Federated Recommender Systems (FedRecs) are considered privacy-preserving techniques to collaboratively learn a recommendation model without sharing user data. Since all participants can directly influence the systems by uploading gradients, FedRecs are vulnerable to poisoning attacks of malicious clients. However, most existing poisoning attacks on FedRecs are either based on some prior knowledge or with less effectiveness. To reveal the real vulnerability of FedRecs, in this paper, we present a new poisoning attack method to manipulate target items' ranks and exposure rates effectively in the top-$K$ recommendation without relying on any prior knowledge. Specifically, our attack manipulates target items' exposure rate by a group of synthetic malicious users who upload poisoned gradients considering target items' alternative products. We conduct extensive experiments with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on two real-world recommendation datasets. The experimental results show that our attack can significantly improve the exposure rate of unpopular target items with extremely fewer malicious users and fewer global epochs than state-of-the-art attacks. In addition to disclosing the security hole, we design a novel countermeasure for poisoning attacks on FedRecs. Specifically, we propose a hierarchical gradient clipping with sparsified updating to defend against existing poisoning attacks. The empirical results demonstrate that the proposed defending mechanism improves the robustness of FedRecs.

翻译：联邦推荐系统（FedRecs）被视为一种隐私保护技术，可在不共享用户数据的情况下协作学习推荐模型。由于所有参与者都能通过上传梯度直接影响系统，FedRecs容易遭受恶意客户端的投毒攻击。然而，现有针对FedRecs的投毒攻击大多基于某些先验知识，或效果有限。为揭示FedRecs的真实脆弱性，本文提出一种新型投毒攻击方法，可在无需任何先验知识的情况下，有效操纵目标物品在Top-K推荐中的排名和曝光率。具体而言，本攻击通过一组合成恶意用户操纵目标物品的曝光率，这些用户会上传考虑目标物品替代产品的投毒梯度。我们在两个真实推荐数据集上，利用两种广泛使用的FedRecs（Fed-NCF和Fed-LightGCN）进行了大量实验。实验结果表明，相较于最先进的攻击方法，本攻击能以极少的恶意用户和更少的全局轮次显著提高非流行目标物品的曝光率。除揭示安全漏洞外，我们还针对FedRecs的投毒攻击设计了一种新型防御对策。具体而言，我们提出一种结合稀疏化更新的层次梯度裁剪方法，以防御现有投毒攻击。实证结果表明，所提出的防御机制增强了FedRecs的鲁棒性。