Compensation as defense: Trusted user guided representation correction learning for poisoned GNN-based recommender systems

Graph Neural Network-based recommender systems (GRS) have gained significant attention for their ability to capture high-order user–item interactions, which enhances the quality of node representation, improving recommendation performance. However, the openness and inherent commercial value of GRS expose them to critical security vulnerabilities, particularly poisoning attacks. Attackers often inject fake users to interfere with the representation learning of target user nodes, thereby biasing recommendations. Existing research on defending against poisoning attacks primarily adopts detection defense strategies that rely on identifying discrepancies in user behavior. However, existing research demonstrates that deep learning-based attack methods improve the difficulty of detecting fake users by blurring the boundaries of anomalous behavior in fake users, leading to fake users being able to avoid detection and inference with recommendations. To mitigate the impact of the fake users, this paper proposes a compensation defense strategy with a T argeted T rusted user G eneration framework (TTG), which aims to generate trusted users similar to target users, thereby leveraging preference-consistent collaborative signals for the target users’ representation correction learning. First, TTG generates trusted user representations by modeling target users’ representations based on a one-step diffusion model, ensuring the representation similarity between trusted users and target users. Second, TTG employs an edge generator to generate the edges of trusted users by reconstructing their representations, ensuring the structural similarity between trusted users and target users, which provides preference-consistent collaborative signals for trusted users. Subsequently, TTG introduces a surrogate joint optimization strategy that utilizes the surrogate model’s feedback to jointly optimize the generation of trusted users’ node representations and edges, ensuring each trusted user effectively contributes to compensation defense. Finally, we conducted extensive experiments on three real-world datasets to comprehensively evaluate the effectiveness and flexibility of TTG in mitigating the impact of poisoning attacks on GRS recommendations. Experimental results on three datasets show that TTG delivers improvements in HR@50 of up to 10.1 %, with average improvements of 0.41 %, 0.32 %, and 0.14 %, respectively, demonstrating the robust defense capability of TTG. The source code is available at https://github.com/tzy528/TTG . • Compensation defense introduce trusted user for representation correction learning. • Trusted users correct representation by providing collaborative signals. • Framework enable similar representation and edge for trusted users. • Similar representation and edge enable preference-consistent collaborative signals.