Silencing Poisoning Attacks in Recommender Systems via Unsupervised Granular Ball Computing

What is it about?

Recommendation systems power the personalized suggestions for products, videos, articles and more on nearly every online platform. They learn patterns from user clicks, ratings and interactions to tailor results. Unfortunately, these systems are vulnerable to "data poisoning": attackers create fake user accounts and false interaction records to unfairly boost certain items in recommendation rankings, or to suppress others, undermining platform fairness and misleading users. Most existing defenses work by detecting suspicious accounts and deleting them entirely. This all-or-nothing approach has critical flaws: it often misclassifies normal users with niche tastes as attackers, and removing accounts breaks the natural network of user interactions, which degrades recommendation quality for everyone. Our work introduces SiPo, a new defense framework that resolves this tradeoff without deleting any accounts. First, we use an unsupervised, multi-scale clustering technique called granular ball computing to automatically spot tight, abnormal groups of malicious accounts hidden in user behavior data. Then, instead of removing them, we apply an adaptive gating mechanism to pull the behavioral patterns of high-risk accounts toward a neutral, average state. This effectively "silences" their harmful influence during model training: malicious signals can no longer spread and skew recommendation results, while the full structure of the interaction network remains intact. We mathematically prove this approach strengthens the stability of recommendation models. Tests on four real-world datasets confirm that SiPo sharply reduces the success rate of various poisoning attacks. Most notably, it does not harm recommendation quality for regular users. In fact, it also filters out random natural noise in real-world data, often leading to slightly better overall recommendation accuracy. SiPo is compatible with all major types of modern recommendation systems, making it a practical, broadly applicable solution for fairer and more reliable personalized recommendations.

Featured Image

Photo by Arian Darvishi on Unsplash

Photo by Arian Darvishi on Unsplash

Why is it important?

This work breaks away from the long-dominant "detect-and-delete" defense paradigm in recommender system security. 1. A paradigm shift to gradient silencing: Instead of removing suspicious user accounts and breaking the structure of the user-item interaction graph, we neutralize malicious attacks by blocking the backpropagation of harmful gradients during model training. This "soft defense" approach fundamentally resolves the persistent robustness-fidelity trade-off, where stronger defenses almost always reduce recommendation quality for regular users. 2. First application of granular ball computing to recommendation security: We use an unsupervised multi-scale clustering technique to identify attackers through their inherent geometric patterns. Even state-of-the-art GAN-generated attacks can mimic the statistical behavior of normal users to evade detection, but they cannot hide the compact, high-density micro-clusters they form. Our method captures this unalterable topological signature without any labeled attack data. 3. Provable stability with Pareto improvement: We provide rigorous mathematical proof based on Lipschitz stability theory, grounding our defense in formal principles rather than only empirical results. Most notably, our defense requires no trade-off between security and performance: it filters out both malicious poisoning and natural random noise in real-world data, often slightly improving recommendation accuracy for normal users. Why This Work Is Timely? 1. Advanced attacks are making traditional defenses obsolete: Poisoning attacks have evolved from simple fake account injections to sophisticated gradient-optimized and GAN-based attacks that closely mimic normal user behavior. Classic detection methods built on statistical features suffer severe performance drops against these modern threats. Our work directly addresses this escalating arms race by targeting the structural traits attackers cannot disguise. 2. Algorithmic fairness and trust are increasingly critical: As recommender systems become central to commerce, media and information access, data poisoning that manipulates rankings undermines market fairness, misleads consumers, and erodes public trust in AI. This work arrives amid rising regulatory and public demand for more transparent, fair and reliable recommendation algorithms. 3. It advances the global trustworthy AI agenda: The AI field is shifting from prioritizing raw accuracy to building robust, accountable systems. This work bridges granular computing, an emerging multi-scale AI framework with graph learning security, offering a novel cross-disciplinary solution to a high-stakes real-world problem. What Difference It Makes? 1. For the research community: It challenges the widely held assumption that defense must sacrifice recommendation performance, opening up a new "gradient purification" research direction for robust recommender systems. It also expands the application scope of granular ball computing, demonstrating its strong value for security and anomaly detection tasks. 2. For industry practice: Our SiPo framework works as a plug-and-play module compatible with all mainstream recommendation architectures, including matrix factorization, graph neural networks and contrastive learning models. It can be integrated into existing systems without full overhauls, helping platforms combat rating manipulation and fake popularity while protecting, and often enhancing the experience of users with niche interests, who are frequently misidentified by traditional hard-filtering methods. 3. For broader fields: The core insight of "silencing harmful influence rather than removing entities" is highly generalizable. It can be adapted to secure other graph-structured systems, such as social media anti-spam tools, financial fraud detection networks and biological data denoising pipelines, offering a less destructive and more precise approach to AI security.

Perspectives