PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Trustworthy Recommender Systems

Yingqiang Ge, Shuchang Liu, Zuohui Fu, Juntao Tan, Zelong Li, Shuyuan Xu, Yunqi Li, Yikun Xian, Yongfeng Zhang

arXiv:2207.12515v2cs.IR

TL;DR

Prior surveys treat ethical recommendation topics separately, leaving a need for a systematic account of trustworthiness and links among its perspectives. This survey defines trustworthiness and reviews work across explainability, fairness, privacy, controllability, and robustness, synthesizing current trends and future directions, particularly across aspects.

  • Problem

    Existing surveys address ethical recommendation topics separately, while a systematic view of trustworthiness and relationships among its perspectives is needed.

    Source: §1 · p. 4

  • Method

    The survey defines trustworthiness, categorizes its principles, and reviews recent work on explainability, fairness, privacy, controllability, and robustness.

    Source: §9 · p. 46

  • Results

    The survey synthesizes current developments and trends and identifies future research directions, especially from cross-aspect perspectives.

    Source: §9 · p. 46

  • Takeaways & Limitations

    The survey highlights cross-aspect perspectives as a focus for future trustworthy-recommendation research.

    Source: §9 · p. 46

    Trustworthiness evaluation remains difficult: explainability and controllability are subjective, and no accepted metric consistently evaluates controllability methods.

    Source: §9.3 · pp. 47–48

Abstract

from arXiv · show

Recommender systems (RS), serving at the forefront of Human-centered AI, are widely deployed in almost every corner of the web and facilitate the human decision-making process. However, despite their enormous capabilities and potential, RS may also lead to undesired effects on users, items, producers, platforms, or even the society at large, such as compromised user trust due to non-transparency, unfair treatment of different consumers, or producers, privacy concerns due to extensive use of user's private data for personalization, just to name a few. All of these create an urgent need for Trustworthy Recommender Systems (TRS) so as to mitigate or avoid such adverse impacts and risks. In this survey, we will introduce techniques related to trustworthy recommendation, including but not limited to explainable recommendation, fairness in recommendation, privacy-aware recommendation, robustness in recommendation, user-controllable recommendation, as well as the relationship between these different perspectives in terms of trustworthy recommendation. Through this survey, we hope to deliver readers with a comprehensive view of the research area and raise attention to the community about the importance, existing research achievements, and future research directions on trustworthy recommendation.

1 INTRODUCTION

Recommender systems shape human decisions, but risks beyond accuracy make trustworthiness essential. This survey synthesizes key trustworthy recommendation perspectives and their relationships, while identifying open problems and future directions.

Introduction

  • Non-transparency, unfair treatment, privacy risks, and limited user control can undermine trust and cause harms, so recommendation quality alone is insufficient.Trustworthy systems should also be fair, robust to tampering and changing conditions, understandable, and developed through transparent, inclusive processes.Source: §1 · p. 3
  • Trust in a recommender system is a trustor’s willingness to rely on it despite vulnerability, with owners, consumers, producers, or society serving as trustors.Source: §1 · p. 3
  • The survey treats explainability, fairness, privacy, robustness, and controllability as core components of trustworthy recommender systems.These address utility and economic needs for accurate, robust recommendations; legal needs for privacy and explanations; and ethical needs to mitigate unfairness and enable user control.Source: §1 · p. 4
  • Unlike topic-specific surveys, this work presents a systematic, comprehensive view of trustworthiness and relationships among perspectives, and identifies open problems at their intersections.It distinguishes its coverage from nearby surveys that focus on selected topics without examining relationships among trustworthiness concepts.Source: §1 · pp. 4–5
  • The survey covers more than 400 works on five core trustworthy recommendation perspectives, drawing from leading Web, IR, RecSys, data-mining, and HCI venues as well as notable arXiv papers.Source: §1 · p. 5
  • The survey targets recommender-systems and AI researchers and practitioners, as well as theorists and policymakers; it focuses mainly on end-user trustworthiness and organizes coverage across perspectives and technical foundations.Sections 4–8 address explainability, fairness, privacy, robustness, and controllability, respectively.Source: §1 · p. 5

2 TRUSTWORTHY PERSPECTIVES & THEIR RELATIONSHIPS IN RECOMMENDATION

Trustworthy recommendation centers on explainability, fairness, privacy, robustness, and controllability, whose failures can undermine user trust through opacity, inequity, data exposure, attacks, or perceived manipulation and filter bubbles.

2 TRUSTWORTHY PERSPECTIVES & THEIR RELATIONSHIPS IN RECOMMENDATION

  • Explainability, fairness, privacy, robustness, and controllability are widely discussed trustworthiness perspectives; failures can undermine trust through opacity, inequity, data exposure, attacks, or perceived manipulation.Opacity can frustrate users, while unfairness, privacy concerns, attacks, and perceived loss of control can also erode trust.Source: §2 · p. 6

2.1 Explainability with other Perspectives

  • Explainability intersects with unequal explanation quality [111, 446], privacy-safe neighbor explanations, attack risks from exposed model logic, and user-controlled, faithful explanation detail.Controllable explanations should reflect users’ needs while presenting faithful facts, not fabricated explanations.Source: §2.1 · pp. 6–7

2.2 Fairness with other Perspectives

  • Fairness connects to explanations of inequity, privacy-preserving sensitive-feature use via federated fairness, attack resistance, and user-prioritized fairness features bounded by system-wide safeguards.Users may prioritize different sensitive features, but their preferences should not disrupt the system’s overall fairness mechanism.Source: §2.2 · pp. 8–9

2.3 Privacy with other Perspectives

  • Privacy intersects with explanations of optimal settings, equitable protection amid privacy-induced bias, attack-resistant safeguards and privacy–robustness trade-offs [432], and user control of shared data.Privacy protection can reduce personalization quality, while privacy-induced bias can create unfair service quality across user groups.Source: §2.3 · pp. 9–10

2.4 Robustness with other Perspectives

  • Robustness benefits from explanations for defense, must consider unequal attack impacts and possible fairness trade-offs, protect privacy during attacks, and keep control designer-directed for testing defenses.The fairness–robustness trade-off in recommender systems remains largely unexplored.Source: §2.4 · pp. 10–11

2.5 Controllability with other Perspectives

  • Controllability should explain action consequences, balance user steering against fairness goals, protect privacy from added collection or probing, and resist injected attacks that distort steering.User control can help escape filter bubbles, but may conflict with system fairness goals or expose recommended users’ private information.Source: §2.5 · pp. 11–12

3 RECOMMENDER SYSTEM BASICS

This section formalizes recommender-system inputs and outputs, then surveys representative recommendation algorithms from shallow to large models. It establishes the basic recommendation workflow and algorithmic landscape for the survey’s later discussion of trustworthy recommendation.

3.1 Input and Output of RS

  • Recommender systems use user, item, and interaction data, with explicit feedback such as ratings and reviews distinguished from implicitly recorded behavior such as clicks.User and item profiles and attributes vary by application; interactions connect users to items and reveal preferences.Source: §3.1 · p. 12
  • Recommendation output typically combines a personalized item list with explanations, produced through Predict, Rank, and Explain stages.Predict generates candidates, Rank refines them into a shorter list while accounting for other considerations, and Explain may occur during ranking or afterward for a black-box model.Source: §3.1 · pp. 12–13

3.2 Representative Recommendation Algorithms

  • Shallow methods use expert-designed matching functions, while deep methods learn matching patterns through collaborative filtering or collaborative reasoning.Shallow approaches include memory- and model-based collaborative filtering and content-based filtering; deep approaches include similarity learning, representation learning, and reasoning methods.Source: §3.2 · pp. 13–14
  • Sequential recommendation models behavior as a sequence to predict future actions, while learning-to-rank methods learn relative item order rather than absolute preference scores.Sequential models span Markov chains and session-based KNN through RNNs, CNNs, LSTMs, BERT, attention, and memory networks; BPR is a pairwise learning-to-rank method.Source: §3.2 · pp. 14–15
  • Large recommendation models include personalized foundation models that unify tasks as language tasks, but current LLM-based recommenders can lack personalization, recommend fictitious items, and require extensive computation.The survey describes P5 and variants as using personalized prompts for multiple recommendation tasks; large models also offer stronger generalization and zero-shot capabilities than deep recommendation models.Source: §3.2 · p. 15
  • The survey next examines explainability, fairness, privacy, robustness, and controllability, including relationships among these perspectives in trustworthy recommendation.These topics frame the upcoming discussion of ways to incorporate trustworthiness into recommendation models.Source: §3.2 · pp. 15–16

4 EXPLAINABILITY

Explainable recommendation seeks to pair recommendations with comprehensible justifications that help stakeholders make decisions and improve transparency and trustworthiness; explanations can also help developers understand and debug models. The section surveys explainability’s dimensions, display styles, and technical approaches.

4.1 Overview of Explainable Recommendation

  • Explainable recommendations add explanations to predicted results to make black-box inference more understandable, with research organized around explanation information or display style and the models that generate explanations.The overview frames these as HCI and machine-learning perspectives, respectively.Source: §4.1 · p. 16

4.2 Different Styles of Explanations in Recommender Systems

  • Recommendation explanations use display styles and evidence tailored to the model, including collaborative-filtering users or items, content features, generated sentences, and visual-image explanations.Examples include neighbor-rating histograms, similar liked items, feature charts, template- or LSTM-generated text, large language models, and image-region or pixel explanations.Source: §4.2 · p. 17

4.3 Explanation Generation in Recommender Systems

  • The technical discussion distinguishes explanations for recommender systems from general explainable AI, then presents a taxonomy of recommendation approaches.Source: §4.3 · p. 17

Differences from Explainable AI.

Modern recommender systems are expected to provide high-quality recommendations alongside personalized, intuitive explanations that engage users in applications such as e-commerce and social media.

Personalized Explanation

  • Personalized explanations adapt recommendations and explanations to user preferences through personalized language generation, image-region highlights, and prompt-based natural-language explanations,,.The cited approaches use review summarization and dialog, user and review information with image regions, and item IDs as prompts, respectively.Source: Differences from Explainable AI · p. 18

Interactive Feedback

  • Unlike one-time ML predictions, explanations in conversational and interactive recommendation can shape later recommendations, while user feedback helps improve results,,.Examples include multi-turn conversations, POI exploration where users express preferences, and vision-language explanations using deconfounded pretraining.Source: Differences from Explainable AI · p. 18

Subjective Reaction

  • Because end users may interpret explanations subjectively, recommendation quality depends on justification, satisfaction, and trust rather than a definite right or wrong item [69],.Le and Lauw incorporate subjective and objective aspect-level quality assumptions as constraints alongside recommendation objectives.Source: Differences from Explainable AI · p. 18

Taxonomy on Explainable Recommendation Approaches.

The section organizes explainable recommendation by explanation information source and by whether explanations are intrinsic or post-hoc, global or local. It also considers how explanations are evaluated and how fairness, privacy, robustness, and user control shape trustworthy explanation design.

Taxonomy on Explainable Recommendation Approaches.

  • The taxonomy classifies explanations by information source, alongside whether generation is model-intrinsic or post-hoc and whether explanations are global or local.Post-hoc explanations need not reflect a model’s internal mechanism, but should provide faithful facts about the model or item.Source: Taxonomy on Explainable Recommendation… · pp. 18–19
  • Explanation sources include users, items, and features; text and reviews; images and videos; logical rules; graphs; counterfactuals; and multi-round interactions.These sources support instance-based, textual, multimedia, reasoning-path, intervention-based, and conversational explanations.Source: Taxonomy on Explainable Recommendation… · pp. 19–21
  • Conversational recommendation can jointly integrate prediction, explanation generation, and user feedback, while human-in-the-loop graph reasoning uses turns to trace behaviors and knowledge-graph structures.These approaches aim to help users understand recommendations and make the decision process more transparent.Source: Taxonomy on Explainable Recommendation… · p. 21

4.4 Explanations Evaluation in Recommender Systems

  • Explanation evaluation serves end users, developers, content providers, and regulators, with goals including satisfaction and trust, transparency and consistency, effectiveness and efficiency, and scrutability.Evaluation approaches trade off reliability and cost; offline metrics are easy to apply, but their relationship to user comprehension and use remains unclear.Source: §4.4 · pp. 21–22
  • Offline evaluation uses available ground-truth explanations or sufficiency and necessity measures, while user studies and online tests capture reactions more directly but cost more and may require system access.Common metrics depend on output form; user studies may be active surveys or passive tracking of reactions.Source: §4.4 · pp. 22–23

4.5 Relationship with other Trustworthy Recommendation Perspectives

  • Explainability supports user trust, but explanations can be biased across groups, expose private information, reveal mechanisms to attackers, or be manipulated into misleading outputs.Fairness-aware explanations remain underexplored; neighbor-based explanations can leak friends’ activity, and counterfactual explanations can reveal interventions that change recommendations.Source: §4.5 · pp. 23–24
  • Controllable explanations let users choose relevant features and adjust detail or expertise level, while requiring faithful facts and clear interfaces to avoid misleading users.Users may also want control over explanation length and sentiment.Source: §4.5 · pp. 24–25

5 FAIRNESS

Fairness is a central concern for trustworthy recommendation because biased or discriminatory recommendations can harm disadvantaged groups and undermine stakeholder satisfaction. The section traces sources of unfairness, distinguishes fairness definitions, and groups research methods into measurement, modeling, and diagnosis.

5 FAIRNESS

  • Fairness matters because recommendation can disadvantage underrepresented groups, privilege certain producers, or contribute to racial or gender discrimination in job recommendations.Such outcomes motivate fairness research to improve satisfaction across stakeholders [2].Source: §5 · p. 25

5.1 Source of Unfairness in Recommendation

  • Data-generation, collection, and storage biases can skew training and visibility, while recommendation algorithms can reinforce skew, including through popularity bias.Discrimination can also arise from human prejudice or stereotyping around sensitive attributes; some fairness definitions cannot be satisfied simultaneously.Source: §5.1 · pp. 25–26

5.2 Definitions of Fairness in Recommendation

  • Group fairness compares average treatment across protected groups, whereas individual fairness requires similar predictions for similar individuals.Recommendation studies include equal opportunity, equalized odds, demographic parity, similar recommendation quality across active and inactive users, and counterfactual fairness for individual users.Source: §5.2 · p. 26
  • Recommendation fairness may concern consumers, producers, or both, with consumer-side work addressing protected-class impacts and producer-side work addressing exposure and market fairness [4] [42] [420].Examples include gender-based consumer inequalities, disparities between active and inactive users, and unequal exposure of popular and less-popular items.Source: §5.2 · p. 27
  • Associative fairness measures statistical disparities, while causal fairness uses causal structure to examine how sensitive attributes affect model outputs [370].Associative measures can miss discrimination under Simpson’s paradox; Wang et al. [370] use causal interventions and back-door adjustment in multi-behavior recommendation.Source: §5.2 · p. 27
  • Static fairness provides a one-time solution, whereas dynamic fairness accounts for changing user preferences and item popularity [213].Ge et al. formulate changing item-exposure fairness as a constrained Markov decision process and use constraint policy optimization.Source: §5.2 · pp. 27–28

5.3 Methods for Fairness in Recommendation

  • Fairness research in recommendation develops quantitative metrics, fair recommendation models, and diagnostic methods that explain why a model is fair or unfair.These approaches respectively measure fairness under different definitions, improve fairness of model outputs, and identify reasons for unfairness.Source: §5.3 · p. 28

Fairness Quantification.

Fairness quantification develops metrics to measure disparities in ranking and recommendation, including disparities tied to sensitive features, item popularity, and recommendation quality across users.

Fairness Quantification

Fair Recommendation Models.

Fair recommendation models use pre-processing, in-processing, or post-processing methods, each with distinct benefits and limitations [213, 215]. Choosing or developing an approach also requires attention to social and legal contexts, not only technical considerations.

Pre-processing methods

  • Pre-processing reduces bias in source data before training, enabling downstream algorithms to use transformed data but requiring access to data that can legally and technically be modified.Methods include sampling, balancing, and label repair; Lahoti et al. learn low-rank representations for individual fairness. These methods may reduce model performance and do not explicitly include output-based fairness metrics.Source: Fair Recommendation Models · pp. 28–29

In-processing methods

  • In-processing incorporates fairness into training objectives, such as through regularization [32] or adversarial terms, and can balance fairness and utility.It can seek a Pareto frontier, offering flexibility for accuracy–fairness trade-offs, but may yield non-convex optimization without guaranteed optimality.Source: Fair Recommendation Models · p. 29

Post-processing methods

  • Post-processing improves fairness by modifying or re-ranking produced outputs, offering model-agnostic flexibility but requiring access to sensitive features at decision time.FA*IR enforces a minimum percentage of protected candidates throughout rankings, while Li et al. re-rank lists to ensure fair recommendation quality for advantaged and disadvantaged users.Source: Fair Recommendation Models · p. 29

Fairness explanations

  • Fairness explanations identify causes of model disparity: Begley et al. [27] use Shapley values to attribute feature contributions, but this approach is unsuitable for recommendation’s large user and item feature spaces.Ge et al. instead use learning-based counterfactual reasoning to find features influencing the fairness–utility trade-off and explain fairness in black-box feature-aware recommenders.Source: Fairness Diagnostics · p. 29

Fairness Diagnostics.

Fairness failures can harm consumers, items, and platforms, motivating fairness-aware design and evaluation. The section relates fairness to explainability, privacy, robustness, and user control in recommender systems.

5.4 Relationship with other Trustworthy Recommendation Perspectives

  • Unfair recommendation can restrict consumer choices, skew item exposure and sales, and erode platform trust, engagement, and revenue.Perceived discrimination may also drive consumers and producers away and expose platforms to legal action.Source: §5.4 · p. 30
  • Explainable fairness seeks to make fairness-related decisions interpretable so users, designers, and policymakers can understand why recommendations are judged fair or unfair.Collaborative learning and bias propagation can create fairness problems even when models do not directly use sensitive features, making the causes difficult to identify manually.Source: §5.4 · p. 30
  • Privacy-aware fairness seeks fair treatment without requiring users to disclose sensitive features, a dilemma federated fairness addresses by keeping that information on personal devices.Source: §5.4 · p. 30
  • Robust fairness aims to preserve fair recommendations under intentional attacks, with evaluation covering fairness violations, accuracy, and the robustness–accuracy trade-off.Suggested metrics include worst-case fairness violations and average-case accuracy; greater robustness may reduce accuracy.Source: §5.4 · pp. 30–31
  • Controllable fairness lets users prioritize fairness aspects rather than switch fairness off, while requiring safeguards against user bias and adjustments to fairness–utility trade-offs.Controls can be bounded to prevent grossly unjust outcomes; interfaces can explain choices and implications to educate users.Source: §5.4 · p. 31

6 PRIVACY

The section frames privacy protection as a trust requirement for recommender systems, balancing personalization needs with the protection of private information and ownership. It organizes the discussion around ownership, threats, protection techniques, and open questions.

6 PRIVACY

  • Privacy protection aims to preserve authorized ownership of sensitive information and counter threats, helping avoid unwanted information exposure in web services.The section adopts common privacy terminology covering private information, ownership, threats, and protection goals.Source: §6 · pp. 31–32

6.1 Ownership of Private Information

  • Personalization depends on sensitive user traces, while platform data and models face recovery and manipulation risks from attackers or fake users.The section frames user privacy around users’ trust in the platform and platform privacy around the system’s trust in users and external entities.Source: §6.1 · p. 32

6.2 Privacy Threats in Recommendation

  • Shared recommender-system data can expose personally identifiable information; anonymized users may still be re-identified through external-data linkage or inference from partial observations.The taxonomy distinguishes ownership types, privacy threats, and protection techniques.Source: De-anonymization · p. 33, Figure 6 · p. 33

De-anonymization. … Anonymization.

The section describes how recommender systems can expose private information through inference and poisoning threats, and surveys anonymization and system-level measures intended to reduce privacy risks.

De-anonymization.

  • Private attributes can be inferred from users’ behavior histories, ratings, interests, social relations, or writing style, and recommendation models can reveal training records or model parameters.Attribute inference may target user privacy, while model inversion uses model behavior, including query feedback, to reconstruct private information.Source: Inference attack · p. 33

Inference attack.

  • Inference threats can indirectly control the recommendation model by modifying its training data through a trusted channel.Source: Poisoning attack · p. 33

Poisoning attack.

  • Poisoning attacks aim to “write,” rather than “read,” private information and can be formulated as an optimization problem related to recommender-system robustness.Source: Poisoning attack · p. 34

Anonymization.

  • Anonymization methods include risk-based k-anonymity, l-diversity, and t-closeness, as well as replacing detailed attributes with cluster-level group information.Source: Anonymization · p. 34
  • Pseudonyms alone do not prevent de-anonymization with auxiliary background knowledge, motivating perturbation-based approaches such as differential privacy.Source: Anonymization · p. 34
  • System-level protections include informing users and obtaining consent, party certification and verification, dynamic authentication and access limits, and distributed storage or computation.Distribution can be service-side, with multiple participants jointly providing recommendations, or user-side, such as federated learning or block-chain that keeps data on personal devices [54] [379].Source: System Design · p. 34

System Design. … Adversarial Machine Learning.

The section surveys privacy protections for recommender systems, from encryption and noise-based methods to adversarial learning, and relates privacy to other trustworthy-system goals. It also identifies challenges involving privacy attacks on explanations and decentralized systems.

Encryption

  • Encryption protects information transferred between recommender systems, users, and third parties, enabling secure computation but adding computational cost.Homomorphic encryption permits third-party computation without decryption or computational error; garbled circuits support joint model optimization without revealing inputs.Source: Encryption · p. 34

Obfuscation and Differential Privacy

  • Noise-based obfuscation and differential privacy disguise individual records while aiming to preserve accurate aggregate recommendations, but can reduce utility.These methods are more efficient in practice than encryption, but introduce computational error and utility loss.Source: Obfuscation and Differential Privacy · pp. 34–35
  • Learned noise distributions can provide differential privacy without compromising utility, specifically against user attribute inference attacks.These methods formulate noise finding as a machine-learning problem.Source: Adversarial Machine Learning · p. 35

Adversarial Machine Learning

  • Adversarial models mimic attackers to train recommendation models robust to a wider range of attacks without significant utility loss.The survey links these approaches to system robustness and their suitability for poisoning and inference attacks.Source: Adversarial Machine Learning · p. 35

6.4 Relationship with other Trustworthy Recommendation Perspectives

  • Privacy violations can erode user trust and engagement, limit item exposure, and damage platform reputation and revenue.The survey argues that designing with privacy in mind can support user confidence, engagement, and platform and item revenue.Source: §6.4 · p. 35
  • Privacy connects with explainability and fairness: systems can explain protections and settings, while privacy schemes should avoid discriminatory protection and unfair service quality.In cross-domain collaboration, protecting one participant’s privacy can constrain its contribution and raise fairness concerns among participating systems.Source: §6.4 · pp. 35–36
  • Robust privacy must account for empirical protections’ instability and accuracy trade-offs, while controllable privacy lets users choose data use and balance privacy with service quality.The survey contrasts theoretical encryption and anonymization guarantees with more efficient empirical methods, and notes that users may limit data collection or sensitive data shared from federated devices.Source: §6.4 · p. 36
  • Privacy attacks may exploit explanation models, and decentralized systems reduce some privacy risks while creating new edge-device communication challenges.Privacy-preserving explanations remain underexplored; decentralization can weaken central control and introduce direct communication between edge devices.Source: §6.4 · p. 36

7 ROBUSTNESS · Hand-engineered Shilling Attack. · Machine-learned Adversarial Attacks.

Recommender systems face attacks that can manipulate recommendations and undermine their reliability, motivating trustworthy designs and defenses. The section distinguishes hand-engineered shilling from machine-learned adversarial attacks and describes their vulnerabilities and countermeasures.

7.1 Taxonomy of Attacks in Recommendation

  • Attacks vary by timing (poisoning or evasion), intent (push, nuke, or untargeted), size, and attacker knowledge.Commercial-system attacks typically inject 1%–15% of profiles; knowledge ranges from public-information-based low knowledge to perfect knowledge of the profile database.Source: §7.1 · pp. 37–38

7.2 Attack Methods

Hand-engineered Shilling Attack.

  • Hand-engineered shilling requires effort to create fake accounts and authentic-looking behavior, is often narrowly targeted, and can be mitigated by outlier detection.These limits constrain its scalability, practicality, and potential for widespread disruption.Source: Hand-engineered Shilling Attack · p. 38

Machine-learned Adversarial Attacks.

  • NDCG decreased by -21.2% under adversarial perturbations versus -1.6% under random perturbations in BPR-MF, demonstrating susceptibility to parameter attacks.The study perturbed user and item embeddings using FGSM before generating recommendations.Source: Machine-learned Adversarial Attacks · pp. 38–39
  • Parameter attacks can sharply reduce recommender accuracy through small latent-factor perturbations, potentially triggered by only a few malicious users during model updates.Related FGSM work spans visual recommenders, factorization machines, deep neural networks, and auto-encoders [331] [412].Source: Machine-learned Adversarial Attacks · pp. 38–39
  • Content attacks can distort user or item data, such as spam reviews that fool review classifiers, and threaten content-based, hybrid, social-based, and sequence-aware recommenders.DeepWordBug is a black-box attack that generates a spam movie review misclassified as positive by a deep RNN-based classifier.Source: Machine-learned Adversarial Attacks · p. 39
  • Machine-learned poisoning attacks optimize training-data manipulation, including S-attack’s promotion of a target item and PoisonRec’s RL-generated fake profiles.S-attack uses influential users and gradient-based optimization; PoisonRec models item sampling with a biased complete binary tree to reduce time complexity in a hierarchical action space.Source: Machine-learned Adversarial Attacks · p. 39

7.3 Defence Methods

  • Defenses use anomaly detection to localize fake profiles or adversarial robust training that augments training data with small, imperceptible adversarial examples.Training with adversarial examples aims to improve the recommender’s ability to withstand attacks at test time.Source: §7.3 · pp. 39–40

Detection methods. · Adversarial robust training.

The section surveys shilling-attack detection and adversarial defenses, then relates robustness to explainability, fairness, privacy, and system-designer control. It emphasizes that robustness affects recommendation quality and trust, while several interactions with other trustworthy perspectives remain open research directions.

Detection methods.

  • Detection methods classify shilling profiles through supervised feature engineering, such as RAdaBoost on filler-size features, or unsupervised clustering and seed-based propagation.Bhaumik et al. use k-means to identify small attack clusters, while Zhang et al. estimate attack likelihood from known-good users.Source: Detection methods · p. 40

Adversarial robust training.

  • Adversarial defenses include robust NMF with R1-norm, kernel-mapped matrix factorization, and trim learning that exploits normal–fake differences.Trim learning is proposed to make matrix factorization resistant to data poisoning.Source: Adversarial robust training · p. 40
  • Adversarial training adds a regularization term to BPR-MF against FGSM, extends to VBPR, and improves context-aware tensor factorization robustness.The tensor approach introduces adversarial perturbations during training to help distinguish real from fake data.Source: Adversarial robust training · p. 40

7.4 Relationship with other Trustworthy Recommendation Perspectives

  • Robustness failures can produce irrelevant recommendations, user frustration or abandonment, reduced item exposure and sales, and lower platform trust and revenue.Robustness is presented as crucial to recommendation accuracy and relevance.Source: §7.4 · pp. 40–41
  • Explainable robustness uses explanations to expose vulnerabilities and guide defenses, while explainers can also inform backdoor trigger selection and counterfactual analysis of attacks.Explainability is framed as useful for both attack design and defense; the section also cites explainable robustness.Source: §7.4 · p. 41
  • Fairness-aware robustness seeks fair protection across users and groups, since profile injection may disproportionately degrade recommendations for users with sparse histories.Robustness–fairness trade-offs have been observed in machine learning, but remain largely unexplored in recommender systems.Source: §7.4 · p. 41
  • Privacy-aware robustness must address attacks that infer membership or attributes [432], and protect data exposed through explanations.The section also notes that private-data exfiltration can occur as a byproduct of attacks.Source: §7.4 · pp. 41–42
  • Controllable robustness treats control primarily as a system-designer tool for generating adversarial examples or malicious activity to identify weaknesses and improve defenses.Source: §7.4 · p. 42

8 CONTROLLABILITY

User controllability is an important aspect of trustworthy recommendation: users may be dissatisfied even with accurate recommendations, while greater control can improve satisfaction and trust. This section distinguishes direct preference editing from indirect preference updates through interaction.

8.1 Explicit Controllability

  • Explicit controllability lets users directly edit profiles or reweight preference features, assuming they can identify and express their preferences.Interfaces use profiles, visualizations, sliders, or other controls to change how preferences shape recommendations.Source: §8.1 · p. 43

8.2 Implicit Controllability

  • Implicit controllability lets users fine-tune preferences through interactions such as reranking recommendations, editing past interactions, or responding to recommendation explanations.The system infers preference updates from these interactions rather than requiring users to directly manipulate profiles or favored features.Source: §8.2 · p. 44

8.3 Relationship with other Trustworthy Recommendation Perspectives

  • Greater control can improve user satisfaction, trust, and engagement, while lack of control can reduce them and constrain item exposure and revenue.Platforms can offer feedback, preference adjustment, and control over recommendation frequency and type, while balancing user needs with platform goals.Source: §8.3 · pp. 44–45
  • Explainable controllability should show how user actions affect recommendations before users intervene, since control without understanding can produce harmful or mistaken outcomes.Existing approaches may let users change preferences without explaining how those preferences contribute to recommendations or how interactions update them.Source: §8.3 · p. 45
  • Fairness-aware controllability must prevent user interventions from reinforcing bias, narrowing item or provider exposure, or trapping users in filter bubbles.Repeatedly disliking unpopular items or controlling recommendations toward certain providers can undermine diversity and fairness.Source: §8.3 · p. 45
  • Privacy-aware controllability must address risks from collecting more user information, exposing preference settings, and probing recommendations for private information.These risks also arise when recommended items are people, such as in friend or advisor recommendation.Source: §8.3 · pp. 45–46
  • Robust controllability must withstand attacks that manipulate data or user histories, alter preferences through control options, or infer the recommendation mechanism.Such attacks can promote particular items, disrupt system behavior, or exploit the controllability back channel.Source: §8.3 · p. 46

9 CONCLUSION, CHALLENGES AND OPPORTUNITIES

The survey reviews trustworthy recommendation across explainability, fairness, privacy, controllability, and robustness, and identifies challenges in balancing trustworthiness objectives and evaluating them. It calls for future work that supports responsible, reliable recommender systems.

9 CONCLUSION, CHALLENGES AND OPPORTUNITIES

  • The survey reviews methods and future directions across five trustworthiness perspectives, emphasizing their cross-aspect relationships and the challenge of making recommender systems responsible and worthy of trust.It aims to equip researchers with background and knowledge to advance future research and implementation.Source: §9 · p. 46

9.1 The Cost of Trustworthiness in Recommendation

  • Trust-driven systems may incur short-term costs and accuracy losses, but researchers and practitioners should prioritize long-term stakeholder trust and sustained use.Adversarial robustness can improve generalizability and reduce overfitting while harming overall accuracy; trust-driven development may also require more learning time, slower development, and greater time and effort.Source: §9.1 · pp. 46–47

9.2 The Trade-offs within Trustworthy Recommendation Perspectives

  • Privacy and fairness can conflict when fairness-aware models need sensitive attributes that privacy protections restrict, including when the same attributes require fairness control and protection.A key challenge is achieving fairness without compromising privacy, particularly when fairness-control attributes are themselves sensitive information.Source: §9.2 · p. 47
  • Robustness, fairness, and explainability can also trade off: robustness techniques may introduce bias, fairness constraints may weaken adversarial robustness, and studies report fairness-explainability trade-offs [5, 167].Because these dimensions interact, separately combining systems that optimize each one does not guarantee a more trustworthy or effective result; integrated approaches must account for compatibility and trade-offs.Source: §9.2 · p. 47

9.3 Limitations in Current Evaluations of Trustworthiness

  • Subjective, inconsistently measured explainability and controllability hinder model comparison, motivating reliable quantitative frameworks for evaluating trustworthiness and objectively comparing systems.User studies are common for controllability, but no generally accepted metric consistently evaluates different methods; the relationship between offline explainability metrics and users’ comprehension and use of explanations also remains unclear.Source: §9.3 · pp. 47–48
Loading 2207.12515v2…