Federated Recommender Systems (FedRecs) are considered privacy-preserving techniques to collaboratively learn a recommendation model without sharing user data. Since all participants can directly influence the systems by uploading gradients, FedRecs are vulnerable to poisoning attacks of malicious clients. However, most existing poisoning attacks on FedRecs are either based on some prior knowledge or with less effectiveness. To reveal the real vulnerability of FedRecs, in this paper, we present a new poisoning attack method to manipulate target items' ranks and exposure rates effectively in the top-$K$ recommendation without relying on any prior knowledge. Specifically, our attack manipulates target items' exposure rate by a group of synthetic malicious users who upload poisoned gradients considering target items' alternative products. We conduct extensive experiments with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on two real-world recommendation datasets. The experimental results show that our attack can significantly improve the exposure rate of unpopular target items with extremely fewer malicious users and fewer global epochs than state-of-the-art attacks. In addition to disclosing the security hole, we design a novel countermeasure for poisoning attacks on FedRecs. Specifically, we propose a hierarchical gradient clipping with sparsified updating to defend against existing poisoning attacks. The empirical results demonstrate that the proposed defending mechanism improves the robustness of FedRecs.

翻译：联邦推荐系统（FedRecs）被视为一种隐私保护技术，可在不共享用户数据的情况下协同学习推荐模型。由于所有参与者均能通过上传梯度直接影响系统，FedRecs面临恶意客户端投毒攻击的威胁。然而，现有针对FedRecs的投毒攻击方法或依赖先验知识，或攻击效果有限。为揭示FedRecs的真实脆弱性，本文提出一种新型投毒攻击方法，无需任何先验知识即可有效操控目标项目在Top-$K$推荐中的排名与曝光率。具体而言，本攻击通过构建合成恶意用户群组，利用目标项目的替代产品上传投毒梯度，实现对目标项目曝光率的操控。我们在两个真实推荐数据集上，采用两种广泛使用的FedRecs架构（Fed-NCF与Fed-LightGCN）进行大量实验。结果表明，与现有最先进攻击方法相比，本方法能以更少的恶意用户数和更少的全局训练轮次，显著提升冷门目标项目的曝光率。除揭示安全漏洞外，我们针对FedRecs投毒攻击设计了新型防御机制，提出结合稀疏化更新的分层梯度裁剪方法以抵御现有投毒攻击。实验结果证明，该防御机制能有效提升FedRecs的鲁棒性。