探索大语言模型增强推荐系统的后门攻击与防御
Exploring Backdoor Attack and Defense for LLM-empowered Recommendations
AI总结：
针对基于LLM的推荐系统后门攻击安全性研究不足的问题，提出BadRec攻击框架可通过1%对抗样本投毒植入后门，还提出P-Scanner防御策略，在三个真实数据集验证了其检测投毒项目的有效性。
摘要：
大语言模型（LLMs）与推荐系统（RecSys）的融合极大推动了个性化推荐的发展并受到广泛关注。尽管取得了显著进展，但基于LLM的推荐系统抵御后门攻击的安全性仍未得到充分研究。本文提出一个新问题：能否向基于LLM的推荐系统注入带有特定触发器的后门，使得在项目标题后附加后门触发器时操纵推荐响应？为研究基于LLM的推荐系统在后门攻击下的脆弱性，我们提出一种名为推荐系统后门注入投毒（BadRec）的新攻击框架。BadRec用触发器扰动项目标题，并使用若干虚假用户与这些项目交互，有效投毒训练集并向基于LLM的推荐系统注入后门。综合实验表明，仅用1%的对抗样本投毒训练数据就足以成功植入后门，实现推荐操纵。为进一步缓解此类安全威胁，我们提出一种名为投毒扫描器（P-Scanner）的通用防御策略。具体而言，我们引入基于LLM的投毒扫描器，利用LLM强大的语言理解能力和丰富知识检测投毒项目；还采用触发器增强智能体生成多样化合成触发器，引导投毒扫描器学习投毒项目检测任务的领域特定知识。在三个真实世界数据集上的大量实验验证了所提P-Scanner的有效性。
英文摘要：
The fusion of Large Language Models (LLMs) with recommender systems (RecSys) has dramatically advanced personalized recommendations and drawn extensive attention. Despite the impressive progress, the safety of LLM-based RecSys against backdoor attacks remains largely under-explored. In this paper, we raise a new problem: Can a backdoor with a specific trigger be injected into LLM-based Recsys, leading to the manipulation of the recommendation responses when the backdoor trigger is appended to an item's title? To investigate the vulnerabilities of LLM-based RecSys under backdoor attacks, we propose a new attack framework termed Backdoor Injection Poisoning for RecSys (BadRec). BadRec perturbs the items' titles with triggers and employs several fake users to interact with these items, effectively poisoning the training set and injecting backdoors into LLM-based RecSys. Comprehensive experiments reveal that poisoning just 1% of the training data with adversarial examples is sufficient to successfully implant backdoors, enabling manipulation of recommendations. To further mitigate such a security threat, we propose a universal defense strategy called Poison Scanner (P-Scanner). Specifically, we introduce an LLM-based poison scanner to detect the poisoned items by leveraging the powerful language understanding and rich knowledge of LLMs. A trigger augmentation agent is employed to generate diverse synthetic triggers to guide the poison scanner in learning domain-specific knowledge of the poisoned item detection task. Extensive experiments on three real-world datasets validate the effectiveness of the proposed P-Scanner.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
