$t_{\mathrm{ion}}^{\mathrm{1.5GHz}}=1.0\times 10^{9}$ yr,
$t_{\mathrm{ion}}^{\mathrm{6GHz}}=2.0\times 10^{9}$ yr, and
$t_{\mathrm{brems}}=1.8\times 10^{8}$ yr. For NGC 4565 we obtain
$t_{\mathrm{syn+IC}}^{\mathrm{1.5GHz}}=3.6\times 10^{7}$ yr,
$t_{\mathrm{syn+IC}}^{\mathrm{6GHz}}=1.8\times 10^{7}$ yr,
$t_{\mathrm{ion}}^{\mathrm{1.5GHz}}=4.9\times 10^{8}$ yr,
$t_{\mathrm{ion}}^{\mathrm{6GHz}}=9.5\times 10^{8}$ yr, and
$t_{\mathrm{brems}}=6.1\times 10^{7}$ yr. Thus, in both galaxies, ionisation
loss rates are at least one order of magnitude lower than those of synchrotron
and IC losses, and can hence be neglected. The same is true for bremsstrahlung
losses in NGC 891, while in NGC 4565 bremsstrahlung losses may have a minor
effect on the spectrum at 1.5 GHz.

##  Appendix C Radio continuum scale heights

In this appendix, we present the scale heights in the individual strips in
both NGC 891 and 4565. In each strip, we have measured scale heights in the
thin disc and thick disc (halo), fitting two-component exponential functions
to the vertical intensity profiles. Scale heights are presented for both $1.5$
and 6 GHz, separately for the total and non-thermal radio continuum emission.
Tables 7 and 8 contain the exponential scale heights of NGC 891 and 4565,
respectively. Table 9 contains the Gaussian scale heights of NGC 4565. In each
strip, we have measured Gaussian scale heights in the thin disc and thick disc
(halo), fitting two-component Gaussian functions to the vertical intensity
profiles.

Table 7: Exponential scale heights of NGC 891 | 1.5 GHz, total |  |  | 1.5 GHz, non-thermal |
---|---|---|---|---|---
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-7.94$ |  0.20 $\pm$ 0.03 |  1.47 $\pm$ 0.08 | 0.28 |  |  0.23 $\pm$ 0.04 |  1.49 $\pm$ 0.09 | 0.24
$-5.29$ |  0.14 $\pm$ 0.01 |  1.36 $\pm$ 0.03 | 0.13 |  |  0.15 $\pm$ 0.01 |  1.37 $\pm$ 0.03 | 0.11
$-2.65$ |  0.18 $\pm$ 0.03 |  1.34 $\pm$ 0.12 | 4.58 |  |  0.20 $\pm$ 0.04 |  1.35 $\pm$ 0.11 | 3.95
0 |  0.14 $\pm$ 0.02 |  1.08 $\pm$ 0.09 | 11.06 |  |  0.14 $\pm$ 0.03 |  1.09 $\pm$ 0.09 | 10.07
2.65 |  0.19 $\pm$ 0.04 |  1.06 $\pm$ 0.09 | 6.45 |  |  0.21 $\pm$ 0.06 |  1.06 $\pm$ 0.09 | 5.58
5.29 |  0.17 $\pm$ 0.02 |  1.35 $\pm$ 0.06 | 1.16 |  |  0.19 $\pm$ 0.02 |  1.35 $\pm$ 0.05 | 0.86
7.94 |  0.17 $\pm$ 0.02 |  1.30 $\pm$ 0.14 | 0.08 |  |  0.21 $\pm$ 0.03 |  1.31 $\pm$ 0.07 | 0.07
average |  0.17 $\pm$ 0.02 |  1.28 $\pm$ 0.14 |  |  |  0.19 $\pm$ 0.03 |  1.29 $\pm$ 0.15 |
|  |  |  |  |  |  |
| 6 GHz, total |  |  | 6 GHz, non-thermal |
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-7.94$ |  0.20 $\pm$ 0.01 |  1.21 $\pm$ 0.09 | 0.25 |  |  0.33 $\pm$ 0.06 |  1.42 $\pm$ 0.27 | 0.25
$-5.29$ |  0.14 $\pm$ 0.01 |  1.16 $\pm$ 0.03 | 0.01 |  |  0.16 $\pm$ 0.01 |  1.19 $\pm$ 0.05 | 0.02
$-2.65$ |  0.16 $\pm$ 0.01 |  1.05 $\pm$ 0.09 | 1.94 |  |  0.18 $\pm$ 0.02 |  1.07 $\pm$ 0.08 | 1.54
0 |  0.13 $\pm$ 0.01 |  0.88 $\pm$ 0.09 | 11.69 |  |  0.14 $\pm$ 0.02 |  0.90 $\pm$ 0.09 | 10.39
2.65 |  0.25 $\pm$ 0.04 |  1.08 $\pm$ 0.29 | 4.77 |  |  0.25 $\pm$ 0.05 |  0.94 $\pm$ 0.18 | 4.34
5.29 |  0.17 $\pm$ 0.01 |  1.17 $\pm$ 0.05 | 0.28 |  |  0.20 $\pm$ 0.01 |  1.17 $\pm$ 0.05 | 0.33
7.94 |  0.15 $\pm$ 0.01 |  1.05 $\pm$ 0.09 | 0.15 |  |  0.17 $\pm$ 0.04 |  1.06 $\pm$ 0.12 | 0.17
average |  0.17 $\pm$ 0.04 |  1.09 $\pm$ 0.10 |  |  |  0.20 $\pm$ 0.06 |  1.11 $\pm$ 0.16 |
Table 8: Exponential scale heights of NGC 4565

| 1.5 GHz, total |  |  | 1.5 GHz, non-thermal |
---|---|---|---|---|---
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-13.85$ |  0.02 $\pm$ 0.01 | 1.50 $\pm$ 0.16 | 0.13 |  |  0.02 $\pm$ 0.11 | 1.35 $\pm$ 0.12 | 0.09
$-6.92$ |  0.02 $\pm$ 0.01 |  1.70 $\pm$ 0.21 | 0.29 |  |  0.02 $\pm$ 0.09 |  1.41 $\pm$ 0.08 | 0.21
0 |  0.03 $\pm$ 0.13⋆ |  1.41 $\pm$ 0.13⋆ | 0.18 |  |  0.18 $\pm$ 0.11⋆ |  1.30 $\pm$ 0.15⋆ | 0.16
6.92 |  0.02 $\pm$ 0.01 |  1.70 $\pm$ 0.22 | 0.52 |  |  0.02 $\pm$ 0.09 |  1.34 $\pm$ 0.11 | 0.19
13.85 |  0.02 $\pm$ 0.01 | 1.36 $\pm$ 0.21 | 0.16 |  |  0.02 $\pm$ 0.01 | 1.19 $\pm$ 0.11 | 0.12
average |  0.02 $\pm$ 0.01 |  1.60 $\pm$ 0.17 |  |  |  0.05 $\pm$ 0.07 |  1.35 $\pm$ 0.06 |
|  |  |  |  |  |  |
| 6 GHz, total |  |  | 6 GHz, non-thermal |
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-13.85$ |  0.02 $\pm$ 0.010 | 2.13 $\pm$ 0.40 | 0.21 |  |  0.53 $\pm$ 0.09 | 4.70 $\pm$ 1.30 | 0.13
$-6.92$ |  0.04 $\pm$ 0.20 |  0.92 $\pm$ 0.16 | 0.24 |  |  0.57 $\pm$ 0.16 |  1.10 $\pm$ 0.28 | 0.22
0 |  0.32 $\pm$ 0.10⋆ |  1.64 $\pm$ 0.41⋆ | 0.23 |  |  0.52 $\pm$ 0.06⋆ |  0.95 $\pm$ 0.30⋆ | 0.26
6.92 |  0.02 $\pm$ 0.04⋆ |  1.53 $\pm$ 0.29⋆ | 0.51 |  |  0.02 $\pm$ 0.32 |  0.95 $\pm$ 0.18 | 0.25
13.85 |  0.02 $\pm$ 0.08 | 2.47 $\pm$ 1.07 | 0.23 |  |  0.40 $\pm$ 0.12 | 3.30 $\pm$ 0.96 | 0.22
average |  0.08 $\pm$ 0.13 |  1.36 $\pm$ 0.39 |  |  |  0.41 $\pm$ 0.20 |  1.00 $\pm$ 0.09 |

Notes. Only the inner three strips were used to compute the scale heights of
the halo emission.
⋆Average values of the separately determined scale heights on the northern and
southern side of the mid-plane.

Table 9: Gaussian scale heights of NGC 4565

| 1.5 GHz, total |  |  | 1.5 GHz, non-thermal |
---|---|---|---|---|---
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-13.85$ |  0.01 $\pm$ 0.01 |  2.76 $\pm$ 0.42 | 0.13 |  |  0.02 $\pm$ 0.01 |  2.50 $\pm$ 0.09 | 0.08
$-6.92$ |  0.02 $\pm$ 0.01 |  3.05 $\pm$ 0.21 | 0.18 |  |  0.02 $\pm$ 0.16 |  2.65 $\pm$ 0.12 | 0.13
0 |  0.29 $\pm$ 0.10 |  2.87 $\pm$ 0.22 | 0.13 |  |  0.58 $\pm$ 0.06 |  2.95 $\pm$ 0.16 | 0.10
6.92 |  0.01 $\pm$ 0.02 |  3.34 $\pm$ 0.80 | 0.59 |  |  0.02 $\pm$ 0.02 |  2.59 $\pm$ 0.29 | 0.26
13.85 |  0.03 $\pm$ 0.01 |  2.84 $\pm$ 0.40 | 0.16 |  |  0.67 $\pm$ 0.13 |  3.30 $\pm$ 0.59 | 0.12
average |  0.07 $\pm$ 0.11 |  2.97 $\pm$ 0.21 |  |  |  0.26 $\pm$ 0.30 |  2.80 $\pm$ 0.29 |
|  |  |  |  |  |  |
| 6 GHz, total |  |  | 6 GHz, non-thermal |
$r$ [kpc] |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$ |  |  $h_{\mathrm{disc}}$ [kpc] |  $h_{\mathrm{halo}}$ [kpc] | $\chi^{2}_{\mathrm{red}}$
$-13.85$ |  0.02 $\pm$ 0.27 |  4.56 $\pm$ 0.64 | 0.16 |  |  0.70 $\pm$ 0.07 |  6.16 $\pm$ 1.24 | 0.06
$-6.92$ |  0.13 $\pm$ 0.10 |  1.71 $\pm$ 0.38 | 0.12 |  |  1.03 $\pm$ 0.10 |  5.50 $\pm$ 1.13 | 0.16
0 |  0.59 $\pm$ 0.07 |  3.35 $\pm$ 1.06 | 0.24 |  |  1.06 $\pm$ 0.15 |  1.13 $\pm$ 0.21 | 0.23
6.92 |  0.20 $\pm$ 0.12⋆ |  2.73 $\pm$ 0.19⋆ | 0.09 |  |  0.28 $\pm$ 0.23⋆ |  2.13 $\pm$ 0.36⋆ | 0.03
13.85 |  0.02 $\pm$ 0.15 |  7.39 $\pm$ 2.82 | 0.17 |  |  0.57 $\pm$ 0.14 |  9.61 $\pm$ 1.54 | 0.16
average |  0.19 $\pm$ 0.21 |  3.95 $\pm$ 1.95 |  |  |  0.73 $\pm$ 0.29 |  4.92 $\pm$ 3.03 |

Notes.
⋆ Average values of the separately determined scale heights on the northern
and southern side of the mid-plane.

##  Appendix D CR transport models

###  D.1 NGC 891

In this appendix, we present the best-fitting advection and diffusion cosmic-
ray transport models in the individual strips in NGC 891. In Table 10, the
best-fitting parameters are presented for a constant advection speed; the
corresponding best-fitting intensity and spectral index profiles are presented
in Fig. 17. In Table 11 we present the best-fitting parameters for advection
with a linearly accelerating advection velocity; the corresponding best-
fitting intensity and spectral index profiles are presented in Fig. 12. In
Table 12 we present the best-fitting parameters for diffusion with an energy
dependent diffusion coefficient assuming $\mu=0.5$; the corresponding best-
fitting intensity and spectral index profiles are presented in Fig. 18.

###  D.2 NGC 4565

In this appendix, we present the best-fitting advection and diffusion cosmic-
ray transport models in the individual strips in NGC 4565. In Table 13, the
best-fitting parameters are presented for a constant advection speed; the
corresponding best-fitting intensity and spectral index profiles are presented
in Fig. 19. In Table 14 we present the best-fitting parameters for advection
with a linearly accelerating advection velocity; the corresponding best-
fitting intensity and spectral index profiles are presented in Fig. 20. In
Table 15 we present the best-fitting parameters for diffusion with an energy
dependent diffusion coefficient assuming $\mu=0.5$; the corresponding best-
fitting intensity and spectral index profiles are presented in Fig. 21. In
Table 16 we present the best-fitting parameters for diffusion with an energy
dependent diffusion coefficient assuming $\mu=0.3$; the corresponding best-
fitting intensity and spectral index profiles are presented in Fig. 22. In
Table 17 we present the best-fitting parameters for diffusion with an energy
independent diffusion coefficient; the corresponding best-fitting intensity
and spectral index profiles are presented in Fig. 13.

Table 10: Advection models with a constant advection speed for NGC 891.

$r$ [kpc] |  $V$ [$\mathrm{km\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B1}}$ [kpc] | $h_{\mathrm{B1}}/h_{\mathrm{B1,eq}}$ |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---|---|---
$-7.94$ N |  110 ${}^{+30}_{-20}$ | 9.0 | 0.30 | 0.34 |  5.0 ${}^{+2.5}_{-1.3}$ | 0.83 | 1.22
$-7.94$ S |  150 ${}^{+100}_{-40}$ | 9.0 | 0.30 | 0.34 |  4.1 ${}^{+1.8}_{-1.0}$ | 0.68 | 0.41
$-5.29$ N |  160 ${}^{+40}_{-30}$ | 11.2 | 0.20 | 0.35 |  3.4 ${}^{+0.4}_{-0.4}$ | 0.62 | 0.30
$-5.29$ S |  210 ${}^{+110}_{-40}$ | 11.2 | 0.20 | 0.35 |  3.2 ${}^{+0.2}_{-0.3}$ | 0.58 | 0.26
$-2.65$ N |  160 ${}^{+20}_{-20}$ | 12.0 | 0.30 | 0.39 |  3.7 ${}^{+1.3}_{-0.7}$ | 0.69 | 1.00
$-2.65$ S |  170 ${}^{+30}_{-30}$ | 12.0 | 0.30 | 0.39 |  3.6 ${}^{+1.4}_{-0.7}$ | 0.67 | 0.16
0 N |  140 ${}^{+30}_{-10}$ | 13.2 | 0.20 | 0.38 |  2.7 ${}^{+0.5}_{-0.5}$ | 0.61 | 0.29
0 S |  140 ${}^{+40}_{-20}$ | 13.2 | 0.20 | 0.38 |  2.7 ${}^{+0.6}_{-0.6}$ | 0.61 | 1.14
2.65 N |  150 ${}^{+40}_{-10}$ | 11.5 | 0.30 | 0.37 |  2.7 ${}^{+0.7}_{-0.6}$ | 0.64 | 0.07
2.65 S |  170 ${}^{+80}_{-20}$ | 11.5 | 0.30 | 0.37 |  2.6 ${}^{+0.6}_{-0.6}$ | 0.62 | 1.30
5.29 N |  140 ${}^{+40}_{-20}$ | 10.1 | 0.25 | 0.35 |  3.5 ${}^{+0.5}_{-0.5}$ | 0.65 | 0.18
5.29 S |  170 ${}^{+60}_{-10}$ | 10.1 | 0.25 | 0.35 |  3.2 ${}^{+0.3}_{-0.4}$ | 0.59 | 1.36
7.94 N |  130 ${}^{+60}_{-30}$ | 9.3 | 0.25 | 0.31 |  3.3 ${}^{+0.9}_{-0.6}$ | 0.63 | 0.36
7.94 S |  140 ${}^{+90}_{-20}$ | 9.3 | 0.25 | 0.31 |  3.2 ${}^{+0.5}_{-0.7}$ | 0.62 | 1.36

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$V$: advection speed; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Table 11: Advection models with an accelerating advection speed for NGC 891.

$r$ [kpc] |  $V_{0}$ [$\mathrm{km\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B1}}$ [kpc] | $h_{\mathrm{B1}}/h_{\mathrm{B1,eq}}$ |  $h_{\mathrm{B2}}$ ($\overset{!}{=}h_{\mathrm{B2,eq}}$) [kpc] |  $h_{V}$ [kpc] |  $h_{\mathrm{esc}}$ [kpc] | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---|---|---|---
$-7.94$ N |  110 ${}^{+20}_{-20}$ | 9.0 | 0.30 | 0.34 | 6.0 |  20.0 ${}^{+\infty}_{-16.0}$ |  58.0 ${}^{+\infty}_{-32.1}$ | 1.20
$-7.94$ S |  150 ${}^{+80}_{-40}$ | 9.0 | 0.30 | 0.34 | 6.0 |  9.6 ${}^{+56.9}_{-4.6}$ |  17.9 ${}^{+64.7}_{-7.5}$ | 0.44
$-5.29$ N |  150 ${}^{+30}_{-20}$ | 11.2 | 0.20 | 0.35 | 5.5 |  6.6 ${}^{+5.2}_{-1.0}$ |  14.3 ${}^{+6.5}_{-2.2}$ | 0.28
$-5.29$ S |  210 ${}^{+100}_{-40}$ | 11.2 | 0.20 | 0.35 | 5.5 |  4.7 ${}^{+2.2}_{-0.2}$ |  5.9 ${}^{+3.6}_{-1.4}$ | 0.28
$-2.65$ N |  150 ${}^{+20}_{-10}$ | 12.0 | 0.30 | 0.39 | 5.4 |  9.9 ${}^{+\infty}_{-4.0}$ |  25.9 ${}^{+\infty}_{-4.7}$ | 0.84
$-2.65$ S |  160 ${}^{+40}_{-20}$ | 12.0 | 0.30 | 0.39 | 5.4 |  9.0 ${}^{+213}_{-3.6}$ |  21.6 ${}^{+211}_{-4.2}$ | 0.19
0 N |  130 ${}^{+30}_{-10}$ | 13.2 | 0.20 | 0.38 | 4.4 |  4.9 ${}^{+6.8}_{-1.6}$ |  15.6 ${}^{+10.2}_{-2.5}$ | 0.29
0 S |  140 ${}^{+30}_{-20}$ | 13.2 | 0.20 | 0.38 | 4.4 |  4.6 ${}^{+7.1}_{-1.5}$ |  13.2 ${}^{+9.3}_{-2.4}$ | 1.21
2.65 N |  150 ${}^{+30}_{-20}$ | 11.5 | 0.30 | 0.37 | 4.2 |  5.2 ${}^{+8.8}_{-2.1}$ |  13.6 ${}^{+10.1}_{-2.8}$ | 0.09
2.65 S |  170 ${}^{+60}_{-30}$ | 11.5 | 0.30 | 0.37 | 4.2 |  4.6 ${}^{+7.1}_{-1.9}$ |  10.1 ${}^{+6.9}_{-2.2}$ | 1.26
5.29 N |  140 ${}^{+30}_{-20}$ | 10.1 | 0.25 | 0.35 | 5.4 |  6.8 ${}^{+9.0}_{-1.6}$ |  16.3 ${}^{+11.9}_{-3.0}$ | 0.12
5.29 S |  180 ${}^{+70}_{-40}$ | 10.1 | 0.25 | 0.35 | 5.4 |  5.4 ${}^{+4.3}_{-1.1}$ |  8.9 ${}^{+5.0}_{-2.3}$ | 1.20
7.94 N |  120 ${}^{+60}_{-20}$ | 9.3 | 0.25 | 0.31 | 5.2 |  6.6 ${}^{+20.6}_{-2.3}$ |  17.0 ${}^{+35.1}_{-4.8}$ | 0.30
7.94 S |  150 ${}^{+70}_{-30}$ | 9.3 | 0.25 | 0.31 | 5.2 |  5.2 ${}^{+8.3}_{-1.3}$ |  9.7 ${}^{+10.6}_{-2.6}$ | 1.20

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$V_{0}$: initial advection speed in the mid-plane; $B_{0}$: mid-plane magnetic
field strength; $h_{\mathrm{B1}}$: scale height of the disc magnetic field;
$h_{\mathrm{B2}}$: scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $h_{V}$: height where
$V=2V_{0}$; $h_{\mathrm{esc}}$: height where $V=V_{\mathrm{esc}}$;
$\chi^{2}_{I}$: reduced $\chi^{2}$ of the fit to the intensity profile;
$\chi^{2}_{\alpha}$: reduced $\chi^{2}$ of the fit to the spectral index
profile.

Table 12: Diffusion models with an energy-dependent diffusion coefficient
($\mu=0.5$) for NGC 891.

$r$ [kpc] |  $D_{0}$ [$\mathrm{10^{28}\,cm^{2}\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B1}}$ [kpc] | $h_{\mathrm{B1}}/h_{\mathrm{B1,eq}}$ |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---|---|---
$-7.94$ N |  2.5 ${}^{+2.5}_{-0.8}$ | 9.0 | 0.40 | 0.43 |  8.0 ${}^{+10.5}_{-3.2}$ | 1.33 | 1.35
$-7.94$ S |  2.0 ${}^{+7.5}_{-0.4}$ | 9.0 | 0.40 | 0.43 |  8.7 ${}^{+9.7}_{-4.3}$ | 1.45 | 0.84
$-5.29$ N |  2.0 ${}^{+0.5}_{-0.2}$ | 11.2 | 0.25 | 0.42 |  6.0 ${}^{+0.9}_{-1.2}$ | 1.09 | 2.49
$-5.29$ S |  2.5 ${}^{+1.0}_{-0.5}$ | 11.2 | 0.25 | 0.42 |  5.2 ${}^{+1.2}_{-0.7}$ | 0.95 | 1.03
$-2.65$ N |  2.5 ${}^{+0.5}_{-0.5}$ | 12.0 | 0.25 | 0.31 |  4.6 ${}^{+2.1}_{-1.2}$ | 0.85 | 2.86
$-2.65$ S |  2.5 ${}^{+0.5}_{-0.5}$ | 12.0 | 0.25 | 0.31 |  4.6 ${}^{+1.3}_{-1.2}$ | 0.85 | 1.06
0 N |  2.5 ${}^{+1.0}_{-0.4}$ | 13.2 | 0.20 | 0.36 |  3.7 ${}^{+1.2}_{-1.0}$ | 0.84 | 0.31
0 S |  1.5 ${}^{+0.5}_{-0.1}$ | 13.2 | 0.20 | 0.36 |  3.8 ${}^{+1.5}_{-1.1}$ | 0.86 | 3.63
2.65 N |  2.0 ${}^{+0.5}_{-0.2}$ | 11.5 | 0.35 | 0.42 |  4.8 ${}^{+3.0}_{-1.6}$ | 1.14 | 0.59
2.65 S |  2.5 ${}^{+2.0}_{-0.5}$ | 11.5 | 0.35 | 0.42 |  4.0 ${}^{+2.9}_{-1.2}$ | 0.95 | 2.15
5.29 N |  2.0 ${}^{+1.0}_{-0.3}$ | 10.1 | 0.30 | 0.39 |  6.1 ${}^{+1.8}_{-1.7}$ | 1.13 | 0.63
5.29 S |  3.5 ${}^{+54.0}_{-1.0}$ | 10.1 | 0.30 | 0.39 |  3.9 ${}^{+1.0}_{-0.9}$ | 0.72 | 1.43
7.94 N |  2.0 ${}^{+11.0}_{-0.5}$ | 9.3 | 0.35 | 0.42 |  5.8 ${}^{+3.4}_{-2.3}$ | 1.12 | 0.55
7.94 S |  2.5 ${}^{+\infty}_{-0.5}$ | 9.3 | 0.35 | 0.42 |  5.1 ${}^{+1.4}_{-1.9}$ | 0.98 | 1.54

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$D_{0}$: diffusion coefficient [$D(E)=D_{0}(E/1\leavevmode\nobreak\ {\rm
GeV})^{\,\mu}$]; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Figure 17: Advection models with a constant advection speed for NGC 891. Data
points denote the vertical profile of the non-thermal spectral index between
1.5 and 6 GHz (left panels) and the exponential model of the non-thermal
intensity profile at 1.5 GHz (right panels). The radial position of each
profile is given in the right-hand-side plot; $r<0$ is east of the minor axis
and $r>0$ is west of the minor axis. Positive $z$ values are on the north side
and negative ones on the south side of the mid-plane. The solid lines show the
best-fitting advection models.

Figure 18: Diffusion models with an energy-dependent diffusion coefficient
[$D(E)=D_{0}(E/{1\leavevmode\nobreak\ \rm GeV})^{\mu}$] for NGC 891 (assuming
$\mu=0.5$). Data points denote the vertical profile of the non-thermal
spectral index between 1.5 and 6 GHz (left panels) and the exponential model
of the non-thermal intensity profile at 1.5 GHz (right panels). The radial
position of each profile is given in the right-hand-side plot; $r<0$ is east
of the minor axis and $r>0$ is west of the minor axis. Positive $z$ values are
on the north side and negative ones on the south side of the mid-plane. Solid
lines show the best-fitting diffusion models. Table 13: Advection models with
a constant advection speed for NGC 4565.

$r$ [kpc] |  $V$ [$\mathrm{km\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---
$-13.85$ N |  100 ${}^{+\infty}_{-50}$ | 5.5 |  3.4 ${}^{+6.2}_{-1.2}$ | 0.61 | 0.05
$-13.85$ S |  120 ${}^{+3700}_{-50}$ | 5.5 |  3.2 ${}^{+2.1}_{-1.0}$ | 0.57 | 0.06
$-6.92$ N |  80 ${}^{+50}_{-20}$ | 6.4 |  4.2 ${}^{+2.9}_{-1.2}$ | 0.72 | 0.46
$-6.92$ S |  80 ${}^{+60}_{-10}$ | 6.4 |  4.2 ${}^{+1.3}_{-1.3}$ | 0.72 | 0.17
0 N |  120 ${}^{+140}_{-50}$ | 6.3 |  3.6 ${}^{+3.5}_{-1.5}$ | 0.67 | 0.07
0 S |  110 ${}^{+250}_{-20}$ | 6.3 |  3.7 ${}^{+2.4}_{-1.6}$ | 0.69 | 0.20
6.92 N |  280 ${}^{+\infty}_{-160}$ | 6.5 |  3.1 ${}^{+1.5}_{-0.8}$ | 0.55 | 0.08
6.92 S |  80 ${}^{+70}_{-20}$ | 6.5 |  4.4 ${}^{+6.0}_{-1.7}$ | 0.79 | 0.05
13.85 N |  70 ${}^{+610}_{-20}$ | 5.2 |  3.0 ${}^{+5.9}_{-2.4}$ | 0.61 | 0.31
13.85 S |  90 ${}^{+\infty}_{-50}$ | 5.2 |  3.1 ${}^{+116}_{-2.6}$ | 0.63 | 0.41

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$V$: advection speed; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Table 14: Advection models with an accelerating advection speed for NGC 4565.

$r$ [kpc] |  $V_{0}$ [$\mathrm{km\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B2}}$ ($\overset{!}{=}h_{\mathrm{B2,eq}}$) [kpc] |  $h_{V}$ [kpc] |  $h_{\mathrm{esc}}$ [kpc] | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---|---
$-13.85$ N |  90 ${}^{+\infty}_{-40}$ | 5.5 | 5.6 |  6.4 ${}^{+\infty}_{-4.3}$ |  24.7 ${}^{+\infty}_{-16.4}$ | 0.05
$-13.85$ S |  100 ${}^{+2200}_{-30}$ | 5.5 | 5.6 |  5.7 ${}^{+74.6}_{-3.5}$ |  19.2 ${}^{+472}_{-10.5}$ | 0.07
$-6.92$ N |  80 ${}^{+50}_{-20}$ | 6.4 | 5.8 |  10.0 ${}^{+\infty}_{-6.0}$ |  55.5 ${}^{+\infty}_{-22.7}$ | 0.42
$-6.92$ S |  80 ${}^{+50}_{-10}$ | 6.4 | 5.8 |  10.0 ${}^{+62.0}_{-6.2}$ |  55.5 ${}^{+208}_{-21.4}$ | 0.09
0 N |  120 ${}^{+220}_{-50}$ | 6.3 | 5.4 |  6.9 ${}^{+\infty}_{-5.0}$ |  23.2 ${}^{+\infty}_{-12.6}$ | 0.09
0 S |  100 ${}^{+230}_{-30}$ | 6.3 | 5.4 |  9.2 ${}^{+\infty}_{-7.3}$ |  39.0 ${}^{+\infty}_{-20.4}$ | 0.22
6.92 N |  280 ${}^{+\infty}_{-160}$ | 6.5 | 5.6 |  4.4 ${}^{+16.2}_{-2.1}$ |  3.8 ${}^{+\infty}_{-1.0}$ | 0.11
6.92 S |  80 ${}^{+60}_{-20}$ | 6.5 | 5.6 |  13.7 ${}^{+\infty}_{-10.6}$ |  76.0 ${}^{+\infty}_{-38.3}$ | 0.05
13.85 N |  70 ${}^{+130}_{-50}$ | 5.2 | 4.9 |  4.7 ${}^{+\infty}_{-4.6}$ |  24.7 ${}^{+\infty}_{-18.6}$ | 0.27
13.85 S |  80 ${}^{+\infty}_{-60}$ | 5.2 | 4.9 |  6.6 ${}^{+\infty}_{-6.5}$ |  29.5 ${}^{+\infty}_{-22.0}$ | 0.40

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$V_{0}$: initial advection speed in the mid-plane; $B_{0}$: mid-plane magnetic
field strength; $h_{\mathrm{B1}}$: scale height of the disc magnetic field;
$h_{\mathrm{B2}}$: scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $h_{V}$: height where
$V=2V_{0}$; $h_{\mathrm{esc}}$: height where $V=V_{\mathrm{esc}}$;
$\chi^{2}_{I}$: reduced $\chi^{2}$ of the fit to the intensity profile;
$\chi^{2}_{\alpha}$: reduced $\chi^{2}$ of the fit to the spectral index
profile.

Table 15: Diffusion models with an energy-dependent diffusion coefficient for
NGC 4565 ($\mu=0.5$).

$r$ [kpc] |  $D_{0}$ [$\mathrm{10^{28}\,cm^{2}\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---
$-13.85$ N |  1.5 ${}^{+1.0}_{-0.5}$ | 5.5 |  10 ${}^{+\infty}_{-4}$ | 1.96 | 0.40
$-13.85$ S |  1.5 ${}^{+1.0}_{-0.5}$ | 5.5 |  10 ${}^{+\infty}_{-4}$ | 1.96 | 0.48
$-6.92$ N |  2.0 ${}^{+0.5}_{-0.5}$ | 6.4 |  20 ${}^{+15}_{-6}$ | 3.70 | 1.43
$-6.92$ S |  2.0 ${}^{+0.5}_{-0.5}$ | 6.4 |  20 ${}^{+15}_{-6}$ | 3.70 | 1.25
0 N |  3.0 ${}^{+1.0}_{-0.5}$ | 6.3 |  18 ${}^{+\infty}_{-8}$ | 3.00 | 0.32
0 S |  3.0 ${}^{+1.0}_{-0.5}$ | 6.3 |  18 ${}^{+\infty}_{-8}$ | 3.00 | 0.59
6.92 N |  2.0 ${}^{+3.0}_{-0.5}$ | 6.5 |  17 ${}^{+83}_{-11}$ | 3.21 | 0.22
6.92 S |  2.0 ${}^{+3.0}_{-0.5}$ | 6.5 |  16 ${}^{+84}_{-10}$ | 3.02 | 0.83
13.85 N |  2.0 ${}^{+\infty}_{-1.0}$ | 5.2 |  25 ${}^{+\infty}_{-19}$ | 3.73 | 0.49
13.85 S |  2.0 ${}^{+\infty}_{-1.0}$ | 5.2 |  25 ${}^{+\infty}_{-19}$ | 3.73 | 0.72

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$D_{0}$: diffusion coefficient [$D(E)=D_{0}(E/{\rm 1\leavevmode\nobreak\
GeV})^{\,\mu}$]; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Table 16: Diffusion models with an energy-dependent diffusion coefficient for
NGC 4565 ($\mu=0.3$).

$r$ [kpc] |  $D_{0}$ [$\mathrm{10^{28}\,cm^{2}\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---
$-13.85$ N |  1.5 ${}^{+3.0}_{-0.5}$ | 5.5 |  27 ${}^{+\infty}_{-19}$ | 5.29 | 0.13
$-13.85$ S |  2.5 ${}^{+3.0}_{-1.5}$ | 5.5 |  9 ${}^{+\infty}_{-2}$ | 1.76 | 0.60
$-6.92$ N |  3.0 ${}^{+0.5}_{-0.5}$ | 6.4 |  16 ${}^{+54}_{-6}$ | 2.96 | 0.74
$-6.92$ S |  3.0 ${}^{+0.5}_{-0.5}$ | 6.4 |  16 ${}^{+54}_{-6}$ | 2.96 | 0.57
0 N |  4.0 ${}^{+2.0}_{-0.5}$ | 6.3 |  21 ${}^{+\infty}_{-11}$ | 3.50 | 0.23
0 S |  4.0 ${}^{+2.0}_{-0.5}$ | 6.3 |  21 ${}^{+\infty}_{-11}$ | 3.50 | 0.41
6.92 N |  3.5 ${}^{+3.5}_{-1.0}$ | 6.5 |  11 ${}^{+\infty}_{-6}$ | 2.08 | 0.35
6.92 S |  2.5 ${}^{+4.5}_{-0.5}$ | 6.5 |  25 ${}^{+\infty}_{-19}$ | 4.72 | 0.48
13.85 N |  2.5 ${}^{+\infty}_{-1.0}$ | 5.2 |  32 ${}^{+\infty}_{-25}$ | 4.78 | 0.35
13.85 S |  2.5 ${}^{+\infty}_{-1.0}$ | 5.2 |  32 ${}^{+\infty}_{-25}$ | 4.78 | 0.69

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$D_{0}$: diffusion coefficient [$D(E)=D_{0}(E/{\rm 1\leavevmode\nobreak\
GeV})^{\,\mu}$]; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Table 17: Diffusion models with no energy dependency of the diffusion
coefficient for NGC 4565 ($\mu=0$).

$r$ [kpc] |  $D_{0}$ [$\mathrm{10^{28}\,cm^{2}\,s^{-1}}$] |  $B_{0}$ [$\mu$G] |  $h_{\mathrm{B2}}$ [kpc] | $h_{\mathrm{B2}}/h_{\mathrm{B2,eq}}$ | $\chi^{2}_{I}+\chi^{2}_{\alpha}$
---|---|---|---|---|---
$-13.85$ N |  2.5 ${}^{+4.0}_{-0.5}$ | 5.5 |  27 ${}^{+\infty}_{-21}$ | 5.29 | 0.06
$-13.85$ S |  3.5 ${}^{+3.0}_{-1.0}$ | 5.5 |  12 ${}^{+32}_{-5}$ | 2.35 | 0.58
$-6.92$ N |  4.5 ${}^{+0.5}_{-1.0}$ | 6.4 |  19 ${}^{+48}_{-7}$ | 3.52 | 0.67
$-6.92$ S |  4.5 ${}^{+0.5}_{-0.5}$ | 6.4 |  19 ${}^{+48}_{-7}$ | 3.52 | 0.65
0 N |  5.5 ${}^{+1.0}_{-0.5}$ | 6.3 |  34 ${}^{+100}_{-10}$ | 5.67 | 0.59
0 S |  5.5 ${}^{+1.0}_{-0.5}$ | 6.3 |  34 ${}^{+100}_{-10}$ | 5.67 | 0.28
6.92 N |  8.0 ${}^{+7.0}_{-3.0}$ | 6.5 |  8 ${}^{+24}_{-2}$ | 1.51 | 0.58
6.92 S |  4.0 ${}^{+11.0}_{-1.0}$ | 6.5 |  24 ${}^{+\infty}_{-18}$ | 4.53 | 0.17
13.85 N |  4.5 ${}^{+6.5}_{-2.0}$ | 5.2 |  28 ${}^{+\infty}_{-20}$ | 4.18 | 0.29
13.85 S |  4.5 ${}^{+6.5}_{-2.0}$ | 5.2 |  29 ${}^{+\infty}_{-21}$ | 4.33 | 0.67

Notes. ”N” denotes north of the mid-plane, ”S” denotes south of the mid-plane;
$D_{0}$: diffusion coefficient [$D(E)=D_{0}(E/{\rm 1\leavevmode\nobreak\
GeV})^{\,\mu}$]; $B_{0}$: mid-plane magnetic field strength;
$h_{\mathrm{B1}}$: scale height of the disc magnetic field; $h_{\mathrm{B2}}$:
scale height of the halo magnetic field;
$h_{\mathrm{B1,eq}},h_{\mathrm{B2,eq}}$: scale height of the disc or halo
magnetic field if energy equipartition is assumed; $\chi^{2}_{I}$: reduced
$\chi^{2}$ of the fit to the intensity profile; $\chi^{2}_{\alpha}$: reduced
$\chi^{2}$ of the fit to the spectral index profile.

Figure 19: Advection models with a constant advection speed for NGC 4565. Data
points denote the vertical profile of the non-thermal spectral index between
1.5 and 6 GHz (left panels) and the exponential model of the non-thermal
intensity profile at 1.5 GHz (right panels). The radial position of each
profile is given in the right-hand-side plot; $r<0$ is east of the minor axis
and $r>0$ is west of the minor axis. Positive $z$ values are on the north side
and negative ones on the south side of the mid-plane. Solid lines show the
best-fitting advection models.

Figure 20: Advection models with an accelerating advection speed for NGC 4565.
Data points denote the vertical profile of the non-thermal spectral index
between 1.5 and 6 GHz (left panels) and the exponential model of the non-
thermal intensity profile at 1.5 GHz (right panels). The radial position of
each profile is given in the right-hand-side plot; $r<0$ is east of the minor
axis and $r>0$ is west of the minor axis. Positive $z$ values are on the north
side and negative ones on the south side of the mid-plane. Solid lines show
the best-fitting advection models.

Figure 21: Diffusion models with an energy-dependent diffusion coefficient
[$D(E)=D_{0}(E/{1\leavevmode\nobreak\ \rm GeV})^{\mu}$] for NGC 4565 (assuming
$\mu=0.5$). Data points denote the vertical profile of the non-thermal
spectral index between 1.5 and 6 GHz (left panels) and the Gaussian model of
the non-thermal intensity profile at 1.5 GHz (right panels). The radial
position of each profile is given in the right-hand-side plot; $r<0$ is east
of the minor axis and $r>0$ is west of the minor axis. Positive $z$ values are
on the north side and negative ones on the south side of the mid-plane. Solid
lines show the best-fitting diffusion models.

Figure 22: Diffusion models with an energy-dependent diffusion coefficient
[$D(E)=D_{0}(E/{1\leavevmode\nobreak\ \rm GeV})^{\mu}$] for NGC 4565 (assuming
$\mu=0.3$). Data points denote the vertical profile of the non-thermal
spectral index between 1.5 and 6 GHz (left panels) and the Gaussian model of
the non-thermal intensity profile at 1.5 GHz (right panels). The radial
position of each profile is given in the right-hand-side plot; $r<0$ is east
of the minor axis and $r>0$ is west of the minor axis. Positive $z$ values are
on the north side and negative ones on the south side of the mid-plane. Solid
lines show the best-fitting diffusion models.


# Attack Detection Using Item Vector Shift in Matrix Factorisation
Recommenders

Sulthana Shams  Trinity College DublinIreland<EMAIL_ADDRESS>and  Douglas Leith
Trinity College DublinIreland<EMAIL_ADDRESS>
(2023)

###### Abstract.

This paper proposes a novel method for detecting shilling attacks in Matrix
Factorization (MF)-based Recommender Systems (RS), in which attackers use
false user-item feedback to promote a specific item. Unlike existing methods
that use either use supervised learning to distinguish between attack and
genuine profiles or analyse target item rating distributions to detect false
ratings, our method uses an unsupervised technique to detect false ratings by
examining shifts in item preference vectors that exploit rating deviations and
user characteristics, making it a promising new direction. The experimental
results demonstrate the effectiveness of our approach in various attack
scenarios, including those involving obfuscation techniques.

Data Poisoning Attacks, Matrix Factorisation, Recommender Systems, Attack
Detection

††copyright: acmcopyright††journalyear: 2023††doi: XXXXXXX.XXXXXXX††ccs:
Information Systems Recommender systems

##  1\. Introduction

In Recommender Systems (RS), users are grouped based on their interests which
motivates many advertising strategies (Epasto et al., 2021; Xie and Phoha,
2001; Geyik et al., 2015). Recent research proposes exploiting such clustering
of users in RS for their ’hiding in the crowd’ privacy benefits (Checco et
al., 2017; Research and Ads, 2009; Google, 2021). Unfortunately, despite
privacy benefits, user clusters in RS are also susceptible to data poisoning
attacks (Mobasher et al., 2005; Shams and Leith, 2023). For example, social
media platforms have received attention for discriminatory and predatory
targeting of user communities (Angwin and Parris Jr., 2016; Datta et al.,
2014). Further, adversaries have been known to use RS to influence users by
introducing false product reviews (He et al., 2021) to promote misinformation.

The vulnerability of RS to potential manipulation by malicious users was
initially investigated by (O’Mahony et al., 2002; Lam and Riedl, 2004;
Mobasher et al., 2005). These attacks involve injecting false profiles to
either promote or demote specific items and are called Data Poisoning/Shilling
Attacks in RS. Push attacks elevate targeted items, while nuke attacks seek to
demote them. Such fraudulent ratings and profiles can severely undermine the
RS robustness. We assume that the attacker can only inject a limited number of
fake users. Each fake user rates a limited number of items (including the
target item and other non-target items called filler items) to evade
suspicion. To detect these attacks, various approaches have been explored over
the years. For example, exploiting features of attack profiles to distinguish
“attack” profiles from “regular” profiles (Williams et al., 2007; Chirita et
al., 2005), assigning reputation scores to users in RS (Resnick and Sami,
2007) and analysing rating distributions of items in time (Gao et al., 2015;
Zhang et al., 2006) are some of the approaches explored to make RS robust.

In this work we re-visit the robustness problem to attacks in a Matrix
Factorisation (MF) based RS (Koren et al., 2009). MF is widely known in RS due
to its simplicity and effectiveness. The typical paradigm of MF in RS is to
decompose the user-item interaction matrix $R\in\mathbb{R}^{n\times m}$ as the
product of two low-dimensional latent matrices $U\in\mathbb{R}^{d\times n}$
and $V\in\mathbb{R}^{d\times m}$ such that their product $U^{T}V$ is
approximating $R$. Matrix $U$ captures the relationship between a user and the
latent features while matrix $V$ captures the relationship between an item and
the features. We call $U$ as the user-feature matrix and $V$ as the item-
feature matrix. Items are recommended in such an MF-based RS based on the
proximity of the item vectors to the user vectors in the latent space. When a
targeted attack, such as a push attack, is launched on a particular item, it
will cause a shift of the item vector in the low-dimensional space, impacting
the item’s recommendation (Shams and Leith, 2023). Success of the attack
depends on how much it can shift the item vector distribution significantly.
Based on this observation, we propose a detection approach that examines the
shift in item vectors.

We know that the effect of fake ratings is largest in groups, while individual
fake ratings have negligible effects, especially in small numbers (Mehta and
Nejdl, 2009). As a result, eliminating clusters of fake ratings rather than
individual ones makes sense. If the feature vector of an item changes
significantly after a block of ratings enters the RS, we can suspect that the
ratings are fake and avoid using them to train the $U,V$ matrices. Many
literary works assume that the target attack rating is always the highest
value on a scale. An attacker can avoid detection based on such assumptions by
simply providing a rating value one step lower (Williams et al., 2006). Our
detection method significantly improves the identification of these obscured
attack tactics highlighting the importance of considering rating variability
in attack detection methods.

In this paper, we present a novel detection method that is based on the
deviation in the item vector and takes into account an item’s overall
preference information. With only $20-25$ true ratings per user cluster
required during training, the experimental results achieve a superior
detection precision over existing state-of-the-art detection strategies.

##  2\. Related Work

Various shilling detection methods have been proposed that defend by detecting
and removing fake profiles in RS, focusing mainly on extracting the signatures
of authentic user profiles. The generated profiles will deviate statistically
from those of authentic users and several attributes for detecting these
anomalies are examined in (Burke et al., 2006; Williams et al., 2007; Chirita
et al., 2005). But a major obstacle in user focussed detection method is that
it can recognize the distinctive signature of only the known attack model. For
newer or hybrid attack models, the detection methods may fall short.

In (Mehta and Nejdl, 2009), authors proposed a PCA-based (Principal Component
Analysis based) detection method that exploit the similarity structure in fake
user profiles to separate them from normal user profiles using unsupervised
dimensionality reduction methods. While the approach works well for attacks
that show a good correlation among attack profiles, (Cheng and Hurley, 2009)
discusses effective attack strategies dropping the assumption of unusually
high correlations among malicious attack profiles. They demonstrate that
dimensionality reduction-based detection methods cannot detect such low-
diversity attacks accurately.

Detecting shilling attacks in a model-free approach involves identifying
abnormalities in the rating distribution of items as discussed in (Bhaumik et
al., 2006; Zhang et al., 2006; Gao et al., 2015; O’Mahony et al., 2006; Yang
et al., 2018). Consider, (Bhaumik et al., 2006; Zhang et al., 2006; Gao et
al., 2015) which analyses the changes to items in a time series. They
investigate time intervals of rating activity that may suggest an item is
under attack. They assume that attack profiles are injected in a short time
and detection result is influenced by the selected time interval size. For
example, (Zhang et al., 2006) uses item anomaly detection based on sample
average and sample entropy in a time series. However, their method is tested
only on dense items with at least $500$ ratings. Studies such as (O’Mahony et
al., 2006; Yang et al., 2018) look at the deviation of target item ratings
from predicted ratings to identify abnormal ratings. Other works such as
(Mehta and Nejdl, 2008; Hidano and Kiyomoto, 2020; Resnick and Sami, 2007;
Deldjoo et al., 2020) aim to build manipulation-resistant RS to limit the
damage from injected fake ratings.

To the best of our knowledge, no previous work has investigated leveraging
item preference vectors to detect attacks in MF-based RS. Our detection
approach provides the next step by performing well against obfuscated and
unobfuscated attacks while requiring little amount of training data.

##  3\. Item Vector Shift Based Detection Model

###  3.1. User Cluster Based Recommendation Model

In a MF-based RS, the user-item rating matrix $R$ is first factorized
approximately as $U^{T}V$, where matrices $U$ and $V$ have relatively small
inner dimensions $d$. Each column in matrix $U$ is a length $d$ weight vector
that captures a user’s preferences, and each column in matrix $V$ is a length
$d$ weight vector that captures the characteristics of one item.

The standard approach to obtain $U,V$ given user-item ratings is to minimize
the sum of squared error over the set of all observed ratings, i.e.

(1)
$\min_{U,V}\sum_{(i,j)\in\mathcal{O}}(R_{i,j}-U_{i}^{T}V_{j})^{2}+\lambda\left(\sum_{i}\lVert
U_{i}\rVert^{2}+\sum_{j}\lVert V_{j}\rVert^{2}\right)$

Where $\mathcal{O}$ is the set of (user, item) rating pairs, $R_{i,j}$ is the
rating of item $j$ by user $i$, $U_{i}$ and $V_{j}$ are the column vectors
that describe the preferences associated to user $i$ and item $j$
respectively; $\lVert.\rVert$ is the Euclidean norm and $\lambda$ is a
regularisation weight. The predicted rating matrix given by the inner product
$U^{T}V$ gives the individual predicted rating per user per item. We deviate
from the standard setup by assuming that users are part of separate groups.
Each user belongs to one of the user groups and each group’s members share
similar preferences. To create the matrix $\tilde{U}$ of group vectors, we
cluster the $U_{i}$ values. In our study, we use $k$-means to group columns of
matrix $U$ such that users with similar preferences (i.e., weight vectors) are
clustered together. Other clustering algorithms, such as the strategy in
(Checco et al., 2017) may also be used. Let
$\tilde{U}_{g}\in\mathbb{R}^{d\times 1}$ for $g=1,\cdots,|\mathcal{G}|$ be the
preference vector associated with a group of users and gather these features
to form matrix $\tilde{U}\in\mathbb{R}^{d\times|\mathcal{G}|}$. Each column in
$\tilde{U}$ is a length $d$ weight vector that captures a group’s preferences.
For users belonging to a group $g$ with weight vector $\tilde{U_{g}}$ and
items with weight vectors in $V$, the predicted rating matrix is the inner
product $\tilde{U_{g}}^{T}V$, i.e., users belonging to the same group have the
same predicted rating value per item.

###  3.2. Utilizing Item Vectors for Improved Anomaly Detection

Given a target item $j^{*}$ and its item vector $V_{j^{*}}$ based on initial
rating information, we can recursively compute updates to $V_{j^{*}}$ (Shams
and Leith, 2023) 111Proof of Theorem 2 given in Appendix. i.e. let
$\hat{V}_{{j^{*}}}$ be the updated $V_{j^{*}}$ after receiving a block of $m$
new ratings, i.e. let a block of $m$ users with feature vectors in
$X\in\mathbb{R}^{d\times m}$ and target item ratings in vector
$y\in\mathcal{R}^{m\times 1}$ enter RS. Given
$A^{-1}=\left(\sum_{i\in\mathcal{U}(j^{*})}U_{i}U_{i}^{T}+\lambda
I\right)^{-1}$ where $\mathcal{U}(j^{*})$ is the set of all true users who
initially rated item $j^{*}$, we can write,

(2) $\displaystyle\hat{V_{j^{*}}}-V_{j^{*}}$
$\displaystyle=A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}\left(y-X^{T}V_{j^{*}}\right)$

The updated position of the item vector in the latent space given by equation
2 depends on three factors: the initial user preference vectors of users who
gave ratings (represented by matrix $A$), the feature values of users who
provide the new ratings (represented by $X$), and the deviation factor
(represented by $y-X^{T}V_{j^{*}}$).

The term $y-X^{T}V_{j^{*}}$ measures how much of the new rating vector ($y$)
for the target item can be explained by the predicted rating
($X^{T}V_{j^{*}}$), which helps to distinguish between fake and real ratings.
If $X^{T}V_{j^{*}}$ can already explain $y$, then the term is zero and
$\hat{V_{j^{*}}}$ is equal to $V_{j^{*}}$. However, a significant deviation is
anticipated when compared to ratings from actual users because fake ratings
are typically set to the maximum or nearly maximum value on the rating scale.
If there is no significant deviation, the target item already has a high
rating and is not worth further attacking. In addition to the deviation
factor, the shift also depends on matrix $X$. The knowledge that the attacker
has access to determines the feature vector values of attack profiles ($X$).
Thus the shift to the item vector also depends on the information available to
the attacker.

To illustrate how attacks may shift the target item vector, suppose true users
have $U=[1,-1]$ or $U=[-1,1]$. i.e. the first set of users like items with
$V=[1,0]$ and dislike items with $V=[0,1]$, but the second set of users are
the opposite. Then an attack against the first set of true users keeping
$U=[1,-1]$ constant to increase the rating of an item with $V=[0,1]$ may be
performed by shifting $V=[0,1]$ to $V[1,0]$. Then such a shift, while it
increases the rating in users with $U=[1,-1]$, would decrease the rating in
group $U=[-1,1]$. So the attack effects leaks to all clusters due to the
changes to item vector $V_{j^{*}}$. The approach that is adopted in this paper
is to consider the consistency of the preference of user clusters to the
target item vector.

Utilising item feature vectors for anomaly detection provides a distinct
advantage over existing methods. Unlike other methods that rely solely on
attack profile signatures or analysing item rating distributions, the item
feature vectors capture the effect of both of these factors, promising a more
robust and effective approach to detecting shilling attacks in RS.

###  3.3. Proposed Item Vector Based Detection (IVD) Method

(a)

(b)

Figure 1. Plot illustrating the IVD method in MovieLens 100k dataset

Consider that the target item $j^{*}$ initially received no ratings in the RS.
Then, at random, we select a group and a user from that group to offer a
rating. The iterative change in distance (mean and standard deviation) between
the updated $\hat{V}_{j^{*}}$ and the last updated $V_{j^{*}}$ after each
block of true ratings is depicted in Figure 1(a). We see that the item vector
shifts less from its previous value in response to new ratings after roughly
$100$ in total true ratings, indicating that the item’s preference has been
established and that additional true ratings contribute little new preference
information.

Given a target item $j^{*}$, we randomly select a cluster $g$ as a reference
in the d-dimensional vector space. We hypothesize that further real ratings
will not significantly shift the vector $V_{j^{*}}$ in reference to cluster
$g$, because true ratings rarely generate large changes in current
preferences, as previously demonstrated. We suspect that the ratings are
fraudulent if any block of new ratings leads the item vector to deviate
significantly from reference cluster $g$. Significant deviations from the
reference cluster may indicate that the new ratings are attempting to
manipulate the recommendations by shifting the item vector into a different
region of the vector space.

To demonstrate this concept, Figure 1(b) computes the distance
($D_{g,\hat{j}^{*}}$) between $\hat{V}_{{j^{*}}}$ to cluster $g$ and compares
it to the distance ($D_{g,j^{*}}$) between initial $V_{j^{*}}$ and cluster $g$
for each false (indicated by red plot) and true rating blocks (indicated by
blue plot). As we can see, each block of fake rating 222modelled as Average
Attack results in a larger shift away from the initial distance $D_{g,j^{*}}$
(reference preference information: green plot), indicating a shift in
preferences, whereas each block of real rating results in shifts relatively
close to the reference preference $D_{g,j^{*}}$.

This observation allows us to recognise and eliminate fake ratings from the
RS. Note that the model can continue to recommend to fake users. Thus, only
suspected ratings are removed before the RS retrains the $U,V$ to generate an
updated prediction matrix.

Input: $V_{j^{*}}$, Cluster $g$, Reference Euclidean Distance
$D_{g,j^{*}}(\tilde{U}_{g},V_{j^{*}})$, Threshold =$th$

1 for  _block index $n=1,2,3.\ldots$_ do

2 Find updated item vector $\hat{V}_{j^{*}}$ from eqn 4

3 Calculate $D_{g,\hat{j}^{*}}$ between $\hat{V}_{j^{*}}$ and $\tilde{U}_{g}$;

4 if  _$D{g,\hat{j}^{*}} >D_{g,j}+th$_ then

5 Remove the new block of ratings from the RS training process

6 else

7 Keep the new block of ratings for RS training process

Algorithm 1 Item Vector Based Detection Algorithm

##  4\. Experiments and Evaluation Setup

###  4.1. Datasets

We evaluate the effectiveness of attack on the MovieLens dataset (943 users
rating 1682 movies, contains 100000 ratings from 1-5) which is widely used
across literature for evaluating recommender systems under attack.
Additionally we use larger Movielens dataset (6040 users, 3706 movies,
contains 1 milion ratings from 1-5 ) and Netflix dataset. We take a dense
subset of the Netflix dataset by selecting the top 1000 items and the top
10000 users who rated these items.

###  4.2. Attack Model

The attackers give high ratings to the target item to make it more visible,
and a set of items are rated to create a fake user profile that mimics actual
user behaviour. The rating distribution of these filler items determines the
type of attack. We report results for two standard attack profiles mentioned
in the literature: Random Attack and Average Attack (Lam and Riedl, 2004) in
addition to another sophisticated attack type called Target Cluster Attack
(Shams and Leith, 2022) which is an extension of Average attack but aimed at
specific user clusters.

The Random Attack is a zero-knowledge attack where ratings to filler items in
each rating profile are distributed around the overall mean of items in the
RS. The Average Attack distributes the ratings for filler items in attack
profiles around the mean for each item. In the Target-Cluster Attack,
attackers target a specific user cluster 333We randomly choose $g=2$ to
target. Results are similar for any chosen $g$ by sampling filler ratings from
a Gaussian distribution using the cluster-wise mean rating of items in the RS.
The Average and Target attacks assume access to item mean ratings. This is a
reasonable assumption as aggregate user preference information is often
publicly available.

It’s worth noting that we don’t require mean ratings for every single item in
the RS to execute these attacks. This is because most users only rate a small
fraction of the entire product space, given the limitations of how many items
a person can interact with. Therefore, attackers can focus on a subset of the
product space to make their attacks effective (Mobasher et al., 2005). Ratings
for popular items within the RS are relatively easy to obtain and can be used
for these attacks. The popularity of these items can be determined using
external data sources and doesn’t necessarily depend on RS-specific data.

In the case of the target attack model, attackers can leverage general domain
knowledge about item features to target users with preferences for specific
types of items. For instance, they may spot products with genres that are
comparable to the one they want to advertise and find possible targets by
locating users who highly score these related items. In the RS, it is possible
to then create fictitious profiles that closely resemble real ones by
computing the mean ratings that this set of users provided for other items.
Platforms like Amazon and Goodreads display user’s ratings and reviews for
items/books they’ve engaged with. By filtering based on adversary’s domain
knowledge of the target item, an attacker can target user clusters likely to
be pre-disposed to the targeted item.

Moreover, the availability of public rating datasets has made finding
preference ratings easier. For instance, a complete viewing history of any
user may be acquired with limited adversary knowledge (2-8 ratings per user),
which does not need to be precise, from the standard Netflix Dataset
(Narayanan and Shmatikov, 2007). Similarly, the presence of overlapping
sources of preference information can contribute to the identification of
target users. For instance, Amazon could potentially re-identify users on
competitors’ websites by comparing their purchase history with reviews posted
on those sites, and subsequently decide on marketing strategies for these
customers. This idea of leveraging overlapping sources was explored and
demonstrated by (Frankowski et al., 2006) using ML datasets and online forums.

Further, Facebook, Instagram and Amazon already offer targeted
advertising/information sharing services where you can select any user segment
based on preferences to the type of product you want to promote, age, location
and other demographics (AWS, 2022; Meta, 2023).

####  4.2.1. Target Item Ratings

We consider items with ground truth average empirical rating $<3.5$ in all
user clusters and with at least $20-25$ true ratings per user cluster, and
attack profiles assign a maximum rating value to promote it in the RS. To make
the detection harder, we also report results when using the target-shifting
obfuscation technique (Williams et al., 2006), which involves shifting the
rating given to the target item from the maximum rating to a rating one step
lower.

Additionally, we also evaluate the effect of the choice of filler items.
Choosing filler items appropriately makes the generated profiles similar to
the genuine profiles making it harder to spot fake users.

###  4.3. Baseline Detection Approach

In a series of experiments, the presented method’s detection performance was
compared with several baselines. Here is a brief description of the methods
used:

  * •

PCA-based: This method involves transforming the user-item matrix into a
lower-dimensional space using Principal Component Analysis (PCA). Each user
profile is then represented by three principal components. By analyzing the
proximity of profiles to the new space’s origin, potential attackers can be
identified as users exhibiting suspicious behavior. We fix the $r=10\%$ i.e.
the top $10\%$ of the users given by PCA is suspected as fake users. (Mehta
and Nejdl, 2009).

  * •

MPE-based: This method utilizes the mean prediction error (MPE) for individual
items. It calculates the deviation between predicted ratings and actual
ratings to identify anomalous rating behavior. If the item has significant MPE
values, potential anomalies in the user ratings to the item can be detected
(Yang et al., 2018). We fix the threshold as $1.5$

###  4.4. Evaluation Metric

We evaluate detection performance using two metrics: detection rate and false
alarm rate. The detection rate is calculated by dividing the number of times
of detected attack ratings by the total number of times fake rating blocks
were inserted. The false alarm rate, on the other hand, is determined by the
number of true rating blocks predicted as anomalies divided by the total
number of true rating blocks inserted. The reported results are an average
over $50$ randomly chosen target item from the set of potential target items.
We set the threshold to 0.07 for IVD

##  5\. Results and Discussion

In this section, we compare the performance of IVD against two state of the
art detection strategies that reports a high detection rate and very low false
alarm rate, namely PCA method (Mehta and Nejdl, 2009) and MPE method (Yang et
al., 2018). Both methods are stable against attack and filler sizes with
$>90\%$ detection rates as we will see later.

But both approaches have their limitations. For example, PCA works by
observing that the profiles of shillers are very similar. They interpret users
as variables (i.e. the dimensions of the data are the users, and the
observations are the item ratings), then we have data where a number of
dimensions are very similar and PCA can find a set of variables (users) which
are highly correlated. Thus an attack profile that is undetectable by the PCA
detector must reduce the differences from genuine profiles. The key factor
here is in filler selection. Choosing filler items appropriately can bring
down the correlation among fake users making them similar to other true users
in the RS. When filler items are selected randomly, they are likely to have
smaller pairwise overlaps compared to genuine users. Genuine users are more
likely to rate certain items more frequently than others. Based on this
observation, study by (Cheng and Hurley, 2009) has shown that an attacker
should choose filler items according to their overall popularity among the
genuine user base. A simple and effective strategy to obfuscate attacks is to
choose filler items with equal probability from the top x% of most popular
items, rather than from the entire catalogue of items, to make detection
harder.

In Figure 2, we plot the users in RS in the PC space. The coordinates here are
the coefficients of each user in the 1st and 2nd principal component. Figure
2(a) shows how, due to their low PC scores, the fake users are focused around
the origin in the PC space. To identify fake users, PCA method assumes the two
coefficents of each user represent a point in space and sort the points in
order of their distance from origin. The top $r\%$ eliminated users will
contain fake users with more than $90\%$ accuracy. The PC scores are difficult
to distinguish when smaller subsets of popular item are used as filler items
as can be observed from figure 2(b) and thus fails to identify fake users.
Figure 4(a) shows how the detection rate of PCA against standard average
attack. The detection rate decreases as the selection of most popular items is
reduced to smaller subsets, with $0\%$ detection for $x\leq 20$. Although not
demonstrated separately, we note that PCA shows no perceivable drop in
detection accuracy in the face of target rating obfuscation as discussed in
(Mehta and Nejdl, 2009). This is because these are linear transformations,
which are not very effective when linear dimensionality reduction is
performed.

MPE, on the other hand, is more concerned with deviations in item predicted
ratings than with user profiles. It is relatively resistant to filler
selection strategies and produced good results in our studies. The capacity of
MPE to identify tiny changes in item predicted rating deviation made it a
desirable tool for attack detection. The assumption is that attackers just
focus on the target item and rate it with the maximum or lowest rating many
times in order to promote or demote the item to the recommendation list. The
simple approach of obfuscating the target item rating from a maximum value to
a value one step lower, on the other hand, leads the prediction error to be
similar to that of the genuine user base and fails to detect the fake
activity.

(a) PC Space under Random Filler Choice

(b) PC Space Under top $20\%$ Filler Choice

Figure 2. Clusters in 2D Space for Normal Users and Fake Users (Avg Attack) in
ML-100k

(a) Target Item Rating: Maximum

(b) Target Item Rating: Obfuscated

Figure 3. Distribution of MPE for Genuine and Fake Rating Blocks in ML-100k

(a) PCA Performance Against Filler Choice

(b) MPE performance against Target Rating Obfuscation

Figure 4. Detection Accuracy for PCA and MPE in ML-100k

The MPE for average attack with and without target rating obfuscation approach
is plotted in the figure 3. Figure 3(a) depicts how the fake ratings form a
cluster away from true users due to their significant deviations. However,
when target rating obfuscation is used, the MPE of false users becomes
difficult to discern from that of legitimate users as is demonstrated in
figure 3(b). Figure 4(b) compares the performance of MPE against standard
attack model and when target rating is obfuscated for a fixed filler choice of
top $20\%$. We can see that the detection rate decreases when compared to 100%
detection in un-obfuscated attacks. Thus, the choice of filler items has no
effect on MPE, but the target rating obfuscation does since without
obfuscation, MPE results in perfect detection for the $x=20\%$ filler choice.

In the further sections, we compare how IVD performs under these obfuscation
schemes to PCA and MPE approaches, and we give findings for three different
datasets. We demonstrate that IVD performs more effectively than both
techniques under these obfuscation strategies.

###  5.1. Effectiveness of Attack Size and Filler Size

(a) Detection Rate for varying attack sizes. Filler size=$10\%$

(b) Detection Rate for varying filler sizes. Attack size=$5\%$

Figure 5. Effect of Attack and Filler Size IVD for ML-100k

In this experiment, we simulate an attack by introducing fake profiles
alongside the regular user profiles in the recommender system. We examine how
the performance of the IVD method is affected by varying attack and filler
sizes using the ML-100k dataset. The findings from this experimentation hold
true for larger datasets such as Movielens 1M and Netflix. Our focus on the
100k ML dataset allows for direct comparison with previously reported results,
as this dataset has been widely used to evaluate prior shilling detection
methods.

We consider diverse attack sizes ($0.5\%$, $1\%$, $3\%$, $5\%$, $10\%$,
$20\%$) and select the filler items randomly from the top $60\%$ of most
popular items in the RS. We fix the number of filler items to $10\%$ of the
total item count. In figure 5(a), we observe that for attack size $<1\%$, IVD
fails to detect the presence of fake ratings. Detecting an attack’s impact is
challenging when attack sizes are small. This is because such low attack sizes
are unable to alter the item vector sufficiently to enhance the target item’s
rating. As a result, the attack’s effect on the target item is insignificant.
Because IVD directly gauges attack power, small and weak attacks are difficult
to detect.

In Figure 5(b), we consdider various filler sizes ($1\%$, $3\%$, $5\%$,
$10\%$, $25\%$, $40\%$) for a fixed attack size of $5\%$. We can see that
altering filler size has little effect on IVD performance. Although we don’t
report separately, the PCA and MPE methods demonstrate almost flawless
detection across diverse attack and filler sizes, corroborated by both our
datasets and findings in (Mehta and Nejdl, 2009; Yang et al., 2018). It’s
noteworthy that their detection accuracy is influenced by filler selection and
rating obfuscation respectively, as elucidated in earlier sections.

Based on these findings, for our experimets, we fix an attack size of $5\%$
and filler size of $10\%$ for the rest of the analysis.

###  5.2. Effect of Choice of Filler Items

Defense Strategy/Dataset | Filler
---|---
filler@60 | filler@40 | filler@20 | filler@10
IVD/ML-100k | 1 | 1 | 1 | 1
MPE/ML-100k | 1 | 1 | 1 | 1
PCA/ML-100k | 1 | 0.58 | 0.0 | 0.0
IVD/ML-1M | 1 | 1 | 1 | 1
MPE/ML-1M | 0.96 | 0.97 | 0.95 | 0.94
PCA/ML-1M | 0.96 | 0.31 | 0.0 | 0.0
IVD/Netflix | 1 | 1 | 1 | 1
MPE/Netflix | 1 | 1 | 1 | 1
PCA/Netflix | 1 | 0.98 | 0.25 | 0.0
Table 1. Detection Rate for Different Defense Strategies and Datasets for Average Attack over top $x\%$ filler. Attack size=$5\%$, Filler size=$10\%$ Defense Strategy/Dataset | Filler
---|---
filler@60 | filler@40 | filler@20 | filler@10
IVD/ML-100k | 0.84 | 0.85 | 0.97 | 1
MPE/ML-100k | 1 | 1 | 1 | 1
PCA/ML-100k | 1 | 0.83 | 0.0 | 0.0
IVD/ML-1M | 0.87 | 1 | 1 | 1
MPE/ML-1M | 1 | 1 | 1 | 1
PCA/ML-1M | 1 | 0.63 | 0.0 | 0.0
IVD/Netflix | 1 | 1 | 1 | 1
MPE/Netflix | 1 | 1 | 1 | 1
PCA/Netflix | 1 | 1 | 0.43 | 0.0
Table 2. Detection Rate for Different Defense Strategies and Datasets for Random Attack over top $x\%$ filler. Attack size=$5\%$, Filler size=$10\%$ Defense Strategy/Dataset | Filler
---|---
filler@60 | filler@40 | filler@20 | filler@10
IVD/ML-100k | 1 | 1 | 1 | 1
MPE/ML-100k | 1 | 1 | 1 | 1
PCA/ML-100k | 0.93 | 0.58 | 0.0 | 0.0
IVD/ML-1M | 1 | 1 | 1 | 1
MPE/ML-1M | 0.80 | 0.89 | 0.83 | 0.88
PCA/ML-1M | 0.94 | 0.25 | 0.0 | 0.0
IVD/Netflix | 1 | 1 | 1 | 1
MPE/Netflix | 1 | 1 | 1 | 1
PCA/Netflix | 1 | 1 | 0.25 | 0.0
Table 3. Detection Rate for Different Defense Strategies and Datasets for
Target Attack over top $x\%$ filler. Attack size=$5\%$, Filler size=$10\%$

Recall our discussion that the PCA defense strategy relies on the assumption
that attackers are more similar to each other than to the genuine user base.
We choose filler items with equal probability from the top x% of most popular
items. We report detection rate for the three methods against reducing value
of $x$ from the top $60\%$ to the top $10\%$ of the most popular items and
compare the performance. Table 1, 2 and 3 report the results for Average,
Random and Target Attack respectively.

As expected, the PCA accuracy decreased significantly with increasing $x\%$
due to the increase in similarity among attack profiles and genuine profiles.
As demomstrated earlier, detection becomes hopeless for $x$ values less than
$20\%$ for all datasets. When filler items are selected from the popular
items, their preferences become more diverse and closer to other genuine users
who also rated these popular items and thus are less likely to form a well-
defined cluster. This leads to a reduced accuracy of PCA as it fails to
effectively distinguish attackers from genuine users.

However, both the IVD and MPE strategies still demonstrate high accuracy in
comparison to PCA as discussed previously. This is because these detection
methods are not reliant on the correlation between fake profiles.
Specifically, MPE focuses on the deviation from the point of view of item
predicted ratings rather than user profiles. As a result, it is not
significantly impacted by the choice of filler items, making it more robust
against variations in filler selection. Similarly IVD focuses on the deviation
of the item feature vector to new ratings. Fake user profiles have no direct
impact on the item vector deviation calculation 2. Rather than working with
the profiles directly, IVD employs user vector $U$ of users who provide
ratings to compute the updated item vector.

###  5.3. Effect of Target Shifting Obfuscation

In this section, we will look at the effects of using target-shifting
obfuscation in attack techniques. For the experiment, we fix the filler
selection to the top $20\%$ of the items in the datasets. The detection rates
are shown in Table 4.

In terms of shilling detection rate, the IVD technique surpasses both MPE and
PCA. As previously noted in the previous sections, the reduced performance of
PCA is primarily attributable to the selection of filler items. In contrast,
MPE performance suffers because, when fraudulent users use target rating
obfuscation, their MPE values may closely mirror those of real users, making
differentiation difficult as demonstrated in section 5. However, because IVD
takes into account both the user vector of raters and the rating deviation, it
is more sensitive to changes from attacks even after target-rating
obfuscation.

Defense Strategy/Dataset | Attack Type
---|---
Average | Random | Target
IVD/ML-100k | 0.86 | 0.65 | 0.90
MPE/ML-100k | 0.51 | 0.19 | 0.67
PCA/ML-100k | 0.0 | 0.0 | 0.0
IVD/ML-1M | 0.86 | 0.60 | 0.83
MPE/ML-1M | 0.55 | 0.29 | 0.42
PCA/ML-1M | 0.0 | 0.0 | 0.0
IVD/Netflix | 1 | 0.93 | 1
MPE/Netflix | 0.40 | 0.03 | 0.84
PCA/Netflix | 0.22 | 0.40 | 0.25
Table 4. Results for Different Defense Strategies and Datasets under Target
Rating Obfuscation+Filler@20 Obfuscation

###  5.4. Reciever Operater Characterstics

(a) ML 100k: Average Attack

(b) ML 100k: Random Attack

(c) ML 1M: Average Attack

(d) ML 1M: Random Attack

Figure 6. Reciever Operating Characterstics for ML100k and ML-1M Datasets

The Receiver Operator Characteristic for the IVD method applied to two
standard attack strategies: Average and Random is depicted in Figure 6. We
simulate genuine ratings by drawing ratings from the empirical distribution of
ratings for a group. When we need a rating for the target item that the user
has not rated, pick a second user from the same group who has rated the item
and merge the pair of user ratings.

IVD technique is applied to attack scenarios with fixed parameters: the top
$20\%$ popular items as filler options, a filler size of $10\%$, and an attack
size of $5\%$. For each Average and Random attack case, we examine the ROC
curve for the 1) maximum target item rating model and 2) target rating
obfuscated model.

For the un-obfuscated Average and Random attacks, we can see that IVD obtains
a $100\%$ detection rate with a false-alarm rate of less than $10\%$ for both
datasets.

When we apply rating obfuscation to these attack strategies, we find that
detection is achieved at $80\%$ for the average attack and at $~{}60\%$ for
the random attack for the same false alarm rate of less than $10\%$. For the
obfuscated attacks in both datasets, a near perfect detection rate happens
with a cost of approximately $35\%$ false alarm rate. We can see that IVD
performs better at detecting Obfuscated Average attacks than Random attacks.
This is to be expected given that IVD directly gauges attack power. Obfuscated
Random attacks are more difficult to detect since they are simpler and less
effective at shifting the item vector.

###  5.5. Limitations

  * •

Cold Items: The proposed method assumes that initial ratings for new items can
be obtained in the RS. This is a reasonable assumption since, ratings for such
items may be obtained from trusted sources, such as professional critics,
trusted representatives (Liu et al., 2011; Shi et al., 2017), or filter bots
(Good et al., 1999). We could also randomly elicit ratings from users in the
system to reduce the risk of sampling fake ratings from false users already
existing in RS. For instance, Goodreads
444https://help.goodreads.com/s/announcements/a031H00000RKE8VQAX/giveaways-
for-authors-frequently-asked-questions?ref=kdpnl and ’Voracious readers only’
555https://voraciousreadersonly.com/ give away free copies of new books to
readers in exchange for voluntary ratings. At the same time, movie RS offer
rewards for watching new movies and TV series and provide initial reviews
666https://www.amazon.in/b/ref=as_li_ss_tl?node=15697217031&ref_=dvm_crs_merch_in_ai_slashpv_P_watch&wint2_header&pf_rd_m=A1K21FY43GMZF8&pf_rd_s=merchandised-
search-2&pf_rd_r=4N0T0PVXWA9S566NFGQV&pf_rd_t=101&pf_rd_p=51f6c505-5ad6-4b9c-b9b6-91450c336884&pf_rd_i=10882806031&linkCode=sl2&tag=thinkerviewsc-21&linkId=eb862e43198dfa2f8e5a415bb4db6f26&language=en_IN.
We further assume that the randomly selected users are real and that the
likelihood of all initial users and ratings being fake is low. We note that
the RS does not have to wait for $20-25$ ratings per group before recommending
the new item to existing system users. We simply propose that the RS avoid
using unprompted ratings for the new item in the training process until it
receives ratings from reliable sources upto the threshold.

  * •

A reasonable choice of reference and threshold are crucial in determining the
performance of the proposed approach. We demonstrated the detection in both a
dense dataset and two complete datasets. IVD results in reasonable performance
in all the cases. In practice, utilizing a single reference cluster as a broad
assumption may yield insights and preliminary findings. However, in order to
create a viable fake ratings detection mechanism, additional techniques such
as dynamic references, weighted references, or models that learn references
adaptively over time can be explored as part of future work. These methods may
better capture the intricacies of user preferences, deal with potential
changes, and accommodate a wide range of scenarios, resulting in increased
detection accuracy.

###  5.6. Conclusions

We present a new approach for detecting shilling attacks that makes use of
item preference vectors. The Item Vector Deviation (IVD) technique provides an
unsupervised and attack model-free strategy that can be deployed directly to
any target item, provided the recommender system has sufficient rating
information about the item in question to compute its initial preference
vector. Remarkably, as low as $20-25$ ratings per user cluster were sufficient
to produce favorable outcomes across all examined datasets.

Our experiments confirm the sustained effectiveness of our proposed strategy,
achieving high detection accuracy with minimal false alarms. This performance
is stable across a wide range of attack scenarios, and it even performs
reasonably well against obfuscated attacks, outperforming our baselines.

###### Acknowledgements.

This work was supported by Science Foundation Ireland (SFI) under grant
16/IA/4610

## References

  * (1)
  * Angwin and Parris Jr. (2016) Julia Angwin and Terry Parris Jr. 2016.  Facebook Lets Advertisers Exclude Users by Race.  _ProPublica_ (2016).  https:/www.propublica.org/article/facebook-lets-advertisers-exclude-users-by-race
  * AWS (2022) AWS. 2022.  Use Machine Learning to Target Your Customers Based on Their Interest in a Product or Product Attribute.  https://aws.amazon.com/blogs/messaging-and-targeting/use-machine-learning-to-target-your-customers-based-on-their-interest-in-a-product-or-product-attribute.
  * Bhaumik et al. (2006) Runa Bhaumik, Chad Williams, Bamshad Mobasher, and Robin Burke. 2006.  Securing collaborative filtering against malicious attacks through anomaly detection.  (01 2006).
  * Burke et al. (2006) Robin Burke, Bamshad Mobasher, Chad Williams, and Runa Bhaumik. 2006.  Detecting Profile Injection Attacks in Collaborative Recommender Systems, Vol. 2006. 23–23.  https://doi.org/10.1109/CEC-EEE.2006.34
  * Checco et al. (2017) Alessandro Checco, Giuseppe Bianchi, and Douglas J. Leith. 2017.  BLC: Private Matrix Factorization Recommenders via Automatic Group Learning.  _ACM Trans. Priv. Secur._ 20, 2, Article 4 (May 2017), 25 pages.  https://doi.org/10.1145/3041760
  * Cheng and Hurley (2009) Zunping Cheng and Neil Hurley. 2009.  Effective diverse and obfuscated attacks on model-based recommender systems. 141–148.  https://doi.org/10.1145/1639714.1639739
  * Chirita et al. (2005) Paul-Alexandru Chirita, Wolfgang Nejdl, and Cristian Zamfir. 2005.  Preventing Shilling Attacks in Online Recommender Systems. In _Proceedings of the 7th Annual ACM International Workshop on Web Information and Data Management_ (Bremen, Germany) _(WIDM ’05)_. Association for Computing Machinery, New York, NY, USA, 67–74.  https://doi.org/10.1145/1097047.1097061
  * Datta et al. (2014) Amit Datta, Michael Carl Tschantz, and Anupam Datta. 2014.  Automated Experiments on Ad Privacy Settings: A Tale of Opacity, Choice, and Discrimination.  _ArXiv_ abs/1408.6491 (2014).
  * Deldjoo et al. (2020) Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2020.  A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks.  arXiv:2005.10322 [cs.IR]
  * Epasto et al. (2021) Alessandro Epasto, Andrés Muñoz Medina, Steven Avery, Yijian Bai, Robert Busa-Fekete, CJ Carey, Ya Gao, David Guthrie, Subham Ghosh, James Ioannidis, Junyi Jiao, Jakub Lacki, Jason Lee, Arne Mauser, Brian Milch, Vahab Mirrokni, Deepak Ravichandran, Wei Shi, Max Spero, Yunting Sun, Umar Syed, Sergei Vassilvitskii, and Shuo Wang. 2021.  Clustering for Private Interest-Based Advertising. In _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_ (Virtual Event, Singapore) _(KDD ’21)_. Association for Computing Machinery, New York, NY, USA, 2802–2810.  https://doi.org/10.1145/3447548.3467180
  * Frankowski et al. (2006) Dan Frankowski, Dan Cosley, Shilad Sen, Loren Terveen, and John Riedl. 2006.  You are what you say: Privacy risks of public mentions. 565–572.  https://doi.org/10.1145/1148170.1148267
  * Gao et al. (2015) Min Gao, Renli Tian, Junhao Wen, Qingyu Xiong, Bin Ling, and Linda Yang. 2015.  Item Anomaly Detection Based on Dynamic Partition for Time Series in Recommender Systems.  _PLOS ONE_ 10, 8 (08 2015), 1–22.  https://doi.org/10.1371/journal.pone.0135155
  * Geyik et al. (2015) Sahin Cem Geyik, Ali Dasdan, and Kuang-Chih Lee. 2015.  User Clustering in Online Advertising via Topic Models.  https://doi.org/10.48550/ARXIV.1501.06595
  * Good et al. (1999) Nathaniel Good, Ben Schafer, Joseph Konstan, Al Borchers, Badrul Sarwar, Jon Herlocker, and John Riedl. 1999.  Combining Collaborative Filtering with Personal Agents for Better Recommendations. 439–446.
  * Google (2021) Google. 2021.  Building a privacy-first future for web advertising.  https://blog.google/products/ads-commerce/2021-01-privacy-sandbox/.
  * He et al. (2021) Sherry He, Brett Hollenbeck, and Davide Proserpio. 2021.  The Market for Fake Reviews. 588–588.  https://doi.org/10.1145/3465456.3467589
  * Hidano and Kiyomoto (2020) Seira Hidano and Shinsaku Kiyomoto. 2020.  Recommender Systems Robust to Data Poisoning using Trim Learning. 721–724.  https://doi.org/10.5220/0009180407210724
  * Koren et al. (2009) Yehuda Koren, Robert Bell, and Chris Volinsky. 2009.  Matrix Factorization Techniques for Recommender Systems.  _Computer_ 42, 8 (2009), 30–37.  https://doi.org/10.1109/MC.2009.263
  * Lam and Riedl (2004) Shyong K. Lam and John Riedl. 2004.  Shilling Recommender Systems for Fun and Profit. In _Proceedings of the 13th International Conference on World Wide Web_ (New York, NY, USA) _(WWW ’04)_. Association for Computing Machinery, New York, NY, USA, 393–402.  https://doi.org/10.1145/988672.988726
  * Liu et al. (2011) Nathan N. Liu, Xiangrui Meng, Chao Liu, and Qiang Yang. 2011.  Wisdom of the Better Few: Cold Start Recommendation via Representative Based Rating Elicitation. In _Proceedings of the Fifth ACM Conference on Recommender Systems_ (Chicago, Illinois, USA) _(RecSys ’11)_. Association for Computing Machinery, New York, NY, USA, 37–44.  https://doi.org/10.1145/2043932.2043943
  * Mehta and Nejdl (2008) Bhaskar Mehta and Wolfgang Nejdl. 2008.  Attack Resistant Collaborative Filtering. In _The 31st Annual International ACM SIGIR Conference (SIGIR)_.
  * Mehta and Nejdl (2009) Bhaskar Mehta and Wolfgang Nejdl. 2009.  Unsupervised strategies for shilling detection and robust collaborative filtering.  _User Model. User-Adapt. Interact._ 19 (02 2009), 65–97.  https://doi.org/10.1007/s11257-008-9050-4
  * Meta (2023) Meta. 2023.  Ad Targeting.  https://www.facebook.com/business/ads/ad-targeting.
  * Mobasher et al. (2005) Bamshad Mobasher, Robin Burke, Chad Williams, and Runa Bhaumik. 2005.  Analysis and Detection of Segment-Focused Attacks Against Collaborative Recommendation, Vol. 4198. 96–118.  https://doi.org/10.1007/11891321_6
  * Narayanan and Shmatikov (2007) Arvind Narayanan and Vitaly Shmatikov. 2007.  How To Break Anonymity of the Netflix Prize Dataset.  arXiv:cs/0610105 [cs.CR]
  * O’Mahony et al. (2006) Michael P. O’Mahony, Neil J. Hurley, and Guénolé C.M. Silvestre. 2006.  Detecting Noise in Recommender System Databases. In _Proceedings of the 11th International Conference on Intelligent User Interfaces_ (Sydney, Australia) _(IUI ’06)_. Association for Computing Machinery, New York, NY, USA, 109–115.  https://doi.org/10.1145/1111449.1111477
  * O’Mahony et al. (2002) Michael O’Mahony, Neil Hurley, and Guenole Silvestre. 2002.  Promoting Recommendations: An Attack on Collaborative Filtering. 494–503.  https://doi.org/10.1007/3-540-46146-9_49
  * Research and Ads (2009) Google Research and Ads. 2009.  Evaluation of Cohort Algorithms for the FloC API.  https://github.com/google/ads-privacy/blob/master/proposals/FLoC/FLOC-Whitepaper-Google.pdf
  * Resnick and Sami (2007) Paul Resnick and Rahul Sami. 2007.  The influence limiter: Provably manipulation-resistant recommender systems.  _RecSys’07: Proceedings of the 2007 ACM Conference on Recommender Systems_ (10 2007), 25–32.  https://doi.org/10.1145/1297231.1297236
  * Shams and Leith (2023) Sulthana Shams and Douglas Leith. 2023.  Evaluating Impact of User-Cluster Targeted Attacks in Matrix Factorisation Recommenders.  arXiv:2305.04694 [cs.IR]
  * Shams and Leith (2022) Sulthana Shams and Douglas J. Leith. 2022.  Improving Resistance of Matrix Factorization Recommenders To Data Poisoning Attacks. In _2022 Cyber Research Conference - Ireland (Cyber-RCI)_. 1–4.  https://doi.org/10.1109/Cyber-RCI55324.2022.10032671
  * Shi et al. (2017) Lei Shi, Wayne Xin Zhao, and Yi-Dong Shen. 2017.  Local Representative-Based Matrix Factorization for Cold-Start Recommendation.  _ACM Trans. Inf. Syst._ 36, 2, Article 22 (aug 2017), 28 pages.  https://doi.org/10.1145/3108148
  * Williams et al. (2007) Chad Williams, Bamshad Mobasher, and Robin Burke. 2007.  Defending recommender systems: Detection of profile injection attacks.  _Service Oriented Computing and Applications_ 1 (10 2007), 157–170.  https://doi.org/10.1007/s11761-007-0013-0
  * Williams et al. (2006) Chad Williams, Bamshad Mobasher, R. Burke, Jeff J. Sandvig, and Runa Bhaumik. 2006.  Detection of Obfuscated Attacks in Collaborative Recommender Systems 1.
  * Xie and Phoha (2001) Yunjuan Xie and Vir V. Phoha. 2001.  Web User Clustering from Access Log Using Belief Function. In _Proceedings of the 1st International Conference on Knowledge Capture_ (Victoria, British Columbia, Canada) _(K-CAP ’01)_. Association for Computing Machinery, New York, NY, USA, 202–208.  https://doi.org/10.1145/500737.500768
  * Yang et al. (2018) Zhihai Yang, Qindong Sun, and Beibei Zhang. 2018.  Evaluating Prediction Error for Anomaly Detection by Exploiting Matrix Factorization in Rating Systems.  _IEEE Access_ 6 (2018), 50014–50029.  https://doi.org/10.1109/ACCESS.2018.2869271
  * Zhang et al. (2006) Sheng Zhang, Amit Chakrabarti, James Ford, and Fillia Makedon. 2006.  Attack Detection in Time Series for Recommender Systems ABSTRACT, Vol. 2006. 809–814.  https://doi.org/10.1145/1150402.1150508

##  Appendix A APPENDIX

The proof and discussion below are taken from (Shams and Leith, 2023).

Given $M$ is a square $n\times n$ matrix whose inverse matrix we know, for the
simple case of a rank-1 perturbation to $M$, Sherman–Morrison formula provides
a method to find the updated rank-1 change to the inverse.

###### Definition 1.

Given $M$ is a square $n\times n$ matrix whose inverse matrix we know, $u$ and
$v$ are $n\times 1$ column vectors defining the perturbation to matrix $M$
such that $u_{i}v_{j}^{T}$ is added to $M_{i,j}$, then we can find the inverse
of the modified $M$ by Sherman-Morrison formula

$(M+uv^{T})^{-1}=M^{-1}-\frac{M^{-1}uv^{T}M^{-1}}{1+v^{T}M^{-1}u}$

For a generalised rank-$k$ perturbation to $M$, the updated inverse is given
by the following formula.

###### Definition 2.

Given $M$ is a square $n\times n$ matrix whose inverse matrix we know, $U$ and
$V$ are $n\times k$ matrices defining rank $k$ perturbation to matrix $M$,
then we can find the inverse of the modified $M$

$(M+UV^{T})^{-1}=M^{-1}-M^{-1}U(I_{k}+V^{T}M^{-1}U)^{-1}V^{T}M^{-1}$

###  A.1. Proof of Theorem 2

###### Proof 1.

From equation 1, given last updated $U$, $V_{j^{*}}$ of item $j^{*}$ is given
by:

(3) $\displaystyle V_{j^{*}}$
$\displaystyle=\left(\sum_{i\in\mathcal{U}(j^{*})}{U_{i}U_{i}^{T}+\lambda
I}\right)^{-1}\sum_{i\in\mathcal{U}(j^{*})}U_{i}R_{i,j^{*}}$

where $\mathcal{U}(j^{*})=\\{i:(i,j^{*})\in\mathcal{O}\\}$ is the set of users
rating item $j^{*}$. For simplicity, let $\Lambda$ gather together the feature
vectors $U_{i}$ of all users $i$ who rated target item $j^{*}$ such that
$\Lambda\Lambda^{T}=\sum_{i\in\mathcal{U}(j^{*})}U_{i}U_{i}^{T}$ and let $r$
be a column vector of ratings received by the target item from these true
users. We can write equation 3 as,

$V_{j^{*}}=(\Lambda\Lambda^{T}+\lambda I)^{-1}\Lambda r=A^{-1}\Lambda r$

where $A=\Lambda\Lambda^{T}+\lambda I$.

After the block of new users enters with feature vectors represented by the
columns of $X$, we write $\hat{U}=[\Lambda,X]$ and
$\hat{U}\hat{U}^{T}=\Lambda\Lambda^{T}+XX^{T}$. Also
$\hat{r}=\begin{bmatrix}r\\\ y\end{bmatrix}$ and
$\hat{A}^{-1}=(\hat{U}\hat{U}^{T}+\lambda I)^{-1}=(A+XX^{T})^{-1}$. We now
calculate the updated $\hat{V_{j^{*}}}$ after attack. We know that,

$\displaystyle\hat{V_{j^{*}}}$
$\displaystyle=\hat{A}^{-1}\hat{U}\hat{r}=\hat{A}^{-1}\left(\Lambda
r+Xy\right)=\left(A+XX^{T}\right)^{-1}\left(\Lambda r+Xy\right)$ Applying
Sherman Morrison/Woodbury formula to the inverse (see Definition 2)
$\displaystyle=\left(A^{-1}-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}A^{-1}\right)\left(\Lambda
r+Xy\right)$ $\displaystyle=A^{-1}\Lambda
r-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}A^{-1}\Lambda
r+A^{-1}Xy-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}A^{-1}Xy$
$\displaystyle\text{We have, }V_{j^{*}}=A^{-1}\Lambda r\text{. substituting
for $A^{-1}\Lambda r$ and rearranging, we get, }$
$\displaystyle=V_{j^{*}}-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}V_{j^{*}}+A^{-1}X\left(I-\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}A^{-1}X\right)y$
$\displaystyle\text{Substituting
}I=(I+X^{T}A^{-1}X)^{-1}(I+X^{T}A^{-1}X)\text{ inside third term, we get,}$
$\displaystyle\begin{split}&=V_{j^{*}}-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}V_{j^{*}}+\\\
&A^{-1}X\left(\left(I+X^{T}A^{-1}X\right)^{-1}\left(I+X^{T}A^{-1}X\right)-\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}A^{-1}X\right)y\end{split}$
$\displaystyle=V_{j^{*}}-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}V_{j^{*}}+A^{-1}X\left(\left(I+X^{T}A^{-1}X\right)^{-1}\left(I+X^{T}A^{-1}X-X^{T}A^{-1}X\right)\right)y$
$\displaystyle=V_{j^{*}}-A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}X^{T}V_{j^{*}}+A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}y$
$\displaystyle=V_{j^{*}}+A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}\left(y-X^{T}V_{j^{*}}\right)$

Finally, we have,

(4) $\displaystyle\hat{V_{j^{*}}}-V_{j^{*}}$
$\displaystyle=A^{-1}X\left(I+X^{T}A^{-1}X\right)^{-1}\left(y-X^{T}V_{j^{*}}\right)$