A.1 Additional Motivational Observations A.1.1 Additional Results on Difficulty-agnostic Analysis Figure 1 shows additional results of TNA [11] and PAPU [51] on The results also verify the conclusion in the Sec 3.1.1: Also, we do not show the result of TrialAttack [45], since it satisfies the difficulty-property 1 that enables attackers to put more efforts on easy users (see Sec. 3.1.2). Additional Results on Diversity-agnostic Analysis Figure 1 shows additional results of TNA [11], PAPU [51], and TrialAttack [45] on ML-100K [14]. We follow the same experiment setting in Sec 3.2.1. As shown in Figure 1 (a) and (c), the fake users of TNA and PAPU form a cluster that is distributed in community 3 and community 1, respectively. Consequently, in Figure 1 (b) and (d), TNA and PAPU improve HR@50 on community 3 and 1, respectively, while keeping similar HR@50 on the other communities. Thus, they suffer from the diversity-deficit issue.

Recent studies have demonstrated that recommender systems (RecSys) are vulnerable to injective attacks. Given a limited fake user budget, attackers can inject fake users with carefully designed behaviors into the open platforms, making RecSys recommend a target item to more real users for profits. In this paper, we first revisit existing attackers and reveal that they suffer from the difficulty-agnostic and diversity-deficit issues. Existing attackers concentrate their efforts on difficult users who have low tendencies toward the target item, thus reducing their effectiveness. Moreover, they are incapable of affecting the target RecSys to recommend the target item to real users in a diverse manner, because their generated fake user behaviors are dominated by large communities. To alleviate these two issues, we propose a difficulty and diversity aware attacker, namely DADA. We design the difficulty-aware and diversity-aware objectives to enable easy users from various communities to contribute more weights when optimizing attackers. By incorporating these two objectives, the proposed attacker DADA can concentrate on easy users while also affecting a broader range of real users simultaneously, thereby boosting the effectiveness. Extensive experiments on three real-world datasets demonstrate the effectiveness of our proposed attacker.