Unlearning Protected User Attributes in Recommendations with Adversarial Training

Abstract

Collaborative filtering algorithms capture underlying consumption patterns, including the ones specific to particular demographics or protected information of users, e. g., gender, race, and location. These encoded biases can influence the decision of a recommendation system (RS) towards further separation of the contents provided to various demographic subgroups, and raise privacy concerns regarding the disclosure of users' protected attributes. In this work, we investigate the possibility and challenges of removing specific protected information of users from the learned interaction representations of a RS algorithm, while maintaining its effectiveness. Specifically, we incorporate adversarial training into the state-of-the-art MultVAE architecture, resulting in a novel model, Adversarial Variational Auto-Encoder with Multinomial Likelihood (Adv-MultVAE), which aims at removing the implicit information of protected attributes while preserving recommendation performance. We conduct experiments on the MovieLens-1M and LFM-2b-DemoBias datasets, and evaluate the effectiveness of the bias mitigation method based on the inability of external attackers in revealing the users' gender information from the model. Comparing with baseline MultVAE, the results show that Adv-MultVAE, with marginal deterioration in performance (w. r. t. NDCG and recall), largely mitigates inherent biases in the model on both datasets. CCS CONCEPTS• Information systems → Collaborative filtering; • Computing methodologies → Neural networks.

WECHSEL: Effective initialization of subword embeddings for cross-lingual transfer of monolingual language models

“…It is well-known that existing LMs trained on English text encode societal biases (Bolukbasi et al, 2016;Caliskan et al, 2017;Rekabsaz et al, 2021b) and stereotypes and using them in downstream tasks might lead to unfair treatment of various social groups (Zerveas et al, 2022;Krieg et al, 2022;Ganhör et al, 2022;Rekabsaz et al, 2021a;Melchiorre et al, 2021;Rekabsaz and Schedl, 2020;Elazar and Goldberg, 2018). Since we propose a method to transfer the English LMs to new languages, it is highly probable that the existing biases are also transferred to the target LMs.…”

Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems

“…Compared with in-training setting (InT-AU), the post-training setting (PoT-AU) is more challenging. Firstly, PoT-AU allows no interference with the training process, which means InT-AU methods, i.e., adding network block [24], and adversarial training [18], are not applicable. Secondly, even though PoT-AU cuts down the connection with the training process, directly manipulating user embedding by adding artificially-designed noise, e.g., differential privacy [1], is inappropriate, because i) it will inevitably degrade recommendation performance, and ii) its unlearning ability is not promising, as the functional mechanism of attacking models, including complex machine learning models, is not well-understood.…”

“…Experiments are conducted on three publicly accessible datasets that contain both input data, i.e., user-item interactions, and user attributes, i.e., gender. Following [18], the provided gender information of the users are limited to females and males.…”

“…Due to the information extraction capabilities of recommender systems, AU is especially valuable in the context of recommendation. Although recommendation models did not see the latent attribute, the research found that basic machine learning models can successfully infer users' attributes from the user embedding learned by collaborative filtering models [18], which is also known as Attribute Inference Attack (AIA) [3,31]. Therefore, from the perspective of privacy preservation, AU is as important as IU in recommender systems.…”

“…Existing but limited research on AU has focused on In-Training AU (InT-AU) [18,24], where unlearning is performed during model training (as shown in the left of Figure 1). In this paper, we focus on a more strict AU setting, namely Post-Training Attribute Unlearning (PoT-AU), where we can only manipulate the model, i.e., updating parameters, after the training is fully completed and have no knowledge about training data or other training information (as shown in the right of Figure 1).…”