From the perspective of the attacker, the best attack against a system is one that
yields the biggest impact for the least amount of effort. There are two types of effort
involved in mounting an attack. The first is the effort involved in crafting profiles.
On of the crucial variables here is the amount of knowledge that is required to put
together an attack. A high-knowledge attack is one that requires the attacker to have
detailed knowledge of the ratings distribution in a recommender system’s database.
Some attacks, for example, require that the attacker know the mean rating and standard deviation for every item. A low-knowledge attack is one that requires systemindependent knowledge such as might be obtained by consulting public information
sources.
We assume that the attacker will have a general knowledge of the type of al-
gorithm being employed to produce recommendations. An attacker that has more
detailed knowledge of the precise algorithm in use would be able to produce an in-
formed attack that makes use of the mathematical properties of the algorithm itself
to produce the greatest impact.
The second aspect of effort is the number of profiles that must be added to the
system in order for it to be effective. The ratings are less important since the insertion of ratings can be easily automated. Most sites employ online registration
schemes requiring human intervention, and by this means, the site owner can impose a cost on the creation of new profiles. This is precisely why, from an attacker’s
perspective, attacks requiring a smaller number of profiles are particularly attractive.