Gradient attack method and device for federated recommendation system

Abstract

The embodiment of the specification provides a gradient attack method and device for a federal recommendation system, wherein the method comprises: selecting an object to be recommended in an object set in response to an object recommendation request for a federal learning task, and constructing initial simulation data for adjusting a recommendation coefficient of the object to be recommended; processing the initial simulation data through a local recommendation model to obtain a simulation gradient, determining a global gradient corresponding to a global recommendation model, updating the initial simulation data according to the global gradient and the simulation gradient to obtain target simulation data; inputting the target simulation data into the local recommendation model to obtain predicted recommendation data, determining a target recommended object and target recommended information, and information to be recommended of the object to be recommended based on the predicted recommendation data; calculating a first loss value and a second loss value; and adjusting the local recommendation model based on the first loss value and the second loss value to obtain a target local recommendation model for participating in the federal learning task.

Description

Technical Field

[0001] This specification relates to the field of privacy computing technology, and in particular to a gradient attack method for federated recommendation systems. Background Technology

[0002] With the development of the internet and artificial intelligence, machine learning has been applied in many fields, such as risk assessment, speech recognition, and natural language processing. However, the security issues caused by privacy breaches in recent years have made people increasingly concerned about their own privacy and security. Against this backdrop, federated learning has emerged. Federated learning is a distributed learning model in which the client's training data is not uploaded to the server, but is trained locally, and finally the gradients or parameters are uploaded to the server to assist the server in completing the model training.

[0003] In object recommendation scenarios based on federated learning, specific objects need to be recommended to user clients to meet the promotional needs of operators. However, due to the characteristics of federated learning, it is necessary to ensure the recommendation performance of the global federated learning model while increasing the exposure rate of specific objects. Therefore, there is an urgent need for a method that can improve the exposure rate of specific target objects without affecting the overall recommendation performance of the model. Summary of the Invention

[0004] In view of this, embodiments of this specification provide a gradient attack method for federated recommendation systems. One or more embodiments of this specification also relate to a gradient attack apparatus, a computing device, a computer-readable storage medium, and a computer program for federated recommendation systems, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a gradient attack method for a federated recommendation system is provided, comprising:

[0006] In response to an object recommendation request for a federated learning task, select objects to be recommended from the object set and construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended;

[0007] The initial simulation data is processed by a local recommendation model, and the simulation gradient corresponding to the local recommendation model is obtained based on the processing result. The global gradient corresponding to the global recommendation model is determined, and the initial simulation data is updated based on the global gradient and the simulation gradient to obtain the target simulation data.

[0008] The target simulation data is input into the local recommendation model to obtain the predicted recommendation data output by the local recommendation model for the object set. Based on the predicted recommendation data, the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended are determined.

[0009] A first loss value is calculated based on the target recommendation information and the information to be recommended, and a second loss value is calculated based on the target recommendation data in the predicted recommendation data and the target recommendation data in the target simulation data;

[0010] The local recommendation model is tuned based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0011] According to a second aspect of the embodiments of this specification, a gradient attack apparatus for a federated recommendation system is provided, comprising:

[0012] The selection module is configured to select objects to be recommended from a set of objects in response to an object recommendation request for a federated learning task, and to construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended.

[0013] The update module is configured to process the initial simulation data using a local recommendation model, obtain the simulation gradient corresponding to the local recommendation model based on the processing result, determine the global gradient corresponding to the global recommendation model, and update the initial simulation data based on the global gradient and the simulation gradient to obtain the target simulation data.

[0014] The prediction module is configured to input the target simulation data into the local recommendation model, obtain the predicted recommendation data output by the local recommendation model for the object set, and determine the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended, based on the predicted recommendation data.

[0015] The calculation module is configured to calculate a first loss value based on the target recommendation information and the information to be recommended, and to calculate a second loss value based on the target recommendation data in the predicted recommendation data and the target simulation data;

[0016] The training module is configured to tune the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0017] According to a third aspect of the embodiments of this specification, a computing device is provided, comprising:

[0018] Memory and processor;

[0019] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the gradient attack method for the federated recommendation system described above.

[0020] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of the gradient attack method for the federated recommendation system described above.

[0021] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the gradient attack method for the federated recommendation system described above.

[0022] This specification provides a gradient attack method for federated recommendation systems, comprising: selecting objects to be recommended from an object set in response to an object recommendation request for a federated learning task, and constructing initial simulated data for adjusting the recommendation coefficients of the objects to be recommended; processing the initial simulated data using a local recommendation model, obtaining the simulated gradient corresponding to the local recommendation model based on the processing result, determining the global gradient corresponding to the global recommendation model, and updating the initial simulated data based on the global gradient and the simulated gradient to obtain target simulated data; inputting the target simulated data into the local recommendation model to obtain predicted recommendation data output by the local recommendation model for the object set, determining the target recommendation object and its target recommendation information, as well as the object to be recommended's pending recommendation information based on the predicted recommendation data; calculating a first loss value based on the target recommendation information and the object to be recommended information, and calculating a second loss value based on the predicted recommendation data and the target recommendation data in the target simulated data; and tuning the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0023] One embodiment of this specification implements the process of constructing initial simulated data and updating and optimizing it using global gradients and simulated gradients to obtain target simulated data with similar characteristics to real users. Based on the predicted recommendation data, target recommendation objects are determined, and a first loss value is calculated using the target recommendation information of the target object and the information to be recommended of the object to be recommended. This brings the recommendation coefficient of the object to be recommended closer to that of the target object, thereby increasing the exposure rate of the object to be recommended. Furthermore, to ensure the recommendation capability of the local recommendation model, a second loss value is calculated using the predicted recommendation data and the target recommendation data, thus improving the recommendation coefficient and exposure rate of the object to be recommended without affecting the overall recommendation performance of the recommendation model. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of a model framework for a gradient attack method for federated recommendation systems provided in one embodiment of this specification;

[0025] Figure 2 This is a flowchart illustrating a gradient attack method for a federated recommendation system provided in one embodiment of this specification;

[0026] Figure 3 This is a flowchart illustrating the processing procedure of a gradient attack method for a federated recommendation system, provided in one embodiment of this specification.

[0027] Figure 4 This is a schematic diagram of a gradient attack device for a federated recommendation system provided in one embodiment of this specification;

[0028] Figure 5 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0029] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0030] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0031] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0032] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0033] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0034] With the development of the internet and artificial intelligence, machine learning has been applied in many fields, such as risk assessment, speech recognition, and natural language processing. However, the security issues caused by privacy breaches in recent years have made people increasingly concerned about their own privacy and security. Against this backdrop, federated learning has emerged. Federated learning is a distributed learning model where client-side training data is not uploaded to the server but trained locally. The gradients or parameters are then uploaded to the server to assist in training the model. In object recommendation scenarios based on federated learning, to meet the promotional needs of operators, it is necessary to recommend specific objects to user clients. However, due to the characteristics of federated learning, it is crucial to ensure the recommendation performance of the global federated learning model while increasing the exposure rate of the specified objects.

[0035] Based on this, this specification provides a gradient attack method for federated recommendation systems. This specification also relates to a gradient attack apparatus for federated recommendation systems, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0036] See Figure 1 , Figure 1The diagram illustrates a model framework for a gradient attack method against a federated recommender system according to an embodiment of this specification. The model framework includes two stages: a fake user simulation stage and an adaptive attack stage. The fake user simulation stage mainly solves the two-step reversal optimization problem, enabling malicious users to have characteristics similar to real users. The adaptive attack stage uses a multi-agent clustering method to extract the heterogeneous features of the distribution and performs adaptive attacks from both explicit and implicit perspectives.

[0037] See Figure 2 , Figure 2 A flowchart of a gradient attack method for a federated recommendation system according to an embodiment of this specification is shown, which specifically includes the following steps.

[0038] Step 202: In response to the object recommendation request for the federated learning task, select objects to be recommended from the object set and construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended.

[0039] Federated learning can be understood as a model learning task involving multiple participants. Each participant trains its model locally using local data and uploads the model parameters to a central server for aggregation, resulting in an aggregated model that combines the training data from all participants. Federated learning tasks can be recommendation model learning tasks, classification model learning tasks, etc., and the specific task varies depending on the application scenario. An object recommendation request can be understood as a recommendation request from a participant for a specific object. For example, in a product recommendation scenario, a brand wanting to increase the exposure of its products can initiate an object recommendation request for that product. The local client responds to the object recommendation request by selecting the object to be recommended from a set of objects. This set can be understood as the collection of all objects in the federated learning task; in a product recommendation scenario, the set of objects is the collection of all products, and the object to be recommended is the product whose exposure needs to be increased. The recommendation coefficient can be understood as the recommendation parameter of the object to be recommended to the user. The higher the recommendation coefficient, the higher the exposure rate of the object. For example, a higher product recommendation coefficient makes it easier to recommend to the user, increasing the likelihood of the product being exposed to the user.

[0040] In practical applications, federated learning tasks involve multiple participants, each with their own training data. To ensure data privacy, each participant cannot access the training data of other participants. However, to increase the exposure rate of recommended objects, it is necessary to utilize the training data of other clients, such as user attribute data, including browsing and purchase records. To enable clients with object recommendation needs to use the private data of other clients, this method constructs and optimizes simulated data to closely approximate the real data of other clients. This allows local clients to use simulated data as real data, solving the problem of not being able to use the real data of other clients. The initial simulated data is the constructed data used to adjust the recommendation coefficient of the objects to be recommended. This enables the local recommendation model to be updated based on the constructed simulated data in a federated learning scenario. Subsequently, the local recommendation model is used to perform gradient attacks on the global recommendation model, thereby improving the recommendation performance of the global recommendation model and increasing the exposure rate of the recommended objects.

[0041] In a specific embodiment of this specification, in response to a product recommendation request for a federated learning task, products for which the user needs to increase exposure are selected from the product set, and initial simulated data for adjusting the exposure of the products for recommendation is constructed.

[0042] Furthermore, before selecting an object to be recommended from the object set in response to an object recommendation request for a federated learning task, the method further includes: receiving distribution data sent by a server; updating the local initial recommendation model according to the distribution data to obtain the local recommendation model.

[0043] In this context, the distributed data sent by the server can be understood as the data sent from the central server of the federated learning system to the clients of each participating party. This distributed data includes model parameters and object representations; in the product recommendation scenario, the distributed data refers to the model parameters of the global recommendation model and the product object representations. In each training round of federated learning, the central server distributes global data to the clients of each participating party, enabling each local client to train its local recommendation model based on this global data.

[0044] In practical applications, before each round of local model training, the client receives distribution data sent by the server and updates the initial local recommendation model based on the distribution data, thus obtaining the local recommendation model.

[0045] In one specific embodiment of this specification, the receiving server sends distribution data, which includes model parameters of the global recommendation model and item representations. The model is updated using the distribution data to obtain a local recommendation model. During the virtual user simulation phase, the central server in the federated recommendation system sends the model parameters of the global model and item representations to the clients of each participating party. Malicious user clients can infer the personalized model of real users from the common gradients of the model parameters, thereby reconstructing malicious simulated users using more realistic features.

[0046] Furthermore, constructing initial simulated data for adjusting the recommendation coefficient of the object to be recommended includes: generating initial simulated user representations through a user representation distribution sampler, and generating initial simulated label representations through a label representation distribution sampler; based on the initial simulated user representations and the initial simulated label representations, generating initial simulated data for adjusting the recommendation coefficient of the object to be recommended.

[0047] The user representation distribution sampler can be understood as a sampler used to randomly initialize the hidden layer representation of simulated users, and the label representation distribution sampler can be understood as a sampler used to randomly initialize the simulated labels of simulated users. The user representation distribution sampler generates the initial simulated user representation, and the label representation distribution sampler generates the initial simulated label representation. These initial simulated user representations and initial simulated label representations are used as the initial simulated data for adjusting the objects to be recommended.

[0048] In practical applications, the initial simulation data differs from the real data because it is generated randomly. In order to make the simulation data closer to the real data, it is necessary to optimize the simulation data in the future.

[0049] In a specific embodiment of this specification, an initial simulated user representation is generated by a user representation distribution sampler, and an initial simulated label representation is generated by a label representation distribution sampler. The initial simulated user representation and the initial simulated label representation are used as initial simulated data.

[0050] Step 204: Process the initial simulation data using the local recommendation model, obtain the simulation gradient corresponding to the local recommendation model based on the processing result, determine the global gradient corresponding to the global recommendation model, and update the initial simulation data based on the global gradient and the simulation gradient to obtain the target simulation data.

[0051] To make the simulated data approximate real data, it needs to be updated and optimized. Specifically, the initial simulated data can be input into a local recommendation model for training, obtaining simulated gradients during the training process. Simulated gradients can be understood as the parameter gradients and object representation gradients of the local recommendation model. Then, the global gradient is obtained from the model parameters distributed from the server. The initial simulated data is updated using the global gradient and the simulated gradients to obtain the target simulated data.

[0052] In practical applications, by inputting randomly initialized simulated user data into the local recommendation model, the corresponding simulated gradient of the local recommendation model can be obtained. Then, by increasing the similarity between the simulated gradient and the global gradient, the simulated gradient can be made to approximate the real global gradient, thereby optimizing the generation of more realistic simulated user data.

[0053] In a specific embodiment of this specification, the initial simulation data is processed by a local recommendation model, that is, the initial simulation data is input into the local recommendation model of the local client to obtain the network parameter gradient and item representation gradient of the local recommendation model. Then, the initial simulation data is updated according to the global gradient and the simulation gradient to obtain more realistic target simulated user data.

[0054] Furthermore, the initial simulated data is processed by a local recommendation model, and the simulated gradient corresponding to the local recommendation model is obtained based on the processing result. This includes: processing the initial simulated user representation and the initial simulated label representation by the local recommendation model; obtaining the model parameter gradient and the object representation gradient based on the processing result; and using the model parameter gradient and the object representation gradient as the simulated gradient corresponding to the local recommendation model.

[0055] In this context, the model parameter gradient can be understood as the gradient of the network parameters of the local recommendation model, while the object representation gradient can be understood as the representation gradient of all objects in the current recommendation process. For example, in a product recommendation scenario, the object representation gradient can be understood as the item representation gradient corresponding to the recommended product. Throughout the federated framework, the server and client exchange the network parameter gradient and item representation gradient of the recommendation model, and ultimately, these gradients are used to launch model attacks.

[0056] In practical applications, initial simulated user representations can be input into a local recommendation model, and model parameters can be adjusted based on the output results and the initial simulated label representations. During the adjustment process, the gradients of the model parameters and the item representations are obtained. The item representation gradient is a type of model parameter that optimizes with the model's training loss.

[0057] In practice, the local recommendation model is adjusted by inputting the initial simulated user representation U' from the initial simulated data into the local recommendation model, and calculating the loss value using the initial simulated label representation Y' and the model prediction results. During the adjustment process, the corresponding model parameter gradients are obtained. and item characterization gradient Specifically, model parameter gradients and item characterization gradient It can be calculated using formula (1), which is shown below:

[0058]

[0059] in, This represents a local recommendation model.

[0060] In a specific embodiment of this specification, the initial simulated user representation from the initial simulated user data is input into the local recommendation model to obtain a list of predicted scores output by the local recommendation model for each item in the item set. The predicted label of the local recommendation model is determined based on the list of predicted scores. The model parameters are adjusted using the initial simulated label representation and the model predicted label. During the adjustment process, the gradient of the model parameters and the gradient of the item representation are obtained.

[0061] Based on this, the initial simulated user representation and the initial simulated label representation are processed by the local recommendation model to obtain the corresponding simulated gradients. Subsequently, the similarity between the simulated gradients and the global gradients can be increased to generate more realistic user data.

[0062] Furthermore, in order to make the simulated gradient closer to the real global gradient, the simulated gradient can be adjusted using the global gradient. Specifically, after obtaining the model parameter gradient and item representation gradient based on the processing results, the method further includes: calculating the gradient difference between the global gradient and the simulated gradient; adjusting the simulated gradient based on the gradient difference to obtain the adjusted simulated gradient; and using the adjusted simulated gradient as the simulated gradient corresponding to the local recommendation model.

[0063] The gradient difference can be understood as a simulated gradient. and With global gradient and The difference between the two simulated gradients is used to adjust the simulated gradient. In practice, after obtaining the simulated gradient, to generate more realistic user simulation data, the simulated gradient can be made to approximate the real global gradient. This is achieved by minimizing the two simulated gradients in Equation 2. and With global gradient and The difference makes the simulated gradient closer to the real global gradient, enabling the generation of more realistic simulated user data. Formula 2 is shown below:

[0064]

[0065] In a specific embodiment of this specification, the gradient difference between the simulated gradient and the global gradient is calculated by a formula, and then the simulated gradient is adjusted using the gradient difference. Specifically, the adjustment can be to increase the similarity between the simulated gradient and the global gradient based on the gradient difference. The simulated gradient obtained after adjustment can generate more realistic simulated user data in the future, and the adjusted simulated gradient is used as the simulated gradient corresponding to this local recommendation model.

[0066] Based on this, by adjusting the simulated gradient, the adjusted simulated gradient is made closer to the real global gradient, ensuring that more realistic simulated user data can be generated subsequently.

[0067] Further, updating the initial simulated data based on the global gradient and the simulated gradient to obtain target simulated data includes: updating the initial simulated user representation based on the global gradient and the simulated gradient to obtain a target simulated user representation; inputting the target simulated user representation into the local recommendation model to obtain the output result of the local recommendation model to determine a predicted simulated label representation; training the local recommendation model using the predicted simulated label representation and the initial simulated label representation; obtaining the target simulated label representation based on the training result; and using the target simulated user representation and the target simulated label representation as target simulated data.

[0068] The target simulated user representation can be understood as a near-realistic user representation obtained after optimizing and updating the initial simulated user representation. The predicted simulated label representation can be understood as the predicted label representation corresponding to the target simulated user's preferences, and the initial simulated label representation can be understood as the real label representation corresponding to the target simulated user's preferences. After training the model based on the predicted simulated labels and the initial simulated label representation, the model parameters are adjusted to reduce the gap between the predicted simulated labels and the initial simulated label representation, thereby obtaining a more realistic target simulated label representation.

[0069] In practical applications, since the distribution of real users' preferences is complex and uncertain, alternating optimization can be used to update the initial simulation data. Alternating optimization includes gradient reversal optimization and label reversal optimization, thereby achieving effective simulation. The target simulated user representation can be understood as the optimized and updated simulated user representation, and the target simulated label representation can be understood as the optimized and updated simulated label representation. In specific implementation, gradient reversal optimization can be seen as fixing the initial simulated label representation in the simulated gradient and then updating the initial simulated user representation; label reversal optimization can be seen as fixing the target simulated user representation obtained by the gradient reversal optimization and inputting it into the local recommendation model, and then updating the initial simulated label representation. In gradient reversal optimization, as a malicious user client, the interaction label, i.e. the initial simulated label representation, is first fixed, and the model parameters of the local recommendation model are updated using the model parameters of the global model received from the intermediate server. The update formula is shown in formula (3):

[0070]

[0071] in, and These are the model parameters for the updated local recommendation model.

[0072] Furthermore, in order to obtain a more realistic user representation, the initial simulated user representation can be updated using global gradients and simulated gradients. Specifically, updating the initial simulated user representation based on the global gradients and simulated gradients to obtain the target simulated user representation includes: calculating gradient similarity based on the global gradients and simulated gradients; and updating the initial simulated user representation using the gradient similarity to obtain the target simulated user representation.

[0073] Gradient similarity can be understood as the cosine similarity between the global gradient and the simulated gradient. Cosine similarity is used to measure the similarity between the simulated gradient and the global gradient. In practice, difference loss can be used to measure the similarity between the simulated gradient and the common gradient. The purpose is to match the simulated gradient and the common gradient. The formula for calculating cosine similarity is shown in formula (4):

[0074]

[0075] Furthermore, during the label inversion optimization process, by fixing the user embedding, the target simulated user representation U' obtained in the gradient inversion optimization will be... t Input the data into the local recommendation model to obtain the predicted true labels. That is, predict the simulated label representation, and use the predicted simulated label representation and the initial simulated label representation to calculate the difference loss. The calculation formula is shown in formula (5):

[0076]

[0077] Based on this, by iteratively optimizing gradient reversal and label reversal, near-realistic simulated user labels and simulated label representations can be obtained, which can then be used as input for the subsequent adaptive attack phase.

[0078] Step 206: Input the target simulation data into the local recommendation model to obtain the predicted recommendation data output by the local recommendation model for the object set. Based on the predicted recommendation data, determine the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended.

[0079] The process involves inputting target simulation data into the local recommendation model to obtain predicted recommendation data for the set of objects. This predicted data includes recommended objects and their ratings. Based on this predicted data, target recommended objects can be determined; these can be understood as objects that users prefer. The target recommendation information is the recommendation rating corresponding to the target recommended object. The recommendation information for the objects to be recommended can be understood as their recommendation ratings.

[0080] In practical applications, after determining the object set, multi-surrogate point clustering can be used to determine the object categories within the set. This includes randomly selecting classification surrogate points, constructing an optimization objective function, optimizing the switching matrix, and determining class labels. Subsequently, the determined classes can be aligned with the classes of the objects to be recommended, facilitating the alignment of objects belonging to the same category with the target recommended objects.

[0081] In practical implementation, the multi-agent clustering module uses a multi-agent clustering algorithm to capture the intrinsic relationship between the objects to be recommended and popular recommended objects. Popular recommended objects can be understood as objects that are more favored by users. First, a sample is randomly selected. As an agent, regarding the project we will Assigned to The probability of acting as a neighbor agent is We transform this allocation problem into an optimization objective, the objective function of which is shown in formula (6):

[0082]

[0083]

[0084] In practice, after inputting the target simulation data into the local recommendation model, the local recommendation model can predict the object recommendation scores of the target simulated user representation in the target simulation data, thereby outputting the predicted recommendation data corresponding to the object set. The predicted recommendation data includes each object and its recommendation score. Therefore, the target recommended objects that simulated users prefer can be determined through the predicted recommendation data. Subsequently, the recommendation coefficient of the object to be recommended can be adjusted based on the relationship between the target recommended object and the object to be recommended, so that the object to be recommended also becomes liked by the simulated user. Specifically, the model parameters of the local recommendation model are adjusted so that the model's predicted score for the object to be recommended is close to the predicted score for the target recommended object. Subsequently, the local recommendation model can be used to perform gradient attacks on the global recommendation model of the federated learning task, that is, the gradient of the local recommendation model is uploaded to the server, thereby affecting all task participants.

[0085] Furthermore, determining the target recommendation object and its target recommendation information, as well as the proposed recommendation information of the object to be recommended, based on the predicted recommendation data includes: determining the initial recommendation information corresponding to each initial object in the object set based on the predicted recommendation data; and determining the target recommendation object and its target recommendation information, as well as the proposed recommendation information of the object to be recommended, in the object set according to the initial recommendation information corresponding to each initial object.

[0086] In this context, the initial object can be understood as all objects in the object set, and the initial recommendation information can be understood as the recommendation coefficient of the initial object for the simulated user. For example, in a product recommendation scenario, the initial object can be understood as any product in the product set, and the initial recommendation information can be understood as the recommendation score of that product for the simulated user. Based on the recommendation score of each product, the target recommendation object with the higher recommendation score can be selected from the product set. In practical applications, the initial objects in the object set are divided into multiple different classes using the multi-agent point clustering method described above. Each class can determine a target recommendation object. However, to ensure that the object to be recommended can be better recommended to the user, popular objects belonging to the same category as the object to be recommended can be selected as target recommendation objects.

[0087] In a specific embodiment of this specification, the recommended score corresponding to each product in the product set is determined, and then the target recommended product is determined in the product set based on the recommended score corresponding to each product. Since the product to be recommended is a mobile phone, the product with the highest recommended score is also selected from the mobile phone category as the target recommended product.

[0088] Step 208: Calculate the first loss value based on the target recommendation information and the information to be recommended, and calculate the second loss value based on the target recommendation data in the predicted recommendation data and the target simulation data.

[0089] After identifying the target and untarget objects for recommendation, adaptive attacks can be employed from two perspectives to enhance the exposure of the target objects: display attacks and privacy attacks. Therefore, this method adjusts the local recommendation model using both attack methods to improve the exposure of the target objects while ensuring that the local recommendation model provides a high recommendation rating for them.

[0090] In practice, during a display attack, recommendation score alignment is used to boost the display of the recommended items. The predicted score of the target item on the simulated user is calculated, and the largest K value is selected from each cluster. p The item serves as the popular proxy for this cluster, thus selecting the target recommendation object, as shown in formula (7):

[0091]

[0092] The score loss value is calculated by comparing the recommendation score in the target recommendation information of the target recommended object with the recommendation score in the recommendation information of the object to be recommended. The calculation formula is shown in formula (8):

[0093]

[0094] The goal is to make the predicted score of the target item approximate that of the popular items in each popular agent.

[0095] In implicit attacks, the latent representation distributions of the target recommendation object and the object to be recommended are aligned to make them highly similar in the latent feature space. The difference between the distributions is measured using MMD, and the distribution loss value is calculated. The calculation formula is shown in formula (9):

[0096]

[0097] After calculating the rating loss value and the distribution loss value, the first loss value is calculated by weighting. Therefore, the rating loss value under the rating dimension and the distribution loss value under the spatial distribution dimension are calculated based on the target recommendation information and the target recommendation object. The first loss value is calculated based on the rating loss value and the distribution loss value. The formula for calculating the first loss value is shown in formula (10):

[0098]

[0099] In practice, in addition to adjusting the model parameters and item representations by calculating the first loss value to improve the exposure rate of the recommended object, it is also necessary to ensure the recommendation performance of the local recommendation model itself. Therefore, it is also necessary to calculate the recommendation loss value based on the predicted recommendation data and the target recommendation data in the target simulation data. The predicted recommendation data is the model prediction value, and the target recommendation data in the target simulation data is the true value. The recommendation loss value, i.e., the second loss value, can be calculated by the cross-entropy loss function.

[0100] In a specific embodiment of this specification, the rating loss value and distribution loss value are calculated respectively using explicit attack and implicit attack methods based on the target recommendation information and the information to be recommended. Then, the first loss value is calculated using the rating loss value and the distribution loss value. The recommendation loss value is calculated using the predicted recommendation data and the target recommendation data to obtain the second loss value. Subsequently, the first loss value and the second loss value can be used to tune the parameters of the local recommendation model, thereby improving the exposure rate of the local recommendation model for the object to be recommended while ensuring the original recommendation capability of the local recommendation model.

[0101] Step 210: Adjust the parameters of the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0102] After calculating the first loss value and the second loss value, the parameters of the local recommendation model can be adjusted to improve the exposure rate based on the first loss value, and the parameters of the local recommendation model can be adjusted to improve the recommendation performance based on the second loss value. After iterative training, a target local recommendation model that meets the model training stopping condition is obtained.

[0103] In practical applications, the model training stopping condition can be reaching a preset number of iterations or the model parameters reaching a preset threshold; this specification does not specify a particular condition. After obtaining the trained target local recommendation model, the model parameters and corresponding item representations of the target local recommendation model can be uploaded to the intermediate server. This affects the local model training of other clients in the federated learning task, thereby influencing the global training of the model in the federated learning task by generating toxic gradients in the local model. This achieves the goal of increasing the exposure rate of special effect target objects without affecting the overall recommendation performance of the model.

[0104] This specification provides a gradient attack method for federated recommendation systems, comprising: selecting objects to be recommended from an object set in response to an object recommendation request for a federated learning task, and constructing initial simulated data for adjusting the recommendation coefficients of the objects to be recommended; processing the initial simulated data using a local recommendation model, obtaining the simulated gradient corresponding to the local recommendation model based on the processing result, determining the global gradient corresponding to the global recommendation model, and updating the initial simulated data based on the global gradient and the simulated gradient to obtain target simulated data; inputting the target simulated data into the local recommendation model to obtain predicted recommendation data output by the local recommendation model for the object set, determining the target recommendation object and its target recommendation information, as well as the object to be recommended's pending recommendation information based on the predicted recommendation data; calculating a first loss value based on the target recommendation information and the object to be recommended information, and calculating a second loss value based on the predicted recommendation data and the target recommendation data in the target simulated data; and tuning the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0105] One embodiment of this specification implements the process of constructing initial simulated data and updating and optimizing it using global gradients and simulated gradients to obtain target simulated data with similar characteristics to real users. Based on the predicted recommendation data, target recommendation objects are determined, and a first loss value is calculated using the target recommendation information of the target object and the information to be recommended of the object to be recommended. This brings the recommendation coefficient of the object to be recommended closer to that of the target object, thereby increasing the exposure rate of the object to be recommended. Furthermore, to ensure the recommendation capability of the local recommendation model, a second loss value is calculated using the predicted recommendation data and the target recommendation data, thus improving the recommendation coefficient and exposure rate of the object to be recommended without affecting the overall recommendation performance of the recommendation model.

[0106] The following is in conjunction with the appendix Figure 3 Taking the gradient attack method for federated recommendation systems provided in this specification in the application of product recommendation as an example, this paper further explains the gradient attack method for federated recommendation systems. Figure 3 The present specification illustrates a flowchart of a gradient attack method for a federated recommendation system according to an embodiment of this specification, which specifically includes the following steps.

[0107] Step 302: In response to the product recommendation request for the federated learning task, select products to be recommended from the product set and construct initial simulation data for adjusting the recommendation coefficients of the products to be recommended.

[0108] In one feasible approach, a user has a need to increase the recommendation rate of product A, and therefore sends a product recommendation request to a local client. This local client is the one the user uses to participate in the federated learning task and trains the local recommendation model. After receiving the user's product recommendation request, the local client selects product A from the product set, generates an initial simulated user representation using a user distribution sampler, and generates an initial simulated label representation using a label representation distribution sampler. These initial simulated user representations and initial simulated label representations are then used as initial simulated data.

[0109] Step 304: Process the initial simulation data using the local recommendation model, obtain the simulation gradient corresponding to the local recommendation model based on the processing results, determine the global gradient corresponding to the global recommendation model, and update the initial simulation data based on the global gradient and the simulation gradient to obtain the target simulation data.

[0110] In one feasible approach, the local client processes the initial simulated user representation and initial simulated label representation using a local recommendation model. This involves inputting the initial simulated user representation and initial simulated label representation into the local recommendation model for training. During training, the model parameters are continuously adjusted to obtain the gradients of the model parameters and object representations corresponding to the trained local recommendation model. These gradients are then used as simulated gradients. Next, the global model parameters of the global recommendation model are received from the central server. These global model parameters are used to update the local model parameters of the local recommendation model. Based on the updated local model parameters, the global gradient is determined. The initial simulated user representation is then updated using the global gradient and the simulated gradient to obtain the updated target simulated user representation. In other words, near-realistic user representations are generated through gradient optimization. The target simulated user representation is input into the local recommendation model to obtain the predicted simulated label representation output by the local recommendation model. The local recommendation model is trained using the predicted simulated label representation and the initial simulated label representation. During the training process, the target simulated label representation is obtained, that is, the target simulated label representation corresponding to the target simulated user representation is generated through label optimization. In this way, near-real user data can be constructed, which solves the pain point of not being able to obtain real data from other participants in federated learning tasks. The constructed simulated user data is used to simulate real data, and the simulated user data is used for subsequent model attacks.

[0111] Step 306: Input the target simulation data into the local recommendation model to obtain the predicted recommendation data output by the local recommendation model for the product set. Based on the predicted recommendation data, determine the target recommended product and the target recommendation information of the target recommended product, as well as the recommendation information of the product to be recommended.

[0112] In one feasible approach, the constructed target simulated user representation is input into a local recommendation model to obtain the predicted recommendation data output by the local recommendation model for the set of products. The predicted recommendation data includes the recommendation score of each product for the target simulated user. Based on the predicted recommendation data, popular products, i.e. target recommended products, and their corresponding recommendation scores, i.e. target recommendation information, are determined, as well as the recommendation score of product A.

[0113] Step 308: Calculate the first loss value based on the target recommendation information and the information to be recommended, and calculate the second loss value based on the target recommendation data in the predicted recommendation data and the target simulation data.

[0114] In one feasible approach, based on the target recommended product and product A and its corresponding recommendation score, the rating loss value in the rating dimension and the distribution loss value in the spatial distribution dimension are calculated respectively. A first loss value is then calculated based on the rating loss value and the distribution loss value. Finally, the cross-entropy loss value between the two products, i.e., the second loss value, is calculated.

[0115] Step 310: Tune the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0116] In one feasible approach, the parameters of the local recommendation model can be adjusted using a first loss value and a second loss value. When the model training stopping condition is met, the target local recommendation model is obtained. Then, the model gradient of the target local recommendation model, namely the gradient of the model network parameters and the gradient of the item representation, is uploaded to the central server. This enables the client to upload the toxic gradient of the target local recommendation model to the central server, thereby affecting the local model training of other participants' clients in the federated learning task.

[0117] One embodiment of this specification implements the process of constructing initial simulated data and updating and optimizing it using global and simulated gradients to obtain target simulated data with similar characteristics to real users. Based on the predicted recommendation data, target recommended products are determined, and a first loss value is calculated using the target recommendation information of the target recommended product and the information of the product to be recommended. This brings the recommendation coefficient of the product to be recommended closer to that of the target recommended product, thereby increasing the exposure rate of the product to be recommended. Furthermore, to ensure the recommendation capability of the local recommendation model, a second loss value is calculated using the predicted and target recommendation data, thus improving the recommendation coefficient and exposure rate of the product to be recommended without affecting the overall recommendation performance of the recommendation model.

[0118] Corresponding to the above method embodiments, this specification also provides embodiments of gradient attack devices for federated recommendation systems. Figure 4 A schematic diagram of a gradient attack apparatus for a federated recommendation system, according to one embodiment of this specification, is shown. Figure 4 As shown, the device includes:

[0119] Selection module 402 is configured to select objects to be recommended from a set of objects in response to an object recommendation request for a federated learning task, and to construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended;

[0120] The update module 404 is configured to process the initial simulation data through a local recommendation model, obtain the simulation gradient corresponding to the local recommendation model based on the processing result, determine the global gradient corresponding to the global recommendation model, and update the initial simulation data based on the global gradient and the simulation gradient to obtain the target simulation data.

[0121] The prediction module 406 is configured to input the target simulation data into the local recommendation model, obtain the predicted recommendation data output by the local recommendation model for the object set, and determine the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended, based on the predicted recommendation data.

[0122] The calculation module 408 is configured to calculate a first loss value based on the target recommendation information and the information to be recommended, and to calculate a second loss value based on the target recommendation data in the predicted recommendation data and the target simulation data;

[0123] Training module 410 is configured to tune the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

[0124] Optionally, the device further includes a distribution module configured to receive distribution data sent by a server; and update the local initial recommendation model according to the distribution data to obtain the local recommendation model.

[0125] Optionally, the selection module 402 is further configured to generate an initial simulated user representation through a user representation distribution sampler, and generate an initial simulated label representation through a label representation distribution sampler; based on the initial simulated user representation and the initial simulated label representation, generate initial simulated data for adjusting the recommendation coefficient of the object to be recommended.

[0126] Optionally, the update module 404 is further configured to process the initial simulated user representation and the initial simulated label representation through a local recommendation model; obtain the model parameter gradient and the object representation gradient based on the processing result, and use the model parameter gradient and the object representation gradient as the simulated gradient corresponding to the local recommendation model.

[0127] Optionally, the device further includes an adjustment module configured to calculate the gradient difference between the global gradient and the simulated gradient; adjust the simulated gradient according to the gradient difference to obtain an adjusted simulated gradient; and use the adjusted simulated gradient as the simulated gradient corresponding to the local recommendation model.

[0128] Optionally, the update module 404 is further configured to obtain the global model parameters corresponding to the global recommendation model, and update the local model parameters of the local recommendation model using the global model parameters; and determine the global gradient of the global recommendation model based on the updated local model parameters.

[0129] Optionally, the update module 404 is further configured to update the initial simulated user representation according to the global gradient and the simulated gradient to obtain a target simulated user representation; input the target simulated user representation into the local recommendation model to obtain a predicted simulated label representation output by the local recommendation model; train the local recommendation model using the predicted simulated label representation and the initial simulated label representation; obtain the target simulated label representation based on the training result; and use the target simulated user representation and the target simulated label representation as target simulated data.

[0130] Optionally, the update module 404 is further configured to calculate gradient similarity based on the global gradient and the simulated gradient; and update the initial simulated user representation using the gradient similarity to obtain the target simulated user representation.

[0131] Optionally, the prediction module 406 is further configured to determine the initial recommendation information corresponding to each initial object in the object set based on the predicted recommendation data; and to determine the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended, in the object set according to the initial recommendation information corresponding to each initial object.

[0132] This specification provides a gradient attack apparatus for federated recommendation systems, comprising: a selection module configured to select objects to be recommended from an object set in response to an object recommendation request for a federated learning task, and construct initial simulated data for adjusting the recommendation coefficients of the objects to be recommended; an update module configured to process the initial simulated data using a local recommendation model, obtain the simulated gradient corresponding to the local recommendation model based on the processing result, determine the global gradient corresponding to the global recommendation model, and update the initial simulated data based on the global gradient and the simulated gradient to obtain target simulated data; and a prediction module configured to input the target simulated data into the local recommendation model to obtain... The local recommendation model outputs predicted recommendation data for the object set, determines the target recommendation object and its target recommendation information, as well as the pending recommendation information of the object to be recommended, based on the predicted recommendation data. A calculation module is configured to calculate a first loss value based on the target recommendation information and the pending recommendation information, and to calculate a second loss value based on the predicted recommendation data and the target recommendation data in the target simulation data. A training module is configured to tune the local recommendation model based on the first and second loss values ​​until a target local recommendation model that meets the model training stopping condition is obtained. The target local recommendation model is used to participate in the federated learning task. This achieves the goal of constructing initial simulation data and updating and optimizing it using global and simulated gradients to obtain target simulation data with similar characteristics to real users. The target recommendation object is determined based on the predicted recommendation data, and the first loss value is calculated using the target recommendation information of the target recommendation object and the pending recommendation information of the object to be recommended, thereby bringing the recommendation coefficient of the object to be recommended closer to that of the target recommendation object and increasing the exposure rate of the object to be recommended. Furthermore, to ensure the recommendation capability of the local recommendation model, a second loss value is calculated using predicted recommendation data and target recommendation data, thereby improving the recommendation coefficient and exposure rate of the recommended object without affecting the overall recommendation performance of the recommendation model.

[0133] The above is an illustrative scheme of a gradient attack device for a federated recommendation system according to this embodiment. It should be noted that the technical solution of this gradient attack device for a federated recommendation system belongs to the same concept as the technical solution of the gradient attack method for a federated recommendation system described above. Details not described in detail in the technical solution of the gradient attack device for a federated recommendation system can be found in the description of the technical solution of the gradient attack method for a federated recommendation system described above.

[0134] Figure 5A structural block diagram of a computing device 500 according to one embodiment of this specification is shown. The components of the computing device 500 include, but are not limited to, a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and a database 550 is used to store data.

[0135] The computing device 500 also includes an access device 540, which enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 540 may include one or more of any type of wired or wireless network interface (e.g., a network interface controller (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, or a Near Field Communication (NFC) interface.

[0136] In one embodiment of this specification, the above-described components of the computing device 500 and Figure 5 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 5 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0137] Computing device 500 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). Computing device 500 can also be a mobile or stationary server.

[0138] The processor 520 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the gradient attack method against the federated recommendation system described above.

[0139] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device belongs to the same concept as the technical solution of the gradient attack method for federated recommendation systems described above. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the gradient attack method for federated recommendation systems described above.

[0140] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the gradient attack method for the federated recommendation system described above.

[0141] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the gradient attack method for federated recommendation systems described above. Details not described in detail in the technical solution of the storage medium can be found in the description of the technical solution of the gradient attack method for federated recommendation systems described above.

[0142] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the gradient attack method for the federated recommendation system described above.

[0143] The above is an illustrative example of a computer program according to this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the gradient attack method for federated recommendation systems described above. Details not described in detail in the technical solution of the computer program can be found in the description of the technical solution of the gradient attack method for federated recommendation systems described above.

[0144] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0145] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0146] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0147] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0148] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A gradient attack method for federated recommendation systems, characterized in that, include: In response to an object recommendation request for a federated learning task, select objects to be recommended from the object set and construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended; The initial simulation data is processed by a local recommendation model, and the simulation gradient corresponding to the local recommendation model is obtained based on the processing result. The global gradient corresponding to the global recommendation model is determined, and the initial simulation data is updated based on the global gradient and the simulation gradient to obtain the target simulation data. The target simulation data is input into the local recommendation model to obtain the predicted recommendation data output by the local recommendation model for the object set. Based on the predicted recommendation data, the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended are determined. A first loss value is calculated based on the target recommendation information and the information to be recommended, and a second loss value is calculated based on the target recommendation data in the predicted recommendation data and the target recommendation data in the target simulation data; The local recommendation model is tuned based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

2. The method according to claim 1, characterized in that, Before selecting objects to be recommended from the object set in response to an object recommendation request for a federated learning task, the method further includes: Receive distribution data sent by the server; The local initial recommendation model is updated based on the distribution data to obtain the local recommendation model.

3. The method according to claim 1, characterized in that, Constructing initial simulation data for adjusting the recommendation coefficient of the object to be recommended, including: Initial simulated user representations are generated using a user representation distribution sampler, and initial simulated label representations are generated using a label representation distribution sampler. Based on the initial simulated user representation and the initial simulated label representation, initial simulated data is generated to adjust the recommendation coefficient of the object to be recommended.

4. The method according to claim 3, characterized in that, The initial simulation data is processed using a local recommendation model, and the simulation gradient corresponding to the local recommendation model is obtained based on the processing result, including: The initial simulated user representation and the initial simulated label representation are processed using a local recommendation model; Based on the processing results, the gradients of the model parameters and the object representation are obtained, and the gradients of the model parameters and the object representation are used as the simulated gradients corresponding to the local recommendation model.

5. The method according to claim 4, characterized in that, After using the model parameter gradient and the object representation gradient as the simulated gradient corresponding to the local recommendation model, the method further includes: Calculate the gradient difference between the global gradient and the simulated gradient; The simulated gradient is adjusted based on the gradient difference to obtain the adjusted simulated gradient, and the adjusted simulated gradient is used as the simulated gradient corresponding to the local recommendation model.

6. The method according to claim 1, characterized in that, Determine the global gradient corresponding to the global recommendation model, including: Obtain the global model parameters corresponding to the global recommendation model, and use the global model parameters to update the local model parameters of the local recommendation model; The global gradient of the global recommendation model is determined based on the updated local model parameters.

7. The method according to claim 3, characterized in that, The initial simulation data is updated based on the global gradient and the simulated gradient to obtain the target simulation data, including: The initial simulated user representation is updated based on the global gradient and the simulated gradient to obtain the target simulated user representation; The target simulated user representation is input into the local recommendation model to obtain the predicted simulated label representation output by the local recommendation model. The local recommendation model is trained using the predicted simulated label representation and the initial simulated label representation, and the target simulated label representation is obtained based on the training results. The target simulated user representation and the target simulated label representation are used as target simulated data.

8. The method according to claim 7, characterized in that, The initial simulated user representation is updated based on the global gradient and the simulated gradient to obtain the target simulated user representation, including: Calculate gradient similarity based on the global gradient and the simulated gradient; The initial simulated user representation is updated using the gradient similarity to obtain the target simulated user representation.

9. The method according to claim 1, characterized in that, Based on the predicted recommendation data, the target recommendation object and its target recommendation information, as well as the recommendation information of the object to be recommended, are determined, including: Based on the predicted recommendation data, determine the initial recommendation information corresponding to each initial object in the object set; Based on the initial recommendation information corresponding to each initial object, the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended, are determined in the object set.

10. A gradient attack device for federated recommendation systems, characterized in that, include: The selection module is configured to select objects to be recommended from a set of objects in response to an object recommendation request for a federated learning task, and to construct initial simulation data for adjusting the recommendation coefficients of the objects to be recommended. The update module is configured to process the initial simulation data through a local recommendation model, obtain the simulation gradient corresponding to the local recommendation model based on the processing result, determine the global gradient corresponding to the global recommendation model, and update the initial simulation data based on the global gradient and the simulation gradient to obtain the target simulation data. The prediction module is configured to input the target simulation data into the local recommendation model, obtain the predicted recommendation data output by the local recommendation model for the object set, and determine the target recommendation object and the target recommendation information of the target recommendation object, as well as the recommendation information of the object to be recommended, based on the predicted recommendation data. The calculation module is configured to calculate a first loss value based on the target recommendation information and the information to be recommended, and to calculate a second loss value based on the target recommendation data in the predicted recommendation data and the target simulation data; The training module is configured to tune the local recommendation model based on the first loss value and the second loss value until a target local recommendation model that meets the model training stopping condition is obtained, wherein the target local recommendation model is used to participate in the federated learning task.

11. A computing device, characterized in that, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, It stores computer-executable instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

Images