Collaborative Research: SaTC: CORE: Small: Securing Recommender Systems against Data Poisoning Attacks

该项目的目标是构建安全的推荐系统来抵御数据中毒攻击。推荐系统在网上很常见，推荐电影、产品、新闻和许多其他类型的项目，以帮助人们找到他们感兴趣的东西并做出决定。然而，推荐系统对人们行为的影响使他们成为有吸引力的目标：攻击者可以创造虚假用户，这些用户对商品进行评分，导致系统推荐更符合攻击者利益的产品。这些“数据中毒”攻击威胁到推荐系统的完整性，对使用它们的公司和个人都造成了伤害。该提案将开发检测、限制和恢复数据中毒攻击造成的损害的方法，使推荐系统更能抵抗不良行为者的操纵，从而更可靠和有用；这些方法还将纳入学生的课程和研究工作，培养下一代计算机科学家，以构建更健壮的机器学习系统。该项目围绕三个主要目标构建。任务1涉及系统地调查推荐系统针对数据中毒攻击的安全漏洞，在数据中毒攻击中，攻击者对算法和数据集具有不同程度的知识。在任务2中，团队将开发新的推荐算法，以证明可以防止数据中毒攻击，即有限数量的虚假用户显然不会影响系统的性能，无论这些虚假用户如何设计他们的评级分数。第三个任务是开发方法来检测数据中毒攻击中的虚假用户并提供可证明的保证，并有效地从数据中毒攻击中恢复推荐系统。该项目将为具有传统上在计算机领域代表性不足的背景的学生提供研究机会，该工作将被纳入杜克大学和西弗吉尼亚大学的课程并广泛传播。该项目由安全可信计算(SATC)和既定的刺激竞争研究计划(EPSCoR)联合资助。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of this project is to build secure recommender systems against data poisoning attacks. Recommender systems are common online, suggesting movies, products, news, and many other kinds of items in order to help people find things they are interested in and make decisions. The influence recommender systems have on people's behavior, however, makes them attractive targets: attackers can create fake users who rate items in ways that lead the system to recommend products that are more in the attackers' interests than the users'. These "data poisoning" attacks threaten the integrity of recommender systems, harming both the companies and people that use them. This proposal will develop methods to detect, limit, and recover from the damage of data poisoning attacks, making recommender systems more resistant to manipulation by bad actors and thus more trustable and useful; the methods will also be incorporated into students' coursework and research work, training a next generation of computer scientists to build more robust machine learning systems.The project is structured around three main aims. Task 1 involves systematically investigating the security vulnerabilities of recommender systems against data poisoning attacks where attackers have varying levels of knowledge about the algorithms and datasets. In task 2 the team will develop new recommendation algorithms that provably prevent data poisoning attacks, i.e., a bounded number of fake users provably cannot affect the system's performance no matter how the fake users craft their rating scores. Task 3 is to develop methods to detect the fake users in data poisoning attacks with provable guarantees and efficiently recover a recommender system from data poisoning attacks. The project will provide research opportunities for students with backgrounds that are traditionally underrepresented in computing, and the work will be incorporated into courses at Duke University and West Virginia University and disseminated widely.This project is jointly funded by Secure and Trustworthy Computing (SaTC) and the Established Program to Stimulate Competitive Research (EPSCoR).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.