A collaborative recommender is supposed to change its recommendations in response to the profiles that users add. It is somewhat counter-intuitive to suppose that
“robustness” or “stability” is a desirable property in a system that is supposed to be
adaptive. The goal of robust recommendation is to prevent attackers from manipulating the system through large-scale insertion of user profiles, a profile injection
attack.
We assume that any user profile is feasible. That is, we do not want to demand
that users’ ratings fit with those that have been entered previously or that they make
any kind of objective sense. Users are entitled to their idiosyncratic opinions and
there is always the possibility that what is an unusual user today may be more typical tomorrow as new users sign up. So, a profile, taken by itself, cannot constitute an
attack. Also, it is important to note that some web phenomena that look like attacks
are not considered such within this definition. For example, in the Fall of 2008, numerous videogame fans converged on the page for the game Spore on Amazon.com,
using it as a vehicle for airing their complaints about the digital rights management
software included with the game. Presumably these were a large number of authentic individuals, and while their ratings no doubt skewed the recommendations for
Spore for some time, their actions would not be considered an attack as we define it
here. It is not clear that any automated technique can identify when a real user posts