  Online recommendation systems make use of a variety of information sources to
provide users the items that users are potentially interested in. However, due
to the openness of the online platform, recommendation systems are vulnerable
to data poisoning attacks. Existing attack approaches are either based on
simple heuristic rules or designed against specific recommendations approaches.
The former often suffers unsatisfactory performance, while the latter requires
strong knowledge of the target system. In this paper, we focus on a general
next-item recommendation setting and propose a practical poisoning attack
approach named LOKI against blackbox recommendation systems. The proposed LOKI
utilizes the reinforcement learning algorithm to train the attack agent, which
can be used to generate user behavior samples for data poisoning. In real-world
recommendation systems, the cost of retraining recommendation models is high,
and the interaction frequency between users and a recommendation system is
restricted.Given these real-world restrictions, we propose to let the agent
interact with a recommender simulator instead of the target recommendation
system and leverage the transferability of the generated adversarial samples to
poison the target system. We also propose to use the influence function to
efficiently estimate the influence of injected samples on the recommendation
results, without re-training the models within the simulator. Extensive
experiments on two datasets against four representative recommendation models
show that the proposed LOKI achieves better attacking performance than existing
methods.
