Federated Recommender Systems (FedRecs) are considered privacy-preserving techniques to collaboratively learn a recommendation model without sharing user data. Since all participants can directly influence the systems by uploading gradients, FedRecs are vulnerable to poisoning attacks of malicious clients. However, most existing poisoning attacks on FedRecs are either based on some prior knowledge or with less effectiveness. To reveal the real vulnerability of FedRecs, in this paper, we present a new poisoning attack method to manipulate target items' ranks and exposure rates effectively in the top-$K$ recommendation without relying on any prior knowledge. Specifically, our attack manipulates target items' exposure rate by a group of synthetic malicious users who upload poisoned gradients considering target items' alternative products. We conduct extensive experiments with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on two real-world recommendation datasets. The experimental results show that our attack can significantly improve the exposure rate of unpopular target items with extremely fewer malicious users and fewer global epochs than state-of-the-art attacks. In addition to disclosing the security hole, we design a novel countermeasure for poisoning attacks on FedRecs. Specifically, we propose a hierarchical gradient clipping with sparsified updating to defend against existing poisoning attacks. The empirical results demonstrate that the proposed defending mechanism improves the robustness of FedRecs.

翻译：联邦推荐系统（FedRecs）被视为一种隐私保护技术，通过协作学习推荐模型而无需共享用户数据。由于所有参与者可直接上传梯度影响系统，FedRecs容易遭受恶意客户端的投毒攻击。然而，现有针对FedRecs的投毒攻击大多依赖先验知识或有效性不足。为揭示FedRecs的真实脆弱性，本文提出一种无需任何先验知识即可有效操控目标物品在Top-$K$推荐中排名与曝光率的全新投毒攻击方法。具体而言，该方法通过一组合成恶意用户上传包含目标物品替代产品信息的投毒梯度，实现对目标物品曝光率的操纵。我们在两个真实推荐数据集上，对两种广泛使用的FedRecs（Fed-NCF和Fed-LightGCN）进行了大量实验。实验结果表明，与现有最先进攻击相比，我们的攻击能以极少的恶意用户和更少的全局迭代轮次，显著提升冷门目标物品的曝光率。除揭示安全漏洞外，我们还为FedRecs的投毒攻击设计了一种新型防御机制。具体而言，我们提出一种基于稀疏更新的分层梯度裁剪方法，以抵御现有投毒攻击。实验结果表明，所提出的防御机制可有效提升FedRecs的鲁棒性。