System and method for inferring attacks on a sequence recommendation system

Abstract

The application discloses a kind of inference system and method for sequence recommendation system member inference attack, including label data generation module, difference feature construction module and attack model training module;Step 1, label data generation is carried out;Step 2, the difference feature construction of member and non-member is carried out;Step 3, the training of attack model is carried out.Compared with prior art, the application can guarantee the data privacy of user in a wider range of scenarios;Fill in the blank of member inference attack in more stringent scenarios;Significantly improve the attack inference effect.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy security, and particularly relates to a robust sequence recommendation system member inference attack system and method. BACKGROUND

[0002] The definition of member inference attack is to determine whether a certain data record is in the training set of the model. The core problem of this technology is to determine whether the data is in the training set given the data record and the permission of black box model query. Member inference attacks occur in various fields of machine learning, such as classification models, generation models, embedding models and regression models. Generally, member inference attacks are roughly divided into two categories:

[0003] (1) White box attack, that is, the attacker can get all the weights of the model and use it to attack the model;

[0004] (2) Black box attack, that is, the attacker is given limited model information, but can only query the model continuously. Compared with white box attack, black box attack is more dangerous because the attacker can destroy member privacy with limited knowledge.

[0005] More specifically, there are two main black box attacks: shadow model-based attack and metric-based attack. The main idea of shadow model-based attack is that the adversary can create one or more shadow models to mimic the behavior of the target model. Shadow model-based attack relies on a binary classifier to identify the complex relationship between members and non-members. At the same time, the metric-based member inference attack makes member inference decisions by calculating the metric of the prediction vector of the data record. The metrics used in member inference attack include prediction accuracy, prediction loss, prediction entropy, etc.

[0006] In addition, the previous two problems of the previous approach are described: (1) Some inventions are based on extremely over-fitted but have no practical use models, and the results on such models should not be generalized to well-trained models; (2) No performance of the attack model on negative samples (non-members) is given, especially how many negative samples are misclassified as positive (false positives). Therefore, the false positive rate or its equivalent indicators (such as AUC) are used to illustrate the performance of member inference attack.

[0007] Regarding membership inference attacks on news recommendation systems: Compared with computer vision and natural language processing, the research on recommendation systems is very limited. More specifically, there have been only two studies related to recommendation systems. ① The first study is the key idea of the membership inference attack on recommendation systems, which is to build a user-item matrix with the dataset for rating and decompose the matrix into a user matrix and an item matrix. For each user, the adversary extracts two sets of items (one containing recommended items and the other containing items that the user has interacted with) and calculates the center vectors of the two sets respectively. The difference between the two center vectors is used as a feature to distinguish members from non-members. This is different from previous membership inference attacks in that: first, the attack is conducted at the user level, while most previous attacks have focused on the sample level. In the context of recommendation systems, it is clear that user-level membership inference attacks can better reflect the user privacy leakage in machine learning and deep models. Second, in the membership inference attack on recommendation systems, the ratings of each item by the recommendation system cannot be accurately obtained, but only the ranking of the candidate set by the recommendation system. In this work, all attack processes are conducted under the assumption that the recommendation system will give personalized recommendations to member records, while non-member data will be recommended based on rules. However, this assumption has certain limitations, as user privacy data may not be used for training the target model, but can be applied to the inference of the target model. ② The second study is a follow-up study of the first study, which retains the idea of extracting the difference between recommended items and interactive items as a feature, but solves the gap between the shadow model and the target model and the bias problem of difference vector estimation. These two studies demonstrate the risk of membership inference attacks in recommendation systems. However, they have an assumption that non-member recommendations are based on popularity, which is not practical, as recommendation systems are always used to serve both members and non-members. If the recommendation system is not used for non-members, either the scope of the system's use is limited and cannot achieve maximum benefit, or the system's training workload is large, as the system's training data must cover all people.

[0008] Regarding sequence-based recommendation systems. Sequence-based recommendation systems mainly recommend the order of items that users may be interested in (e.g., viewing news on an online information platform) by modeling the sequential dependence relationship between user and item interactions. Compared with traditional recommendation systems, which model user and item interactions in a static way and can only capture general user preferences, sequence-based recommendation systems treat user and item interactions as a dynamic sequence and take into account the sequential dependence relationship to capture current and recent user preferences, resulting in more accurate recommendation results.

[0009] In addition, the member inference attack of the recommendation system is to determine whether a given user private sequence member is a member or a non-member. From the perspective of the attacker's knowledge, the attacker assumes that the target model is a black box model, and can only obtain the input and output. Specifically, the attacker cannot obtain the score of the recommendation system for each news, but can only get the ranking of the candidate set by the recommendation system. In addition, the attacker has no user information, but can only obtain the user's browsing history to model the user. This makes the member inference attack of the recommendation system difficult.

[0010] In the existing research, the recommendation system provides differentiated services for members and member users, that is, the recommendation result of the member user is generated by the reasoning of the recommendation algorithm, and the recommendation result of the non-member user is generated according to the popularity, which expands the gap between the member and non-member recommendation results, so that they can be easily distinguished by the attacker. At the same time, this assumption is not practical. In order to increase profits, the recommendation system needs to 1) reduce the training cost, that is, use a small amount of data to achieve high performance; 2) obtain more income, that is, recommend items to users and obtain high click rate. Therefore, the recommendation system is not only used to serve member users, but also used to serve non-member users. Once the above assumption is relaxed, that is, the non-member is also served by the trained recommendation system, instead of only performing popularity-based recommendation, the method based on the extraction of difference features of the central vector in the existing research does not work. Therefore, in the service stage, when the member and non-member users are served by the same strategy, that is, they both enjoy the reasoning of the recommendation system, a method is needed to distinguish them. SUMMARY

[0011] In view of the problems existing in the prior art, the present application provides a sequence recommendation system member inference attack reasoning system and method, which considers that the ranking list of the behavior output of the member is more robust to input disturbance, and realizes a member attack inference method based on the sequence recommendation system.

[0012] The present application realizes the following technical solutions:

[0013] A sequence recommendation system member inference attack reasoning system, which comprises a label data generation module, a difference feature construction module and an attack model training module connected in sequence.

[0014] The label data generation module is used to set labels for a member shadow data set and a non-member shadow data set in a shadow data set obtained by the attacker. The difference feature construction module is used to set labels for a member shadow data set and a non-member shadow data set in a shadow data set obtained by the attacker. The difference feature construction module is used to set labels for a member shadow data set and a non-member shadow data set in a shadow data set obtained by the attacker. The difference feature construction module is used to set labels for a member shadow data set and a non-member shadow data set in a shadow data set obtained by the attacker. The attack model training module is configured to obtain the trained attack model, and finally input into the trained attack model to infer the membership.

[0015] A sequence recommendation system membership inference attack reasoning method, which specifically comprises the following

[0016] Step 1, generating label data: first, the attacker obtains a shadow data set, denoted as D S , and the data set is divided into positive and negative samples for training, wherein the trained samples are positive samples, and the untrained samples are negative samples; the positive samples are taken as the member shadow data set The negative samples are taken as the non-member shadow data set The member shadow data set and the non-member shadow data set are set up, and the member shadow data set is used to train the shadow recommendation system M S ;

[0017] Step 2, extracting features from the member shadow data set and the non-member shadow data set , and calculating the feature difference vector:

[0018] First, a relevant mathematical model is established, as follows:

[0019] The target of the attacker is a sequence-based recommendation system, and a sequence representing the user's historical browsing record is taken as the original input of the current recommendation system. The mathematical model of the recommendation system M is expressed as:

[0020] M(x)=r

[0021] Wherein, x is the sequence of the user's historical browsing record, which is the input of the current recommendation system, and r is the ranking list of the recommendation set of the current recommendation system, which is the original output of the current recommendation system;

[0022] The expression of the i-th perturbed input x i is:

[0023] x i =p i (x)

[0024] Wherein, p i () is the perturbation operator corresponding to the i-th perturbation;

[0025] The attacker inputs the i-th perturbed input x i into the recommendation system M to obtain the i-th perturbed output ranking list r i , which is expressed as:

[0026] r i = M(x i )

[0027] Next, get the difference feature vector between the original output r and the i-th perturbed output r i , the expression is as follows:

[0028] d i = D(r i , r)

[0029] Where D is three kinds of measurement methods about ranking quality, namely, synthetic ranking agreement SRA, Jaro-Winkler similarity JWS and normalized discounted cumulative gain NDCG;

[0030] The expression of the difference feature vector d about the attacker's series of perturbations {p1, …, p N} is as follows:

[0031] d = [d1, …, d N ]

[0032] The behavior sequence x1, …, x L of the current recommendation system input is divided into N+1 equal parts; next, remove these perturbation parts in turn from beginning to end, and the remaining part is taken as the i-th perturbed input x i ,

[0033] According to the three kinds of measurement methods about ranking quality, synthetic ranking agreement SRA, Jaro-Winkler similarity JWS and normalized discounted cumulative gain NDCG, the corresponding difference vectors obtained by the attacker are respectively represented as d SRA , d JWS and d NDCG , and the three difference vectors are concatenated to distinguish members and non-members;

[0034] Step 3, establish an attack model, the expression is as follows:

[0035] h1 = ReLU(BN(w1d + b1))

[0036] h2 = ReLU(BN(w2h1 + b2))

[0037] y = w3h2 + b3

[0038] Wherein, d is the difference feature vector, w1, w2, w3, b1, b2, b3 are parameters to be updated in the training process, ReLUO is the output activation function of the hidden layer, BNO is the batch normalization function, which is used for batch normalization processing of the result after linear transformation, h1 and h2 are the results of the two hidden layers after ReLUO, and y is the two-dimensional vector of the attack output;

[0039] Finally, the trained attack model is obtained, when facing a user sequence x to be inferred, first, the original output is obtained by querying the target model, then the user sequence after perturbation is input to the target model again, feature extraction is performed, the difference feature vector is calculated, and finally the membership inference is performed by inputting the trained attack model.

[0040] Compared with the prior art, the present application can achieve the following beneficial technical effects:

[0041] 1) The present application expands the previous attack scene assumption for the recommendation system, so that the member inference attack for the recommendation system can guarantee the data privacy of the user in a wider scene;

[0042] 2) The present application designs a perturbation process for the input of the recommendation model, then proposes a method for calculating the change of the output of the recommendation system after perturbation, and uses it as a feature, finally uses a binary classifier to divide the members and non-members, filling the gap of member inference attack in a more rigorous scene;

[0043] 3) The present application also performs joint learning of multiple indicators of the sequence, which significantly improves the attack inference effect. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 It is a module diagram of a member inference attack reasoning system for a sequence recommendation system of the present application;

[0045] Figure 2 It is a whole flow chart of a member inference attack reasoning method for a sequence recommendation system of the present application;

[0046] Figure 3 It is a specific embodiment process schematic diagram of the present application;

[0047] Figure 4 It is a statistical chart of the influence of the perturbation length hyperparameter on the attack effect. DETAILED DESCRIPTION

[0048] The technical solutions of the present application will be described in detail below with reference to the accompanying drawings.

[0049] The recommender system involved in this invention also includes a content-based news recommendation algorithm. Membership inference attacks represent a completely new area. While some work has already researched product recommendation systems, news recommendations have strong textual attributes, rendering previous feature extraction methods based on matrix factorization inapplicable. Therefore, it is necessary to find appropriate text feature extraction methods that can be integrated into the membership inference attack framework.

[0050] To broaden the application of member inference attacks across various recommendation scenarios, this invention assumes that non-member data is also used by the target recommendation system. Aside from this distinction, this invention focuses on the same attack model as previous research, aiming to infer whether user behavior records are used to train the target recommendation system, and sets the attacker's access to the target system as a black box.

[0051] To ensure the practical use of member inference attacks, this invention selects a black-box attack for the attacker, using a shadow model to mimic the target model and a binary classification model as the attack model.

[0052] like Figure 1 The diagram shown is a block diagram of a member inference attack inference system for sequence recommendation systems according to the present invention. The system includes a label data generation module 100, a differential feature construction module 200, and an attack model training module 300. The label data generation module 100 is used to generate a member shadow dataset from a shadow dataset obtained by the attacker. Non-member shadow dataset Labels are set, and label data is generated; the differential feature construction module 200 is used to extract data from the member shadow dataset. Non-member shadow dataset Features are extracted, feature difference vectors are calculated, and the feature vectors are used to distinguish between members and non-members; the attack model training module 300 is used to obtain the trained attack model, and finally input it into the trained attack model to infer the membership relationship.

[0053] The robust member inference attack framework for sequence recommendation systems of the present invention is implemented in Python. The main steps include: Step 1, generating label data; Step 2, constructing differential features of members and non-members; Step 3, training the attack model.

[0054] like Figure 2 The diagram shown is an overall flowchart of a member inference attack reasoning method for sequence recommendation systems according to the present invention. The process specifically includes the following steps:

[0055] Step 1: Generate Label Data: First, the attacker obtains a shadow dataset, denoted as D. s, the trained samples are positive samples, and the untrained samples are negative samples; the positive samples are taken as the member shadow data set The negative samples are taken as the non-member shadow data set The member shadow data set And the non-member shadow data set Set the label, use the member data set Train the shadow recommendation system M S ;

[0056] Step 2, extract features from the member shadow data set And the non-member shadow data set Calculate the feature difference:

[0057] The related mathematical model is described as follows:

[0058] The target of the attacker is a sequence-based recommendation system, and a sequence representing the user's historical browsing record is taken as the original input of the current recommendation system. The expression of the mathematical model of the recommendation system M is:

[0059] M(x) = r (1)

[0060] Wherein, x is the sequence of the user's historical browsing record, which is the input of the current recommendation system, and r is the ranking list of the recommendation set of the current recommendation system, which is the original output of the current recommendation system.

[0061] The expression of the i-th perturbed input x i is:

[0062] x i = p i (x) (2)

[0063] Wherein, p i () is the perturbation operator corresponding to the i-th perturbation, i = 1, …, N.

[0064] The attacker inputs the i-th perturbed input x i into the recommendation system M, and obtains the i-th perturbed output ranking list r i , the expression is:

[0065] r i = M(x i ) (3)

[0066] Next, the difference feature vector between the original output r and the i-th perturbed output r i is obtained, and the expression is as follows:

[0067] d i = D(r i, r) (4)

[0068] where D is three kinds of measurement methods about ranking quality, namely, synthetic ranking agreement (SRA), Jaro-Winkler similarity (JWS) and normalized discounted cumulative gain (NDCG),

[0069] The expression of the difference feature vector d about the attacker's series of perturbations {p1,..., p N} is as follows:

[0070] d = [d1,..., d N ] (5)

[0071] Therefore, the present application takes the removal operation (removing certain historical browsing records from the input of the model is a very direct method, and the reduction of information leads to the change of output) as an example of the perturbation unit: first, the behavior sequence x1,..., x L as the input of the current recommendation system is divided into N+1 equal parts; next, these parts are removed in turn from head to tail, that is, the i-th perturbation operator is to remove from the input of the current recommendation system, and the remaining part is taken as the input x i after the i-th perturbation, the expression is as follows:

[0072]

[0073] where L is the length of the behavior sequence of the input of the current recommendation system;

[0074] The present application utilizes three kinds of measurement methods about ranking quality, namely, synthetic ranking agreement (SRA), Jaro-Winkler similarity (JWS) and normalized discounted cumulative gain (NDCG). For each measurement method, the corresponding difference vector obtained by the attacker is respectively denoted as d SRA , d JWS and d NDCG ; the three difference vectors are concatenated, that is,

[0075] d = [d SRA , d JWs , d NDCG ]

[0076] to distinguish between members and non-members. The attacker uses all the diversity vectors because each diversity vector has its own properties on the comparison of ranked lists. Specifically, SRA treats all items equally, that is, the first ranked difference has the same penalty as the last ranked difference; while JWS and NDCG are interested in ranked lists where the high-ranked items are close to each other. In addition, comparing JWS and NDCG, JWS is equal in considering a fixed number of high-ranked items, which is set to four in the experiments; while NDCG is different in treating all places;

[0077] In summary, the attacker's goal is to attack the sequence-based recommendation system, taking a sequence representing the user's historical browsing records as input, perturbing the input sequence, checking the changes of the output candidate set ranked list, extracting features from the changes of a series of perturbations, and taking these features as the basis for dividing member records and non-member records; the inspiration for this method is that the behavior of members is learned by the model, so the output ranked list is more robust to input perturbations, while non-members are not;

[0078] Step 3, establish an attack model: a binary classification model is selected as the attack model, and the expression of the attack model is as follows:

[0079] h1 = ReLU(BN(w1d + b1))

[0080] h2 = ReLU(BN(w2h1 + b2)) (7)

[0081] y = w3h2 + b3

[0082] where d is the diversity feature vector, w1, w2, w3, b1, b2, b3 are parameters to be updated in the training process, ReLUO is the output activation function of the hidden layer, BNO is the batch normalization function, which is used to batch normalize the results after linear transformation, h1 and h2 are the results of the two hidden layers after ReLUO, y is the two-dimensional vector output by the attack model, and the expression is as follows:

[0083]

[0084] Specifically, if a > b, it means that the current record x is a member, otherwise it is a non-member.

[0085] The loss function in the training phase is the cross-entropy function, and the expression is:

[0086]

[0087] where y j is the two-dimensional vector output by the attack model for the jth record, is the true two-dimensional vector for the jth record, specifically when this record is a member is the true two-dimensional vector for the jth record, specifically when this record is a non-member

[0088] Finally, the trained attack model is obtained, when facing a user sequence x to be inferred, first, the original output is obtained by querying the target model, then the user sequence after perturbation is input into the target model again, feature extraction is performed, difference features are calculated, and finally the trained attack model is input into the trained attack model to infer the membership.

[0089] The two data sets MIND and Amazon Review are selected in the application. MIND is a news data set collected from the user behavior log of Microsoft News. The data set contains 1 million users who have at least 5 news click records in 6 weeks from October 12 to November 22, 2019. It contains 161,013 news and 24,155,470 reading records. At the same time, Amazon Review is an open source data set containing product reviews and metadata of Amazon. Now, it is widely used as a benchmark data set in the field of recommendation system. The application selects the movie and television sub-data set in the Amazon review data set for experiment, which contains 1,224,267 users, 212,836 recommended items and 1,697,535 reviews.

[0090] In the application, four recommendation models are selected as the main targets of attack:

[0091] (1) LSTUR: A model uses GRU network to simulate user browsing history sequence. The focus is to solve the case that a user will have both long-term preference and short-term interest.

[0092] (2) GRU4REC: An algorithm based on user browsing sequence, aiming to capture long-term and short-term user preferences using recurrent neural network.

[0093] (3) CASER: A recommendation algorithm based on convolutional neural network, aiming to capture general user preferences and sequence patterns.

[0094] (4) NEXTITNET: A recommendation algorithm based on dilated convolution and residual network, aiming to capture sequence patterns. It considers both user / item interaction and features.

[0095] Up to now, there are few related member inference attacks for recommendation systems. Two studies have conducted member inference attacks on recommendation systems, but their non-member settings are not practical, that is, the recommendations for non-members are based on the popularity of the recommended items. In order to compare the methods under the same conditions, the present application applies their methods to the same practical environment as the perturbation-based attack method, that is, non-members are also served by the recommendation system.

[0096] In this experiment, since the final attack model is a binary classification model, the evaluation indicators commonly used in classification models, AUC value, precision, recall and F1 score, are followed. In order to measure the attack effect of the attack model. In the present application, in order to ensure the actual use of the attack, the generally recognized evaluation indicators are followed, and the false positive rate of the attack or its equivalent indicator AUC is shown in all experiments.

[0097] As shown in Table 1, the performance index comparison results of the present application and the baseline method when 4 recommendation models are taken as the main target of attack. According to Table 1, it is observed that the robust-based member inference attack method proposed in the present application is better than the baseline method. This result shows that in a more practical scenario, the feature vector constructed by perturbation change is more distinguishable than the center vector difference calculated by the user's historical record and the recommendation result by the previous person. In the basic scenario of the non-member user taking the popularity of the item as the logic of recommendation, since the recommendation result of the member is based on the recommendation system, and the non-member is based on the popularity, the difference is easy to distinguish. However, when the difference between the member user and the non-member user is calculated under new and more challenging conditions, the performance AUC value of the baseline attack decreases to only more than 50%, which shows that it has already cannot be an effective attack method.

[0098] Table 1

[0099]

[0100] As Figure 4 shown, Figure 4 is a statistical chart of the influence of the perturbation length hyperparameter on the attack effect. The statistical result shows that when the perturbation size is increased, the attack performance of the model is increased. This is because a larger perturbation size means that the feature size input to the attack model is larger, thereby bringing more information to estimate the member.

[0101] It is found from Table 2 to Table 5 that all types of perturbation are effective in general, which also demonstrates the effectiveness of the attack. Comparing the four perturbation processes, the performance of the out-of-order method is not as good as that of the removal method. This shows that more changes in the input bring better results. Within the scope of the removal method, the effect of the random method is a little worse than those of the removal methods with order. The reason is that the recommendation method used in the experiment takes into account the long-term and short-term interests of the user at the same time. In random deletion, these types of interests will not be missed by the recommendation system. Therefore, the perturbation of random deletion to the recommendation system is not as strong as that of the ordered deletion, so that the amount of characteristic information representing the output change is less.

[0102] Table 2

[0103]

[0104] Table 3

[0105]

[0106] Table 4

[0107]

[0108] Table 5

[0109]

[0110]

[0111] The present application jointly learns three difference vectors as the feature vectors of the member prediction, each of which is calculated by a ranking quality metric, including SRA, NDCG and JWS. Table 6 to Table 9 show that even if one of the indicators is used for measurement, the framework proposed by the present application is still effective. In addition, joint learning can always achieve or approach the best performance.

[0112] Table 6

[0113]

[0114] Table 7

[0115]

[0116] Table 8

[0117]

[0118]

[0119] Table 9

[0120]

Claims

1. A reasoning system for member inference attacks in sequence recommendation systems, characterized in that, The system includes a sequentially connected module for generating labeled data, a module for constructing differential features, and a module for training attack models; The tag data generation module is used to generate member shadow datasets from a shadow dataset obtained by the attacker. Non-member shadow dataset Labels are defined, and label data is generated; the differential feature construction module is used to extract data from the member shadow dataset. Non-member shadow dataset Features are extracted, feature difference vectors are calculated, and the feature vectors are used to distinguish between members and non-members; the attack model training module is used to obtain the trained attack model, and finally input into the trained attack model to perform member relationship reasoning; including: Generate labeled data: First, the attacker obtains a shadow dataset, denoted as D. S The dataset is divided into positive and negative samples for training, with trained samples designated as positive samples and untrained samples as negative samples; the positive samples are then used as the member shadow dataset. Negative samples are used as non-member shadow datasets. For member shadow dataset Non-member shadow dataset Define labels and utilize member shadow datasets. Training Shadow Recommendation System M S ; From the member shadow dataset Non-member shadow dataset Extract features from the dataset and calculate the feature difference vector: First, the relevant mathematical model is established as follows: The attacker's target is a sequence-based recommendation system. A sequence representing a user's browsing history is used as the initial input to the recommendation system. The mathematical model of recommendation system M is expressed as: M(x) = r Where x is the sequence of the user's browsing history, which is the input of the current recommendation system, and r is the sorted list of the recommendation set by the current recommendation system, which is the original output of the current recommendation system; The input x after the i-th perturbation i The expression is: x i =p i (x) Where, p i () represents the perturbation operator corresponding to the i perturbations; The attacker perturbs the input x after the i-th perturbation. i The input is fed into the recommender system M, and the i-th perturbation result is the output ranking list r. i The expression is: r i =M(x i ) Next, we obtain the original output r and the output r after the i-th perturbation. i The difference feature vectors between them are expressed as follows: d i =D(r i ,r) Among them, D is three methods for measuring ranking quality, namely Synthetic Ranking Protocol (SRA), Jaro-Winkler Similarity (JWS), and Normalized Discounted Cumulative Return (NDCG). Regarding the attacker's series of perturbations {p1, ..., p...} N The expression for the differential eigenvector d is as follows: d=[d1,...,d N ] The current recommendation system inputs a sequence of actions x1, ..., x2. L The input is divided into N+1 equal parts; next, these perturbation parts are removed sequentially from beginning to end, and the remaining part is used as the input x after the i-th perturbation. i , Based on three methods for measuring ranking quality—Synthetic Ranking Protocol (SRA), Jaro-Winkler Similarity (JWS), and Normalized Discounted Cumulative Gain (NDCG)—the corresponding difference vectors obtained by the attacker are represented as d. SRA d JWS and d NDCG These three difference vectors are concatenated to distinguish between members and non-members; The attack model is established, and the expression is as follows: h1 = ReLU(BN(w1d+b1)) h2 = ReLU(BN(w2h1+b2)) y = w3h2 + b3 Where d is the differential feature vector, w1, w2, w3, b1, b2, b3 are the parameters to be updated during training, ReLU() is the output activation function of the hidden layer, BN() is the batch normalization function used to batch normalize the result after linear transformation, h1 and h2 are the results of the two hidden layers after ReLU(), and y is the two-dimensional vector of the attack output. Finally, the trained attack model is obtained. When faced with a user sequence x to be inferred, the original output is first obtained by querying the target model. Then, the perturbed user sequence is input back into the target model for feature extraction and calculation of the difference feature vector. Finally, it is input into the trained attack model for member relationship inference.

2. A reasoning method for member inference attacks in sequence recommendation systems, characterized in that, The method specifically includes the following steps: Step 1: Generate Label Data: First, the attacker obtains a shadow dataset, denoted as D. S The dataset is divided into positive and negative samples for training, with trained samples designated as positive samples and untrained samples as negative samples; the positive samples are then used as the member shadow dataset. Negative samples are used as non-member shadow datasets. For member shadow dataset Non-member shadow dataset Define labels and utilize member shadow datasets. Training Shadow Recommendation System M S ; Step 2: From the member shadow dataset Non-member shadow dataset Extract features from the dataset and calculate the feature difference vector: First, the relevant mathematical model is established as follows: The attacker's target is a sequence-based recommendation system. A sequence representing a user's browsing history is used as the initial input to the recommendation system. The mathematical model of recommendation system M is expressed as: M(x) = r Where x is the sequence of the user's browsing history, which is the input of the current recommendation system, and r is the sorted list of the recommendation set by the current recommendation system, which is the original output of the current recommendation system; The input x after the i-th perturbation i The expression is: x i =p i (x) Where, p i () represents the perturbation operator corresponding to the i perturbations; The attacker perturbs the input x after the i-th perturbation. i The input is fed into the recommender system M, and the i-th perturbation result is the output ranking list r. i The expression is: r i =M(x i ) Next, we obtain the original output r and the output r after the i-th perturbation. i The difference feature vectors between them are expressed as follows: d i =D(r i ,r) Among them, D is three methods for measuring ranking quality, namely Synthetic Ranking Protocol (SRA), Jaro-Winkler Similarity (JWS), and Normalized Discounted Cumulative Return (NDCG). Regarding the attacker's series of perturbations {p1, ..., p...} N The expression for the differential eigenvector d is as follows: d=[d1,...,d N ]; The current recommendation system inputs a sequence of actions x1, ..., x2. L The input is divided into N+1 equal parts; next, these perturbation parts are removed sequentially from beginning to end, and the remaining part is used as the input x after the i-th perturbation. i , Based on three methods for measuring ranking quality—Synthetic Ranking Protocol (SRA), Jaro-Winkler Similarity (JWS), and Normalized Discounted Cumulative Gain (NDCG)—the corresponding difference vectors obtained by the attacker are represented as d. SRA d JWS and d NDCG These three difference vectors are concatenated to distinguish between members and non-members; Step 3: Establish the attack model, with the following expression: h1 = ReLU(BN(w1d+b1)) h2 = ReLU(BN(w2h1+b2)) y = w3h2 + b3 Where d is the differential feature vector, w1, w2, w3, b1, b2, b3 are the parameters to be updated during training, ReLU() is the output activation function of the hidden layer, BN() is the batch normalization function used to batch normalize the result after linear transformation, h1 and h2 are the results of the two hidden layers after ReLU(), and y is the two-dimensional vector of the attack output. Finally, the trained attack model is obtained. When faced with a user sequence x to be inferred, the original output is first obtained by querying the target model. Then, the perturbed user sequence is input back into the target model for feature extraction and calculation of the difference feature vector. Finally, it is input into the trained attack model for member relationship inference.

3. The reasoning method for member inference attacks in sequence recommendation systems as described in claim 2, characterized in that, Using three methods to measure ranking quality—Synthetic Ranking Protocol (SRA), Jaro-Winkler Similarity (JWS), and Normalized Discounted Cumulative Gain (NDCG)—the attacker's corresponding difference vector for each method is represented as d. SRA d JWS and d NDCG ; Each difference vector d SRA d JWS and d NDCG Each sorted list has its own properties when comparing it, d SRA The same penalty applies to all differences in all projects; while d JWS and d NDCG They are interested in ranking lists where the top-ranked projects are close to each other.

4. The reasoning method for member inference attacks in sequence recommendation systems as described in claim 2, characterized in that, The current record x is a two-dimensional vector y, which can be either a member or a non-member, and its expression is as follows: Specifically, if a > b, then the current record is a member; otherwise, it is a non-member. The loss function during the training phase is the cross-entropy function, expressed as: Among them, y j Let be the two-dimensional vector output by the attack model for the j-th record. Let j be the true two-dimensional vector of the j-th record, specifically when this record is a member. When not a member

Images