Poisoning attacks against knowledge graph-based recommendation systems using deep reinforcement learning

Zih Wun Wu, Chiao Ting Chen, Szu-Hao Huang*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

11 Scopus citations


In recent years, studies have revealed that introducing knowledge graphs (KGs) into recommendation systems as auxiliary information can improve recommendation accuracy. However, KGs are usually based on third-party data that may be manipulated by malicious individuals. In this study, we developed a poisoning attack strategy applied on a KG-based recommendation system to analyze the influence of fake links. The aim of an attacker is to recommend specific products to improve their visibility. Most related studies have focused on adversarial attacks on graph data; KG-based recommendation systems have rarely been discussed. We propose an attack model corresponding to recommendations. In the model, the current recommended status and a specified item are analyzed to estimate the effects of different attack decisions (addition or deletion of facts), thereby generating the optimal attack combination. Finally, the KG is contaminated by the attack combination so that the trained recommendation model recommends a specific item to as many people as possible. We formulated the process into a deep reinforcement learning method. Conducting experiments on the movie and the fund data sets enabled us to systematically analyze our poisoning attack strategy. The experimental results proved that the proposed strategy can effectively improve an item’s ranking in a recommendation list.

Original languageEnglish
Pages (from-to)3097–3115
Number of pages19
JournalNeural Computing and Applications
Issue number4
StatePublished - Feb 2022


  • Adversarial attacks
  • Deep reinforcement learning
  • Knowledge graph-based recommendation
  • Poisoning attacks


Dive into the research topics of 'Poisoning attacks against knowledge graph-based recommendation systems using deep reinforcement learning'. Together they form a unique fingerprint.

Cite this