A Comprehensive Survey on Trustworthy Recommender Systems

1 INTRODUCTION

• Adversarial attacks, inherited bias, privacy leakage, and opaque predictions can produce unreliable recommendations and harmful effects, especially in safety-critical applications.These concerns also hinder recommendation algorithms’ development and deployment.Source: §1 · p. 2
• The survey focuses on six dimensions: Safety & Robustness, Non-discrimination & Fairness, Explainability, Privacy, Environmental Well-Being, and Auditability & Accountability.It applies trustworthy-AI principles to recommender systems as human-centered AI applications.Source: §1 · p. 3
• Financial recommendations illustrate the dimensions’ practical stakes: decisions may involve robustness, privacy, fairness, explanations, auditing, and environmental sustainability.The passage gives stock, insurance, and loan services as examples of high-stakes scenarios.Source: §1 · p. 3
• The survey presents concepts and definitions and reviews representative algorithms for each dimension, noting that the dimensions are not independent.It also discusses potential interactions among dimensions and future directions.Source: §1 · p. 4
• Unlike reviews organized around selected perspectives or recommendation stages, this survey takes a computational perspective and discusses interactions among dimensions and future research directions.It contrasts its scope with Ge et al. [119] and Wang et al. [359].Source: §1 · p. 5

2.1 Concepts and Taxonomy

• Adversaries can target item exposure or degrade overall system performance through evasion at inference or poisoning during training, using different levels of model knowledge and data perturbations.Defenses are grouped into perturbation detection and adversarial training.Source: §2.1.1 · pp. 5–6, §2.1.2 · p. 6, §2.1.3 · p. 6

2.2 Representative Attack Methods

• Poisoning attacks inject fake user profiles to manipulate recommendation outputs and can be formulated as a bilevel optimization problem constrained by attack budgets and profile plausibility.The attacker’s objective may promote or demote items or reduce system utility.Source: §2.2.1 · p. 7

2.2.2 Heuristic Methods.

• Heuristic attacks use hand-designed profiles to promote or demote items, but such profiles can be detectable, require prior knowledge, and leave adversarial goals unoptimized.Some strategies interact with popular items; examples include random, average, bandwagon, segment, love/hate, and reverse-bandwagon attacks.Source: §2.2.2 · pp. 7–8

2.2.3 Gradient-based Methods.

• Gradient-based methods optimize fake interactions against recommendation losses, while GAN-based approaches model normal-user behavior or add attack objectives to generate profiles.Gradient estimation ranges from approximations to exact higher-order computation, which requires more resources; GAN variants also add influence guidance or initialize gradient attacks.Source: §2.2.3 · pp. 8–9

2.2.4 Reinforcement Learning-based Methods.

• Because white-box gradient attacks need extensive target knowledge, black-box methods learn attack policies from query rewards, using hierarchical action spaces or cross-domain profile copying.KGAttack uses item attributes and hierarchical item selection, while CopyAttack searches clustered profiles and refines them to reduce attack budgets and noise.Source: §2.2.4 · pp. 9–10

2.3 Representative Defense Methods

• Defenses either detect anomalous profiles or train models to tolerate perturbations; adversarial training alternates perturbation generation with model training.Detection approaches range from profile-feature classifiers and clustering to sequential models and joint recommendation-detection frameworks; APR perturbs embeddings and is reported to improve robustness and generalization.Source: §2.3 · p. 10, §2.3.1 · p. 10, §2.3.2 · pp. 10–11

2.4 Application

• Robustness matters in healthcare and e-commerce, where manipulated recommendations can mislead diagnosis or shopping, and the survey reviews existing safety surveys and the RGRecSys evaluation toolkit.The survey reports that RGRecSys is the only robustness toolkit the authors found.Source: §2.4 · p. 11, §2.5 · p. 11, §2.5.1 · pp. 11–12

2.6 Future Directions

• Most attack and defense research focuses on collaborative filtering and user-item interactions, while other model types remain to be investigated and parameter-space perturbations may limit robust-training gains.The survey also calls for interaction-space adversarial training and further study of recommender vulnerabilities across techniques such as reinforcement learning and graph neural networks.Source: §2.6 · p. 12

3 NON-DISCRIMINATION & FAIRNESS

• Recommendation fairness is multi-sided, and bias can arise or amplify in the human-recommender feedback loop, affecting users and item providers.The section describes potential harms including fewer or lower-paid job recommendations for women and reduced exposure for less-popular movies.Source: §3 · p. 12
• The survey categorizes causes of unfairness, fairness criteria and evaluation metrics, then reviews bias-mitigation methods, applications, and future directions.It aims to support a broad overview of fairness issues and further research in recommender systems.Source: §3 · p. 13

3.1 Concepts and Taxonomy

• Fairness is evaluated using diverse criteria because definitions and metrics vary across works and no general definition has been agreed upon.The survey groups fairness definitions from typical perspectives rather than proposing a single universal measure.Source: §3.1 · p. 13, §3.1.3 · p. 15

3.1.1 Bias.

• Bias can arise in data collection, model training, and model serving, including feedback-loop reinforcement that can widen popularity-related traffic gaps.Data bias includes selection, exposure, conformity, and position effects; model/result bias includes popularity bias.Source: §3.1.1 · p. 13

3.1.2 Fairness.

• Fairness spans procedural justice and outcome parity, with outcome definitions organized by stakeholder, granularity, and other perspectives.The section includes user, item/provider, joint-sided, group, individual, causal, personalized, explainable, raw max-min, and dynamic fairness.Source: §3.1.2 · pp. 14–15

3.1.3 Fairness Evaluation Metrics.

• Metrics capture different disparities: group utility gaps, performance dispersion, allocation range, exposure uncertainty, and distribution mismatch.Lower KL-divergence between item-group exposure and historical exposure indicates fairer recommendations.Source: §3.1.3 · p. 15

3.2.1 Pre-processing Methods.

• Pre-processing modifies training data to reduce bias, but gains at this stage may not persist through later steps such as re-ranking.Re-sampling balances sensitive groups and can yield minor fairness improvement; antidote data can mitigate unfairness more effectively but takes more time.Source: §3.2.1 · p. 16

3.2.2 In-processing Methods.

• In-processing methods address bias during training through regularization, adversarial learning, and other approaches including reinforcement learning and causal methods.Fairness criteria can enter the loss as regularizers, while adversarial methods train representations from which sensitive attributes cannot be inferred; reinforcement-learning methods can model dynamic feedback, and causal methods target discriminatory effects.Source: §3.2.2 · pp. 16–19

3.2.3 Post-processing Methods.

• Post-processing promotes fairness by re-ranking recommendation outputs using slot-wise, user-wise, or global-wise strategies.These approaches range from sequentially filling a list under fairness rules to jointly re-ranking several users’ lists through optimization.Source: §3.2.3 · pp. 19–20

• Unfairness in large-scale, resource-allocating platforms threatens their trustworthiness and motivates the survey’s application examples.The section examines job and commercial recommendation systems.Source: §3.3 · p. 20
• Job recommendations should offer fair opportunities to qualified candidates, since group over- or under-representation and racial or gender stereotypes can raise legal and societal issues.The passage frames recommendations as a form of social resource allocation.Source: §3.3 · p. 20
• Commercial recommendations can disregard users with different activity levels, and provider-side unfairness also matters for platforms’ long-term benefits.The survey says mitigating unfairness on both sides is essential to commercial recommender systems’ long-term benefits.Source: §3.3 · pp. 20–21

3.4 Surveys and Tools

• The section aims to organize existing surveys and tools on fairness in recommender systems for researchers.Source: §3.4 · p. 21

3.4.1 Surveys.

• Prior surveys cover recommendation bias and debiasing, fairness in ranking and recommendations, broader fairness foundations, or fairness specifically in recommender systems.The cited works differ in emphasis and coverage, from technical comparisons to connections across fields.Source: §3.4.1 · p. 21

3.4 Surveys and Tools

• General fairness toolkits offer metrics, mitigation algorithms, explanations, and model-comparison workflows, but recommender-system evaluation and analysis toolkits are still lacking.Source: §3.4.2 · p. 21

3.5 Future directions

• Fairness definitions can vary by scenario and stakeholder, and some conflict, leaving open how to prioritize objectives, choose metrics, and combine notions.The survey calls for benchmarking different metrics and establishing their relationships from a unified view.Source: §3.5 · p. 21
• Fairness-aware design still needs to address model-induced bias, including bias from graph neural networks and spurious associations in collaborative filtering.The survey identifies causal methods as a direction for mitigating such bias.Source: §3.5 · p. 22
• Fairness and utility can trade off, while industrial recommender systems may not tolerate overall performance degradation because of revenue loss.The survey calls for research into the trade-off mechanism to help decision-makers balance the two.Source: §3.5 · p. 22

4.1.1 Concepts.

• Explainable recommendations provide users with recommendations and reasons for them, supporting interpretation of models whose mechanisms may otherwise be obscure.The survey links explainability to trust and use in safety-critical applications.Source: §4 · p. 22, §4.1.1 · p. 22

4.1 Concepts and Taxonomy

• The survey organizes explainable recommendation research into taxonomies for models and for evaluations.The model taxonomy distinguishes production and presentation; evaluation is classified by perspective and form.Source: §4.1.2 · pp. 22–23

4.1.2 Taxonomy.

• Model taxonomies distinguish intrinsic from post-hoc explanation production and structured from unstructured presentation, while evaluations consider perspectives and forms.Evaluation perspectives include effectiveness, transparency, and scrutability; forms include quantitative metrics, case studies, real-world performance, and ablation studies.Source: §4.1.2 · pp. 23–24

4.2.1 Different methods of producing explanations: model-intrinsic based and post-hoc.

• Model-intrinsic methods generate explanations within recommendation models, including through multi-task learning, aspect-aware ratings, and knowledge-graph reasoning.Their explanations rely on the model’s reasoning process, which can make them detailed but difficult to migrate to other models.Source: §4.2.1 · pp. 25–26
• Post-hoc methods use inputs, predictions, or visible features to explain recommendations without depending on a model’s internal reasoning.They are generally more model-agnostic, but their explanations often rely on instance associations and may be weaker than intrinsic explanations.Source: §4.2.1 · pp. 26–27

4.2.2 Different methods of presenting explanations: structured and unstructured.

• Structured methods use paths, rules, or trees to make explanation logic visible, but often require abundant structured data linking users and items.Examples include knowledge-graph reasoning and post-hoc tree models.Source: §4.2.2 · pp. 27–28
• Unstructured methods generate explanations such as sentences, scores, or features; their flexible forms can be intuitive but may lack clear reasoning logic.Examples include conversational recommendation, Transformer-generated explanations, and counterfactual items.Source: §4.2.2 · pp. 29–30

4.3.1 Quantitative Metrics.

• Quantitative metrics, often designed for natural-language generation, numerically approximate aspects of explanations using measures such as ROUGE and BLEU.Other examples include Unique Sentence Ratio, Feature Matching Ratio, and shift scores.Source: §4.3.1 · p. 30

4.3.2 Case Study.

• Case studies present example explanations for people to judge their validity and can expose the logic of structured explanations.Researchers may compare examples with one another or with outputs from other models.Source: §4.3.2 · p. 30

4.3.3 Real-world Performance.

• Real-world evaluations collect user feedback or annotator judgments and examine whether explanations positively affect recommendations in an application.Evaluations may run models online or recruit annotators.Source: §4.3.3 · pp. 30–31

4.3 Methods of Evaluations

• Ablation studies remove modules or adjust parameters to assess their contribution to the recommender and its explanation generation.They can isolate the contributions of explainable modules and modules involved in producing explanations.Source: §4.3.4 · p. 31

4.4 Applications

• E-commerce explanations aim to give justifiable reasons for product recommendations, while social-media examples include explainable place recommendations.The survey describes commercial platform evaluations and models using visual, textual, sentiment, aspect, and regional information.Source: §4.4 · p. 31

4.5 Surveys and Tools

• Prior work surveys explainable recommendation models and evaluation, while available AI toolkits are mostly general-purpose and recommendation-specific tooling remains limited.The survey names AIX360, Quantus, and XAITK as tools oriented mainly to general explainable AI.Source: §4.5.1 · p. 31, §4.5.2 · p. 31

4.6 Future Directions

• Future directions include generating detailed, natural-sounding explanations and expanding research beyond e-commerce and social media into fields such as medical care and education.The survey says current sentence explanations often rely on predefined templates and that research in these additional fields remains limited.Source: §4.6 · p. 32

5 PRIVACY

• Privacy protection addresses risks from sensitive training data and model knowledge, organizing the section around attack strategies, defenses, applications, and unresolved challenges.The survey treats privacy as important for recommender systems used in safety-critical areas such as finance and healthcare.Source: §5 · p. 32

5.1 Concepts and Taxonomy; 5.1.1 Privacy Attacks.

• Attacks vary by attacker access—white-box, black-box, or grey-box—and target membership, global properties, user-level reconstruction, or model extraction.White-box attackers can access model architecture, parameters, gradients, and training data; black-box attackers have minimal knowledge, while grey-box attackers have partial knowledge.Source: §5.1.1 · pp. 32–33

5.1.2 Privacy Preserving.

• Privacy-preserving strategies include differential privacy, federated learning, adversarial learning, anonymization, and encryption.Differential privacy adds noise; federated learning keeps data decentralized and transfers parameters; anonymization obscures identity links, while encryption restricts access to authorized key holders.Source: §5.1.2 · pp. 33–34

5.2 Methods; 5.2.1 Privacy Attacks.

• Shadow training uses auxiliary data to train surrogate recommenders, whose predictions then train attackers; membership inference compares recommendations with historical interactions.Some membership attacks also use temporal changes in ranking lists or operate without labels.Source: §5.2.1 · pp. 34–35, Figure 8 · p. 34, Figure 9 · p. 35

5.2.1 Privacy Attacks.

• Other attacks infer global training-set properties, reconstruct sensitive user information, or extract recommender parameters and structure.Model extraction is usually black-box and differs from the other attack types by targeting the model rather than users’ information.Source: §5.2.1 · pp. 35–36

5.2.2 Privacy-preserving Methods.

• Privacy-preserving methods apply differential privacy and federated learning, adversarial objectives, anonymization, encryption, and distortion-based mappings.Federated approaches keep user data local and aggregate model parameters; adversarial approaches reduce attackers’ gains, while anonymization or encryption obscures or restricts access to sensitive information.Source: §5.2.2 · pp. 36–37

5.3 Applications; 5.4 Survey and Tools; 5.4.1 Surveys.

• Applications include privacy-preserving medical and location recommendations, while surveys and tools cover privacy methods and implementations.Examples include cryptographic and anonymization approaches for medical recommendations, differential privacy for location data, and tools such as Opacus, TensorFlow-Privacy, TFF, and FedML.Source: §5.3 · p. 38, §5.4.1 · p. 38, §5.4.2 · p. 38

5.5 Future Directions

• Future work must reduce privacy-related utility loss, combine defenses across attack types without degrading recommendation performance, and investigate defenses against shadow training.The survey notes that obscured information may be critical to recommendation performance and that shadow-training attacks rely on reasonable assumptions.Source: §5.5 · pp. 38–39

6 ENVIRONMENTAL WELL-BEING; 6.1 Concepts and Taxonomy; 6.1.2 Taxonomy.

• Environmental well-being addresses recommender systems’ growing resource demands through model compression to save storage and acceleration to reduce training or inference time.Compression methods target embedding or middle layers, while acceleration methods focus on training or inference stages.Source: §6.1.1 · p. 39, §6.1.2 · pp. 39–40, §6 · p. 39

6.2 Methods; 6.2.1 Model Compression.

• Recommendation-model compression includes hashing and quantization, which shrink embedding representations through shorter codes or cluster codewords.The survey also describes product, additive, and residual quantization; product and additive quantization are commonly used in recommendation.Source: §6.2.1 · pp. 40–41

6.2.1 Model Compression.

• Other compression approaches include student–teacher distillation, architecture search, embedding-dimension search, automated feature selection, and parameter-sharing techniques.Distillation transfers output responses or intermediate features; neural architecture search uses validation loss to adjust model architecture.Source: §6.2.1 · pp. 41–43

6.2.2 Acceleration Techniques.

• Acceleration methods address memory movement and computation, using near- or in-memory computing, caches, CPU–GPU co-design, and software optimization.The survey distinguishes hardware methods, generally aimed at memory-related challenges, from software methods, mainly aimed at computation.Source: §6.2.2 · pp. 43–45
• Embedding-based retrieval accelerates online recommendation by indexing embeddings for sub-linear search, with tree-, graph-, hash-, and quantization-based approaches.Retrieval must balance memory, latency, and accuracy.Source: §6.2.2 · p. 45

6.3 Applications in Real Systems; 6.3.1 Big Model; 6.3.2 Edge Computation.

• Real-system examples include pretrained recommendation models, edge–cloud collaboration, and embedding-based retrieval systems.Pretraining can avoid retraining a whole model for each task, while edge approaches place selected recommendation functions or user models on edge devices.Source: §6.3.1 · pp. 45–46, §6.3.2 · p. 46, §6.3.3 · p. 46

6.4 Surveys and Tools; 6.4.1 Surveys.

• The survey presents itself as the first to collect work on recommender-system environmental well-being and points readers to related surveys and Faiss retrieval tools.It notes that surveys specifically on recommendation-model compression and acceleration are also few.Source: §6.4.1 · pp. 46–47, §6.4.2 · p. 47

6.5 Future Directions

• Future directions include recommender-specific energy measurement, balancing model size against accuracy in neural architecture search, and hardware–software collaboration.The survey names edge recommendation as an example of hardware–software collaboration.Source: §6.5 · p. 47

7 ACCOUNTABILITY & AUDITABILITY

• The section links accountability to users’ trust and responsibility for harmful effects, including distrust and societal harm associated with crisis-time fake-news recommendations.The authors also note that limited transparency and explainability can leave users and experts unable to control recommendation systems fully [24, 169].Source: §7 · p. 47

7.1.1 Accountability.

• Accountability comprises responsibility, answerability, and sanctionability, which the survey maps to content governors, model designers, system deployers, and third-party auditors.Their roles include examining harmful content, explaining bad effects, building reproducible models, and checking systems for potential problems.Source: §7.1.1 · pp. 47–48

7.1.2 Auditability.

• Algorithm audits analyze whether harmful problems exist and why, with recommendation audits divided into external and internal classes.The two classes differ in access: external audits use inputs and outputs, whereas internal audits can access training data.Source: §7.1.2 · p. 48
• External audits assess recommender systems as black boxes after deployment, while internal audits examine systems before deployment but may be subjective when designers and auditors overlap.External audits avoid developer and deployer involvement; internal audits can reduce the probability of harmful impacts before deployment.Source: §7.1.2 · pp. 48–49

7.2 Surveys and Tools

• Existing surveys address accountability or auditability separately, but the authors report no survey specifically focused on both for recommendations.The surveyed work covers accountability theory, audit behavior and methods, and external audit processes, [19], and [200].Source: §7.2.1 · p. 49

7.2.2 Tools.

• Manual annotation is used for accuracy in external audits but is difficult; crowdsourcing and reproducibility-focused recommendation libraries are available tools.The section names Amazon Mechanical Turk and libraries including RecBole [443] [444], FuxiCTR [458], DaisyRec [333], and ELLIOT [9].Source: §7.2.2 · p. 49

7.3 Future Directions

• Future work should combine accountability dimensions, develop automated internal audits, and coordinate internal and external audits to draw on both approaches’ merits.The authors note that most studies focus on one aspect of accountability and that few studies address internal audits.Source: §7.3 · p. 49

Interactions among dimensions

• Although trustworthy systems should possess six dimensions simultaneously, most research addresses one dimension, and the dimensions can vary in interdependence or conflict.The survey frames balancing positive interactions and potentially conflicting dimensions as a non-trivial problem.Source: §8 · pp. 49–50

Interactions with Robustness

• Robustness is positively correlated with explainability but may partly conflict with privacy and fairness, making it challenging to improve robustness without affecting other dimensions.The survey identifies adversarial attacks and robust training as settings where these interactions are particularly evident.Source: §8 · p. 50

Interactions with Fairness

• Studies connect fairness with explainability and robustness, while explainability work also examines robustness and privacy interactions.Examples include a fairness-aware explainable model [114], a robust-fairness model [433], and a counterfactual explanation mechanism addressing privacy exposure [126].Source: §8 · p. 50

Interactions among different dimensions

• Future work should address interactions among three or more trustworthiness dimensions and resolve conflicts, since existing studies mostly focus on one dimension or pairs.Adding an explainability module may risk environmental well-being.Source: §9 · pp. 50–51

Other Dimensions to achieve trustworthy recommender systems

• Security and controllability are proposed as additional dimensions: security matters in consequential settings, while controllability can stop harmful recommendations and minimize their effects.The passage gives medication and industrial recommendation as settings where improper decisions can cause losses to life and property,.Source: §9 · p. 51

Technology Ecosystem for trustworthy recommender systems

• A trustworthy recommender-systems ecosystem needs datasets, metrics, and toolkits, which the authors say remain underdeveloped.The survey notes a dataset example for non-discrimination, KuaiRec [117], but no specific datasets for environmental well-being or accountability and no toolkit for evaluating multiple dimensions.Source: §9 · p. 51

10 CONCLUSION

• The survey covers six dimensions: safety and robustness, non-discrimination and fairness, explainability, privacy, environmental well-being, and accountability and auditability.It provides basic concepts and taxonomies and summarizes representative methods for each dimension.Source: §10 · p. 51
• The survey also presents real-world applications, related surveys, and tools for further exploration of trustworthy recommender systems.Source: §10 · p. 51
• It analyzes potential interactions among dimensions and discusses possible future research directions.Source: §10 · p. 51