IFM: Integrating and fine-tuning adversarial examples of recommendation system under multiple models to enhance their transferability

Abstract

In black-box attack scenarios on recommendation systems, attackers typically rely on surrogate models to approximate the target model and use them to generate adversarial examples due to a lack of knowledge about the internal mechanisms of the target recommendation model. However, reliance on a single surrogate model often leads to adversarial examples that are prone to overfitting, making them vulnerable to local extremes and limiting their transferability across different models. Moreover, methods generating adversarial examples in flat minimum regions fail to consistently perform across diverse models. To address these limitations, this paper proposes a feature integration and fine-tuning framework, IFM, which aims to reduce the overfitting of adversarial examples and enhance their transferability. IFM captures a wider range of attack features by integrating the knowledge of multiple recommendation models and performs fine-tuning to further improve the transferability of the adversarial examples. Experimental results affirm that our approach markedly enhances the transferability of adversarial examples in recommendation systems over existing state-of-the-art techniques, enabling efficient attacks on recommendation models.