When we discussed collaborative filtering techniques in previous chapters of this book, we made the implicit assumption that everyone in the user community behaves honestly and is fair and benevolent. If this assumption holds, all the participants profit: customers are receiving good buying proposals, well-appreciated items get some extra promotion, and the recommendation service itself will be appreciated by web site visitors if its proposals are of high quality and correctly reflect the opinions of the user community.

In the real world, however, the assumption of having only honest and fair users may not hold, in particular when we consider that the proposals of a recommender system can influence the buying behavior of users and real money comes into play. A malevolent user might, for instance, try to influence the behavior of the recommender system in a such way that it includes a certain item very often (or very seldom) in its recommendation list. We shall call this an attack on the recommender system. When a person expresses his or her genuine negative opinion – which can be based on any reasons – this is not seen as an attack. An attack occurs when an agent tries to influence the functioning of the system intentionally.

In general, attackers might have different goals, such as to increase the sales of an item, to cause damage to a competitor, or to sabotage the system as a whole so it is no longer able to produce helpful recommendations.