Target item identification for injection attacks in recommender systems via graph-enhanced user representations

Recommender systems are increasingly threatened by profile injection attacks. However, most existing defenses focus on detecting fake users, which becomes unreliable as modern attacks generate highly concealed profiles and operational platforms often lack attacker labels or attack priors. To address this limitation, we propose TIGER (Target Item Identification via Graph-Enhanced Representations), a hybrid auditing-oriented framework that reframes the final defensive output from user-level fake user labels to item-level suspicious target item candidates. Importantly, TIGER does not eliminate user-side analysis; instead, it uses unsupervised suspicious user discovery as an intermediate support step for downstream auditing. Specifically, TIGER first leverages a small trusted reference set to learn stable item embeddings and aligns unknown data into a shared semantic space. It then constructs graph-enhanced user representations by integrating rating statistics, preference patterns, and item semantics, enabling the extraction of informative suspicious user candidates for target item auditing. Finally, suspicious target item candidates are flagged through a rank-shift auditing strategy that compares recommendation outcomes before and after reintroducing suspicious users. Extensive experiments on three widely used datasets under ten representative attack scenarios demonstrate the effectiveness and robustness of TIGER. Across ten attacks, TIGER achieves average DR@5/DR@10 values of 0.4430/0.6120, 0.5550/0.7500, and 0.2670/0.3400 on ML-100K, ML-1M, and Automotive, outperforming the average results of the best baseline selected for each attack by 106.20%/28.25%, 72.36%/64.84%, and 154.29%/111.18%, respectively. These results indicate that TIGER provides a reliable auditing tool for identifying high-risk target item candidates in adversarial recommender systems.