Spattack: Subgroup-Targeted Poisoning in FedRec

• Spattack is a targeted poisoning attack that simulates phantom subgroups using item-semantic priors and contrastive separation to control recommendation outcomes.
• It employs a two-stage strategy—an approximation phase for subgroup embedding simulation and a promotion phase with adaptive weighting—to manipulate target and non-target exposures.
• Empirical results show near 100% target exposure with minimal non-target impact, even against robust aggregation defenses in federated recommendation settings.

Searching arXiv for the exact paper and closely related federated recommender poisoning work to ground the article. arXiv search query: (Yan et al., 7 Jul 2025) Spattack is a stealthy, subgroup-targeted model poisoning method for federated recommender systems (FedRec). It is the first attack that explicitly manipulates recommendations for a specific user subgroup while minimizing collateral effects on non-target users and preserving overall recommendation utility. The method follows a two-stage approximation-and-promotion strategy, enhanced with contrastive separation of subgroup embeddings, clustering-based augmentation of relevant items, adaptive weighting across subgroups, and target–relevant item embedding alignment (Yan et al., 7 Jul 2025).

1. Definition, scope, and distinguishing characteristics

Spattack is introduced as a targeted poisoning attack designed to manipulate recommendations for specific user subgroups in the federated setting. Existing attacks typically target the entire user group, which compromises stealth and increases the risk of detection. In contrast, Spattack is built around subgroup specificity: it promotes target items to the target subgroup, demotes them for the non-target subgroup, and keeps overall recommendation performance nearly unchanged.

The attack is organized around a “phantom subgroup” construction. No explicit subgroup labels are observed; the attacker defines a phantom subgroup by specifying interested items $\mathcal{V}^{in}$ and approximates subgroup embeddings locally. This is the central structural distinction between Spattack and prior global poisoning attacks. Rather than assuming access to raw user data or subgroup annotations, it uses item-semantic priors to simulate subgroup behavior.

The attack objective is measured by subgroup-aware exposure rather than only global degradation. The paper defines exposure ratio and an overall trade-off metric:

$$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$

and

$$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$

This formulation makes the target versus non-target trade-off explicit.

A common misconception is that a subgroup-targeted poisoning attack in FedRec requires explicit subgroup labels. Spattack is defined precisely to avoid that requirement: the subgroup is simulated rather than observed. A plausible implication is that subgroup targeting can be carried out under substantially weaker attacker knowledge than label-dependent formulations would require.

2. Federated recommendation setting and threat model

The method is instantiated in a standard federated recommendation setting with users/clients $\mathcal{U}$ and items $\mathcal{V}$. Each client $u_i$ owns private implicit-feedback data

$$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$

The private parameter is the user embedding $u_i$, which is kept locally. The public parameters are the item embedding table $V$ and model parameters $\Theta$. Training proceeds by server broadcast of $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$0, client-side local updates, and aggregation of gradients of $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$1 and $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$2.

The recommendation backbone used in the paper is Neural Collaborative Filtering (NCF) under the FedCF/FCF-style protocol. Local optimization uses implicit-feedback cross-entropy:

$$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$3

The attacker controls a small fraction of clients: $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$4 on ML-1M and $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$5 on ML-100K and Steam in the default experiments (Yan et al., 7 Jul 2025). The attacker observes global public parameters $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$6 per round, freely crafts and uploads malicious gradients from controlled clients, and knows only global hyperparameters; there is no access to raw user data, item popularity, or server aggregation rule internals.

The target subgroup $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$7 is induced by an interested item set $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$8 that characterizes the intended subgroup. The non-target subgroup is $$ER@K(\mathcal{U}) = \frac{1}{|\tilde{V}|} \sum_{v\in\tilde{V}} \frac{|\{u\in\mathcal{U} \mid v \in TopK(u)\}|}{|\{u\in\mathcal{U} \mid (u,v,1) \notin \mathcal{D}_u\}|}$$9, and the target items to promote are denoted $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$0. This setting makes subgroup poisoning meaningful without explicit demographic or behavioral subgroup labels.

3. Approximation stage: phantom subgroup simulation

The first stage of Spattack is the approximation stage. Its purpose is to simulate phantom embeddings for target and non-target subgroups without seeing real labels. The attack enhances separability by combining clustering-based augmentation of interested items with contrastive inter-group repulsion.

The relevant item set $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$1 is constructed from $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$2 by centroid similarity. Let

$$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$3

denote the centroid of interested item embeddings. For each item $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$4, the attacker computes cosine similarity $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$5 and selects the top-$$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$6 most similar items to produce $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$7.

The target-group phantom embedding $$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$8 minimizes

$$\alpha\text{-}GER@K = \alpha\cdot ER@K(\mathcal{U}^t) + (1-\alpha)\cdot(1 - ER@K(\mathcal{U}^n)), \quad \alpha \in [0,1].$$9

The second term uses target items as negatives to simulate “hard” positive preference for $\mathcal{U}$0 distinct from target items before promotion.

The non-target phantom embedding $\mathcal{U}$1 minimizes

$\mathcal{U}$2

where $\mathcal{U}$3 is sampled disjoint from $\mathcal{U}$4 and satisfies $\mathcal{U}$5.

To enforce separation, the paper introduces a contrastive repulsion term:

$\mathcal{U}$6

The overall approximation loss is

$\mathcal{U}$7

Only $\mathcal{U}$8 and $\mathcal{U}$9 are optimized in this stage; $\mathcal{V}$0 and $\mathcal{V}$1 remain frozen.

This stage gives Spattack its phantom subgroup aspect. Because actual subgroup labels are private in FedRec, the attack synthesizes subgroup embeddings using $\mathcal{V}$2 and $\mathcal{V}$3 for target-simulated users and disjoint $\mathcal{V}$4 for non-target users. This suggests that subgroup-targeted poisoning can be realized through latent-space approximation rather than direct subgroup identification.

4. Promotion stage: subgroup-specific target item manipulation

The second stage is the promotion stage. Here the attack fixes $\mathcal{V}$5 and $\mathcal{V}$6, then optimizes $\mathcal{V}$7 and $\mathcal{V}$8 so that target items are promoted for the target subgroup and demoted for the non-target subgroup (Yan et al., 7 Jul 2025).

The target-side promotion loss is

$\mathcal{V}$9

and the non-target-side demotion loss is

$u_i$0

Spattack further introduces adaptive subgroup weighting. Let $u_i$1 and $u_i$2 be normalized average ranks of $u_i$3 within the recommendation lists for $u_i$4 and $u_i$5 respectively. Define

$u_i$6

With current global round $u_i$7 and total rounds $u_i$8, the adaptive objective is

$u_i$9

This reweights target and non-target terms according to current ranking status.

A further term aligns target items with relevant items:

$$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$0

The overall promotion loss is then

$$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$1

This stage resolves the central tension in subgroup poisoning: the same target items should become attractive for one subgroup and unattractive for another. The adaptive weighting mechanism and target–relevant item embedding alignment are the paper’s specific answer to that conflict. A plausible implication is that subgroup specificity is achieved not only by simulated user embeddings, but also by shaping the item space itself around subgroup-relevant semantics.

5. Empirical performance, baselines, and defense evaluation

The evaluation uses MovieLens-100K, MovieLens-1M, and Steam-200K, with leave-one-out evaluation, HR@K and NDCG@K for recommendation utility, and ER@K and $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$2-GER@K for subgroup-aware attack efficacy. Baselines include PipAttack, FedRecAttack, A-hum, PSMU, PoisonFRS, and PIECK; defenses include NormBound, Median, TrimmedMean, Krum, MultiKrum, and Bulyan.

Across all three datasets, Spattack achieves $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$3 ER@5 and ER@10 on target groups while keeping non-target exposure low (Yan et al., 7 Jul 2025). On ML-1M, ER@5 is $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$4 for the target subgroup and $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$5 for the non-target subgroup; ER@10 is $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$6 and $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$7. On ML-100K, ER@5 is $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$8 and $$\mathcal{D}_i = \{(u_i, v_j, r_{ij})\}, \qquad r_{ij} \in \{0,1\}.$$9, and ER@10 is $u_i$0 and $u_i$1. On Steam, ER@5 is $u_i$2 and $u_i$3, and ER@10 is $u_i$4 and $u_i$5.

Stealth is reflected in maintained recommendation utility. Reported HR@10/NDCG@10 values remain competitive or best-in-class under attack: ML-1M has HR@10 $u_i$6 and NDCG@10 $u_i$7; ML-100K has HR@10 $u_i$8 and NDCG@10 $u_i$9; Steam has HR@10 $V$0 and NDCG@10 $V$1.

The attack remains effective under several robust aggregation defenses. Against NormBound, TrimmedMean, Krum, MultiKrum, and Bulyan, Spattack maintains high target exposure. Median can suppress the attack on some datasets, but at the cost of large HR/NDCG drops, indicating impracticality. The paper therefore characterizes the method as exhibiting strong resilience against existing mainstream defenses.

The ablation results show that each component is functionally important. On ML-1M, removing approximation enhancement drops target ER@5 from $V$2 to $V$3; removing promotion enhancement drops it to $V$4. The paper also reports stable behavior over alignment weight $V$5 in the range $V$6–$V$7, and finds that moderate $V$8 and moderate $V$9 provide the best balance between discriminability and overlap.

6. Interpretation, stealth properties, and limitations

Spattack’s stealth derives from four coupled mechanisms: contrastive separation of subgroup embeddings, relevant-item augmentation, adaptive weighting, and alignment. These components are designed to minimize impact on non-target users and preserve overall HR/NDCG, making server-side detection via utility degradation difficult.

A second misconception is that subgroup poisoning in federated recommendation must necessarily be a global manipulation in disguise. The paper’s results argue against this view: prior targeted attacks are described as global because they promote $\Theta$0 to all users via popularity mimicry or generic user approximation, whereas Spattack constructs phantom subgroups via item-semantic priors and contrastive repulsion, and aligns target items to group-relevant semantics. This is the basis of its low non-target exposure.

The method also has explicit limitations (Yan et al., 7 Jul 2025). It requires the attacker to define $\Theta$1; if $\Theta$2 poorly correlates with real subgroup preferences, approximation quality drops. Experiments use NCF, and extension to GNN-based FedRecs may change the computational profile, although the paradigm is described as general. Visibility is limited to public parameters; if the server perturbs public parameters with differential privacy noise or throttles gradient impact, attack strength may reduce.

The defense discussion remains open-ended. Robust aggregation like Median can neutralize the attack in some cases, but at a cost to HR/NDCG. Stronger anomaly detection combining gradient statistics with subgroup-aware drift detection, differential privacy or adaptive clipping, randomized item embedding re-initialization or periodic re-centering, and limiting per-item update frequency are all identified as possible mitigations.

Within the current literature, Spattack is best understood as a subgroup-specific poisoning framework rather than a generic federated poisoning method. Its central contribution is to recast targeted poisoning around latent subgroup approximation and subgroup-aware promotion, thereby resolving the target-versus-non-target trade-off more effectively than prior global attacks.