Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems

1 Introduction

Recommendation systems play a vital role in modern information societies and are widely applied in areas such as ecommerce, social media, and content platforms. By providing users with personalized content and services, they significantly enhance user experience and platform revenue. Traditional recommendation systems, typically based on collaborative filtering [Sarwar et al., 2001; Hu et al., 2008], matrix factorization [Koren et al., 2009; Abdi et al., 2018], or sequence model techniques [Hidasi et al., 2016; Bai et al., 2024], often struggle to fully explore the potential high-order relationships and contextual information between users and items. To better capture complex interaction patterns, Graph Neural Networks (GNNs) have been widely adopted in recommendation systems due to their ability to model relational data[Wang et al., 2024a; Wang et al., 2024b; Zheng et al., 2025; Zheng et al., 2022; Zhang et al., 2024a]. By leveraging GNNs,Graph-based Recommendation Systems (GRSs) can effectively represent users, items, and their interactions as a graph structure, enabling a more comprehensive discovery of latent user behavior patterns.By modeling high-order connectivity and complex relationships, GRSs improve personalized recommendation accuracy [Yang and Toni, 2018; Dong et al., 2024; Jin et al., 2023b].

∗Corresponding author

However, recommendation systems based on Graph Neural Networks have certain vulnerabilities [Chen et al., 2021; Geisler et al., 2021; Zhang et al., 2024b], and recent studies have focused on shilling attacks in recommendation systems. Attackers can achieve targeted attacks by carefully designing perturbations to nodes or edges, such as GOAT [Wu et al., 2021] who first proposed injecting fake user features and link structures in the graph to recommend target items to the user group. AutoAttack [Guo et al., 2023] consider enhancing the exposure of target items within the interested group from a more realistic perspective. However, current methods have two significant flaws, as shown in Figure 1. First, to achieve better attack effectiveness, existing methods require injecting a large number of fake nodes, which lack stealth. Second, as graph-based recommendation systems rely on the bipartite graph structure between users and items to generate personalized recommendations through information propagation via historical interaction edges, the large amount of false information injected by shilling attacks can corrupt the graph structure and the information propagation process, significantly disrupting the accuracy and stability of recommendations.

Graph backdoor attacks are a covert form of graph structure attack, where an attacker quietly implants malicious nodes or edges in the graph to influence the overall behavior of the graph when specific conditions are triggered. The primary advantage of such attacks lies in their stealthiness, as the malicious modifications are typically difficult to detect, allowing the attack to remain dormant and effective without alerting the system [Wang et al., 2025; Wang et al., 2023; Xi et al., 2021; Zhang et al., 2024c]. However, directly applying backdoor attacks to recommendation systems presents two challenges. First, current graph backdoor attacks mainly focus on single-entity classification tasks. Specifically, they generate specific triggers for a single node [Dai et al., 2023; Feng et al., 2024; Jin et al., 2025; He et al., 2025; Zhu et al., 2024] or a single graph [Zhang et al., 2021; Zheng et al., 2024; Jin et al., 2023a] to influence its classification results, as shown in Figure 2(a). However, in a graph-based recommendation system, recommendations are generated by computing the similarity between users and items. Therefore, the key challenge is how to generate triggers that can simultaneously affect both target users and items, as shown in Figure 2(b). Second, even if a backdoor attack method is successfully applied to the recommendation system, generating specific triggers for each target item poses a challenge. Once a large number of trigger nodes are injected, the fake information contained in these triggers will still be spread to unrelated users and items through message propagation, significantly disrupting the recommendation performance of the original system. Thus, another key challenge is how to prevent the trigger information from affecting irrelevant nodes.

To address these challenges, we propose a backdoor attack method named Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems(SNT-BA). Specifically, we introduce a single-node trigger generator for target items and users. By inserting a fake user as a trigger into all target items, we can significantly increase the exposure of these items to the target user. We achieve this by introducing latent edges in the graph, allowing the trigger to simultaneously affect both the target items and the users. Moreover, since it is a single-trigger structure, only a single piece of fake information is propagated to irrelevant items and users, thus minimizing the impact on the original recommendation system's performance. In addition, we design constraints between user and item nodes to ensure the stability of the distribution of user and item nodes, further enhancing the stealth of the attack. Finally, our proposed attack method is an end-toend approach, where, during application, inserting the trigger user into the target items is sufficient to achieve the attack objective. The contributions of our work are as follows:

• We propose a backdoor attack approach for graph-based recommendation systems, which, to the best of our knowledge, is the first work to apply backdoor attacks in the context of graph recommendation systems.
• We propose a more effective recommendation attack method, which not only solves the problems of low stealthiness and high destructiveness in existing graph recommendation attack methods, but also reduces the attack cost.
• We conduct experiments on multiple datasets, ensuring that the exposure of the target item to at least 50% of the target users is achieved in 99% of cases, while the impact on the performance of the recommendation system is controlled to around 5%.

2 Preliminary

In this section, we will define graph-based recommendation systems and backdoor attack methods targeting graph neural networks.

2.1 Graph-based Recommendation System

A graph-based recommendation system models users and items as nodes, with their interactions as edges. It leverages the graph structure to infer user preferences for unseen items based on connectivity patterns.

Let the graph in the recommendation system be defined as G = (V,E), where V is the set of nodes, V = U ∪ I, U is the set of user nodes, and I is the set of item nodes. E is the set of edges that represents the interactions between users and items. Each edge eu,i ∈ E represents an interaction between user u ∈ U and item i ∈ I.

In graph-based recommendation systems, the goal of the model is to learn low-dimensional vector representations for users and items, and to perform prediction tasks based on these representations. Let hu(θ) represent the embedding vector of user u, and hi(θ) represent the embedding vector of item i, where θ denotes the model parameters. These embedding vectors are optimized by learning the graph structure to improve the accuracy of the recommendation.

A typical objective in the recommendation task is to predict the rating that a user would give to an item. Suppose the goal is to predict the rating ˆ rui that user u gives to item i, this rating can be computed using the following formula:

where f(·) is the rating prediction function. By training the model and optimizing the parameters θ, the prediction error between the predicted and actual ratings is minimized, thereby accomplishing the recommendation task.

2.2 Graph Backdoor Attacks on GRSs

In recommendation systems, the goal of a backdoor attack is to manipulate the similarity prediction between user u and item i by introducing triggers, such as fake users or false interactions.

Specifically, after training the model with a backdoor attack, we leave a backdoor in the recommendation graph. During the application of the model, once the trigger is inserted for the target item, the model will output a higher similarity score for the target user and target item, thereby prioritizing the items that the attacker wants to be recommended. In contrast, without the trigger, the model will perform the recommendation task normally, without any detectable anomalies. In a backdoor attack, the similarity prediction can be represented as:

Let Gtrigger be the attacked graph with the inserted trigger. When the trigger is present, our goal is to maximize ˆ rui∗ , where i∗ is the target item, to ensure that the target item is prioritized in the recommendation. At the same time, when no trigger is injected, the model continues to make recommendations according to Equation (1), ensuring the stealthiness of the model.

3 Methods

Previous graph recommendation system attack methods have suffered from poor stealth and strong disruption due to the injection of a large number of fake nodes. In this paper, we propose a more covert and flexible backdoor attack method. This method can dynamically generate a single specific trigger based on the features of all attacked nodes, thereby avoiding the limitations of attack node structure and quantity on the attack's effectiveness. This section will elaborate on the structure and principles of the proposed model.

3.1 The Backdoor Attack Framework

Figure 3 shows the architecture of the backdoor attack model for graph-based recommendation systems. Our task is to take a clean input graph and, through the designed backdoor attack model, enable any target item in the attacked graph to significantly improve its ranking in the target user's candidate item list after the trigger is inserted. At the same time, it is necessary to ensure that, prior to the attack, the contaminated model remains stealthy. Furthermore, after inserting the trigger, the model's recommendation performance for irrelevant users and items should remain stable. To achieve this goal, we divide the backdoor attack model into two modules: the trigger generation training module and the recommendation system training module. The trigger generation module creates specific triggers for the target items according to their features, ensuring that the insertion of these triggers will boost the ranking of the target item in the candidate set. The recommendation training module is responsible for ensuring that the attacked graph representation, when used for recommendations, maintains the accuracy of the model.

3.2 Trigger Generation

Fake User Generation: The objective of the backdoor attack is to recommend the target item to the target class of users t ∈ T after injecting the trigger. To ensure the stealthiness of the trigger node, we only inject a single fake user node u∗ into the recommendation system. To ensure that the fake user node only influences the target item, for all target items s ∈ S, we average their representations ft ∈ R|S|×d to find the centroid node feature fs∗ ∈ R1×d , where d is the dimension of the node features. For the fake user node's feature fu∗, we generate its feature representation based on fs∗ using a two-layer neural network, as follows:

To ensure that the target item is preferentially recommended to the target class of users Ut, it is necessary to guarantee that, after injecting the trigger, the similarity between the target item S and the users of the target class T is higher than that of other items in the same class. Therefore, we select a number of negative sample items from the non-target items in the target class, equal in quantity to the target items. We design the loss function Ltrigger to ensure that the target user should be more similar to the target item in this round of recommendations. The loss function is designed as follows:

where D represents all recommendation data, Θ represents the parameters of the recommendation model, P is the set of candidate target items (S ∈ P), and p ∈ P refers to the candidate item selected as a negative sample in the current iteration. ˆ rts represents the rating of the target item by the target user, ˆ rtp represents the rating of candidate negative items by the target user, and λΘ∥Θ∥2 is the regularization coefficient used to control the complexity of the parameters.

Constraints on Attacked Nodes: Since our task involves reserving a backdoor during the training process, and each round of trigger injection simultaneously affects both the target user T and the target item S, this will lead to a shift in the position of candidate items and the target user in the original feature space after multiple training rounds. Specifically, because items of the same type are competing, the candidate items will first be pushed away from the target user, and only after the injection of triggers will the representations of the target items and the target user be pulled closer

Clean Graph

BackdoorAttack Model

Attacked Graph

together. Since the target user will also interact with noncandidate items N, this will reduce the exposure of the intended target items, which could be detected by the recommendation system.

Therefore, we need to design a constraint loss to control the relative positions of users and items in the original feature space. In each round, we randomly sample the same number of interactions between the target user T and other noncandidate items N as negative samples for interactions with the candidate item P, thereby ensuring the relative stability of the distributions of different types of nodes. The specific constraint loss is as follows:

3.3 GNN-based Recommendation

Since backdoor attacks do not alter the original model's training procedure, we directly use LightGCN [He et al., 2020] as the surrogate model for the attack. The core idea of LightGCN is to learn node representations through neighborhoodbased information propagation on the graph structure. Unlike traditional GCNs, LightGCN simplifies the convolution operation by disregarding the node feature matrix and instead propagating information solely using the graph adjacency matrix. Specifically, this can be expressed as follows.

In this context, h(k) v represents the embedding of node v at the k-th layer, N(v) denotes the set of neighbors of node v, dv is the degree of node v, and du is the degree of node u.

In LightGCN, the convolution operation at each layer involves a simple weighted summation, so the multi-layer graph convolution operation is essentially multiple weighted averages of different neighbor information. The final node representation h(k) v is the result after k layers of convolution. Specifically, the final representation of node v can be expressed as:

where K is the number of graph convolution layers, representing the node's embedding after multiple rounds of neighbor information propagation.

During training, the BPR loss function is typically used to optimize the model parameters. The BPR loss function optimizes by maximizing the user's preference for positive items relative to negative items. The BPR loss function is defined as:

where (u, i, j) represents a triplet, with i being the positive item interacted with by user u, j being the negative item, and σ denoting the sigmoid function.

3.4 Joint Optimization Function

The trigger generator model and the recommendation model are trained simultaneously, ensuring that the recommendation performance for other types of nodes remains intact after trigger injection. Considering all the aforementioned loss conditions, we adopt a joint optimization loss function, which is defined as follows:

where α, β and γ are hyper-parameters that control the impact of each optimization objective on the final attack effects.

4 Experiments

In this section, we will evaluate our method on several realworld recommendation datasets to address the following research questions:

• RQ1: Can the proposed method effectively perform backdoor attacks on graph-based recommendation systems, and can it increase the appearance of target items in the recommendation lists of more target users?
• RQ2: How does the constraint loss function enhance the stealthiness of the attack, and how can it ensure the attack remains undetected as much as possible before execution?
• RQ3: Why is the use of multiple triggers not preferred for backdoor attacks in graph-based recommendation systems? What are the advantages of using a single trigger compared to multiple structural triggers?

4.1 Experimental Settings

Datasets: We conduct experiments on four real-world datasets, namely Gowalla, Amazon, Yelp and MovieLens. When constructing the user-item interaction graph, we hypothesize that if a user's rating for an item exceeds the average rating, it can be determined that the user has an affinity for the item, and an interaction edge between the user and the item is established.The dataset statistics are shown in Table 1.

• Gowalla 1 : is a popular check-in dataset that contains data on users' check-in times, locations and social relationships.
• Amazon 2 : is a collection of user-item interactions from Amazon, specifically focusing on books. It includes data such as user reviews, ratings, and metadata about books.
• Yelp 3 : is a publicly available collection of data from Yelp, a popular platform for user reviews of local businesses such as restaurants, cafes, shops, and service providers.
• MovieLens 4 : is a widely used dataset for recommendation system research and experiments, containing user ratings for movies and metadata information about the movies.

Baselines: We compare our method with several traditional attack and injection attack methods.

• Random Attack [Lam and Riedl, 2004]: The attacker randomly generates a large number of fake users connected to the target items, thereby increasing the degree of the target

1 http://snap.stanford.edu/data/loc-gowalla.html

2 https://snap.stanford.edu/data/amazon/

3 https://www.kaggle.com/yelp-dataset/yelp-dataset

4 https://www.kaggle.com/datasets/movielens-100k-dataset

• items and enhancing their exposure. In this paper, we introduce an attack by injecting false users constituting 20% of the original user base.
• Popular Attack [O'Mahony et al., 2004]: The attacker generates fake users connected to the target items based on the central representation of each user category. In this paper, 5% of the users from each category are added as fake users for the attack.
• Vote Attack: The attacker generates representations for the most active target users and connects them to the target items. In this paper, 10% of the target class users are added as fake users for the attack.
• GSPAttack [Nguyen et al., 2023]: The attacker uses a GAN network to learn and generate fake user representations and their connection relationships, thereby achieving the attack effect.
• AutoAttack [Guo et al., 2023]: The attacker generates fake user representations based on the target user representations and learns the connection relationships. In this paper, 10% of fake users are generated for the attack.

Evaluation Metrics: To quantitatively evaluate the impact of the backdoor attack, we design three metrics to assess both the attack performance and recommendation performance. The success rate and coverage rate are used to evaluate the impact of the backdoor attack, while the hit rate is used to assess the recommendation performance.

• Access Rate: The access rate (ACC) measures the proportion of target users successfully attacked, defined as the ratio of the number of target users successfully attacked to the total number of target users:

where TS is the set of target users successfully attacked, and TU is the set of all target users.

• Coverage Rate: The coverage rate (CVR) measures the proportion of target items in the recommendation list of target users. For each target user, the coverage rate is the proportion of target items appearing in the top K recommended items. The overall coverage rate is the average of these individual coverage rates:

where TU is the set of target users, TP (u) is the set of target items for user u, and R(K) u is the topK recommended item list for user u.In this paper, the value of K is set to 10.

• HR@N: This metric represents the number of items in the top N items of the recommendation list that have been actually interacted with by the user. It is used to calculate the accuracy of the recommendation system in real-world applications. Specifically, it is expressed as:

where R(N) u is the set of the top N recommended items for user u, Iu is the set of items that user u has actually interacted with, and |{i ∈ R(N) u | i ∈ Iu}| represents the number of items in the top N recommended list that the user has actually interacted with. In this paper, the value of N is set to 20.

Parameter Settings: To evaluate the recommendation performance, we split each dataset into two parts: 80% for training and 20% for testing. The number of target items is set to 20. The training epoch, node embedding size, and learning rate are set to 1000, 64, and 0.001, respectively.

4.2 Main Result

To answer RQ1, we evaluate our method from two aspects: the effectiveness of the backdoor attack and its impact on the original recommendation system. For the backdoor attack effectiveness, we assess the success rate for target users and the coverage of target items appearing in the recommendation lists of target users. To evaluate the impact on recommendation performance, we use the HR@20 metric. The experimental results are shown in Table 2. We will analyze the performance of each metric in detail to verify the effectiveness of our method.

• Access Rate: We demonstrate the occurrence of target items in the top 10 recommendation lists of target users. The results show that for each dataset, the proposed framework successfully includes the target items in the top 10 recommendations for no less than 99% of the target users, demonstrating a significant performance improvement. Compared to traditional shilling attack methods, our approach performs more favorably in both attack success rate and recommendation quality, effectively boosting the ranking of target items, thereby achieving a stronger backdoor attack effect.
• Coverage Rate: We evaluate the coverage of target items in the top 10 recommended items for all target users using this metric. The experimental results show that, with our approach, the average coverage of target items in the top 10 recommended items for all target users exceeds 80%. This result indicates that our framework ensures that most target users see the target items in the recommendation list during

the attack process, further validating the effectiveness and robustness of our method.

• Hit Rate: The experimental results show that, after applying our proposed framework, the hit rate of the original recommendation system for the top 20 recommended items decreases by no more than 5%. This result indicates that our attack method not only successfully introduces the target items into the recommendation lists of target users but also keeps the impact on the overall recommendation quality and user experience at a low level, ensuring both the stealthiness and effectiveness of the attack.

4.3 Experimental Analysis

In this section, we conduct an in-depth analysis of our approach to validate the stealthiness and low destructiveness of the proposed attack method.

Stealthiness: To answer RQ2, We first examine the recommendation performance of the model before launching the attack and compare it with the recommendation performance of an unaffected recommendation system, as shown in Table 3. Specifically, we compare the recommendation accuracy of the model before the backdoor attack with the recommendation accuracy of the original recommendation system, and calculate the relative decline in recommendation performance of our model compared to the attack-free system.

The results indicate that our recommendation model performs nearly identically to the original recommendation model, with no significant impact on the user's recommendation experience. Additionally, since the model is end-to-end trained, this effect remains undetected.

Additionally, we validate the effectiveness of the constraint in Equation (5). The purpose of our constraint is to ensure that, after training with the backdoor attack, the distribution of candidate items remains stable, preventing the system from detecting the attack due to the inability to recommend items that should have been recommended to the target user before the attack. Figure 4 (a) shows the distribution of candidate items after training without the constraint loss term, while (b) illustrates the feature distribution after incorporating the constraint. It can be observed that with the inclusion of the constraint loss, the item representations transition from a discrete state to one that aligns better with the distribution of each item category. Furthermore, Table 4 provides a more intuitive comparison of the fluctuation ratios of the candidate items for the target user with and without the constraint loss.

Table 4: Comparison of target item exposure in the clean graph, without constrained loss functions, and after applying our attack method.

We find that the model without the constraint term performs significantly worse in recommending candidate items even before the attack is launched, compared to the model with the constraint. This observation highlights that the constraint not only contributes to the effectiveness of the attack but also plays a crucial role in preserving the model's recommendation quality under normal conditions. The performance drop in the unconstrained setting further validates the necessity of this design, as it ensures that the introduced triggers remain stealthy and do not degrade the overall user experience, thereby making the backdoor less detectable.

Low Destructiveness: To answer RQ3, we will investigate the impact of multiple triggers on the experimental results. Specifically, we generate a trigger exclusively for a single target item. To ensure the authenticity of the trigger, its structure consists of the target item being connected to a fake user, which in turn is connected to a fake item. For each trigger, we set different control groups with varying numbers of fake items: 0, 5, 11, 15, and 20. The attack results are shown in Figure 5.

We found that, although increasing the size of the trigger slightly improved the coverage of the target item, the extent of this improvement is negligible in practical applications. Additionally, as the size of the trigger increases, a large amount of fake information is propagated through the message-passing mechanism into the graph. Since the recommendation system is based on a bipartite graph structure and the proxy model generally uses three layers of convolution, the fake information can easily contaminate unrelated users and items, leading to significant performance degradation in the recommendation system. Even generating a trigger of size 1 for each target item individually can still cause a substantial decrease in performance.

Regarding this issue, we believe that when multiple triggers are present, they may overlap in their effects, especially when each trigger affects different target items. This can lead to redundant effects or conflicts, increasing the complexity of the recommendation system. The single trigger method, by uniformly linking all target items, avoids this redundancy and simplifies the attack structure. A single trigger can influence multiple target items, but its propagation path is controlled, preventing the complexity and unnecessary conflicts that may arise from the simultaneous use of multiple triggers.

5 Conclusion

In this paper, we propose a novel backdoor attack method for graph-based recommendation systems. This method generates a single trigger based on the target item, significantly increasing its exposure among the target users. Additionally, we design a constrained loss function to address the stealth issues inherent in traditional attack methods. By employing the single-trigger attack strategy, we mitigate the high destructiveness of false information on irrelevant user and item recommendations. Our work also demonstrates that current mainstream graph recommendation methods lack robustness and are highly susceptible to various attacks. In future work, we will explore the detection of backdoor attacks in graphbased recommendation systems and investigate more robust recommendation models to fundamentally address the vulnerability to attacks.

Acknowledgments

This work was partly supported by the National Natural Science Foundation of China (Nos. 92370111, 62272340, 62422210, 62276187, 62302333, U22B2036, 62261136549), the Open Research Fund from Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ) (No. GMLKF-24-16), the Technological Innovation Team of Shaanxi Province (No. 2025RS-CXTD-009), the International Cooperation Project of Shaanxi Province (No. 2025GH-YBXM017) and the Tencent Foundation and XPLORER PRIZE.