Recommender systems are vulnerable to injective attacks, which inject limited fake users into the platforms to manipulate the exposure of target items to all users. In this work, we identify that conventional injective attackers overlook the fact that each item has its unique potential audience, and meanwhile, the attack difficulty across different users varies. Blindly attacking all users will result in a waste of fake user budgets and inferior attack performance. To address these issues, we focus on an under-explored attack task called target user attacks, aiming at promoting target items to a particular user group. In addition, we formulate the varying attack difficulty as heterogeneous treatment effects through a causal lens and propose an Uplift-guided Budget Allocation (UBA) framework. UBA estimates the treatment effect on each target user and optimizes the allocation of fake user budgets to maximize the attack performance. Theoretical and empirical analysis demonstrates the rationality of treatment effect estimation methods of UBA. By instantiating UBA on multiple attackers, we conduct extensive experiments on three datasets under various settings with different target items, target users, fake user budgets, victim models, and defense models, validating the effectiveness and robustness of UBA.

翻译：推荐系统易受注入式攻击，攻击者通过向平台注入有限数量的虚假用户，以操纵目标项目对所有用户的曝光。在本研究中，我们指出现有注入式攻击方法忽略了一个事实：每个项目有其独特的潜在受众群体，且不同用户的攻击难度存在差异。盲目攻击所有用户将导致虚假用户预算的浪费及攻击性能下降。为解决此问题，我们聚焦于一项尚未充分探索的攻击任务——目标用户攻击，旨在将目标项目推广至特定用户群体。此外，我们通过因果视角将攻击难度差异建模为异质性处理效应，并提出一种基于提升引导的预算分配（UBA）框架。UBA估计各目标用户的处理效应，优化虚假用户预算分配以最大化攻击性能。理论与实证分析证明了UBA中处理效应估计方法的合理性。通过将UBA实例化到多种攻击器，我们在三个数据集上针对不同目标项目、目标用户、虚假用户预算、受害者模型及防御模型进行了广泛实验，验证了UBA的有效性与鲁棒性。