Autoencoder-Based Poisoning Attack Detection in Graph Recommender Systems

Graph-based Recommender Systems (GRSs) model complex user–item relationships. They offer improved accuracy and personalization in recommendations compared to traditional models. However, GRSs also face severe challenges from novel poisoning attacks. Attackers often manipulate GRS graph structures by injecting attack users and their interaction data. This leads to misleading recommendations. Existing detection methods lack the ability to identify such attacks targeting graph-based systems. To address this, we propose AutoDAP, a novel autoencoder-based detection method for poisoning attacks in GRSs. AutoDAP first extracts key statistical features from user interaction data. It fuses them with original interaction information. Then, an autoencoder architecture processes this data. The encoder extracts deep features and connects to an output layer for classification prediction probabilities. The decoder reconstructs graph structure features. By jointly optimizing classification and reconstruction losses, AutoDAP effectively integrates supervised and unsupervised signals. This enhances the detection of attack users. Evaluations on the MovieLens-10M dataset against various poisoning attacks, and on the Amazon dataset with real attack data, demonstrate AutoDAP’s superiority. It outperforms several representative baseline methods in both simulated (MovieLens) and real-world (Amazon) attack scenarios, demonstrating its effectiveness and robustness.