MAGuard: A Multi-View Anomaly Gatekeeping Defense Framework for Backdoors in Multimodal Recommendation

Zhang Jiaqi; Liu Guchun; Wang Mengyu; Huang Yuelong; Tang Tao; Ding Feng; Yu Shuo

doi:10.11959/j.issn.1000-436x.TXXB260494

Chinese

您当前的位置：

首页 >

文章列表页 >

MAGuard: A Multi-View Anomaly Gatekeeping Defense Framework for Backdoors in Multimodal Recommendation

更新时间：2026-09-20

- MAGuard: A Multi-View Anomaly Gatekeeping Defense Framework for Backdoors in Multimodal Recommendation
- Journal on Communications (2026)
- 作者机构：
  
  1.国家计算机网络应急技术处理协调中心，北京 100029
  2.大连理工大学计算机科学与技术学院，辽宁大连 116024
  3.大连理工大学软件学院，辽宁大连 116024
  4.浙江工业大学计算机科学与技术学院，浙江杭州 310023
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000-436x.TXXB260494
  CLC： TP309
- Received：18 August 2026，
  
  Revised：2026-09-19，
  
  Accepted：20 September 2026，
- 稿件说明：
移动端阅览
Zhang Jiaqi, Liu Guchun, Wang Mengyu, et al. MAGuard: A Multi-View Anomaly Gatekeeping Defense Framework for Backdoors in Multimodal Recommendation[J/OL]. Journal on Communications, 2026.
DOI：

Zhang Jiaqi, Liu Guchun, Wang Mengyu, et al. MAGuard: A Multi-View Anomaly Gatekeeping Defense Framework for Backdoors in Multimodal Recommendation[J/OL]. Journal on Communications, 2026. DOI： 10.11959/j.issn.1000-436x.TXXB260494.

摘要

近年来，多模态推荐系统在内容分发、互联网服务领域应用持续普及。第三方视觉和文本预训练编码器常被直接复用，其生成的多模态表示通过特征缓存接口为下游推荐模型提供输入。这种由预训练编码器到推荐排序的系统架构在提升开发效率的同时引入了新的供应链安全风险。若编码器输出或缓存的多模态表示被隐蔽污染，攻击者无需改动推荐模型参数与训练数据，即可定向偏移特定用户群体的推荐排序结果，同时维持全局推荐性能基本稳定。针对这一问题，本文聚焦多模态推荐系统供应链后门的检测与修复需求，提出多视角异常门控防御框架MAGuard。该框架从局部邻域一致性、用户-物品协同行为、排序敏感性、全局分布偏离四个维度构建异常特征，融合生成物品综合风险评分以识别受污染物品。进一步通过异常门控屏蔽不可信多模态特征，结合分布校正将协同过滤得分映射至正常区间，实现无需重训练的推理修复，降低后门对目标用户推荐结果的干扰。在MovieLens-100K和Amazon-TG数据集上的实验结果显示，MAGuard可高效识别嵌入层后门异常，在抑制攻击效果的同时仅带来较低的正常推荐性能损失。本文研究为多模态推荐系统场景下的预训练组件复用审计、特征缓存安全校验及AI供应链安全防护提供了可落地的技术方案。

Abstract

Multimodal recommender systems are widely used in content delivery and online services. The third-party visual and textual pretrained encoders are often reused to downstream recommenders through feature caches. This decoupled deployment improves efficiency but exposes pretrained components and cached representations to supply-chain backdoors. If encoder outputs or cached features are covertly poisoned

attackers can bias target-user rankings without changing model parameters or training data

while keeping overall performance nearly unchanged. To address this threat

we propose MAGuard

a multi-view anomaly-gated defense framework. MAGuard detects poisoned representations by fusing local consistency

collaborative behavior

ranking sensitivity

and global distributional deviation into an item-level risk score. It then repairs recommendations at inference time by gating untrusted multimodal features and calibrating collaborative filtering scores

without model retraining. Experiments on MovieLens-10K and Amazon-TG show that MAGuard effectively detects embedding-level backdoors and mitigates attacks with minimal performance loss. This work supports pretrained-component auditing and AI supply-chain protection for multimodal recommender systems.

关键词

Keywords

references

Li D , Li X , Wang J , Li P . Video recommendation with multi-gate mixture of experts soft actor critic [C ] // Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval . 2020 : 1553 - 1556 .

Bai H , Wu L , Hou M , Cai M , He Z , Zhou Y , Hong R , Wang M . Multimodality invariant learning for multimedia-based new item recommendation [C ] // Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval . 2024 : 677 - 686 .

Liu P , Zhang L , Gulla JA . Pre-train, prompt, and recommendation: A comprehensive survey of language modeling paradigm adaptations in recommender systems [C ] // Transactions of the Association for Computational Linguistics . 2023 , 11 : 1553 - 1571 .

Yue Z , He Z , Zeng H , McAuley J . Black-box attacks on sequential recommenders via data-free model extraction .[C ] // Proceedings of the 15th ACM Conference on Recommender Systems , 2021 : 44 - 54 .

Li Y , Ma H , Zhang Z , Gao Y , Abuadbba A , Xue M , et al . Ntd: Non-transferability enabled deep learning backdoor detection [J ] . IEEE Transactions on Information Forensics and Security . 2023 , 19 : 104 - 119 .

Song W , Chen L , Ma R , Zhang F . From Evaluation to Detection: Advancing Poisoning Attack Defense in Recommender Systems [J ] . Knowledge-Based Systems . 2025 , 114963 .

Zhou Q , Huang C . A recommendation attack detection approach integrating CNN with Bagging [J ] . Computers & Security . 2024 , 146 : 104030 .

吕晓婷 , 刘敬楷 , 刘芷辰 , 等 . 联邦学习后门攻击威胁与对抗性防御方法综述 [J ] . 计算机学报 , 2025 , 48 ( 12 ): 2823 - 2854 .

Lü X T , Liu J K , Liu Z C , et al . Survey on Backdoor Attack Threats and Adversarial Defense Approaches in Federated Learning [J ] . Chinese Journal of Computers , 2025 , 48 ( 12 ): 2823 - 2854 .

张一鸣 , 李舒婷 , 陈爱国 , 等 . 一种融合剪枝和微调的联邦学习后门防御方法 [J ] . 智能安全 , 2025 , 4 ( 4 ): 13 - 23 .

Zhang Y M , Li S T , Chen A G , et al . A Federated Learning Backdoor Defense Method Combining Pruning and Fine-tuning [J ] . Intelligent Security , 2025 , 4 ( 4 ): 13 - 23 .

Min N M , Pham L H , Sun J . Unified neural backdoor removal with only few clean samples through unlearning and relearning [J ] . IEEE Transactions on Information Forensics and Security . 2025 .

Zhu R , Tang D , Tang S , Wang X , Tang H . Selective amnesia: On efficient, high-fidelity and blind suppression of backdoor effects in trojaned machine learning models [J ] . IEEE Symposium on Security and Privacy , 2023 , 1 - 19 .

IEEE. Fang M , Yang G , Gong N Z , Liu J . Poisoning attacks to graph-based recommender systems [C ] // Proceedings of the 34th Annual Computer Security Applications Conference , 2018 : 381 - 392 .

Zhang H , Li Y , Ding B , Gao J . Practical data poisoning attack against next-item recommendation .[C ] // Proceedings of the Web Conference , 2020 : 2458 - 2464 .

Xu X , Huang K , Li Y , Qin Z , Ren K . Towards reliable and efficient backdoor trigger inversion via decoupling benign features .[C ] // The Twelfth International Conference on Learning Representations 2024 .

You X , Li C , Ding D , Zhang M , Feng F , Pan X , Yang M . Anti-fakeu: Defending shilling attacks on graph neural network based recommender model .[C ] // Proceedings of the ACM Web Conference 2023 : 938 - 948 .

Jia J , Liu Y , Gong N Z . Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning [J ] . IEEE Symposium on Security and Privacy , 2022 : 2043 - 2059 .

Du W , Li P , Zhao H , Ju T , Ren G , Liu G . Uor: Universal backdoor attacks on pre-trained language models [C ] // Findings of the Association for Computational Linguistics , 2024 : 7865 - 7877 .

Xi Z , Du T , Li C , Pang R , Ji S , Chen J , Ma F , Wang T . Defending pre-trained language models as few-shot learners against backdoor attacks [C ] // Advances in Neural Information Processing Systems , 2023 , 15 ( 36 ): 32748 - 32764 .

Casey B , Santos J , Mirakhorli M . A large-scale exploit instrumentation study of AI/ML supply chain attacks in hugging face models . ArXiv . 2024

Wang H , Guo S , He J , Liu H , Zhang T , Xiang T . Model supply chain poisoning: Backdooring pre-trained models via embedding indistinguishability [C ] // Proceedings of the ACM on Web Conference , 2025 : 840 - 851 .

Kalu KG , Singla T , Okafor C , Torres-Arias S , Davis JC . An industry interview study of software signing for supply chain security [C ] // USENIX Security Symposium , 2025 : 81 - 100 .

Spoczynski M , Melara MS , Szyller S . Atlas: A framework for ml lifecycle provenance & transparency .[J ] IEEE European Symposium on Security and Privacy Workshops , 2025 : 448 - 461 .

Sabane A , Bissyande TF . AI4DVault: A Registry Architecture for Securing the AI4D Supply Chain .[C ] // Cybersecurity4 D, 2025 : 1 - 11 .

Schölkopf B , Platt JC , Shawe-Taylor J , Smola AJ , Williamson RC . Estimating the support of a high-dimensional distribution [J ] . Neural Computation . 2001 , 13 ( 7 ): 1443 - 1471 .

Wei Y , Liu W , Liu F , Wang X , Nie L , Chua TS . Lightgt: A light graph transformer for multimedia recommendation [C ] // Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval . 2023 : 1508 - 1517 .

Feng S , Tao G , Cheng S , Shen G , Xu X , Liu Y , Zhang K , Ma S , Zhang X . Detecting backdoors in pre-trained encoders [J ] . IEEE Conference on Computer Vision and Pattern Recognition , 2023 , 16352 - 16362 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Fed-DCR: a backdoor defense scheme for federated learning based on dual-domain synergistic detection

Backdoor defense method in federated learning based on contrastive training

Privacy-preserving task offloading strategy for digital twin system in satellite edge computing

Advances in cross-medium magnetic induction communication: theories, technologies, and applications

Cyberspace assets ownership analysis method based on path reasoning

Related Author

Kang Jie

Du Ruizhong

Liang Xiaoyan

Zhang Xiaoyu

Shi Pengliang

Wang Shaoqing

Jiale ZHANG

Chengcheng ZHU

Related Institution

School of Cyber Security and Computer/Department of Computer Teaching, Hebei University

School of Financial Technology, Hebei Finance University

Department of Foreign Studies, North China Electric Power University

School of Information and Communication Technology, Griffith University

School of Information Engineering, Yangzhou University

AI问答

Postal code：100079
Tel：（010）53879206 Email：tmw@bjxintong.com.cn
Technical support is provided by Beijing Founder electronics co., LTD 京ICP备09082226号-64 京公网安备11010602201714号
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰