Profile Injection Attack

Collaborative filtering has an open door built into it: it learns from whoever shows up. Create a few hundred accounts, give them carefully chosen rating histories, and you can steer what the system recommends to everyone else. A profile injection attack — also called a shilling attack — is exactly that: fake user profiles pushed into the interaction data to promote or demote a target item.

How the fake profiles are built
The attacker's real problem is influence, which means making the fake accounts look similar to many genuine users. Ratings on filler items do that work; the target item then receives the extreme rating the attacker wants.

• Random attack — filler ratings drawn around the global mean.
• Average attack — each filler item rated near its own average, which is far harder to spot.
• Bandwagon attack — fillers concentrated on blockbusters, buying similarity with a large slice of the user base cheaply.

Why it works, and the defences
User-user CF is the most exposed, because a handful of profiles can dominate a neighbourhood. Factorisation models absorb the attack more slowly but not indefinitely. Defence pairs detection — implausible rating distributions, suspiciously high agreement among new accounts, burst timing — with robust estimation that caps how much any single profile can move an item.

Why it matters
Recommendation drives real revenue, so there is a market for manipulating it, and this attack needs no access to the model, the features or the code — only the ability to register. Measuring robustness alongside accuracy is what stops a recommender being quietly rented out to whoever creates accounts fastest.