Interaction-level Membership Inference Attack Against Federated Recommender Systems

Abstract

The marriage of federated learning and recommender system (Fe-dRec) has been widely used to address the growing data privacy concerns in personalized recommendation services. In FedRecs, users' attribute information and behavior data (i.e., user-item interaction data) are kept locally on their personal devices, therefore, it is considered a fairly secure approach to protect user privacy. As a result, the privacy issue of FedRecs is rarely explored. Unfortunately, several recent studies reveal that FedRecs are vulnerable to user attribute inference attacks, highlighting the privacy concerns of FedRecs. In this paper, we further investigate the privacy problem of user behavior data (i.e., user-item interactions) in FedRecs. Specifically, we perform the first systematic study on interactionlevel membership inference attacks on FedRecs. An interactionlevel membership inference attacker is first designed, and then the classical privacy protection mechanism, Local Differential Privacy (LDP), is adopted to defend against the membership inference attack. Unfortunately, the empirical analysis shows that LDP is not effective against such new attacks unless the recommendation performance is largely compromised. To mitigate the interactionlevel membership attack threats, we design a simple yet effective defense method to significantly reduce the attacker's inference accuracy without losing recommendation performance. Extensive experiments are conducted with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on three real-world recommendation datasets (MovieLens-100K, Steam-200K, and Amazon Cell Phone), and the experimental results show the effectiveness of our solutions. CCS CONCEPTS• Information systems → Recommender systems.

Analyzing Public Sentiment on the Amazon Website: A GSK-Based Double Path Transformer Network Approach for Sentiment Analysis

“…Concerning user behavior data in FedRecs, Yuan et al [29] have investigated the privacy concern. To be more precise, we conduct the initial comprehensive investigation into assaults on FedRecs that aim to infer membership at the interaction level.…”

Membership Inference Attacks Against Sequential Recommender Systems

“…Recently, some studies [15,[44][45][46] have pointed out that recommender systems face serious data privacy risks. For example, attackers can detect whether a user has engaged in the training process of the target model by using auxiliary data and query permission [36,41,44]. Such attacks are called membership inference attacks [9,27,31].…”

A Comprehensive Survey on Privacy-Preserving Techniques in Federated Recommendation Systems

“…This can lead to a potential violation of an individual's right to privacy. • Server-side concerns: An FRS is vulnerable to attacks by malicious actors, who can disrupt the federated system by manipulating user ratings, injecting false information, and taking over the federated system [16,17]. Attackers can also employ various techniques, such as data poisoning, distributed denial-of-service attacks, and brute force attacks, to disrupt the system [18].…”