Collaborative Research: SaTC: CORE: Small: Securing Recommender Systems against Data Poisoning Attacks

这个项目的目标是构建安全的推荐系统来抵御数据中毒攻击。推荐系统在网上很常见，推荐电影、产品、新闻和许多其他类型的项目，以帮助人们找到他们感兴趣的东西并做出决定。然而，推荐系统对人们行为的影响使其成为诱人的攻击目标：攻击者可以创建虚假用户，这些用户对商品的评价方式导致系统推荐更符合攻击者利益而非用户利益的产品。这些“数据中毒”攻击威胁到推荐系统的完整性，对使用这些系统的公司和用户都造成了伤害。该提案将开发检测、限制和从数据中毒攻击中恢复的方法，使推荐系统更能抵抗不良行为者的操纵，从而更加可信和有用；这些方法还将被纳入学生的课程和研究工作中，培养下一代计算机科学家构建更强大的机器学习系统。该项目围绕三个主要目标构建。任务1涉及系统地调查针对数据中毒攻击的推荐系统的安全漏洞，攻击者对算法和数据集的了解程度各不相同。在任务2中，团队将开发新的推荐算法，可以证明可以防止数据中毒攻击，即，可以证明有限数量的假用户不会影响系统的性能，无论假用户如何制作他们的评级分数。任务3是开发具有可证明保证的方法来检测数据投毒攻击中的假用户，并有效地从数据投毒攻击中恢复推荐系统。该项目将为具有传统上在计算机领域代表性不足的背景的学生提供研究机会，这项工作将被纳入杜克大学和西弗吉尼亚大学的课程，并广泛传播。该项目由安全与可信计算（SaTC）和促进竞争研究的既定计划（EPSCoR）共同资助。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of this project is to build secure recommender systems against data poisoning attacks. Recommender systems are common online, suggesting movies, products, news, and many other kinds of items in order to help people find things they are interested in and make decisions. The influence recommender systems have on people's behavior, however, makes them attractive targets: attackers can create fake users who rate items in ways that lead the system to recommend products that are more in the attackers' interests than the users'. These "data poisoning" attacks threaten the integrity of recommender systems, harming both the companies and people that use them. This proposal will develop methods to detect, limit, and recover from the damage of data poisoning attacks, making recommender systems more resistant to manipulation by bad actors and thus more trustable and useful; the methods will also be incorporated into students' coursework and research work, training a next generation of computer scientists to build more robust machine learning systems.The project is structured around three main aims. Task 1 involves systematically investigating the security vulnerabilities of recommender systems against data poisoning attacks where attackers have varying levels of knowledge about the algorithms and datasets. In task 2 the team will develop new recommendation algorithms that provably prevent data poisoning attacks, i.e., a bounded number of fake users provably cannot affect the system's performance no matter how the fake users craft their rating scores. Task 3 is to develop methods to detect the fake users in data poisoning attacks with provable guarantees and efficiently recover a recommender system from data poisoning attacks. The project will provide research opportunities for students with backgrounds that are traditionally underrepresented in computing, and the work will be incorporated into courses at Duke University and West Virginia University and disseminated widely.This project is jointly funded by Secure and Trustworthy Computing (SaTC) and the Established Program to Stimulate Competitive Research (EPSCoR).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.