda, E. Aydiner, EPL 129 (2020) 50002.
  * [23] S. S. Luo, Z. W. Feng, Ann. Phys. 458 (2023) 169449.
  * [24] S. Kouwn, Phys. Dark Universe 21 (2018) 76.
  * [25] M. A. A. Alsabbagh, K. Nozari, Ann. Phys. 458 (2023) 169469.
  * [26] A. Sheykhi, Class. Quantum Grav. 27 (2010) 025007.
  * [27] A. Sheykhi, B. Wang, R. G. Cai, Nucl. Phys. B 779 (2007) 265.
  * [28] A. Sheykhi, B. Wang, R. G. Cai, Phys. Rev. D 76 (2007) 023515.
  * [29] A. Sheykhi, B. Wang, Phys. Lett. B 678 (2009) 434.
  * [30] A. Sheykhi, Phys. Lett. B 785 (2018) 118.
  * [31] S. Nojiri, S. D. Odintsov, E. N. Saridakis, Eur. Phys. J. C 79 (2019) 242.
  * [32] A. Lymperis, E. N. Saridakis, Eur. Phys. J. C 78 (2018) 993.
  * [33] K. Karami, A. Sheykhi, N. Sahraei, S. Ghaffari, EPL 93 (2011) 29002.
  * [34] A. Sheykhi, Int. J. Mod. Phys. D 28 (2019) 1950057.
  * [35] A. Sheykhi, B. Farsi, Eur. Phys. J. C 82 (2022) 1111.
  * [36] M. Asghari, A. Sheykhi, Eur. Phys. J. C82 (2022) 388.
  * [37] A. Sheykhi, M. S. Hamedan, Entropy 25 (2023) 569.
  * [38] A. Sheykhi, arXiv:2302.13012 [gr-qc] (2023) 1-6.
  * [39] A. Lymperis, S. Basilakos, E. N. Saridakis, Eur. Phys. J. C 81 (2021) 1037.
  * [40] N. Drepanou, A. Lymperis, ,E. N. Saridakis, K. Yesmakhanova, Eur. Phys. J. C 82 (2022) 449.
  * [41] S. D. Odinstov, T. Paul, Phys. Dark Universe 39 (2023) 101159.
  * [42] E. N. Saridakis, JCAP 07 (2020) 031.
  * [43] J. D. Barrow, S. Basilakos, E. N. Saridakis, Phys. Lett. B 815 (2021) 136134.
  * [44] E. N. Saridakis, S. Basilakos, Eur. Phys. J. C 81 (2021) 644.
  * [45] F. K. Anagnostopoulos, S. Basilakos, E. N. Saridakis, Eur. Phys. J. C 80 (2020) 826.
  * [46] A. Sheykhi, Phys. Rev. D 103 (2021) 123503.
  * [47] M. Asghari, A. Sheykhi, MNRAS 508 (2021) 2855.
  * [48] A. Sheykhi, Phys. Rev. D 107 (2022) 023505.
  * [49] S. Di Genarro, Y. C. Ong, Universe 8 (2022) 541.
  * [50] E. M. C. Abreu, J. A. Neto, Phys.Lett. B 824 (2022) 136803.
  * [51] Z. Çoker, Ö. Ökcü, E. Aydiner, EPL 143 (2023) 59001.
  * [52] S. A. Hayward, Class. Quant. Grav. 15 (1998) 3147.
  * [53] T. R. Govindarajan, R. K. Kaul, V. Suneeta, Class. Quantum Grav. 18 (2001) 2877.
  * [54] R. B: Mann, S. N. Solodukhin, Nucl. Phys. B 523 (1998) 293.
  * [55] A. Sen, JHEP 2013 (2013) 156.
  * [56] C. Tsallis, L. J. L. Cirto, Eur. Phys. C 73 (2013) 2487.
  * [57] G. Kaniadakis, Phys. Rev. E 66 (2002) 056125.
  * [58] G. Kaniadakis, Phys. Rev. E 72 (2005) 036108.
  * [59] J. D. Barrow, Phys. Lett. B 808 (2020) 135643.
  * [60] S. Jalalzadeh, F. R. da Silva, P. V. Moniz, Eur. Phys. J. C  81 (2021) 632.
  * [61] M. Maggiore, Phys. Lett. B 304 (1993) 65.
  * [62] F. Scardigli, Phys. Lett. B 452 (1999) 39.
  * [63] A. Kempf, G. Mangano, R. B. Mann, Phys. Rev. D 52 (1995) 1108.
  * [64] C. Bambi, F. R. Urban, Class. Quant. Grav. 25 (2008) 095006.
  * [65] K. Nozari, A. Etemadi, Phys. Rev. D 85 (2012) 104029.
  * [66] R. N. C. Filho, J. P. M. Braga, J. H. S. Lira, J. S. Andrade Jr., Phys. Lett. B 755 (2016) 367.
  * [67] W. S. Chung, H. Hassanabadi, Phys. Lett. B 785 (2018) 127.
  * [68] M. J. Lake, M. Miller, R. F. Ganardi, Z. Liu, S. D. Liang, T. Paterek, Class. Quantum Grav. 36 (2019) 155012.
  * [69] W. S. Chung, Int. J. Theor. Phys. 58 (2019) 2575.
  * [70] M. P. Dabrowski, F. Wagner, Eur. Phys. J. C 79 (2019) 716.
  * [71] M. J. Lake, M. Miller, S. D. Liang, Universe 6 (2020) 56.
  * [72] M. J. Lake, Quantum Rep. 3 (2021) 196.
  * [73] J.R. Mureika, Phys. Lett. B 789 (2019) 88.
  * [74] X. D. Du, C. Y. Long, JHEP 2022 (2022) 063.
  * [75] K. Nouicer, Phys. Lett. B 646 (2006) 63.
  * [76] R. J. Adler, P. Chen, D. I. Santiago, Gen. Relat. Gravit. 33 (2001) 2101.
  * [77] A. J. M. Medved, E. C. Vagenas, Phys. Rev. D 70 (2004) 124021.
  * [78] M. I. Park, Phys. Lett. B 659 (2007) 698.
  * [79] K. Nozari, S. H. Mehdipour, EPL 84 (2008) 20008.
  * [80] I. Arraut, D. Batic, M. Nowakowski, Class. Quantum Grav. 26 (2009) 125006.
  * [81] R. Banerjee, S. Gosh, Phys. Lett. B 688 (2010) 224.
  * [82] K. Nozari, S. Saghafi, JHEP 2012 (2012) 005.
  * [83] A. F. Ali, JHEP 2012 (2012) 067.
  * [84] B. Majumder, Gen. Relat. Gravit. 45 (2013) 2403.
  * [85] D. Chen, H. Wu, H. Yang, Adv. High Energy Phys. 2013 (2013) 432412.
  * [86] M. A. Anacleto, F. A. Brito, E. Passos, Phys. Lett. B 749 (2015) 181.
  * [87] Z. W. Feng, H. L. Li, X. T. Zu, S. Z. Yang, Eur. Phys. J. C 76 (2016) 212.
  * [88] L. Xiang, X. Q. Wen, JHEP 2009 (2009) 046.
  * [89] F. Scardigli, Symmetry 12 (2020) 1519.
  * [90] S. Hassanabadi, J. Kriz, W. S. Chung, B. C. Lutfuoglu, E. Maghsoodi, H. Hassanabadi, Eur. Phys. J. Plus 136 (2021) 918.
  * [91] B. C. Lutfuoglu, B. Hamil, L. Dahbi, Eur. Phys. J. Plus 136 (2021) 976.
  * [92] Z. Sun, M. S. Ma, EPL 122 (2018) 60002.
  * [93] M. S. Ma, Y. S. Liu, Adv. High Energy Phys. 2018 (2018) 1257631.
  * [94] Ö. Ökcü, E. Aydiner, Int. J. Theor. Phys. 59 (2020) 2839.
  * [95] H. Hassanabadi, E. Maghsoodi, W. S. Chung, M. de Montigny, Eur. Phys. J. C 79 (2019) 936.
  * [96] B. Bolen, M. Cavaglia, Gen. Relativ. Gravit. 37 (2005) 1255.
  * [97] X. Han, H. Li, Y. Ling, Phys. Lett. B 666 (2008) 121.
  * [98] H. Moradpour, C. Corda, A. H. Ziaie, S. Ghaffari, EPL 127 (2019) 60006.
  * [99] W. S. Chung, H. Hassanabadi, Phys. Lett. B 793 (2019) 451.
  * [100] B. Hamil, B. C. Lutfuoglu, EPL 133 (2021) 30003.
  * [101] B. Hamil, B. C. Lutfuoglu, EPL 134 (2021) 50007.
  * [102] H. Chen, B. C. Lutfuoglu, H. Hassanabadi, Z. W. Long, Phys. Lett. B 827 (2022) 136994.
  * [103] P. Bosso, G. G. Luciano, L. Petruzziello, F. Wagner, Class. Quantum Gravity 40 (2023) 195014.
  * [104] S. Hossenfelder, Phys. Rev. D 73 (2006) 105013.
  * [105] S. Hossenfelder, Class. Quantum Gravity 23 (2006) 1815.
  * [106] R. M. Coreless, G. H. Gonnet, D. E. Hare, D. J. Jerey, D. E. Knuth, Adv. Comput. Math. 5 (1996) 329.
  * [107] S. D. Odintsov, S. Nojiri, Phys. Rept. 505 (2011) 59.
  * [108] G. Izquierdo, D. Pavon, Phys. Lett. B 633 (2006) 420.
  * [109] B. Ryden, Intoduction to Cosmology, 2nd edition, Cambridge University Press, (2017).


# RecAD: Towards A Unified Library for Recommender Attack and Defense

Changsheng Wang<EMAIL_ADDRESS>0009-0007-0957-638X University of Science
and Technology of ChinaNo.96 Jinzhai RoadHefeiAnhuiChina230000 ,  Jianbai Ye
0009-0004-9095-4947<EMAIL_ADDRESS>University of Science and
Technology of ChinaHefeiAnhuiChina ,  Wenjie Wang<EMAIL_ADDRESS>0000-0002-5199-1428 National University of SingaporeSingapore ,  Chongming Gao
<EMAIL_ADDRESS>0000-0002-5187-9196 University of Science and
Technology of ChinaNo.96 Jinzhai RoadHefeiAnhuiChina230000 ,  Fuli Feng
<EMAIL_ADDRESS>0000-0002-5828-9842 University of Science and Technology
of ChinaNo.96 Jinzhai RoadHefeiAnhuiChina230000 and  Xiangnan He
<EMAIL_ADDRESS>0000-0001-8472-7992 University of Science and Technology
of ChinaNo.96 Jinzhai RoadHefeiAnhuiChina230000

(2023)

###### Abstract.

In recent years, recommender systems have become a ubiquitous part of our
daily lives, while they suffer from a high risk of being attacked due to the
growing commercial and social values. Despite significant research progress in
recommender attack and defense, there is a lack of a widely-recognized
benchmarking standard in the field, leading to unfair performance comparison
and limited credibility of experiments. To address this, we propose RecAD, a
unified library aiming at establishing an open benchmark for recommender
attack and defense. RecAD takes an initial step to set up a unified
benchmarking pipeline for reproducible research by integrating diverse
datasets, standard source codes, hyper-parameter settings, running logs,
attack knowledge, attack budget, and evaluation results. The benchmark is
designed to be comprehensive and sustainable, covering both attack, defense,
and evaluation tasks, enabling more researchers to easily follow and
contribute to this promising field. RecAD will drive more solid and
reproducible research on recommender systems attack and defense, reduce the
redundant efforts of researchers, and ultimately increase the credibility and
practical value of recommender attack and defense. The project is released at
https://github.com/gusye1234/recad.

Recommender Systems; Shilling Attack and Defense; Benchmark

††journalyear: 2023††copyright: acmlicensed††conference: Seventeenth ACM
Conference on Recommender Systems; September 18–22, 2023; Singapore,
Singapore††booktitle: Seventeenth ACM Conference on Recommender Systems
(RecSys ’23), September 18–22, 2023, Singapore, Singapore††price: 15.00††doi:
10.1145/3604915.3609490††isbn: 979-8-4007-0241-9/23/09††ccs: Information
systems Recommender systems

##  1\. Introduction

In recent decades, recommender systems have become increasingly important in
various areas, including E-commerce recommendation (Huang et al., 2007), short
video entertainment (Gao et al., 2022), news headlines (Liu et al., 2010), and
online education (Wu et al., 2011). However, the widespread use of recommender
systems has also led to concerns regarding their security. When an attacker
successfully attack a recommender system, users may be offended by malicious
recommendations, and the platform owner may lose the trust of users in the
platform. Additionally, merchants who rely on recommender platforms may suffer
from commercial losses. Malicious attacks may even cause recommender systems
to engage in unethical or illegal behavior, resulting in adverse effects on
society. Therefore, it is essential to address these security risks and ensure
the integrity of recommender systems to maintain user trust and prevent any
negative consequences.

Recently, industry and academia are trying to develop strategies for both
attacking and defending recommender systems, especially pay attention to the
techniques about shilling attacks and defense (Xing et al., 2013). In shilling
attacks, fake users are generated and assigned high ratings for a target item,
while also rating other items to act like normal users for evading. There are
three main kinds of shilling attack methods: heuristic methods, gradient
methods, and neural methods. Heuristic methods (Linden et al., 2003; Burke et
al., 2005a; Kaur and Goel, 2016) involve artificially or randomly selecting
items based on user preferences, and then intuitively fabricate interaction
information. Gradient methods (Li et al., 2016b; Fang et al., 2020) estimate
the gradients of maximizing attack objectives to directly optimize the
interactions of fake users, while Neural methods (Tang et al., 2020; Lin et
al., 2022, 2020) optimize the neural networks parameters to predict the
optimal fake user behaviors for maximizing attack objectives.

To combat these attacks, many defense methods (Dou et al., 2018; Cao et al.,
2013; Mehta and Nejdl, 2009) are emerging to enhance the defense ability of
existing recommendation models. Essentially, these defense models aim to
distinguish between fake data generated by the attack model and real user
data, ensuring that the recommendation model uses as much real data as
possible (Yang et al., 2018). Currently, the mainstream defense model can be
divided into three types according to whether the label of fake users can be
obtained (Dou et al., 2018; Aktukmak et al., 2019; Tang et al., 2019). As new
attack methods emerge, defense models are constantly evolving to keep up with
these threats. Therefore, staying up-to-date with the latest attack and
defense methods is essential for maintaining the security of recommender
systems.

With the continuous emergence of new attack and defense algorithms in the
field of recommender system security, there are several research challenges
that deserve attention. Firstly, while many articles provide details about
their experiments, there is often a lack of standardization in dataset
processing methods, which can lead to unfair comparison. Secondly, there is a
lack of unified settings for attack experiments. Various works usually
leverage different experimental setting, making it difficult to compare and
evaluate different models. It is critical to establish a standardized approach
for similar attack settings to facilitate the comparison and evaluation of
different models. Additionally, many works lack public code, which can create
repetition and difficulties for subsequent researchers trying to advance the
field. To address these challenges, researchers should strive to provide clear
and standardized descriptions of dataset processing methods, unified settings
for attack experiments, and make their code publicly available to facilitate
replication and extension of their work. These efforts can help promote the
development of the recommender attack and defense and contribute to more
robust and effective recommender system security solutions.

To address the aforementioned challenges, we have initiated a project to
develop a unified framework for Recommender Attack and Defense, named RecAD.
RecAD aims to improve the reproducibility of existing models and simplify the
development process for new recommender attack and defense models. Our
benchmarking library design is innovative and effective, revealing several
advantages compared to earlier attempts.

  * •

Unified library framework. RecAD is implemented using
Pytorch111https://pytorch.org/., one of the most popular deep learning
frameworks. The library is composed of three core modules, namely the data
module, model module, and evaluation module. The library supports a vast array
of options provided by each module, and a straightforward configuration
ensures that users can promptly complete algorithm reproduction and
comparison. The seamless interface integration of the three core modules also
enables the minimal adjustment for incorporating new algorithms, allowing for
continuous development and extension within our framework in the future.

  * •

Comprehensive benchmark models and datasets. RecAD provides support not only
for replacing individual models but also for integrating a wide range of
research issues. From generating fake attack data to defending against
existing data and injecting data into victim models, RecAD covers the entire
spectrum of shilling attack and defense research. It provides an array of
choices for all models and datasets, guaranteeing an ample assortment of
combinations for researchers to utilize. This allows them to execute, compare,
and assess the entire procedure, relying on lucid instructions and
configurations. RecAD is highly adaptable and scalable, with original dataset
copies that can be effortlessly transformed into a practical form using the
provided preprocessing tools or scripts. Additionally, we are continuously
expanding our library with additional datasets and methods to better serve the
needs of the community and researchers.

  * •

Extensive and standard evaluation protocols.  RecAD offers evaluation methods
from two perspectives: attack evaluation and defense evaluation. Researchers
interested in continuing the offensive direction or those focusing on the
defensive direction can use the corresponding evaluation methods.
Additionally, it provides standard evaluation techniques for assessing the
effectiveness of defense models, encapsulating the entire evaluation process
within a singular module enables RecAD to more readily accommodate more
evaluation techniques, thus enhancing its adaptability and versatility.

  * •

Openness and high integration of models.  Openness is crucial for promoting
transparency, collaboration, and reproducibility in computer science research.
RecAD adopts a highly integrated approach, simplifying the relationships
between modules as much as possible and making the corresponding parameters
publicly available at each module. This ensures that subsequent researchers
who use our framework to add new models only need to make the corresponding
modules public, allowing other researchers to quickly and efficiently
reproduce the work and ensure the openness of the field in the future.

  * •

The generalization of attacker’s knowledge.  The attacker’s knowledge level
directly impacts the effectiveness of the attack. A high degree of accessible
knowledge about the recommender system allows an attacker to craft adversarial
examples that can evade the model’s defenses. RecAD can elevate white-box
attacks to gray-box attacks and customize the proportion of data accessible by
the attackers for gray-box attacks (Fang et al., 2018a), promoting the fair
comparison between a wide range of attackers.

##  2\. Related Work

###  2.1. Overview of Shilling Attack and Defense

In the past two decades, researchers have conducted experiments to demonstrate
the feasibility of attacking real-world recommender systems, such as YouTube,
Google Search, Amazon, and Yelp. These experiments have shown that it is
possible to manipulate recommendation systems in practice, resulting in an
increasing focus on this field from both the academic community and industry.
To promote its development, researchers have typically focused on either
shilling attacks or defense mechanisms. With the advancements in deep
learning, the field has seen a notable increase in the effectiveness of these
methods.

###  2.2. Shilling attack

The objective of an shilling attack is to interfere with the recommendation
strategy of the victim recommender system through a series of measures
(O’Mahony et al., 2005; Mobasher et al., 2007; Deldjoo et al., 2019). The
ultimate goal is to enhance the exposure of a specific target item among all
users after the recommender model is trained. To achieve this objective,
attackers often inject fake users into the historical interactive data, or
training matrix, of the recommender system. However, if these fake users are
not adequately protected, they will be sent into the recommender system model
during the training process, thus disrupting the recommendation strategy of
the system. As a result, the key challenge of an shilling attack is to
construct the interaction behaviors of the fake users. The interaction
behaviors of the constructed users can generally be classified into three
categories:

  * •

Heuristic attacks.  Heuristic attacks involve selecting items to create fake
profiles based on subjective inference and existing knowledge. The goal is to
strengthen the connection between fake users and other real users while
evading defense methods and achieving exposure enhancement of the final target
item (Linden et al., 2003; Burke et al., 2005a). Currently, existing methods
include the Random Attack (Kaur and Goel, 2016), Average Attack (Lam and
Riedl, 2004), Bandwagon Attack, and Segment Attack (Burke et al., 2005b). The
Random Attack is a low-knowledge method that selects filler items randomly,
while the Average Attack selects filler items randomly and requires more
knowledge. In the case of an Average Attack, the target item needs to be given
the highest rating to implement a push attack. Segment Attack selects items of
the same category as the target item and maximizes their rating, with the goal
of creating a stronger correlation with the corresponding target user among
real users so that it can attack more effectively.

  * •

Gradient attacks. Gradient attacks involve relaxing the discrete space to a
continuous space to ensure that the objective function can be optimized by the
gradient to achieve the optimal attack effect. For instance, Li et al. (Li et
al., 2016b; Fang et al., 2020) developed poisoning attacks optimized for
matrix factorization-based recommender systems, while Yang et al. (2017)
developed poisoning attacks optimized for co-visitation rule-based recommender
systems. Additionally, there are gradient attack methods based on Next-item
(Zhang et al., 2020), and graph (Fang et al., 2018b). However, all Gradient
Attacks require known types of recommender systems to carry out specific
optimization, which does not have good generalization. Moreover, in order to
achieve bi-level optimization (Huang et al., 2021), directly adjusting
interactions according to gradients involved transforming the discrete
interactions into continuous optimization. During the process of re-
discretization, information loss occurred, leading to sub-optimal results and
the lack of robustness in the model.

  * •

Neural attacks.  Neural Attacks, primarily inspired by deep learning (Huang et
al., 2021), generate realistic profiles that have a significant impact on
recommender systems by optimizing the parameters of neural networks to
maximize the objective function. WGAN (Arjovsky et al., 2017) draws on
Wasserstein’s distance, which has shown better empirical performance than the
original GAN (Goodfellow et al., 2020). It can emulate real user behavior with
fake user behavior to achieve the effect of fake user behavior. AIA (Tang et
al., 2020) reviewed the bi-level optimization problems of the surrogate model
and proposed time-efficient and resource-efficient solutions. AUSH (Lin et
al., 2020) and Legup (Lin et al., 2022) solve the randomness caused by noise
generation in common models, making the generated template artificially based
on known knowledge, resulting in a more undetectable configuration file. When
the attacker’s knowledge is limited to a black box, researchers use RL attack
(Zhang et al., 2022; Fan et al., 2021; Song et al., 2020) to complete the
attack, with the attacker adjusting changes based on feedback given by the spy
user in the victim model. The methods of Neural Attacks all show better
performance on real datasets than Gradient and Heuristic attacks.

In addition to the challenges associated with constructing effective shilling
attacks, another emerging issue is the knowledge of the attacker (Burke et
al., 2005a). In today’s world, data security and privacy are increasingly
important to both users and companies. This makes it increasingly challenging
for attackers to obtain the necessary user data to construct effective attack
models. As a result, researchers have begun to consider the attacker’s
knowledge as a key constraint for the attack model. The attacker’s knowledge
can be classified into three categories: _white box_ , _grey box_ , and _black
box_. In a white box attack, the attacker has complete knowledge of the target
recommender model, which includes all the data of the victim model used for
training and the network structure and parameters of the victim model. In a
grey box attack, the attacker can only access part of the training set of the
target model and has no knowledge of the victim model. In a black box attack,
only some spy users are allowed as attack feedback.

In addition to shilling attacks, there are other types of attacks, such as
attacks that involve modifying the real user interaction history (Zeller and
Felten, 2008) or attacks based on federated learning recommender models (Rong
et al., 2022b, a; Zhou et al., 2021; Yi et al., 2022). The former is not very
effective due to the adoption of multiple privacy protection mechanisms by
real recommender platforms, such as email and mobile phone hardware binding.
Therefore, this method is easily detected and defended by the platform and is
insufficient for a large-scale attack. On the other hand, the latter is still
in the theoretical research stage and the models proposed are too basic, at
the same time this kind of method has not yet been implemented by companies.
This means that the criteria for the above two methods still need to be
explored by more researchers.

###  2.3. Defense

A defense model can be viewed as a checkpoint responsible for detecting
possible fake users in the data before it is sent to the recommender model.
The defense model eliminates fake users to ensure that the recommendation
results are not interfered with by attackers to the greatest extent possible.
Some defense models attempt to find the law of data distribution from all the
data or obtain the probability of the corresponding label through probability
methods to predict and classify. Currently, the defense direction can be
classified into three categories:

  * •

Supervised defense models,  which need to be pre-labeled with true and false
data. The goal of the model is to learn the relationship between the input and
output variables, so that it can make predictions on new data. The learning
process involves minimizing the difference between the predicted output and
the true output for each example in the training data. In other words, the
model is trained to approximate the mapping from inputs to outputs. In the
direction of recommender defense, Supervised work emerges in the initial
exploration of this field, such as CoDetector (Dou et al., 2018), DegreeSAD
(Li et al., 2016a), BayesDetector (Yang et al., 2018).

  * •

Semi-supervised defense models,  as explored in (Cao et al., 2013; Wu et al.,
2011), aim to use a minimal amount of false data while still maintaining the
purpose and accuracy of the supervised method. This is because attackers
typically use a small amount of data to launch attacks, leading to an inherent
imbalance between true and false training samples, highlighting the crucial
importance of maintaining the supervised aspect of the method.

  * •

Unsupervised defense models,  which have been intensively investigated in
recent years, including traditional machine learning models such as
probabilistic models (Aktukmak et al., 2019), statistical anomaly detection
(Bhaumik et al., 2006), PCA (Mehta and Nejdl, 2009), SVM (Zhou et al., 2016),
and K-means (Davoudi and Chatterjee, 2017). More recently, network models have
been used for detection, such as Graph Embedding (Zhang et al., 2021),
Sequential GANs (Shahrasbi et al., 2020), Recurrent Neural Network (Gao et
al., 2020), and Dual-input CNN (Yu et al., 2021).

In addition to the model-based prediction introduced above to realize the
defense of the recommender platform, some scholars also have trained the
recommender model by using adversarial data training (Tang et al., 2019; He et
al., 2018; Liu et al., 2020; Wu et al., 2021) so that the recommender model
can have better generalization in the face of fake data.

###  2.4. Benchmarking for Recommender Attack and Defense

Despite the recent growth in the field of RS security, different studies have
employed different data sets, evaluation methods, and knowledge constraints,
resulting in significant fairness issues when comparing different models. This
has had a negative impact on the steady development of the field. Although
some works have attempted to address these issues in the past, there is still
a need for a comprehensive and unified library to solve the current dilemma.

For instance, in AUSH (Lin et al., 2020), the author provided a code that
integrated multiple attack models, but the workflow was inefficient and
required a significant amount of time for subsequent researchers to study the
code structure. Additionally, the code was not friendly for adding new models
under the same framework and focused more on the study of attack models.
Moreover, the code only provided a limited data set and did not include the
data processing method, making it difficult to test the model on a working
public data set. In SDLib222https://github.com/Coder-Yu/SDLib., some defense
models and attack models were provided, but the attack model was outdated and
did not complete the entire process from attack generation to defense
detection and injection into the recommender model. Furthermore, the code
language used in this work was obsolete. Our framework overcomes the
limitations of previous methods by abstracting each component into relatively
independent modules, ensuring the unity and extensibility of the model. This
allows for better maintenance and development of the framework in the future.

Figure 1.  The overall framework of RecAD.  Table 1. Collected data in our library. Dataset | #Users | #Items | #Interations | #Density
---|---|---|---|---
MovieLens-1m* | 5,950 | 3,702 | 567,533 | 0.257%
Yelp* | 54,632 | 34,474 | 1,334,942 | 0.070%
Amazon-Game* | 3,179 | 5,600 | 38, 596 | 0.216%
Book-Crossing | 105,284 | 340,557 | 1,149,780 | 0.003%
Last.FM | 1,892 | 17,632 | 92,834 | 0.278%
Epinions | 116,260 | 41,269 | 188,478 | 0.004%
Gowalla | 107,092 | 1,280,969 | 6,442,892 | 0.005%
*means the dataset is used in the experiments and only kept high-frequency users
and items (at least 10 interactions).
22footnotetext: https://grouplens.org/datasets/movielens/1m/.33footnotetext:
https://www.yelp.com/dataset.

##  3\. The Library-RecAD

The overall framework of RecAD is illustrated in Figure 1. At the bottom, our
library maintains a flat structure for the default hyper-parameters globally,
and the core components are built upon it with automated parameter loading
(see Section 4). Our library abstracts the core modules at three levels: data,
model, and workflow. In the following, we briefly present the designs of these
three core modules.

Figure 2.  Component workflow under different attack knowledge.

###  3.1. Data Module

The data module serves as the fundamental part of the entire library, as it
provides essential runtime information such as batches and indicators of
scale. It takes charge of dataset loading, batch generation, and fake data
manipulation.

####  3.1.1. Dataset Loading

To create an actively-contributed benchmark, it is important to make the
addition of new datasets as easy as possible. Therefore, we have designed the
data module to keep the required dataset formats simple and flexible. At
present, our library only requires the human-readable CSV format with specific
column names to load datasets into explicit or implicit interactions. This
design decision allows users to easily add their own datasets to the library
without having to modify the codebase. Our library already supports multiple
datasets (as shown in Table 1), and we also provide auxiliary functions to
convert datasets from other well-known recommender frameworks, such as RecBole
(Zhao et al., 2021). This provides further flexibility for users to utilize
the datasets that they are familiar with.

####  3.1.2. Batch Generation

Our library prioritizes seamless integration between datasets, models, and
workflows, which presents challenges for batch generation. To address this, we
design a flexible and generic interface (generate_batch). The interface allows
the caller to provide runtime configuration parameters (_e.g._ , pairwise
sampling; binarizing the ratings) and dispatches itself to the corresponding
behavior. This design reduces the workloads on developers who are attempting
to adapt their data and allows them to focus on providing as much runtime
information as possible.

####  3.1.3. Fake Data Manipulation

In our library, we recognize the importance of addressing the manipulation of
fake data during runtime. Specifically, we must account for both the injection
of fake data from attacker models and the filtering of fake data by defense
models. We address this challenge with unified interfaces named inject_data
and filter_data, respectively. These interfaces are called by the attacker and
defense models to manipulate the dataset.

Figure 3.  The models that are supported by RecAD.

###  3.2. Model Module

The model implementation is the most versatile part of the library, and we
offer maximum flexibility to accommodate different approaches. To account for
the similarities and differences between models, we introduce a general base
model and its successors: the victim, attacker, and defense models. Figure 3
presents the models that have been implemented.

####  3.2.1. Base Model

We don’t provide framework-level abstractions for model optimization. Instead,
the models are responsible for their own single-epoch training and evaluation,
which can be implemented through a set of auxiliary functions provided by the
library. This design choice is aimed at reducing the complexity of the
framework and enabling the integration of a wide range of models, without
requiring modification of the framework-level abstractions for each individual
model. To facilitate this, we use unified interfaces (train_step, test_step)
that enable the callers to initiate the training or evaluation process of the
models.

####  3.2.2. Victim Model

Victim models are recommender models, and the library provides a unified
interface for training and testing them. This makes it easy to integrate any
victim model into the library without the need for modification of the core
framework.

####  3.2.3. Attacker Model

In our library, the training of the attacker model shares the same interface
with victim models (_i.e._ train_step). After training, the attacker model
generates the fake data through a unified interface (generate_fake) and then
forwards the contaminated data to the next module. Since the full set of the
dataset is not necessarily exposed (_e.g._ Gray box attacking in Figure 2),
generate_fake should explicitly receive the target dataset as a parameter.

####  3.2.4. Defense Model

The defense model is trained on the attacked data through the same training
interface. The objective of the model is to output a filtered dataset with
fake data removed. Our library summarizes a unified interface generate_filter
to wrap the implementation details of each defense model.

###  3.3. Workflow Module

This module is the corresponding abstraction of different attack knowledge
(Figure 2). The workflow module holds the instantiations of the data module
and model module, controlling the exposure of data and the interaction of
modules. It also contains the boilerplate code for the training loop and
evaluation callbacks (_e.g._ , early stop; report after training).

####  3.3.1. Data Exposure

The data exposure level for different models varies depending on the attack
knowledge settings and the running stages (as shown in Figure 2). For
instance, the attacker model may be exposed separately to full, partial, or
zero training data. Similarly, the victim model may be trained on clean data
initially and later re-trained on the contaminated data during the attack
process. The workflow module in our library is responsible for constructing
the appropriate data flow according to the attack knowledge and ensuring that
no accidental data leakage occurs. This way, our library provides a flexible
and secure environment for implementing and testing various attack and defense
models under different settings.

####  3.3.2. Module Interaction

The interactions between modules vary between attacks. In a white-box attack,
the model has direct access to all the training data, whereas, in a black-box
attack, the model receives feedback from the victim without any access to the
training data. For workflows (Tang et al., 2020; Lin et al., 2022) where no
defense model is involved, the fake data generated by the attacker model flows
directly into the victim’s training without filtering. The workflow module
arranges the dependencies of modules and prevents any inappropriate
interactions between them.

####  3.3.3. Training & Evaluation

In order to better control the data exposure and module interaction, we give
the workflow module the responsibility for launching the training and
evaluation of the contained models. The workflow module contains the
boilerplate codes for wrapping the training loop outside the models’
train_step. Also, we design a hooking mechanism to provide flexibility for
models to set up their evaluation callbacks. This allows models to define
their own evaluation metrics to evaluate the model’s performance at different
stages of the training process.

Figure 4.  A code snippet of module instantiations of RecAD.  Figure 5.  An
illustration of lazy instantiation.

##  4\. USAGE GUIDELINE OF THE LIBRARY

In the following two parts, we first show the typical usage to instantiate the
existing modules of our library, then detail the steps to extend our library
with a new implementation.

###  4.1. Module Instantiations

Attacking a recommender system often involves using multiple datasets and
machine learning models, which makes the training and testing process more
complex than for regular recommender systems. Our library simplifies this
process by exposing the necessary modules to users and providing a unified
interface called _from_config_ for instantiating them (Figure 4). Two kinds of
parameters may be needed from _from_config_ : hyper-parameters and runtime
parameters.

####  4.1.1. Hyper-parameters

Our library employs the hashing table to store all default hyper-parameters of
modules together and offer global access across programs. While instantiating,
our library automatically loads default parameters on-fly from the hashing
table and updates them from the keyword arguments passed by the user. The
decoupling of default hyper-parameters and the actual module implementation
facilitates a quick overview of configurable parameters for the user.

####  4.1.2. Runtime Parameters

Runtime parameters are the parameters that won’t be settled before the
runtime. For example, the model module in Figure 4 normally needs the numbers
of the user and item to create the embeddings when instantiating. Due to the
data injection or data filtering from the attacker model, the actual numbers
of the user and item are not known before the runtime. But the dependency
between the model and data module is clear, and it is burdensome to ask the
user to manually pass in the required instances in the program. Hence, we
implement lazy instantiation (Figure 5) to make runtime parameters transparent
at the user level. The module won’t actually instantiate at the time the user
call _from_config_ if the needed runtime parameters are not passed. Instead,
the workflow will sort out the dependencies between modules and automatically
fill in the required runtime parameters to complete the instantiation. This
decouples the instantiation of modules from the availability of runtime
parameters, making the library more flexible and adaptable to different
scenarios.

###  4.2. Module Extension

In our library, we provide the base class for all the core modules: BaseData,
BaseModel, and BaseWorkflow. We require the extended module must be the
corresponding base class’s subclass so that the necessary abstract interfaces
can be called properly.

Table 2. Overall attack performance on three recommendation datasets.

|  | ML-1M | Yelp | Amazon
---|---|---|---|---
Attack Method | Attack Knowledge | HR@10 | HR@20 | HR@50 | HR@100 | HR@10 | HR@20 | HR@50 | HR@100 | HR@10 | HR@20 | HR@50 | HR@100
No Attacker | None | 0.0050 | 0.0109 | 0.0297 | 0.0656 | 0.0114 | 0.0190 | 0.0375 | 0.0630 | 0.0000 | 0.0000 | 0.0003 | 0.0016
RandomAttacker | White Box | 0.0050 | 0.0082 | 0.0228 | 0.0457 | 0.0078 | 0.0112 | 0.0214 | 0.0362 | 0.0000 | 0.0000 | 0.0000 | 0.0000
SegmentAttack | White Box | 0.0069 | 0.0123 | 0.0288 | 0.0630 | 0.0057 | 0.0083 | 0.0153 | 0.0258 | 0.0397 | 0.0520 | 0.0675 | 0.0832
BandwagonAttack | White Box | 0.0059 | 0.0119 | 0.0267 | 0.0592 | 0.0066 | 0.0114 | 0.0257 | 0.0431 | 0.0050 | 0.0205 | 0.0523 | 0.0854
AverageAttack | White Box | 0.0016 | 0.0044 | 0.0167 | 0.0400 | 0.0053 | 0.0090 | 0.0169 | 0.0284 | 0.0085 | 0.0170 | 0.0463 | 0.0914
WGAN | White Box | 0.0023 | 0.0060 | 0.0149 | 0.0340 | 0.0143 | 0.0177 | 0.0254 | 0.0344 | 0.1646 | 0.1788 | 0.2043 | 0.2226
AIA | Gray Box 20% data | 0.0078 | 0.0180 | 0.0459 | 0.1007 | 0.0187 | 0.0273 | 0.0465 | 0.0686 | 0.0441 | 0.0873 | 0.4278 | 0.4839
AUSH | Gray Box 20% data | 0.0071 | 0.0151 | 0.0434 | 0.0945 | 0.0135 | 0.0217 | 0.0393 | 0.0617 | 0.0583 | 0.1170 | 0.4392 | 0.4805
Legup | Gray Box 20% data | 0.0094 | 0.0130 | 0.0283 | 0.0471 | 0.0068 | 0.0099 | 0.0162 | 0.0242 | 0.1847 | 0.2015 | 0.2286 | 0.2566

####  4.2.1. General Module

Two abstract methods must be implemented for all the modules:

  * •

from_config: users pass arguments to this method to instantiate a new module.
Our library has already implemented the argument sanity checking and
overwriting the default hyper-parameters in the father class. A new module
should assign the default hyper-parameters in this method.

  * •

info_describe: modules interact through this method. The method should return
a hash table with the named variable that this module can expose publicly.

####  4.2.2. Core Modules

The core modules have specialized interfaces that need to be implemented in
addition. We have discussed most of the below interfaces in Section 3.

  * •

Data Module: The most important interface for this module is generate_batch.
The interface should take the caller’s keyword arguments as the input, and
return the correct batches of the dataset for later training or testing.

  * •

Model Module: Right now, three kinds of models are considered: victim model,
attacker model, and defense model. They are all required to be implemented
with two interfaces: train_step and test_step to perform one-epoch training or
testing. Besides, for the attacker model and defense model, generate_fake and
generate_filter need to be implemented, respectively.

  * •

Workflow Module: An interface named execute should be implemented for users to
explicitly launch the whole workflow. Inside the interface, the implementor
should correctly instantiate and arrange the modules.

##  5\. Experiments

This section showcases the application of RecAD by implementing various
representative attackers and detection models. Through a comparison of the
outcomes produced by these models, valuable insights can be derived.

Figure 6.  Performances of attackers before and after detection by
PCASelectUser in the ML-1M dataset.  Table 3. Defense performance against five
representative shilling attackers.

|  | AIA | Legup | WGAN | RandomAttacker | SegmentAttacker
---|---|---|---|---|---|---
|  | Gray Box 20% data | Gray Box 20% data | Gray Box 20% data | White Box | White Box
Detect Method | Data Lable | Precision | Recall | F1-score | Precision | Recall | F1-score | Precision | Recall | F1-score | Precision | Recall | F1-score | Precision | Recall | F1-score
DegreeSAD | True Data | 0.782 | 0.845 | 0.812 | 0.782 | 0.841 | 0.810 | 0.782 | 0.840 | 0.810 | 0.780 | 0.843 | 0.810 | 0.781 | 0.840 | 0.810
| Fake Data | 0.720 | 0.630 | 0.672 | 0.717 | 0.632 | 0.672 | 0.716 | 0.632 | 0.671 | 0.718 | 0.627 | 0.669 | 0.715 | 0.631 | 0.670
CoDetector | True Data | 0.898 | 0.861 | 0.879 | 0.887 | 0.885 | 0.886 | 0.897 | 0.873 | 0.885 | 0.908 | 0.877 | 0.892 | 0.904 | 0.880 | 0.892
| Fake Data | 0.796 | 0.846 | 0.820 | 0.840 | 0.843 | 0.841 | 0.811 | 0.844 | 0.827 | 0.809 | 0.854 | 0.831 | 0.823 | 0.857 | 0.840
BayesDetector | True Data | 0.943 | 0.946 | 0.945 | 0.945 | 0.945 | 0.945 | 0.936 | 0.943 | 0.940 | 0.944 | 0.936 | 0.940 | 0.938 | 0.943 | 0.940
| Fake Data | 0.915 | 0.910 | 0.912 | 0.914 | 0.913 | 0.913 | 0.909 | 0.899 | 0.904 | 0.896 | 0.908 | 0.902 | 0.909 | 0.902 | 0.905
SemiSAD | True Data | 0.895 | 1.000 | 0.945 | 0.911 | 1.000 | 0.954 | 0.921 | 1.000 | 0.959 | 0.903 | 1.000 | 0.949 | 0.892 | 1.000 | 0.943
| Fake Data | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000
PCASelectUser | True Data | 0.953 | 0.985 | 0.969 | 0.954 | 0.986 | 0.970 | 0.954 | 0.986 | 0.970 | 0.952 | 0.983 | 0.967 | 0.952 | 0.983 | 0.967
| Fake Data | 0.100 | 0.034 | 0.050 | 0.170 | 0.057 | 0.086 | 0.170 | 0.057 | 0.086 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000 | 0.000
FAP | True Data | 0.963 | 0.992 | 0.977 | 0.970 | 1.000 | 0.985 | 0.970 | 1.000 | 0.985 | 0.872 | 0.296 | 0.442 | 0.953 | 0.658 | 0.728
| Fake Data | 0.526 | 0.184 | 0.272 | 1.000 | 0.325 | 0.491 | 1.000 | 0.343 | 0.511 | 0.920 | 0.647 | 0.967 | 0.968 | 0.969 | 0.961

###  5.1. Comparison of Attackers

We illustrate the performance of all attackers in three recommendation
datasets in Table 2. The goal of all attackers is to make the target items get
higher rankings, _i.e._ , larger HR@k.

The two gray box methods, AIA and AUSH, exhibit the best performances across
all metrics and datasets, which attests to the efficacy of neural network-
based approaches. In contrast, the performance of Legup is less consistent.
For instance, Legup displays optimal performance with respect to HR@10 in
Amazon, whereas it experiences a decrease in rank, falling to the middle-lower
range, with respect to HR@20, HR@50, and HR@100. Additionally, in Yelp, Legup
performs inadequately across all metrics, and its weak robustness is further
illustrated in Figure 6. The Legup model has been observed to exhibit unstable
performance, which can be attributed to its training methodology that involves
the simultaneous use of three distinct models. This approach has resulted in
the same training instability issues that are commonly associated with GANs.
Specifically, the use of multiple models in training can lead to a lack of
consistency in the learned representations across the different models. This,
in turn, can create conflicts in the optimization process and cause the
model’s performance to become highly dependent on the initialization and
training procedures.

The heuristic method RandomAttacker exhibits the poorest performance across
all metrics and datasets, even when compared to a situation in which no
attacker is utilized. In other words, RandomAttacker not only fails to enhance
the ranking of target items but also results in a lowered ranking for those
items. Due to the highly randomized nature of heuristic attacks, the resulting
attack target can be skewed by the random effects, resulting in a greater
impact of inserting fake users on vulnerable users.

In addition, other methods, including SegmentAttack, BandwagonAttack,
AverageAttack, and WGAN, also occasionally result in a poorer ranking for the
targeted items. Consequently, there remains substantial room for the
development of effective attacker methods in recommender systems. Currently,
the existing methods of attack are characterized by significant limitations,
such as their capacity to target only specific structures of recommendation
algorithms or their limited ability to transfer attacks to models in other
domains.

###  5.2. Comparison of Defenders

We choose three supervised methods (DegreeSAD, CoDetector, and BayesDetector),
one semi-supervised method (SemiSAD), and two unsupervised methods
(PCASelectUser and FAP) to act as defenders, tasked with protecting the victim
model from five attacker models. The goal of these experiments is to evaluate
several defense methods using our framework process.

We present three evaluation metrics for the predicted label results, namely
F1-score, Recall, and Precision. To evaluate the performance of our model, we
split our data into two categories: True Data and Fake Data. True Data refers
to the original real data used to train the recommender system, while Fake
Data represents the fake data generated by attackers. We have provided three
evaluation metrics for each category instead of treating them as a whole, as
we believe that an effective detector should be able to not only successfully
predict fake data but also avoid misclassifying real data. Hence, we hope that
the values for the three metrics corresponding to both types of data are as
high as possible, indicating that the detector models have better defensive
performances from two dimensions.

Based on the data presented in Table 3, it can be observed that although the
three supervised methods may not exhibit the highest performance, they
demonstrate consistent performance against various attacks. Conversely, the
semi-supervised method is not effective in defending against attacks due to
the requirement of more data for training and evaluation, which is restricted
by the attack budget in our approach. Consequently, the semi-supervised method
misclassifies both real and fake data. Among the unsupervised methods, FAP
shows promising results for certain attacks and outperforms other defense
methods, but still displays certain limitations in some metrics.

###  5.3. Robustness of Attackers Encountering Detection

For illustration, we visualize the performance comparison before and after
detection by PCASelectUser. Due to space limitations, we only present the
results in the ML-1M dataset.

From Figure 6, we can observe that the performance of all attack methods will
vary after detection. In heuristic methods, Bandwagon exhibits a notable
difference in performance before and after detection. After detection, there
is a marked decrease in all four HR metrics. The potential reason is that
Bandwagon selects the popular items as users’ fakes preferences, where this
pattern is relatively easier to identify, making the generated data easier to
be detected. In the neural methods, Legup demonstrates a similar phenomenon
with a more significant performance difference before and after detection. In
the HR@10 metric, Legup outperforms all other attacker methods before the
detection, however, it has the worst performance after the detection. On
HR@20, HR@50, and HR@100, it remains to be the worst one after detection. One
possible reason for this is that Legup’s optimization objective is more
complex and it includes a greater number of modules compared to other attacker
methods. Both the two attackers show poor robustness before and after
detection, while other methods exhibited relatively high robustness after
detection.

Counterintuitively, the results of AverageAttack and WGAN demonstrate an
inverse effect: the targeted items rank higher after detection, _i.e._ , the
detection process helps the attackers achieve their purposes. There are two
potential explanations. The first possibility is that this method generates
users that are virtually indistinguishable from real ones, rendering detection
modules theoretically unable to identify them. The second explanation is that
the mechanism by which the method generates fake users was not taken into
account by the detection module, allowing it to evade detection by this
detection method.

###  5.4. Comparison of Defense Evaluation.

In light of the results presented in Figure 6 and Table 3, we have observed
that relying solely on either injection-based or label prediction evaluation
for assessing the performance of defense models may not be adequate. For
instance, in the case of the WGAN method, the injection-based evaluation
indicates that the exposure rate of the target item is even higher after
defense than the direct attack, while the label prediction evaluation suggests
that the current defense approach is more effective in true and false
prediction. Thus, we urge future researchers in this field to use both
evaluation methods to ensure the practical effectiveness of defense models.
Our framework supports both evaluation processes, eliminating the need for
researchers to repeat work.

Figure 7. Attack performance of AIA and Legup with different proportions of
data.

###  5.5. Effect of knowledge of the attackers.

To investigate the impact of the scale of models’ knowledge, _i.e._ , the
quantity of training data for attacker models, on the results, we visualize
the performance of two neural models (AIA and Legup) as the amount of training
data varies. The results are shown in Figure 7. From the results, we observe
that the performance of both models increases as the amount of data increases,
albeit with a slight fluctuation for AIA at x50%. This inspires us to provide
the attack model with more knowledge. However, as we venture into the
exploration of novel attack algorithms, we must also take into consideration
the importance of placing constraints on the known knowledge of these
algorithms. This is particularly crucial, as it creates a trade-off between
the scale of a model’s knowledge and the effectiveness of the attack. Striking
the right balance between these two factors is key to maximizing the potential
impact of new attack algorithms while minimizing their potential negative
consequences. This trade-off raises the critical question of how we can best
manage the scale of models’ knowledge while still maintaining the efficacy of
the attack. This requires a comprehensive understanding of the intricate
interplay between the scale of knowledge and the effectiveness of the attack,
and a willingness to explore new frontiers of research and development in
order to push the boundaries of what is currently possible.

##  6\. Conclusion and future work

Recommender systems have gained significant attention in recent years.
However, the effectiveness and security of these systems have also become
major concerns, as attackers may attempt to manipulate the recommendations for
their own benefit. To promote research in this important field, we introduce
RecAD, a new recommender library that provides a variety of benchmark
datasets, evaluation settings, attackers, and defense models. By using RecAD,
researchers can simulate a range of real-world scenarios and evaluate the
robustness of different recommender systems against a variety of potential
attacks.

In addition to advancing attacks and defenses on traditional models, we also
acknowledge the transformative impact of large language models in the field of
recommender systems (Wang et al., 2023a; Bao et al., 2023; Zhang et al.,
2023). Despite their powerful generative capabilities, these models are also
susceptible to various attacks (Wang et al., 2023b). Therefore, our future
research will also focus on the development of attack and defense mechanisms
specifically tailored to large language model-based recommendations. In order
to address this aim, We call upon researchers to collaborate and establish
recommender system attack and defense methods that better align with the
evolving needs of the field, enhancing the security and robustness of these
models.

## References

  * (1)
  * Aktukmak et al. (2019) Mehmet Aktukmak, Yasin Yilmaz, and Ismail Uysal. 2019\.  Quick and accurate attack detection in recommender systems through user attributes. In _Proceedings of the 13th ACM Conference on Recommender Systems_. ACM, 348–352.
  * Arjovsky et al. (2017) Martin Arjovsky, Soumith Chintala, and Léon Bottou. 2017\.  Wasserstein Generative Adversarial Networks. In _Proceedings of the 34th International Conference on Machine Learning_ , Doina Precup and Yee Whye Teh (Eds.), Vol. 70. PMLR, 214–223.
  * Bao et al. (2023) Keqin Bao, Jizhi Zhang, Yang Zhang, Wenjie Wang, Fuli Feng, and Xiangnan He. 2023\.  TALLRec: An Effective and Efficient Tuning Framework to Align Large Language Model with Recommendation.
  * Bhaumik et al. (2006) Runa Bhaumik, Chad Williams, Bamshad Mobasher, and Robin Burke. 2006.  Securing collaborative filtering against malicious attacks through anomaly detection. In _Proceedings of the 4th workshop on intelligent techniques for web personalization (ITWP’06), Boston_. AAAI, 10.
  * Burke et al. (2005a) Robin Burke, Bamshad Mobasher, and Runa Bhaumik. 2005a.  Limited knowledge shilling attacks in collaborative filtering systems. In _Proceedings of 3rd international workshop on intelligent techniques for web personalization (ITWP), 19th international joint conference on artificial intelligence (IJCAI)_. IJCAI, 17–24.
  * Burke et al. (2005b) R. Burke, B. Mobasher, R. Bhaumik, and C. Williams. 2005b.  Segment-based injection attacks against collaborative filtering recommender systems. In _Fifth IEEE International Conference on Data Mining (ICDM’05)_. IEEE, 4 pp.–.
  * Cao et al. (2013) Jie Cao, Zhiang Wu, Bo Mao, and Yanchun Zhang. 2013\.  Shilling attack detection utilizing semi-supervised learning method for collaborative recommender system.  _World Wide Web_ 16 (2013), 729–748.
  * Davoudi and Chatterjee (2017) Anahita Davoudi and Mainak Chatterjee. 2017.  Detection of profile injection attacks in social recommender systems using outlier analysis. In _2017 IEEE International Conference on Big Data (Big Data)_. IEEE, 2714–2719.
  * Deldjoo et al. (2019) Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2019\.  Assessing the impact of a user-item collaborative attack on class of users.  _arXiv preprint arXiv:1908.07968_ (2019).
  * Dou et al. (2018) Tong Dou, Junliang Yu, Qingyu Xiong, Min Gao, Yuqi Song, and Qianqi Fang. 2018\.  Collaborative shilling detection bridging factorization and user embedding. In _Collaborative Computing: Networking, Applications and Worksharing_. Springer, 459–469.
  * Fan et al. (2021) Wenqi Fan, Tyler Derr, Xiangyu Zhao, Yao Ma, Hui Liu, Jianping Wang, Jiliang Tang, and Qing Li. 2021\.  Attacking black-box recommendations via copying cross-domain user profiles. In _2021 IEEE 37th International Conference on Data Engineering (ICDE)_. IEEE, 1583–1594.
  * Fang et al. (2020) Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. 2020\.  Influence function based data poisoning attacks to top-n recommender systems. In _Proceedings of The Web Conference_. ACM, 3019–3025.
  * Fang et al. (2018a) Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. 2018a.  Poisoning Attacks to Graph-Based Recommender Systems. In _Proceedings of the 34th Annual Computer Security Applications Conference_. Association for Computing Machinery, New York, NY, USA, 381–392.
  * Fang et al. (2018b) Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. 2018b.  Poisoning attacks to graph-based recommender systems. In _Proceedings of the 34th annual computer security applications conference_. ACM, 381–392.
  * Gao et al. (2022) Chongming Gao, Wenqiang Lei, Jiawei Chen, Shiqi Wang, Xiangnan He, Shijun Li, Biao Li, Yuan Zhang, and Peng Jiang. 2022.  Cirs: Bursting filter bubbles by counterfactual interactive recommender system.  _arXiv preprint arXiv:2204.01266_ (2022).
  * Gao et al. (2020) Jianling Gao, Lingtao Qi, Haiping Huang, and Chao Sha. 2020\.  Shilling attack detection scheme in collaborative filtering recommendation system based on recurrent neural network. In _Advances in Information and Communication: Proceedings of the 2020 Future of Information and Communication Conference (FICC), Volume 1_. Springer, 634–644.
  * Goodfellow et al. (2020) Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2020\.  Generative adversarial networks.  _Commun. ACM_ 63, 11 (2020), 139–144.
  * He et al. (2018) Xiangnan He, Zhankui He, Xiaoyu Du, and Tat-Seng Chua. 2018\.  Adversarial personalized ranking for recommendation. In _The 41st International ACM SIGIR conference on research & development in information retrieval_. ACM, 355–364.
  * Huang et al. (2021) Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. 2021\.  Data poisoning attacks to deep learning based recommender systems.  _arXiv preprint arXiv:2101.02644_ (2021).
  * Huang et al. (2007) Zan Huang, Daniel Zeng, and Hsinchun Chen. 2007.  A Comparison of Collaborative-Filtering Recommendation Algorithms for E-commerce.  _IEEE Intelligent Systems_ 22 (2007), 68–78.
  * Kaur and Goel (2016) Parneet Kaur and Shivani Goel. 2016.  Shilling attack models in recommender system. In _ICICT_ , Vol. 2. IEEE, 1–5.
  * Lam and Riedl (2004) Shyong K Lam and John Riedl. 2004.  Shilling recommender systems for fun and profit. In _Proceedings of the 13th international conference on World Wide Web_. ACM, 393–402.
  * Li et al. (2016b) Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. 2016b.  Data poisoning attacks on factorization-based collaborative filtering.  _Advances in neural information processing systems_ 29 (2016).
  * Li et al. (2016a) Wentao Li, Min Gao, Hua Li, Jun Zeng, Qingyu Xiong, and Sachio Hirokawa. 2016a.  Shilling attack detection in recommender systems via selecting patterns analysis.  _IEICE TRANSACTIONS on Information and Systems_ 99, 10 (2016), 2600–2611.
  * Lin et al. (2020) Chen Lin, Si Chen, Hui Li, Yanghua Xiao, Lianyun Li, and Qian Yang. 2020\.  Attacking recommender systems with augmented user profiles. In _Proceedings of the 29th ACM international conference on information & knowledge management_. ACM, 855–864.
  * Lin et al. (2022) Chen Lin, Si Chen, Meifang Zeng, Sheng Zhang, Min Gao, and Hui Li. 2022\.  Shilling Black-Box Recommender Systems by Learning to Generate Fake User Profiles.  _IEEE Transactions on Neural Networks and Learning Systems_ (2022), 1–15.
  * Linden et al. (2003) G. Linden, B. Smith, and J. York. 2003.  Amazon.com recommendations: item-to-item collaborative filtering.  _IEEE Internet Computing_ 7, 1 (2003), 76–80.
  * Liu et al. (2010) Jiahui Liu, Peter Dolan, and Elin Rønby Pedersen. 2010\.  Personalized News Recommendation Based on Click Behavior. In _Proceedings of the 15th International Conference on Intelligent User Interfaces_. ACM, 31–40.
  * Liu et al. (2020) Yang Liu, Xianzhuo Xia, Liang Chen, Xiangnan He, Carl Yang, and Zibin Zheng. 2020\.  Certifiable robustness to discrete adversarial perturbations for factorization machines. In _Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval_. ACM, 419–428.
  * Mehta and Nejdl (2009) Bhaskar Mehta and Wolfgang Nejdl. 2009.  Unsupervised strategies for shilling detection and robust collaborative filtering.  _User Modeling and User-Adapted Interaction_ 19 (2009), 65–97.
  * Mobasher et al. (2007) Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams. 2007.  Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness.  _ACM Transactions on Internet Technology (TOIT)_ 7, 4 (2007), 23–es.
  * O’Mahony et al. (2005) Michael P O’Mahony, Neil J Hurley, and Guénolé CM Silvestre. 2005\.  Recommender systems: Attack types and strategies. In _Association for the Advancement of Artificial Intelligence (AAAI)_. AAAI, 334–339.
  * Rong et al. (2022a) Dazhong Rong, Qinming He, and Jianhai Chen. 2022a.  Poisoning Deep Learning based Recommender Model in Federated Learning Scenarios.  _arXiv preprint arXiv:2204.13594_ (2022).
  * Rong et al. (2022b) Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. 2022b.  Fedrecattack: Model poisoning attack to federated recommendation. In _2022 IEEE 38th International Conference on Data Engineering (ICDE)_. IEEE, 2643–2655.
  * Shahrasbi et al. (2020) Behzad Shahrasbi, Venugopal Mani, Apoorv Reddy Arrabothu, Deepthi Sharma, Kannan Achan, and Sushant Kumar. 2020.  On Detecting Data Pollution Attacks On Recommender Systems Using Sequential GANs.  _CoRR_ abs/2012.02509 (2020).
  * Song et al. (2020) Junshuai Song, Zhao Li, Zehong Hu, Yucheng Wu, Zhenpeng Li, Jian Li, and Jun Gao. 2020.  Poisonrec: an adaptive data poisoning framework for attacking black-box recommender systems. In _2020 IEEE 36th International Conference on Data Engineering (ICDE)_. IEEE, 157–168.
  * Tang et al. (2019) Jinhui Tang, Xiaoyu Du, Xiangnan He, Fajie Yuan, Qi Tian, and Tat-Seng Chua. 2019\.  Adversarial training towards robust multimedia recommender system.  _IEEE Transactions on Knowledge and Data Engineering_ 32, 5 (2019), 855–867.
  * Tang et al. (2020) Jiaxi Tang, Hongyi Wen, and Ke Wang. 2020.  Revisiting adversarially learned injection attacks against recommender systems. In _Proceedings of the 14th ACM Conference on Recommender Systems_. ACM, 318–327.
  * Wang et al. (2023b) Jiongxiao Wang, Zichen Liu, Keun Hee Park, Muhao Chen, and Chaowei Xiao. 2023b.  Adversarial Demonstration Attacks on Large Language Models.
  * Wang et al. (2023a) Wenjie Wang, Xinyu Lin, Fuli Feng, Xiangnan He, and Tat-Seng Chua. 2023a.  Generative Recommendation: Towards Next-generation Recommender Paradigm.
  * Wu et al. (2021) Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, Enhong Chen, and Senchao Yuan. 2021\.  Fight fire with fire: towards robust recommender systems via adversarial poisoning training. In _Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval_. ACM, 1074–1083.
  * Wu et al. (2011) Zhiang Wu, Jie Cao, Bo Mao, and Youquan Wang. 2011\.  Semi-SAD: applying semi-supervised learning to shilling attack detection. In _Proceedings of the fifth ACM conference on Recommender systems_. ACM, 289–292.
  * Xing et al. (2013) Xingyu Xing, Wei Meng, Dan Doozan, Alex C. Snoeren, Nick Feamster, and Wenke Lee. 2013\.  Take This Personally: Pollution Attacks on Personalized Services. In _22nd USENIX Security Symposium (USENIX Security 13)_. USENIX Association, 671–686.
  * Yang et al. (2018) Fan Yang, Min Gao, Junliang Yu, Yuqi Song, and Xinyi Wang. 2018.  Detection of shilling attack based on bayesian model and user embedding. In _2018 IEEE 30th International Conference on Tools with Artificial Intelligence (ICTAI)_. IEEE, 639–646.
  * Yang et al. (2017) Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. 2017\.  Fake Co-visitation Injection Attacks to Recommender Systems. In _Network and Distributed System Security Symposium_.
  * Yi et al. (2022) Jingwei Yi, Fangzhao Wu, Bin Zhu, Yang Yu, Chao Zhang, Guangzhong Sun, and Xing Xie. 2022\.  UA-FedRec: Untargeted Attack on Federated News Recommendation.  _CoRR_ abs/2202.06701 (2022).
  * Yu et al. (2021) Hongtao Yu, Haihong Zheng, Yishu Xu, Ru Ma, Dingli Gao, and Fuzhi Zhang. 2021\.  Detecting group shilling attacks in recommender systems based on maximum dense subtensor mining. In _2021 IEEE International Conference on Artificial Intelligence and Computer Applications_. IEEE, 644–648.
  * Zeller and Felten (2008) William Zeller and Edward W Felten. 2008.  Cross-site request forgeries: Exploitation and prevention.  _The New York Times_ (2008), 1–13.
  * Zhang et al. (2020) Hengtong Zhang, Yaliang Li, Bolin Ding, and Jing Gao. 2020\.  Practical data poisoning attack against next-item recommendation. In _Proceedings of The Web Conference_. ACM, 2458–2464.
  * Zhang et al. (2023) Jizhi Zhang, Keqin Bao, Yang Zhang, Wenjie Wang, Fuli Feng, and Xiangnan He. 2023\.  Is ChatGPT Fair for Recommendation? Evaluating Fairness in Large Language Model Recommendation.
  * Zhang et al. (2021) Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Lizhen Cui, and Xiangliang Zhang. 2021\.  Graph Embedding for Recommendation against Attribute Inference Attacks. In _Proceedings of the Web Conference 2021_. ACM, 3002–3014.
  * Zhang et al. (2022) Xudong Zhang, Zan Wang, Jingke Zhao, and Lanjun Wang. 2022\.  Targeted Data Poisoning Attack on News Recommendation System.  _arXiv preprint arXiv:2203.03560_ (2022).
  * Zhao et al. (2021) Wayne Xin Zhao, Shanlei Mu, Yupeng Hou, Zihan Lin, Yushuo Chen, Xingyu Pan, Kaiyuan Li, Yujie Lu, Hui Wang, Changxin Tian, Yingqian Min, Zhichao Feng, Xinyan Fan, Xu Chen, Pengfei Wang, Wendi Ji, Yaliang Li, Xiaoling Wang, and Ji-Rong Wen. 2021.  RecBole: Towards a Unified, Comprehensive and Efficient Framework for Recommendation Algorithms. In _CIKM_. ACM, 4653–4664.
  * Zhou et al. (2016) Wei Zhou, Junhao Wen, Qingyu Xiong, Min Gao, and Jun Zeng. 2016.  SVM-TIA a shilling attack detection method based on SVM and target item analysis in recommender systems.  _Neurocomputing_ 210 (2016), 197–205.
  * Zhou et al. (2021) Xingchen Zhou, Ming Xu, Yiming Wu, and Ning Zheng. 2021\.  Deep model poisoning attack on federated learning.  _Future Internet_ 13, 3 (2021), 73.