25.3 Characterising Attacks
A profile-injection attack against a recommender system consists of a set of profiles
added to the system by the attacker. A profile consists of a set of rating/item pairs, or
alternately, we can think of the profile being a vector of all items, with a rating value
for each item, but allowing the null value for unrated items. For the attacks that we
are discussing, there will always be a target item it that the attacker is interested
in promoting or demoting. There will generally also be a set of filler items, that are
chosen randomly from those available. We will denote this set IF . Some attack models also make use of a set of items that are selected out of the database. The small set
usually has some association with the target item (or a targeted segment of users).
For some attacks, this set is empty. This will be the set IS. Finally, for completeness,
the set I0 contains those items not rated in the profile. Since the selected item set is
usually small, the size of each profile (total number of ratings) is determined mostly
by the size of the filler item set. Some of the experimental results report filler size
as a proportion of the size of I (i.e., the set of all items).