PaperlayerView exact revision on arXiv

Source-linked AI summary

Comprehensive Privacy Analysis on Federated Recommender System against Attribute Inference Attacks

Shijie Zhang, Wei Yuan, Hongzhi Yin

arXiv:2205.11857v2cs.IR

TL;DR

Federated recommendation keeps training data on users’ devices, but uploaded model parameters can still reveal private attributes, a risk that has received little study in this setting. The paper analyzes component-level vulnerability and proposes adaptive privacy protection; experiments report resistance to attribute inference with less compromise in recommendation accuracy than baselines.

  • Problem

    Attribute-inference vulnerabilities in federated recommenders remain little explored, even though uploaded parameters can retain information about users’ private attributes.

    Source: §1 · pp. 1–2

  • Method

    The paper designs an attribute-inference attacker to assess recommender components and proposes adaptive LDP protection that adjusts privacy treatment across components.

    Source: §1 · p. 2

  • Results

    The attacker’s F1 scores differed significantly from random guessing on well-trained MF, NCF, and GCN federated recommenders, and the proposed solution reports less accuracy compromise than baselines.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Component vulnerabilities vary, and the authors report that adaptive protection can provide strong privacy guarantees with less compromise in recommendation accuracy than baselines.

    Source: §1 · p. 2

    The attack setting includes users who may cooperate with an untrusted server, constraining the stated threat model to that cooperation scenario.

    Source: §3.3 · p. 5

Abstract

from arXiv · show

In recent years, recommender systems are crucially important for the delivery of personalized services that satisfy users' preferences. With personalized recommendation services, users can enjoy a variety of recommendations such as movies, books, ads, restaurants, and more. Despite the great benefits, personalized recommendations typically require the collection of personal data for user modelling and analysis, which can make users susceptible to attribute inference attacks. Specifically, the vulnerability of existing centralized recommenders under attribute inference attacks leaves malicious attackers a backdoor to infer users' private attributes, as the systems remember information of their training data (i.e., interaction data and side information). An emerging practice is to implement recommender systems in the federated setting, which enables all user devices to collaboratively learn a shared global recommender while keeping all the training data on device. However, the privacy issues in federated recommender systems have been rarely explored. In this paper, we first design a novel attribute inference attacker to perform a comprehensive privacy analysis of the state-of-the-art federated recommender models. The experimental results show that the vulnerability of each model component against attribute inference attack is varied, highlighting the need for new defense approaches. Therefore, we propose a novel adaptive privacy-preserving approach to protect users' sensitive data in the presence of attribute inference attacks and meanwhile maximize the recommendation accuracy. Extensive experimental results on two real-world datasets validate the superior performance of our model on both recommendation effectiveness and resistance to inference attacks.

1 INTRODUCTION

Personalized recommenders use interaction histories and side information, but federated learning does not eliminate attribute-inference risk because uploaded parameters can retain local information. This paper analyzes that risk and proposes adaptive privacy protection intended to preserve recommendation quality.

1 INTRODUCTION

  • Centralized recommenders may expose sensitive attributes through collected side information and interaction histories, while federated learning keeps training data on devices but still exposes uploaded model parameters.Inferred attributes may also be used to link accounts across platforms and break anonymity.Source: §1 · pp. 1–2
  • The attribute inference attacker achieved F1 scores that differed significantly from random guessing on well-trained MF, NCF, and GCN federated recommenders, showing that uploaded parameters reveal user attributes.The comparison covers ML-100K and ML-1M.Source: §1 · p. 2, Figure 2 · p. 3
  • The paper analyzes component-level vulnerability in GCN-based federated recommenders and proposes APM, an adaptive LDP mechanism that adjusts each component’s utility loss during defense.The approach uses informative bias to reduce overall utility loss.Source: §1 · p. 2
  • Experiments on two real-world datasets report that the proposed model provides strong privacy protection with less compromise in recommendation accuracy than all baselines.The supplied passages do not give numerical results.Source: §1 · p. 2

2 PRELIMINARIES

This section defines the privacy concepts and federated recommendation setting used to formulate the paper’s goal: preventing inference of users’ private attributes from uploaded local model parameters.

2 PRELIMINARIES

  • Local differential privacy requires each device to perturb its model parameters before uploading them, so the server receives a noised version rather than the original update.The privacy budget ϵ controls the trade-off between privacy and model utility; a lower ϵ provides stronger privacy but may reduce performance.Source: §2 · p. 3
  • The federated recommendation setup keeps each user’s interaction dataset and feature vector on their device while collaboratively training a global recommender.Implicit feedback is downsampled for negative instances, and categorical attributes such as age and gender use one-hot encoding.Source: §2 · p. 3
  • The stated task is to learn a privacy-preserving federated recommender that prevents attackers from inferring gender and age with high confidence from a user’s uploaded model parameters.The model parameters denote the trainable parameters of the user’s local recommender.Source: §2 · p. 3

3 ATTRIBUTE INFERENCE ATTACKS

FedRec keeps training data local but uploads model parameters; this section tests whether those updates reveal attributes and finds leakage varies across components.

3.1 Base Recommender

  • FedRec extends DSSM with user, item, and MLP components, using a GCN for user embeddings; item-side convolution is omitted because item-neighbor sets are unavailable.The MLP models user-level interactions to estimate ranking scores.Source: §3.1 · pp. 3–4

3.2 Federated Learning Protocol.

  • Devices optimize local models with cross-entropy, upload updated parameters, and rely on the server to aggregate them with FedAvg rather than sharing personal data.Each selected device downloads the latest global recommender before local training.Source: §3.2 · pp. 4–5

3.3 Attribute Inference Attack

  • The honest-but-curious server can train a three-layer attacker on updates from users with known attributes, then infer attributes for other users.The attack assumes access to local model parameters and a small group of users who share their sensitive attributes.Source: §3.3 · p. 5
  • 0.528 age and 0.677 gender inference accuracy on ML-100K, and 0.522 age and 0.684 gender on ML-1M, with ζ = 10%.The attacker uses the full set of model updates as input.Source: §3.3 · p. 5
  • The user component leaks more attribute information than the item component or MLP; within the MLP, its first layer leaks more than its last, while combining layers adds no significant gain.The paper attributes user-component leakage to user features and GCN aggregation of interacted-item embeddings.Source: §3.3 · pp. 5–6

4 ADAPTIVE PRIVACY-PRESERVING MECHANISM

APM applies local differential privacy with component-specific noise, allocating stronger protection to parameters that are less resistant to attribute inference.

4 ADAPTIVE PRIVACY-PRESERVING MECHANISM

  • APM assigns each model component a different privacy budget instead of perturbing all updates with a fixed budget.The mechanism uses an adaptive local differential privacy constraint with a noise factor for each component.Source: §4 · p. 6
  • Parameters with lower attack resistance receive larger noise factors, while more resistant parameters receive smaller factors to limit recommendation-accuracy loss.The paper motivates this allocation by the unequal vulnerability of model components.Source: §4 · p. 6
  • The mechanism clips parameters and adds Laplace noise whose scale is set by adaptive privacy parameters derived from resistance and bounded privacy budgets.The stated noise-factor range is [2δ/ϵmax, 2δ/ϵmin].Source: §4 · pp. 6–7

5 EXPERIMENTS

The experiments are organized around privacy protection, recommendation effectiveness, and the behavior of APM across attack models, hyperparameters, and base recommenders.

5 EXPERIMENTS

  • The experiments assess attribute protection against inference attacks alongside recommendation-task performance.These are identified as the two evaluation tasks.Source: §5 · p. 7
  • The evaluation asks how much the adaptive privacy mechanism contributes and whether APM resists different attack models.Source: §5 · p. 7
  • The remaining questions examine how privacy and recommendation effectiveness vary with key hyperparameters and how APM performs with different base recommenders.Source: §5 · p. 7

5.1 Datasets

The evaluation uses MovieLens datasets and focuses on gender and age attributes. It measures recommendation accuracy and attack resistance, then compares the proposed model with federated baselines.

5.1 Datasets

  • ML-100K and ML-1M provide the evaluation data; the study focuses on gender and age because occupation is difficult for simple classifiers to infer.Age and gender are encoded as 3- and 2-dimensional one-hot vectors, respectively.Source: §5.1 · p. 7

5.2 Evaluation Metrics

  • Hit@K measures whether each user’s held-out ground-truth item appears in the top-K recommendations, while attacker F1 score measures attribute-inference accuracy.Recommendation evaluation uses the full negative-item sets rather than sampled subsets.Source: §5.2 · p. 7

5.3 Baseline Methods

  • Baselines include unprotected Pure FedRec, DP-based F-GERAI and F-DPMF variants, and noise-based FedNews and FedRec-GN.F-GERAI-NL perturbs only the objective function; FedRec-GN adds Gaussian noise to uploaded client parameters.Source: §5.3 · pp. 7–8

5.4 Parameters Settings

The experiments compare attribute-inference resistance across privacy-protected federated recommenders. The proposed method performs best among LDP-based recommenders without an extra privacy budget on original features.

5.4 Parameters Settings

  • FedRec uses latent dimension 64, learning rate 0.001, batch size 32, and five local epochs; the proposed mechanism varies λ and ϵ across specified ranges.The settings are δ = 0.5, λ ∈ {0.017, 0.020, 0.025, 0.033}, and ϵ ∈ {30, 40, 50, 60}.Source: §5.4 · p. 8

5.5 Privacy Protection Effectiveness (RQ1)

  • LDP methods that add noise to uploaded parameters outperform optimization-perturbation DP baselines against attribute inference.The authors also report that deep recommenders offer stronger privacy than shallow F-DPMF, whose embeddings may preserve more original information.Source: §5.5 · p. 8
  • Our method yields the best performance among LDP-based recommenders in obscuring private attributes, without an extra privacy budget on original features.Lower attacker F1 scores indicate stronger resistance.Source: §5.5 · p. 8

5.6 Recommendation Effectiveness (RQ2)

The proposed method outperforms privacy-preserving baselines in recommendation quality on both datasets. With adaptive budgets, it also combines attack resistance comparable to the maximum fixed budget with recommendation results close to the minimum fixed budget.

5.6 Recommendation Effectiveness (RQ2)

  • Our method outperforms all privacy-preserving baselines in Hit@20 on both datasets, while LDP-based recommenders preserve stronger privacy and achieve better recommendation results than DP-based ones.The authors attribute their method’s performance to dynamically adjusting privacy budgets according to the vulnerability of each model component.Source: §5.6 · p. 8

5.7 Importance of Adaptive Privacy Mechanism (RQ3)

  • The adaptive method outperforms FixFed-min and achieves attribute-inference resistance comparable to Fixed-max while using a lower privacy budget.FixRec-max provides the strongest attack resistance among the fixed-budget variants because larger λ injects more noise.Source: §5.7 · p. 9
  • The adaptive model’s recommendation results are close to FixRec-min and its resistance is comparable to FixRec-max, reducing utility loss relative to the fixed-budget trade-off.Table 3 reports recommendation results for the adaptive model and both fixed-budget variants.Source: §5.7 · p. 9, Table 3 · p. 9

5.8 Robustness against Different Attribute Inference Attackers (RQ4)

The tested attacker models vary in effectiveness, but the proposed method outperforms comparison methods in most scenarios. Increasing embedding dimension favors recommendation accuracy but can weaken attack resistance, while more attacker training data improves attack accuracy.

5.8 Robustness against Different Attribute Inference Attackers (RQ4)

  • The proposed method outperforms comparison methods in most attacker scenarios, although Fednews does slightly better against KNN and performs worse on recommendation.The DNN-based AIA outperforms the other attackers in most scenarios.Source: §5.8 · p. 9, Table 4 · p. 10

5.9 Parameter Sensitivity (RQ5)

  • At d = 64, the method achieves competitive recommendation and inference-resistance performance as recommendation gains taper and smaller dimensions resist inference better.The sensitivity study varies d or ζ while holding other hyperparameters unchanged; it reports ML-100K results and similar results on ML-1M.Source: §5.9 · pp. 9–10, Figure 7 · p. 10
  • Increasing the attackers’ training-data share improves attribute-inference accuracy, yet the method retains acceptable resistance at ζ = 30%.The study varies train-test split ratio ζ to represent attacker prior-knowledge size.Source: §5.9 · pp. 9–10

5.10 Applications of APM (RQ6)

APM is compared with other privacy mechanisms in federated LightGCN and NCF. It consistently performs better on recommendation and attribute-inference tasks than the alternatives described.

5.10 Applications of APM (RQ6)

  • APM-equipped LightGCN and NCF outperform the compared privacy mechanisms on both recommendation and attribute-inference tasks.The comparisons include models without protection, with Laplace Noise-based LDP, and with APM.Source: Table 6 · p. 10, §5.10 · p. 10

6 RELATED WORK

Prior work studies attribute inference and privacy protection in centralized recommenders, while federated learning keeps training data on users’ devices. Existing federated protections leave open how to defend against attribute inference from locally uploaded model parameters without sacrificing recommendation performance.

6 RELATED WORK

  • Prior attribute-inference attacks use social connections, behavior, or both; centralized defenses include adversarial training, encryption, and differential privacy, each with stated constraints.RAP is designed to defend against a specific attacker model, while encryption-based approaches require an extra crypto-service provider and are computation intensive.Source: §6 · pp. 10–11
  • Federated recommenders include matrix factorization, client sampling and aggregation, and meta-learning approaches, but server-side differential privacy is effective only in a sterile environment.Federated learning keeps sensitive data on local devices while clients submit updated model parameters for aggregation.Source: §6 · p. 11
  • Because a curious server can infer attributes from received updates, local parameter protection is needed; assuming all components have equal resistance can sharply reduce recommendation performance.These limitations motivate an adaptive privacy-preserving recommender intended to counter attribute inference while maintaining recommendation accuracy.Source: §6 · p. 11

7 CONCLUSION AND FUTURE WORK

The paper analyzes attribute-inference vulnerability in federated recommenders and proposes adaptive privacy protection. It reports protection against inference while maintaining recommendation quality, and identifies active attackers as future work.

7 CONCLUSION AND FUTURE WORK

  • The analysis examines vulnerabilities across recommender components and proposes adaptive privacy budgeting based on resistance degree to limit LDP utility loss.Experiments report superiority over baseline approaches for privacy protection and recommendation quality.Source: §7 · p. 11
  • Future work will investigate active attackers that join training and craft parameter updates for subsequent attribute-inference attacks.Source: §7 · p. 11
Loading 2205.11857v2…