<p>In the field of recommendation systems, some offenders inject a large number of malicious user profiles into the rating system to generate favorable recommendation results for themselves. Such attacks are referred to as “poisoning attacks”, which severely infringe upon the legitimate rights and interests of users and also cause losses to the interests of platforms and merchants. Poisoning attack detection is crucial for maintaining the security of recommender systems. However, existing poisoning attack detections mainly consider the user relationship with similar interaction histories, ignoring the implicit relationship between suspicious items and malicious users. Moreover, current poisoning attack detection methods based on graph convolutional neural networks ignore the differences in the ability of different layers of graph-based detectors to distinguish malicious users. To solve the above problems, we propose a poisoning attack detection method based on cross-distillation. First, we use singular value decomposition to extract four features from user and item implicit feature vectors to mine suspicious target items and construct a weighted suspicious user relationship graph by the maximum item suspicious degree between users. Then, we utilize noise and edge discard to augment the weighted suspicious user relationship graph, and use a cross-distillation model with different layers of teacher and student models to learn the user embeddings and employ class-wise loss to mitigate the imbalance classification and improve the learned embeddings. Finally, we combine different student models to detect malicious users. Experiments on three datasets show that our detection model outperforms the baseline models.</p>