Shilling Attack

A collaborative filter trusts its users, because the interaction matrix is the only evidence it has. A shilling attack is what happens when someone notices that and buys a few hundred fake accounts.

How profile injection works
The attacker creates fabricated user profiles whose ratings are engineered to place a target item inside as many genuine users' neighbourhoods as possible. A push attack rates the target highly; a nuke attack buries it. The craft lies in the filler items. Random filler is easy to spot; an average attack rates popular items close to their true means so the fake user looks unremarkable, and a bandwagon attack co-rates blockbusters to land in the widest possible set of neighbourhoods.

Why neighbourhood methods suffer most
User-user collaborative filtering is the most exposed: a handful of fake neighbours with near-perfect similarity can dominate a prediction, especially for a thinly-rated target where there is little genuine signal to outweigh them. Matrix factorization is harder to move, since each injected profile only nudges shared latent factors, but it is not immune — enough coordinated profiles bend the factors too.

Defences

• Detection: statistical signatures such as implausible rating distributions, suspiciously high agreement among newly created accounts, and profiles whose attention concentrates on one item.
• Robust aggregation: significance weighting, caps on any single neighbour's influence, and trimmed means instead of plain averages.
• Harder currency: counting only verified purchases or completed plays as interactions, plus rate limits on new accounts.

Because the incentive is commercial, this stays an adversarial contest rather than a bug closed once.