Attacking Visually-aware Recommender Systems with Transferable and Imperceptible Adversarial Styles

The inclusion of the images opens up a security vulnerability of visually-aware recommender systems (VARSs). It can be exploited by unscrupulous parties to upload well-crafted adversarial images for certain malicious purposes (e.g., promoting their own products for profits). Some studies have focused on attacking VARSs to gain insights into their robustness, while they are still far from practical, i.e., the attacks often 1) lack diversity in perturbations, 2) are easily perceived and 3) have limited transferability, which may lead to overestimation of defenses in practice. To tackle the problems, we propose to perturb the style of the product, which is an unnoticeable but important property of visual recommendations. Specifically, we propose a novel Style perturbation-based Practical Attack Framework (SPAF). Unlike existing attacks that change pixels within l∞ -norm constraints, SPAF interferes with styles in latent feature space so that the attack becomes unbounded in the pixel space to reflect possible actual perturbations. SPAF formulates attack objectives as an optimization problem and adopts an adaptive adversarial style transfer network to solve it so that transferable and imperceptible attacks can be generated. Comprehensive experiments on real-world datasets demonstrate that SPAF significantly outperforms state-of-the-art attacks.