When Graph Contrastive Learning Backfires: Spectral Vulnerability and Defense in Recommendation

Hongzhi Yin; Junliang Yu; Ling Liu; Min Gao; Shazia Sadiq; Zongwei Wang

REVIEW 3 major objections 6 minor 59 references

When Graph Contrastive Learning Backfires: Spectral Vulnerability and Defense in Recommendation

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Graph contrastive learning, meant to harden recommenders, instead increases their exposure to targeted item-promotion attacks by smoothing the embedding spectrum; the paper builds a spectral attack (CLeaR) and a spectral defense (SIM).

desk verdict Plausible empirical story and a working defense, but the paper dodges its own comparative claim and the spectral proof has a real gap. read the letter →

arxiv 2507.07436 v1 pith:UFBWEG5Y submitted 2025-07-10 cs.IR

Zongwei Wang , Min Gao , Junliang Yu , Shazia Sadiq , Hongzhi Yin , Ling Liu This is my paper · ORCID

classification cs.IR

keywords graphcontrastivelearningrecommendersystemstargetedpromotionattackspectralanalysisadversarialrobustnesspoisoninganomalydetectionembeddingspectrum

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Graph contrastive learning (GCL) is added to recommender systems to make learned embeddings more robust, but this paper claims it also makes the recommender more vulnerable to targeted promotion attacks, where an attacker injects fake interactions to push a specific cold item into many users' top-K lists. The proposed mechanism is spectral smoothing: contrastive optimization spreads variance across the singular-value spectrum of the embedding matrix, so item embeddings disperse and unpopular target items sit closer to the user population. The paper proves an upper bound on the InfoNCE contrastive loss in terms of singular-value products, uses that insight to build an attack called CLeaR that deliberately amplifies the smoothness, and proposes a defense called SIM that detects items deviating from the low-rank spectral subspace and suppresses their exposure. If the claim is right, GCL-based recommenders should be audited for item-level attack exposure, not judged only by global accuracy.

What carries the argument

The carrying object is the singular-value spectrum of the user-item embedding matrix $\mathbf{Z}=\mathbf{L}\boldsymbol{\Sigma}\mathbf{R}^\top$. The theoretical load is Proposition 1, an upper bound on InfoNCE written in terms of the products $\sigma'_i\sigma''_i$; minimizing that bound suppresses the largest singular-value product and aligns the two spectra, which makes the singular values decay more gradually and spreads embeddings through previously underused dimensions. The attack's machinery is a differentiable dispersion objective that avoids explicit SVD by using a rank-1 approximation $\hat{\mathbf{Z}} = \mathbf{Z} - \mathbf{Z}\mathbf{V}'\mathbf{V}'^\top/\|\mathbf{V}'\|_2^2$, together with a CW-style rank-promotion loss. The defense's machinery is the reconstruction error $\epsilon_i = \|\mathbf{z}_i - \mathbf{L}_{top-k}\boldsymbol{\Sigma}_{top-k}\mathbf{R}_{top-k}^\top\|_2$, an adaptive threshold $\mu + \gamma s$, and a mitigation loss over the top-$m$ most similar users.

What would settle it

Run the same GCL recommender under a fixed promotion attack with the contrastive term on and off; if attack success, measured by Hit Ratio, does not rise together with a measurable flattening of the singular-value spectrum, such as slower singular-value decay or a higher participation ratio, the proposed mechanism is contradicted.

Watch

Extended reading notes

Core claim

The paper's central claim is that integrating graph contrastive learning into a recommender improves global metrics such as Recall while also increasing the Hit Ratio of target items under a white-box promotion attack, and that the increase follows from the spectral signature of the InfoNCE objective. The authors derive Proposition 1, an upper bound $L_{gcl} < N\max_j \sigma'_j\sigma''_j - \sum_i \sigma'_i\sigma''_i + N\log N$, under the assumption that the two augmented views share singular vectors, and read the objective as suppressing the leading singular-value product while aligning the two spectra, which flattens the singular-value curve and disperses embeddings. Because target items are typically cold items at the periphery of the embedding space, this dispersion moves them closer to the user population and makes promotion easier. The authors operationalize this as CLeaR, a bi-level attack with a dispersion-promotion objective and a rank-promotion objective, and as SIM, a defense that flags items by rank-$k$ SVD reconstruction error and penalizes their similarity to their top-$m$ closest users.

Load-bearing premise

The argument's load-bearing step is the assumption that the two differently augmented views of the graph have essentially the same geometric directions, so that the contrastive loss can be written in terms of their singular values; under realistic augmentations such as random node or edge dropout this equality does not hold.

Editorial extensions

If this is right

GCL-based recommenders inherit a measurable per-item exposure risk, so robustness evaluations should report attack success on promoted items, not only global Recall.
An attacker does not need to pick a vulnerable target with great precision: amplifying spectral smoothness lifts the whole cold tail, making whatever item is chosen easier to promote.
A defender can use the same spectrum: promoted items become reconstruction outliers under a rank-$k$ fit, enabling detection before suppression.
The defense's success condition is that Hit Ratio falls while Recall holds approximately constant, which the paper reports on dense datasets and in weaker form on sparse data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the same spectral argument suggests that the temperature $\tau$ in InfoNCE sets an exposure ceiling, so lowering $\tau$ to harden embeddings should also reduce the reach of promotion attacks, a testable knob the paper does not turn.
Beyond the paper: if spectral smoothing is the mechanism, other objectives that flatten the singular-value spectrum, such as decorrelation or uniformity regularizers, should produce comparable vulnerability, which would generalize the finding outside graph contrastive learning.
Beyond the paper: SIM's detection stage identifies items by reconstruction error, so an adaptive attacker could try to keep target embeddings inside the principal subspace; testing CLeaR against such spectrum-aware variants would probe whether the defense's signal is fundamental or evadable.
Beyond the paper: the finding implies a fairness-security coupling, because the same dispersion that reduces popularity bias by lifting cold items also widens the attack surface for promoting arbitrary cold items, so deployment may need to trade off bias reduction against manipulation risk.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the paper's empirical story is plausible and the defense looks effective, but the paper does not actually test its central comparative claim, and the spectral proof doesn't hold together. Worth refereeing, but it needs a major revision.

What's genuinely new: Proposition 1 is a new upper bound on InfoNCE in terms of singular value products, and SIM is a new defense that detects spectrally irregular items and suppresses them. The empirical fact that GCL variants have flatter singular spectra than LightGCN is consistent with earlier dimensional collapse work. And the SIM results are consistent across three datasets and six attack baselines, often driving H@50 to zero on DouBan while keeping R@50 stable. That's a useful contribution.

The soft spots are load-bearing. First and most important: the central claim is comparative—'GCL integration increases susceptibility'—but Table 2 compares only GCL variants against each other. There is no LightGCN row under CLeaR or any of the five attacks. Fig. 1 shows LightGCN only under RandomAttack, which is weak and does not exploit spectral smoothing. So the higher H@50 of GCL models under CLeaR could simply mean CLeaR is a stronger attack on any recommender. The paper's root-cause story is not empirically differentiated. This is a decisive missing experiment, independent of the proof issue.

Second, the proof of Proposition 1. The step from the log-sum-exp bound to the singular value bound assumes the singular vectors of Z' and Z'' are essentially identical, which the text acknowledges but is not true for node/edge dropout augmentations. Also, 'max over n z'_n^T z''_n' is the largest diagonal entry of Z'^T Z'', not the largest singular value product; the proof conflates these. And the claim that minimizing GCL 'coincides' with minimizing this loose upper bound is asserted, not shown. So the theoretical mechanism is not rigorously established, even though the empirical flattening of the spectrum is convincing.

Also worth noting: the paper calls the vulnerability 'previously unrecognized' while citing its own KDD'24 paper that introduced CLeaR, so the novelty is overstated. The text says 'four benchmarks' while listing three. No code or data are released, and despite averaging over 5 runs, no error bars are reported.

Who it's for: people working on recommender robustness or GCL security. The defense could be practically useful. It deserves a serious referee, but only with a required revision to add the LightGCN baseline under all attacks and fix the proof or reframe it as a heuristic argument. If those are addressed, it could be a solid paper.

Referee Report

3 major / 6 minor

Summary. The paper studies targeted promotion attacks against graph contrastive learning (GCL) recommenders. It claims that integrating GCL into a recommender inadvertently increases susceptibility to such attacks, attributes this to spectral smoothing induced by InfoNCE optimization, and introduces CLeaR, a bi-level attack that amplifies this effect, and SIM, a two-stage spectral-irregularity defense. Experiments on DouBan, Epinions, and Gowalla with four GCL backbones (SSL4Rec, SGL, XSimGCL, RecDCL) compare six attacks and show that SIM substantially reduces HitRatio@50 while maintaining Recall@50.

Significance. If the central comparative claim holds, the paper has practical importance: GCL is widely used to improve recommendation robustness, and the paper argues that it simultaneously opens an attack surface through spectral smoothing. The empirical direction is credible and the paper contains a valuable independent check: Fig. 1 shows, under a weak heuristic attack (RandomAttack), that four GCL variants consistently promote target items more than the non-GCL backbone LightGCN. The defense results on dense datasets are striking, with HitRatio often reduced to zero while Recall is preserved. The paper also provides detailed experimental settings, including target item IDs and hyperparameters, which aids reproducibility. However, the theoretical mechanism is not rigorously established, and a key missing control weakens the causal interpretation. The paper is likely publishable after substantial revision.

major comments (3)

[Section 3.2, Proposition 1 and Eqs. (5)-(9)] The proof of Proposition 1 rests on an assumption that is not justified for the augmentations used in the paper: "Assuming their singular vectors differ negligibly, we enforce them to be identical." For random node or edge dropout, as used by SGL and similar methods, the singular vectors of Z' and Z'' are in general not close, and the paper provides no bound on the error introduced by this enforcement. Even under the assumption, the derivation in Eq. (9) is not correct as written: the maximum diagonal entry of Z'^T Z'' is max_n Σ_j σ'_j σ''_j r_{j,n}^2, which is not equal to max_j σ'_j σ''_j r_j^T r_j; the latter is only an upper bound. Finally, the statement that "minimizing the GCL loss coincides with minimizing this upper bound" is asserted without proof; minimizing an upper bound does not in general minimize the original loss, and the log-sum-exp step in Eq. (6) is a very loose bound. These gaps mean the theoretical claim that InfoNCE minimization induces spectral smoothing is not established by the current proof.
[Section 6.2, Table 2] The paper's central claim is that GCL integration increases susceptibility to targeted promotion attacks. This comparative claim is directly tested in Fig. 1 only under RandomAttack; the main CLeaR evaluation in Table 2 reports results exclusively for four GCL variants (SSL4Rec, SGL, XSimGCL, RecDCL), with no non-GCL baseline. Since CLeaR is explicitly designed to amplify spectral smoothness, the root-cause story predicts that CLeaR should be less effective on LightGCN, which does not have the smooth spectrum produced by contrastive training. Adding LightGCN rows to Table 2 under CLeaR (and ideally under all six attacks on the same datasets and target items) would provide a direct test of this prediction. Without it, the higher H@50 values under CLeaR could simply reflect CLeaR's general attack strength on any recommender rather than a GCL-specific vulnerability.
[Section 5.1, Figure 4, and Table 4] The anomaly detection phase of SIM flags items whose reconstruction error from a low-rank subspace exceeds μ + γ s. The target items in the experiments are cold items, and Figure 4 shows attacked target items with high reconstruction error, but there is no no-attack control. Cold items may already have high reconstruction error because they lie outside the dominant low-rank subspace, so the figure does not demonstrate that the high error is caused by the attack. Table 4's ablation SIM w/o AS, which removes all detected candidates, drives H@50 to zero but severely degrades R@50; this is consistent with the detector flagging a broad set of cold items rather than precisely localizing attacked items. Reporting detection precision/recall against a no-attack baseline, and the number of flagged candidates, would be needed to support the claim that spectral irregularity distinguishes attacked items from normal cold items.

minor comments (6)

[Section 6.1] The text says "We evaluate on four public benchmarks" but then lists only three datasets: DouBan, Epinions, and Gowalla.
[Section 5, Eq. (15)] The reconstruction formula ε_i = |z_i - L_topk Σ_topk R_topk|_2 has a dimension mismatch: if R_topk is N×k, the product L_topk Σ_topk R_topk is not defined. The intended projection is likely L_topk Σ_topk R_topk^T, and the item-specific indexing should be clarified.
[Section 4, Algorithm 1] Line 9 says "Minimize Lattack," which contradicts the maximization formulation in Eq. (4). Since L_R in Eq. (13) increases with the target-minus-lowest-ranked margin, the outer loop should maximize the attack utility or the text should be reworded.
[Table 2 and Table 3] The note "all H@50 values should be multiplied by 10^{-2}" is confusing because the table entries appear to already be in a percent-like scale; please clarify whether the reported numbers are percentages or fractions, and ensure consistency with the y-axis scale in Fig. 1.
[Section 4.2, Eq. (13)] The set-builder condition "i ∈ I_rec_u ∧ i ∉ I_T" should be written as "i ∈ I_rec_u, i ∉ I_T" to avoid ambiguity.
[Front matter] The ACM Reference Format placeholder still contains "2018" and "Conference acronym 'XX"; this should be updated before any formal submission.

Circularity Check

2 steps flagged · score 4.0 of 10

Partially self-confirming CLeaR evaluation, but independent RandomAttack evidence anchors the central claim.

self citation load bearing [Section 1 (Introduction) and Section 6.1 (Experimental Details)]
"Motivated by these insights, our prior work [37] introduced a bi-level optimization framework called Graph Contrastive Learning Recommendation Attack (CLeaR), which is explicitly designed to enable a systematic investigation of the susceptibility of GCL-based recommendation models to targeted promotion attacks. ... For a comprehensive analysis and additional results regarding the attack method, readers may refer to our previous study [37]."

The paper's headline empirical claim, 'GCL-based recommendation models exhibit greater susceptibility when evaluated with CLeaR,' is demonstrated using CLeaR, an attack from the authors' own prior work that was explicitly designed around the spectral-smoothing hypothesis this paper claims to establish. The attack is not an external, neutral probe: its definition and motivation embody the conclusion being tested. Thus the CLeaR rows in Table 2 are partially self-citation load-bearing evidence rather than independent confirmation. The paper does provide independent evidence elsewhere (Fig. 1 with RandomAttack), but the abstract and Table 2 foreground CLeaR as the decisive vulnerability demonstration.
self definitional [Section 4.1 (Dispersion Promotion Goal), Eqs. (10)-(12)]
"The first dispersion promotion goal encourages a more uniform spectral value distribution, thereby ensuring that embeddings are evenly spread across the representation space. This is formalized by aligning the spectral values of the embeddings with a smoother power-law distribution. ... reducing β smoothens the tail of the spectral distribution."

CLeaR's dispersion promotion objective, L_D = sim(σ, c x^{-β}), directly imposes spectral smoothing on the embedding spectrum. The paper's root-cause story is that GCL's spectral smoothing disperses item embeddings and thereby increases target exposure. Evaluating that story with an attack whose first objective is itself spectral smoothing means the attack success under CLeaR is partly generated by the attack's own construction, not solely by GCL's intrinsic property. The attack thus cannot separate the smoothing it actively injects from the smoothing it claims to expose in GCL models, making this portion of the validation self-definitional rather than an independent test of the mechanism.

full rationale

The paper's central comparative vulnerability claim is not fully circular: Fig. 1 compares LightGCN against four GCL variants under RandomAttack, a heuristic that does not exploit spectral smoothness, and shows higher H@50 for GCL variants. Fig. 2 provides additional spectral-dispersion evidence obtained without CLeaR. These are independent, non-circular supports for the claim that GCL increases susceptibility to at least some promotion attacks. However, the abstract and Table 2 foreground CLeaR, an attack from the authors' prior work [37] explicitly designed to amplify spectral smoothness. Eq. (10) makes CLeaR's dispersion objective a direct spectral-smoothing operator, so its high success on GCL models partly self-confirms the spectral-smoothing theory rather than testing it in an unbiased way. The evaluation also lacks a non-GCL LightGCN row under CLeaR in Table 2, so the comparative statement 'GCL-based models are more susceptible' is not tested under the headline attack condition; this is a missing control and an experimental gap, not itself a circularity. Proposition 1 relies on the explicit assumption that the singular vectors of the two augmented views are identical, which is a fragility of the theory but not a circular step, since the assumption is stated rather than smuggled in. Overall, the body of evidence has independent content, but the signature CLeaR-based validation is partially self-confirming, warranting a moderate score.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The central claims rest on modeling and proof assumptions rather than on new entities. The proof of Proposition 1 relies on close-alignment and shared-singular-vector assumptions for the augmented views. The threat model assumes a white-box attacker with bounded budget. The attack and defense introduce several hand-chosen hyperparameters whose values are mostly unspecified. No invented entities are introduced.

free parameters (8)

power-law exponent beta = not specified
Controls the target spectral tail smoothness in the dispersion promotion objective (Eq 10); chosen by hand.
power-law scale c = not specified
Scaling constant for the target power-law distribution in Eq (10).
attack balance alpha = not specified
Weights the rank promotion objective against dispersion promotion in Eq (14).
SIM threshold gamma = 1 (sensitivity analysis default)
Controls anomaly detection sensitivity in Eq (16); adjustable and results depend on it.
mitigation weight lambda_mit = 0.1 (sensitivity analysis default)
Weights the mitigation loss in Eq (18).
top-m users m = not specified
Number of most similar users penalized per candidate item in Eq (17).
SVD rank k = not specified
Rank used for reconstruction error in Eq (15).
GCL weight omega = not specified
Balances BPR and InfoNCE in Eq (3); inherited from baseline models but not stated for this paper's runs.

assumptions (4)

ad hoc to paper Z' and Z'' have nearly identical singular vectors
Invoked in the proof of Proposition 1 (Section 3.2): 'Assuming their singular vectors differ negligibly, we enforce them to be identical'. Not generally true for random augmentations.
domain assumption Max negative-pair similarity is below max positive-pair similarity
Used in the proof of Proposition 1 to replace per-node maxima with a global maximum, citing [30,33].
domain assumption GCL recommenders optimize L_rec + omega L_gcl
The joint objective in Eq (3) underlies the threat model and the theoretical analysis.
domain assumption White-box adversary with bounded budget
Attack model in Section 2.2: full model knowledge, 1% malicious users, per-account interaction cap.

how reviews work

0 comments

Cite this review

Pith. "Pith review of When Graph Contrastive Learning Backfires: Spectral Vulnerability and Defense in Recommendation." pith.science (2026). https://pith.science/paper/UFBWEG5Y

@misc{pith2026250707436,
  author       = {Pith},
  title        = {Pith review of: When Graph Contrastive Learning Backfires: Spectral Vulnerability and Defense in Recommendation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UFBWEG5Y}},
  note         = {Machine review of arXiv:2507.07436}
}

read the original abstract

Graph Contrastive Learning (GCL) has demonstrated substantial promise in enhancing the robustness and generalization of recommender systems, particularly by enabling models to leverage large-scale unlabeled data for improved representation learning. However, in this paper, we reveal an unexpected vulnerability: the integration of GCL inadvertently increases the susceptibility of a recommender to targeted promotion attacks. Through both theoretical investigation and empirical validation, we identify the root cause as the spectral smoothing effect induced by contrastive optimization, which disperses item embeddings across the representation space and unintentionally enhances the exposure of target items. Building on this insight, we introduce CLeaR, a bi-level optimization attack method that deliberately amplifies spectral smoothness, enabling a systematic investigation of the susceptibility of GCL-based recommendation models to targeted promotion attacks. Our findings highlight the urgent need for robust countermeasures; in response, we further propose SIM, a spectral irregularity mitigation framework designed to accurately detect and suppress targeted items without compromising model performance. Extensive experiments on multiple benchmark datasets demonstrate that, compared to existing targeted promotion attacks, GCL-based recommendation models exhibit greater susceptibility when evaluated with CLeaR, while SIM effectively mitigates these vulnerabilities.

Figures

Figures reproduced from arXiv: 2507.07436 by the authors.

**Figure 2.** Representation distribution and singular value distributions on three datasets under RandomAttack. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** The overview of CLeaR. 4 Proposed Attack Method Our theoretical investigation and empirical evaluations reveal that the optimization of GCL inherently induces a more uniform spectral value distribution. To further understand how this property affects system security, we propose Graph Contrastive Learning Recommendation Attack (CLeaR), a targeted promotion attack method that systematically explores the impact of spe… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Visualization of spectral irregularities across datasets. Red dots represent target items, and gray dots [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: The overview of SIM. where a larger 𝜖𝑖 indicates that 𝑧𝑖 cannot be effectively captured by the principal subspace, thus highlighting a potential anomaly [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

**Figure 6.** Figure 6: Parameter analysis of 𝛾 and 𝜆𝑚𝑖𝑡 based on different GCL-based recommendation models. , Vol. 1, No. 1, Article . Publication date: September 2018 [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 51 canonical work pages

[1]

Himan Abdollahpouri. 2019. Popularity bias in ranking and recommendation. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society . 529–530

work page 2019
[2]

Huiyuan Chen, Vivian Lai, Hongye Jin, Zhimeng Jiang, Mahashweta Das, and Xia Hu. 2024. Towards mitigating dimensional collapse of representations in collaborative filtering. InProceedings of the 17th ACM International Conference on Web Search and Data Mining . 106–115

work page 2024
[3]

Jingfan Chen, Wenqi Fan, Guanghui Zhu, Xiangyu Zhao, Chunfeng Yuan, Qing Li, and Yihua Huang. 2022. Knowledge- enhanced black-box attacks for recommendations. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 108–117

work page 2022
[4]

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning

work page 2020
[5]

Ihsan Gunes, Cihan Kaleli, Alper Bilge, and Huseyin Polat. 2014. Shilling attacks against recommender systems: A comprehensive survey. Artificial Intelligence Review (2014)

work page 2014
[6]

Sihan Guo, Ting Bai, and Weihong Deng. 2023. Targeted shilling attacks on gnn-based recommender systems. In Proceedings of the 32nd ACM international conference on information and knowledge management . 649–658

work page 2023
[7]

Yaojun Hao, Guoyan Meng, Jian Wang, and Chunmei Zong. 2023. A detection method for hybrid attacks in recommender systems. Information Systems 114 (2023), 102154

work page 2023
[8]

Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. 2020. Lightgcn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval . 639–648

2020

Show all 59 references

[9]

Zhuangzhuang He, Yifan Wang, Yonghui Yang, Peijie Sun, Le Wu, Haoyue Bai, Jinqi Gong, Richang Hong, and Min Zhang. 2024. Double correction framework for denoising recommendation. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1062–1072

2024
[10]

Zhuangzhuang He, Yifan Wang, Yonghui Yang, Peijie Sun, Le Wu, Haoyue Bai, Jinqi Gong, Richang Hong, and Min Zhang. 2024. Double Correction Framework for Denoising Recommendation. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1062–1072

2024
[11]

Andreas Hoecker and Vakhtang Kartvelishvili. 1996. SVD approach to data unfolding.Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment 372, 3 (1996), 469–481

1996
[12]

Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. 2021. Data poisoning attacks to deep learning based recommender systems. arXiv (2021)

2021
[13]

Ashish Jaiswal, Ashwin Ramesh Babu, Mohammad Zaki Zadeh, Debapriya Banerjee, and Fillia Makedon. 2020. A survey on contrastive self-supervised learning. Technologies (2020)

2020
[14]

Li Jing, Pascal Vincent, Yann LeCun, and Yuandong Tian. 2021. Understanding dimensional collapse in contrastive self-supervised learning. arXiv preprint arXiv:2110.09348 (2021)

2021 arXiv
[15]

Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. 2020. Supervised contrastive learning. Advances in neural information processing systems (2020)

2020
[16]

Shyong K Lam and John Riedl. 2004. Shilling recommender systems for fun and profit. In Proceedings of the 13th international conference on World Wide Web. 393–402

2004
[17]

Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. 2016. Data poisoning attacks on factorization-based collaborative filtering. Advances in neural information processing systems (2016)

2016
[18]

Chen Lin, Si Chen, Hui Li, Yanghua Xiao, Lianyun Li, and Qian Yang. 2020. Attacking recommender systems with augmented user profiles. In Proceedings of the 29th ACM international conference on information & knowledge management

2020
[19]

Siyi Lin, Chongming Gao, Jiawei Chen, Sheng Zhou, Binbin Hu, Yan Feng, Chun Chen, and Can Wang. 2025. How do recommendation models amplify popularity bias? An analysis from the spectral perspective. In Proceedings of the Eighteenth ACM International Conference on Web Search an...

2025
[20]

Weilin Lin, Xiangyu Zhao, Yejing Wang, Yuanshao Zhu, and Wanyu Wang. 2023. Autodenoise: Automatic data instance denoising for recommendations. In Proceedings of the ACM Web Conference 2023 . 1003–1011

2023
[21]

Zihan Lin, Changxin Tian, Yupeng Hou, and Wayne Xin Zhao. 2022. Improving graph collaborative filtering with neighborhood-enriched contrastive learning. In Proceedings of the ACM Web Conference 2022

2022
[22]

Toan Nguyen Thanh, Nguyen Duc Khang Quach, Thanh Tam Nguyen, Thanh Trung Huynh, Viet Hung Vu, Phi Le Nguyen, Jun Jo, and Quoc Viet Hung Nguyen. 2023. Poisoning GNN-based recommender systems with generative surrogate-based attacks. ACM Transactions on Information Systems (2023)...

2023
[23]

Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748 (2018)

2018 arXiv
[24]

Yiteng Pan, Fazhi He, and Haiping Yu. 2020. Learning social representations with deep autoencoder for recommender system. World Wide Web 23 (2020), 2259–2279

2020
[25]

Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. 2012. BPR: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618 (2012)

2012 arXiv
[26]

Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. 2022. Fedrecattack: Model poisoning attack to federated recommendation. In International Conference on Data Engineering

2022
[27]

Jie Shuai, Kun Zhang, Le Wu, Peijie Sun, Richang Hong, Meng Wang, and Yong Li. 2022. A review-aware graph contrastive learning framework for recommendation. In ACM SIGIR Conference on Research and Development in Information Retrieval

2022
[28]

Junshuai Song, Zhao Li, Zehong Hu, Yucheng Wu, Zhenpeng Li, Jian Li, and Jun Gao. 2020. Poisonrec: an adaptive data poisoning framework for attacking black-box recommender systems. In 2020 IEEE 36th International Conference on Data Engineering

2020
[29]

Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of machine learning research 9, 11 (2008)

2008
[30]

Chenyang Wang, Yuanqing Yu, Weizhi Ma, Min Zhang, Chong Chen, Yiqun Liu, and Shaoping Ma. 2022. Towards Representation Alignment and Uniformity in Collaborative Filtering. InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1816–1825

2022
[31]

Qinyong Wang, Hongzhi Yin, Tong Chen, Junliang Yu, Alexander Zhou, and Xiangliang Zhang. 2021. Fast-adapting and privacy-preserving federated recommender system. The VLDB Journal (2021)

2021
[32]

Shilei Wang, Peng Zhang, Hui Wang, Hongtao Yu, and Fuzhi Zhang. 2022. Detecting shilling groups in online recommender systems based on graph convolutional network. Information Processing & Management 59, 5 (2022), 103031

2022
[33]

Tongzhou Wang and Phillip Isola. 2020. Understanding contrastive representation learning through alignment and uniformity on the hypersphere. In International Conference on Machine Learning . PMLR, 9929–9939

2020
[34]

Wenjie Wang, Changsheng Wang, Fuli Feng, Wentao Shi, Daizong Ding, and Tat-Seng Chua. 2024. Uplift Modeling for Target User Attacks on Recommender Systems. arXiv preprint arXiv:2403.02692 (2024)

2024 arXiv
[35]

Zongwei Wang, Min Gao, Jundong Li, Junwei Zhang, and Jiang Zhong. 2022. Gray-Box Shilling Attack: An Adversarial Learning Approach. ACM Transactions on Intelligent Systems and Technology (2022)

2022
[36]

Zongwei Wang, Min Gao, Wentao Li, Junliang Yu, Linxin Guo, and Hongzhi Yin. 2023. Efficient bi-level optimization for recommendation denoising. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2502–2511

2023
[37]

Zongwei Wang, Junliang Yu, Min Gao, Hongzhi Yin, Bin Cui, and Shazia Sadiq. 2024. Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attacks. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 3311–3322

2024
[38]

Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, and Enhong Chen. 2021. Triple adversarial learning for influence based poisoning attack in recommender systems. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining . 1830–1840

2021
[39]

Fan Wu, Min Gao, Junliang Yu, Zongwei Wang, Kecheng Liu, and Xu Wang. 2021. Ready for emerging threats to recommender systems? A graph convolution-based generative shilling attack.Information Sciences 578 (2021), 683–701

2021
[40]

Jiancan Wu, Xiang Wang, Fuli Feng, Xiangnan He, Liang Chen, Jianxun Lian, and Xing Xie. 2021. Self-supervised graph learning for recommendation. In Proceedings of the 44th international ACM SIGIR conference on research and development in information retrieval. 726–735

2021
[41]

Xin Xia, Hongzhi Yin, Junliang Yu, Yingxia Shao, and Lizhen Cui. 2021. Self-supervised graph co-training for session- based recommendation. InProceedings of the 30th ACM international conference on information & knowledge management. 2180–2190

2021
[42]

Tiansheng Yao, Xinyang Yi, Derek Zhiyuan Cheng, Felix Yu, Ting Chen, Aditya Menon, Lichan Hong, Ed H Chi, Steve Tjoa, Jieqi Kang, et al. 2021. Self-supervised learning for large-scale item recommendations. In Proceedings of the 30th ACM International Conference on Information ...

2021
[43]

Jingwei Yi, Fangzhao Wu, Bin Zhu, Yang Yu, Chao Zhang, Guangzhong Sun, and Xing Xie. 2022. UA-FedRec: Untargeted Attack on Federated News Recommendation. arXiv preprint arXiv:2202.06701 (2022)

2022 arXiv
[44]

Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. 2020. Graph contrastive learning with augmentations. Advances in neural information processing systems (2020)

2020
[45]

Junliang Yu, Xin Xia, Tong Chen, Lizhen Cui, Nguyen Quoc Viet Hung, and Hongzhi Yin. 2023. XSimGCL: Towards extremely simple graph contrastive learning for recommendation.IEEE Transactions on Knowledge and Data Engineering (2023). , Vol. 1, No. 1, Article . Publication date: S...

2023
[46]

Junliang Yu, Hongzhi Yin, Min Gao, Xin Xia, Xiangliang Zhang, and Nguyen Quoc Viet Hung. 2021. Socially-aware self-supervised tri-training for recommendation. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining

2021
[47]

Junliang Yu, Hongzhi Yin, Xin Xia, Tong Chen, Lizhen Cui, and Quoc Viet Hung Nguyen. 2022. Are graph augmentations necessary? simple graph contrastive learning for recommendation. In Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Info...

2022
[48]

Junliang Yu, Hongzhi Yin, Xin Xia, Tong Chen, Jundong Li, and Zi Huang. 2023. Self-supervised learning for recommender systems: A survey. IEEE Transactions on Knowledge and Data Engineering (2023)

2023
[49]

Tan Yu, Yunfeng Cai, and Ping Li. 2020. Toward faster and simpler matrix normalization via rank-1 update. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIX 16 . Springer, 203–219

2020
[50]

Wei Yuan, Quoc Viet Hung Nguyen, Tieke He, Liang Chen, and Hongzhi Yin. 2023. Manipulating Federated Recom- mender Systems: Poisoning with Synthetic Users and Its Countermeasures. arXiv preprint arXiv:2304.03054 (2023)

2023 arXiv
[51]

Wei Yuan, Shilong Yuan, Chaoqun Yang, Nguyen Quoc Viet hung, and Hongzhi Yin. 2023. Manipulating Visually Aware Federated Recommender Systems and Its Countermeasures. ACM Transactions on Information Systems (2023)

2023
[52]

Dan Zhang, Yangliao Geng, Wenwen Gong, Zhongang Qi, Zhiyu Chen, Xing Tang, Ying Shan, Yuxiao Dong, and Jie Tang. 2024. Recdcl: Dual contrastive learning for recommendation. In Proceedings of the ACM Web Conference 2024 . 3655–3666

2024
[53]

Hengtong Zhang, Yaliang Li, Bolin Ding, and Jing Gao. 2020. Practical data poisoning attack against next-item recommendation. In Proceedings of The Web Conference 2020 . 2458–2464

2020
[54]

Junwei Zhang, Min Gao, Junliang Yu, Lei Guo, Jundong Li, and Hongzhi Yin. 2021. Double-scale self-supervised hypergraph learning for group recommendation. In Proceedings of the 30th ACM international conference on information & knowledge management. 2557–2567

2021
[55]

Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Quoc Viet Hung Nguyen, and Lizhen Cui. 2022. Pipattack: Poisoning federated recommender systems for manipulating item promotion. In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining . 1415–1423

2022
[56]

Shijie Zhang, Hongzhi Yin, Tong Chen, Quoc Viet Nguyen Hung, Zi Huang, and Lizhen Cui. 2020. Gcn-based user representation learning for unifying robust recommendation and fraudster detection. In Proceedings of the 43rd international ACM SIGIR conference on research and develop...

2020
[57]

Yifei Zhang, Hao Zhu, Zixing Song, Piotr Koniusz, and Irwin King. 2023. Spectral feature augmentation for graph contrastive learning and beyond. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 37. 11289–11297

2023
[58]

Guoshuai Zhao, Xueming Qian, and Xing Xie. 2016. User-service rating prediction by exploring social users’ rating behaviors. IEEE Transactions on Multimedia (2016)

2016
[59]

Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining . 2847–2856. , Vol. 1, No. 1, Article . Publication date: Sep...

2018

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Himan Abdollahpouri. 2019. Popularity bias in ranking and recommendation. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society . 529–530

work page 2019

[2] [2]

Huiyuan Chen, Vivian Lai, Hongye Jin, Zhimeng Jiang, Mahashweta Das, and Xia Hu. 2024. Towards mitigating dimensional collapse of representations in collaborative filtering. InProceedings of the 17th ACM International Conference on Web Search and Data Mining . 106–115

work page 2024

[3] [3]

Jingfan Chen, Wenqi Fan, Guanghui Zhu, Xiangyu Zhao, Chunfeng Yuan, Qing Li, and Yihua Huang. 2022. Knowledge- enhanced black-box attacks for recommendations. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 108–117

work page 2022

[4] [4]

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning

work page 2020

[5] [5]

Ihsan Gunes, Cihan Kaleli, Alper Bilge, and Huseyin Polat. 2014. Shilling attacks against recommender systems: A comprehensive survey. Artificial Intelligence Review (2014)

work page 2014

[6] [6]

Sihan Guo, Ting Bai, and Weihong Deng. 2023. Targeted shilling attacks on gnn-based recommender systems. In Proceedings of the 32nd ACM international conference on information and knowledge management . 649–658

work page 2023

[7] [7]

Yaojun Hao, Guoyan Meng, Jian Wang, and Chunmei Zong. 2023. A detection method for hybrid attacks in recommender systems. Information Systems 114 (2023), 102154

work page 2023

[8] [8]

Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. 2020. Lightgcn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval . 639–648

2020