PaperlayerView exact revision on arXiv

Source-linked AI summary

Fast-adapting and Privacy-preserving Federated Recommender System

Qinyong Wang, Hongzhi Yin, Tong Chen, Junliang Yu, Alexander Zhou, Xiangliang Zhang

arXiv:2104.00919v3cs.IR

TL;DR

The paper addresses the tension between accurate recommendation and user privacy when recommender models rely on centralized personal data. It proposes federated PrivRec with first-order meta-learning and user-level DP-PrivRec, and reports that both models outperform state-of-the-art baselines while DP-PrivRec trades some accuracy for stronger privacy protection.

  • Problem

    Federated recommender systems must handle heterogeneous user data and malicious participants while balancing recommendation accuracy with user privacy.

  • Method

    PrivRec combines federated learning with first-order meta-learning for few-shot personalization, while DP-PrivRec adds user-level differential privacy and two-stage training.

  • Results

    PrivRec and DP-PrivRec achieve superior performance over state-of-the-art baselines in extensive experiments, while DP-PrivRec remains within 10% of PrivRec and outperforms DP-PrivRec-One.

  • Takeaways & Limitations

    The proposed models provide federated recommendation without requiring sensitive user data to leave devices, with DP-PrivRec offering stronger protection against membership inference.

  • Takeaways & Limitations

    First-order meta-learning is motivated partly by the high computational and memory costs of second-order MAML on resource-constrained devices.

Abstract

from arXiv · show

In the mobile Internet era, the recommender system has become an irreplaceable tool to help users discover useful items, and thus alleviating the information overload problem. Recent deep neural network (DNN)-based recommender system research have made significant progress in improving prediction accuracy, which is largely attributed to the access to a large amount of users' personal data collected from users' devices and then centrally stored in the cloud server. However, as there are rising concerns around the globe on user privacy leakage in the online platform, the public is becoming anxious by such abuse of user privacy. Therefore, it is urgent and beneficial to develop a recommender system that can achieve both high prediction accuracy and high degree of user privacy protection. To this end, we propose a DNN-based recommendation model called PrivRec running on the decentralized federated learning (FL) environment, which ensures that a user's data never leaves his/her during the course of model training. On the other hand, to better embrace the data heterogeneity commonly existing in FL, we innovatively introduce a first-order meta-learning method that enables fast in-device personalization with only few data points. Furthermore, to defense from potential malicious participant that poses serious security threat to other users, we develop a user-level differentially private DP-PrivRec model so that it is unable to determine whether a particular user is present or not solely based on the trained model. Finally, we conduct extensive experiments on two large-scale datasets in a simulated FL environment, and the results validate the superiority of our proposed PrivRec and DP-PrivRec.

1 Introduction

The paper targets recommendation systems that must balance predictive performance with privacy in federated settings. It proposes PrivRec for heterogeneous user data and DP-PrivRec for stronger protection against malicious participants.

  • Motivations and Proposals: Federated recommender systems avoid requiring users’ raw data to leave their devices, but malicious clients can still infer private information from shared models.The paper identifies membership inference and related privacy attacks as risks specific to model sharing in FL.
  • Motivations and Proposals: PrivRec combines federated learning with first-order meta-learning to personalize recommendations quickly from only a few user data points.The approach uses multiple local updates while avoiding the computational burden of second-order meta-learning.
  • Motivations and Proposals: Data heterogeneity makes average-loss training favor frequent users, leaving inactive or cold-start users’ preferences poorly estimated.Users differ substantially in preference distributions and interaction volumes.
  • Motivations and Proposals: DP-PrivRec adds user-level differential privacy to reduce membership-inference risk from trained models.Its privacy mechanism adds noise so the published information changes little when one user is present or absent.
  • Motivations and Proposals: DP-PrivRec uses two-stage training to compensate for privacy-induced performance loss by learning item representations before noisy training.The first stage uses self-supervised learning without differential privacy interference.
  • Experiments: DP-PrivRec achieves superior performance over state-of-the-art baselines in extensive experiments conducted in a simulated federated environment.The paper presents this result as validation of both proposed models.

2 Methodologies

This section introduces the proposed PrivRec and DP-PrivRec methodologies and establishes the notation used throughout the paper.

  • Methodologies: The methodology section describes the proposed PrivRec and DP-PrivRec models in detail.
  • Methodologies: Table 1 lists important notation used throughout the paper.

2.1 PrivRec in the Federated Learning Setting

PrivRec treats users as federated clients, trains a shared recommendation model from decentralized data, and predicts preferences from user and item representations without directly sharing raw user data.

  • Federated Learning Setting: Federated learning trains a shared global model across decentralized client data through repeated server distribution and client-side model updates.Clients can include smartphones, wearable devices, or medical institutions.
  • Federated Learning Setting: Federated recommendation keeps users’ data on their devices, but directly deploying DNN recommenders can still create privacy disclosure risks.The paper therefore distinguishes data locality from broader protection against model-based leakage.
  • Recommendation Model: PrivRec avoids dependence on user-identification embeddings by using user-related features such as age and occupation.This design also addresses representation challenges for new or cold-start users.
  • Recommendation Model: The model separately encodes user and item representations, concatenates them, and feeds the result through multilayer perceptron layers to estimate preference.DSSM allows user and item representations to be trained separately before their interaction in the final MLP layers.
  • Recommendation Model: The output activation depends on the preference target: Sigmoid can model implicit feedback, while a linear function can model ratings.The loss compares predicted scores with actual user preferences.

2.2 PrivRec with On-device Personalization

PrivRec treats clients as tasks in a meta-learning framework, using local updates and global meta-updates to support fast personalization with limited user data. The approach uses REPTILE to reduce MAML’s computational and data-splitting burdens while retaining multiple local updates.

  • Meta-learning framework: PrivRec models each client as a task and uses meta-learning to adapt the global recommendation model with limited local training data.The framework samples client tasks, performs local updates, and then updates the global initialization.
  • Model-Agnostic Meta-Learning (MAML): MAML adapts a converged global parameter to an unseen task through a small number of local gradient-descent steps using a support set.The described MAML procedure uses support data for local adaptation and query data for meta-update evaluation.
  • Training procedure: Training alternates between client-side local updates and server-side task sampling and meta-updates across sampled clients.Algorithm 1 summarizes the server and client procedures over global rounds and local epochs.
  • Limitations of MAML: MAML’s second-order gradients are computationally expensive and memory-intensive, while its support-query split may be infeasible for inactive users with few historical interactions.These limitations are especially relevant on resource-constrained personal devices.
  • Faster-adapting PrivRec: PrivRec uses REPTILE to ignore second-order gradients, avoid splitting local data, and move initialization weights toward parameters obtained after task-specific stochastic-gradient updates.The method permits multiple local update iterations before the global update.

2.3 Differentially Private-PrivRec (DP-PrivRec)

DP-PrivRec extends PrivRec with user-level differential privacy to reduce membership-inference risk from malicious participants. Its training procedure samples clients, clips and aggregates gradients, adds Gaussian noise, and tracks composed privacy loss.

  • Differential privacy: Differential privacy limits information disclosure by ensuring that a user’s presence or absence has only a slight effect on the learned model.The formal guarantee is expressed as (ε, δ)-differential privacy over adjacent inputs.
  • User-level privacy: DP-PrivRec protects each user’s entire dataset rather than only an individual training record.Its adjacent-dataset definition replaces all data associated with one user, making the privacy unit user-level.
  • DP-PrivRec mechanism: DP-PrivRec samples a client batch, clips each client gradient to ℓ2 threshold S, aggregates the clipped gradients, and perturbs the aggregate with Gaussian noise.The Gaussian noise scale is proportional to the query sensitivity, which is bounded by 2S.
  • Sensitivity analysis: 2S bounds the sensitivity of the aggregated-gradient query used in DP-PrivRec.The bound supports calibrating the Gaussian perturbation applied after aggregation.
  • Privacy accounting: Moments accountant composes privacy losses across repeated Gaussian-mechanism applications to obtain an (ε, δ)-DP guarantee.The analysis accounts for client subsampling and sequential application over training rounds.

2.4 Two-stage FL Training

The two-stage FL approach first learns item representations without differential privacy using self-supervised learning, then initializes DP-PrivRec for user-item interaction modeling. This separates item-representation learning from privacy-sensitive downstream personalization.

  • Stage 1: Item representation learning: The first stage learns item representations with self-supervised learning without applying differential privacy during training.This stage avoids using user information as direct supervision while learning representations from item sequences.
  • Motivation: The two-stage design addresses the performance degradation associated with adding noise during federated training by learning item representations before privacy-preserving optimization.The paper motivates this separation as a way to enhance item representation learning when user information is exclusive.
  • Self-supervised learning: The self-supervised task uses temporally ordered interacted-item sequences and contrastive objectives based on masked items and masked segments.Positive pairs preserve target items or segments, while negative pairs are sampled from alternative items or segments.
  • Self-supervised objective: The first-stage objective combines item-masked and segment-masked learning losses with hyperparameters controlling their contributions.The two objectives maximize scores for true pairs relative to negative pairs.
  • Stage 2: Downstream training: The second stage initializes DP-PrivRec with the learned item representations and jointly optimizes the downstream recommendation objective.A hyperparameter controls the contribution of the downstream DSSM loss.

3 Evaluation Setup

The evaluation uses simulated federated learning on Frappe and Movielens-1M, with user-level train/test splits, on-device fine-tuning, and ranking metrics averaged across testing users.

  • Experiments simulate federated learning with PySyft, modeling users as virtual workers and a server as the coordinator of global updates.
  • Datasets: Frappe and Movielens-1M provide user and item features for representation learning, with ratings converted into binary implicit feedback.
  • Data heterogeneity: Most Movielens users visited few items, and Frappe shows a similar long-tail activity pattern motivating fast personalization.
  • Protocol: 80% of users are used for training and 20% for testing; each testing user’s data is split for fine-tuning and evaluation.
  • Metrics: Recommendation quality is evaluated with Hits@k and nDCG@k, averaged over testing users after ranking positive and negative items.

4 Experimental Results and Discussions

The experiments compare PrivRec with centralized and federated recommender baselines across two datasets, while examining hyperparameters, privacy, and personalization-related research questions.

  • Research questions: The evaluation asks whether PrivRec outperforms related models, how FL settings affect performance, and how privacy mechanisms and meta-learning alter accuracy and efficiency.
  • RQ3: The study evaluates DP-PrivRec against PrivRec and DP-PrivRec-One, including whether two-stage training compensates for privacy-related performance loss.
  • RQ1: PrivRec is compared with centralized NCF and PrivRec-CEN, plus federated baselines FedGNN, NN-SELF, FOFL-SELF, and FCF.
  • RQ1: FOFL-SELF and PrivRec outperform NN-SELF, while PrivRec benefits from user and item side information and avoids the performance damage associated with FedGNN’s encrypted techniques.

4.2 Impact of FL Hyperparameters (RQ2)

The results examine FL hyperparameters, differential-privacy settings, and privacy–accuracy trade-offs for PrivRec and DP-PrivRec on Movielens and Frappe.

  • FL hyperparameters: PrivRec performance increases dramatically when server training epochs E1 are below 40, especially on Frappe.
  • FL hyperparameters: The hyperparameter experiments vary E1, E2, and client-batch size M, with the observations intended to guide practical training choices.
  • Differential privacy: DP-PrivRec has lower but comparable accuracy to PrivRec, with the performance gap staying within 10% across the reported datasets.
  • Differential privacy: DP-PrivRec consistently outperforms DP-PrivRec-One, supporting the two-stage training approach for mitigating noise-related performance loss.
  • Privacy budget: Different combinations of δ, sampling ratio q, and composition count E1 produce different privacy losses ϵ, with Movielens obtaining lower ϵ than Frappe under the reported settings.
  • Privacy budget: Increasing privacy budget ϵ rapidly improves Hits@20 at first, but accuracy stabilizes once ϵ becomes sufficiently large.

4.5 Effects of First-order Meta-learning (RQ5)

First-order meta-learning improves personalization for inactive users and is more computationally efficient than second-order meta-learning in the evaluated setting.

  • Inactive-user personalization: PrivRec outperforms PrivRec-SGD by 20%−40% in Hits@20 for Movielens users with fewer than 20 visited items.
  • Inactive-user personalization: The comparison indicates that meta-learning is especially beneficial for inactive users with sparse interaction histories.
  • Computational efficiency: First-order PrivRec is compared with second-order NN-SELF using the same base recommender structure while varying the number of participating users per round.
  • Computational efficiency: Second-order Hessian-vector products can add about 10%−30% training time, supporting the first-order approach’s efficiency motivation.

4.6 Defensing Membership Inference (RQ6)

The experiment trains a membership inference attack using shadow-model recommendations, then evaluates attacks against PrivRec and differentially private variants. The results indicate that differential privacy reduces attack accuracy, with stronger privacy involving a trade-off against recommendation performance.

  • Training Attack Model: The attack model uses a shadow model and labeled used-versus-unused users to predict whether a user participated in training.Each user is paired with a top-10 recommendation list, and a random forest predicts the binary in/out label.
  • Attack Evaluation: The evaluation trains PrivRec and DP-PrivRec on separate user subsets and tests membership inference from a malicious participating client.The private dataset is divided by user, with 50% used to separately train the target models.
  • Results: PrivRec yields the highest membership-inference attack accuracy because its parameters are not perturbed by noise.The comparison is reported in Table 6 for different target models.
  • Results: Differential privacy lowers attack-model accuracy for LM-PrivRec and DP-PrivRec relative to PrivRec.The authors attribute the reduction to noisy results introduced by differential privacy.
  • Results: Higher privacy budgets ε improve membership-inference performance while generally sacrificing privacy and improving recommendation results.This identifies a privacy–recommendation trade-off in DP-PrivRec.

5 Related Work

Related work covers federated learning, personalized FL, and private FL, positioning this work as a DNN-based personalized recommender using first-order adaptation and user-level differential privacy. It also distinguishes the paper’s focus on uneven user activity and its two-stage privacy-oriented training design.

  • Federated Learning: Federated learning trains a shared global model while keeping sensitive data in the local institutions where it belongs.The framework addresses the data dilemma of centralized machine learning.
  • Federated Recommender Systems: FL recommender research remains rare, with prior work including federated matrix factorization and collaborative filtering based on implicit feedback.These approaches aggregate user-specific gradient updates to update the global model.
  • Personalizing FL algorithms: Personalized FL methods include local fine-tuning, multi-task learning, and adding user context to adapt global models to client differences.The paper places its work in the local fine-tuning category.
  • Personalizing FL algorithms: The proposed method uses first-order gradients for efficient on-device personalization on resource-constrained edge devices.This distinguishes it from related meta-learning approaches using more costly adaptation procedures.
  • Data Heterogeneity: The paper focuses on unbalanced user activity, where users generate substantially different numbers of activities, rather than only distribution differences across devices.This imbalance is presented as a challenge for personalized recommendation.
  • Private Federated Learning: Although FL keeps raw data local, shared parameters or gradients can still leak sensitive information through membership inference attacks.Related private-FL work seeks to prevent determining whether a client participated in decentralized training.
  • Private Federated Learning: DP-PrivRec uses equal-sized client batches and two-stage training to measure privacy analytically and compensate for differential-privacy performance loss.These are the two distinctions identified relative to cited DP techniques in FL.

6 Conclusions

The paper addresses the tension between recommendation performance and privacy with PrivRec, a federated DNN recommender, and DP-PrivRec, its user-level differentially private extension. It combines few-example personalization with privacy protection and evaluates both models on two datasets in simulated federated learning.

  • Contributions: PrivRec uses user and item side information to learn representations and generate recommendations without requiring sensitive user data to leave devices.The model runs within a fully distributed federated-learning framework.
  • Contributions: A first-order meta-learning method adapts recommendations to new or inactive users using a few local data examples.The method addresses the limited personalization of trivial FL training.
  • Contributions: DP-PrivRec adds user-level differential privacy to reduce risks from malicious FL participants and trained-model membership inference.The paper also provides an analytical sketch for measuring privacy spent during training.
  • Evaluation: Experiments on two datasets in a simulated FL environment validate the reported superiority of PrivRec and DP-PrivRec.The conclusion summarizes the experimental evidence without specifying a numerical result.
Loading 2104.00919v3…