Recommended list privacy risk assessment method, device, equipment and storage medium

Abstract

Disclosed is a method, device, equipment and storage medium for assessing privacy risks of recommendation lists, belonging to the field of computer technology. The method comprises: based on multiple items in a recommendation database and an alignment model, enhancing a first recommendation list of a victim user to obtain a second recommendation list, wherein the first recommendation list is a recommendation list pushed to the victim user by a target recommendation model, and the alignment model is used to align the recommendation embeddings of multiple items; using an adaptive weight allocation model to assign different weights to items of different ranks in the second recommendation list; based on the weights of each item in the second recommendation list, using a multi-layer perceptron to infer the first privacy information of the victim user; and determining the privacy risk of the first recommendation list based on the accuracy of the inferred first privacy information. The method can accurately assess the privacy leakage risk of the recommendation list.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a recommendation list privacy risk assessment method, device, equipment and storage medium. Background Art

[0002] Recommendation systems provide personalized recommendation services to alleviate the problem of information overload. Usually, recommendation systems learn user preferences by analyzing users' historical interaction data, such as ratings, clicks, and views, and generate appropriate recommendation lists for users.

[0003] The user's recommendation list is an important part of user privacy because it not only reflects a person's interests, preferences and consumption habits, but may also expose their lifestyle, values ​​and even emotional state. If this data is improperly used or leaked, it may cause users to face risks such as targeted advertising, prediction or manipulation of personal choices, and identity theft. Therefore, it is necessary to evaluate whether the user's recommendation list has privacy (leakage) risks. Summary of the invention

[0004] The present disclosure provides a recommendation list privacy risk assessment method, device, equipment and storage medium, which can accurately assess the privacy leakage risk of the recommendation list. The technical solution at least includes the following solutions:

[0005] In a first aspect, a method for assessing the privacy risk of a recommendation list is provided, comprising: based on multiple items in a recommendation database and an alignment model, enhancing a first recommendation list of a victim user to obtain a second recommendation list, wherein the first recommendation list is a recommendation list pushed to the victim user by a target recommendation model, and the alignment model is used to align the recommendation embeddings of the multiple items; using an adaptive weight assignment model to assign different weights to items of different ranks in the second recommendation list; based on the weights of each item in the second recommendation list, using a multilayer perceptron to infer first privacy information of the victim user; and determining the privacy risk of the first recommendation list based on the accuracy of the inferred first privacy information.

[0006] Optionally, the method of enhancing the first recommendation list of the victim user based on multiple items in the recommendation database and the alignment model to obtain a second recommendation list includes: using a pre-trained large language model to extract modal feature information of each item in the recommendation database to obtain a content embedding of each item; inputting the content embedding of each item into the alignment model to obtain a recommendation embedding of each item; and performing data enhancement on the first recommendation list based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list to obtain the second recommendation list.

[0007] Optionally, the method of enhancing the victim user's first recommendation list based on multiple items in the recommendation database using an alignment model to obtain a second recommendation list includes: extracting modal feature information of each item in the recommendation database using a pre-trained large language model to obtain content embedding of each item; obtaining a false recommendation model closest to the target recommendation model; determining recommendation embeddings of multiple first items based on the false recommendation model, wherein the first items include items interacted with by the leaking user and items in the recommendation list generated by the recommendation model used by the leaking user but not interacted with by the leaking user; using the recommendation embeddings and content embedding training of the multiple first items related to the leaking user in the recommendation database to obtain the content embedding of each item; obtaining a false recommendation model closest to the target recommendation model; determining recommendation embeddings of multiple first items based on the false recommendation model; The method comprises the steps of: training the alignment model to obtain the trained alignment model; inputting the content embeddings of the plurality of second items in the recommendation database into the trained alignment model for prediction to obtain the recommended embeddings of the plurality of second items, and then obtaining the recommended embeddings of each of the items in the recommendation database, wherein the plurality of second items are items in the recommendation database other than the plurality of first items, and the recommended embeddings of each of the items in the recommendation database include the recommended embeddings of the plurality of first items and the recommended embeddings of the plurality of second items; performing data enhancement on the first recommendation list based on the recommended embeddings of items in the recommendation database other than the items in the first recommendation list to obtain the second recommendation list.

[0008] Optionally, the data enhancement of the first recommendation list based on the recommendation embedding of each of the items to obtain the second recommendation list includes: determining the item similarity of each of the candidate items based on the recommendation embedding of each candidate item and the recommendation embedding of the items in the first recommendation list, the candidate items being items in the recommendation database other than the items in the first recommendation list; sorting multiple candidate items according to the item similarity of each candidate item to determine a top-k2 recommendation list; and concatenating the top-k2 recommendation list with the first recommendation list to obtain the second recommendation list.

[0009] Optionally, the alignment model is expressed by the following formula:

[0010]

[0011] in, is the output of the alignment model, The content embedding generated for the alignment model, is a content embedding matrix of multiple items in the recommendation database, For items, is the weight of the alignment model, is the bias vector of the alignment model.

[0012] Optionally, the using a multilayer perceptron to infer the first private information of the victim user based on the weights of each item in the second recommendation list includes: based on the weights of each item in the second recommendation list, performing weighted summation on the recommendation embeddings of each item in the second recommendation list to obtain a user representation of the victim user; and based on the user representation of the victim user, using a multilayer perceptron to infer the first private information of the victim user.

[0013] Optionally, the adaptive weight allocation model is expressed by the following formula:

[0014]

[0015] in, The second recommended list The weight of an item, is the parameter matrix of the adaptive weight allocation model, For the The recommended embeddings for items, A bias vector for the adaptive weight allocation model.

[0016] In the second aspect, a recommendation list privacy risk assessment device is also provided, including: a recommendation list enhancement module, used to enhance the first recommendation list of the victim user based on multiple items in the recommendation database and an alignment model to obtain a second recommendation list, wherein the first recommendation list is a recommendation list pushed to the victim user by the target recommendation model, and the alignment model is used to align the recommendation embeddings of the multiple items; a weight allocation module, used to use an adaptive weight allocation model to assign different weights to items of different positions in the second recommendation list; a privacy information inference module, used to use a multi-layer perceptron to infer the first privacy information of the victim user based on the weights of each item in the second recommendation list; and a privacy risk assessment module, used to determine the privacy risk of the first recommendation list based on the accuracy of the inferred first privacy information.

[0017] Optionally, the recommendation list enhancement module is also used to extract modal feature information of each item in the recommendation database using a pre-trained large language model to obtain content embedding of each item; input the content embedding of each item into the alignment model to obtain recommendation embedding of each item; and perform data enhancement on the first recommendation list based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list to obtain the second recommendation list.

[0018] Optionally, the recommendation list enhancement module is also used to use a pre-trained large language model to extract modal feature information of each item in the recommendation database to obtain content embedding of each item; obtain a false recommendation model that is closest to the target recommendation model; based on the false recommendation model, determine the recommendation embedding of multiple first items, the first items include items that have been interacted with by the leaking user and items in the recommendation list generated by the recommendation model used by the leaking user that have not been interacted with by the leaking user; use the recommendation embedding and content embedding of the multiple first items related to the leaking user in the recommendation database to train the alignment model to obtain the trained alignment model; input the content embedding of multiple second items in the recommendation database into the trained alignment model for prediction to obtain the recommendation embedding of the multiple second items, and then obtain the recommendation embedding of each item in the recommendation database, the multiple second items are items in the recommendation database other than the multiple first items; based on the recommendation embedding of items in the recommendation database other than the items in the first recommendation list, perform data enhancement on the first recommendation list to obtain the second recommendation list.

[0019] Optionally, the recommendation list enhancement module is also used to determine the item similarity of each candidate item based on the recommendation embedding of each candidate item and the recommendation embedding of items in the first recommendation list, the candidate items being items in the recommendation database other than items in the first recommendation list; sorting multiple candidate items according to the item similarity of each candidate item to determine a top-k2 recommendation list; and concatenating the top-k2 recommendation list with the first recommendation list to obtain the second recommendation list.

[0020] Optionally, the weight allocation module is also used to perform weighted summation of recommendation embeddings of each item in the second recommendation list based on the weight of each item in the second recommendation list to obtain a user representation of the victim user; based on the user representation of the victim user, use a multilayer perceptron to infer the first private information of the victim user.

[0021] In a third aspect, a computer device is also provided, comprising: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor, thereby executing the recommendation list privacy risk assessment method described in the above embodiment.

[0022] In a fourth aspect, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor, thereby executing the recommendation list privacy risk assessment method described in the above embodiment.

[0023] In a fifth aspect, a computer program product is provided, comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the method described in the first aspect is implemented.

[0024] The beneficial effects brought by the technical solution provided by the embodiments of the present disclosure include at least:

[0025] In the disclosed embodiment, the first recommendation list of the victim user is enhanced by using multiple items in the recommendation database and the alignment model, which can improve the accuracy of the first private information of the victim user that is finally inferred, and thus accurately implement the privacy risk assessment of the first recommendation list. In addition, the disclosed embodiment is model-independent, and privacy risk assessment can be performed on the recommendation list generated by any type of target recommendation model. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 A flowchart of a method for assessing privacy risks of a recommendation list provided by an exemplary embodiment of the present disclosure is shown;

[0028] Figure 2 A flowchart of a method for assessing privacy risks of a recommendation list provided by another exemplary embodiment of the present disclosure is shown;

[0029] Figure 3 yes Figure 1 and Figure 2 Schematic diagram of the process of different methods;

[0030] Figure 4 This is a diagram showing the impact of different weight allocation methods on the accuracy of the MovieLens-1M dataset;

[0031] Figure 5 This is a schematic diagram of the impact of different weight allocation methods on the accuracy of the LastFM-1k dataset;

[0032] Figure 6 A schematic diagram of the structure of a recommendation list privacy risk assessment device provided by an exemplary embodiment of the present disclosure is shown;

[0033] Figure 7 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] Unless otherwise defined, the technical or scientific terms used herein shall have the usual meanings understood by persons of ordinary skill in the field to which the present disclosure belongs. The words "first", "second", "third" and similar words used in the patent application specification and claims of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "one" do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" and similar words mean that the elements or objects appearing before "include" or "comprises" cover the elements or objects listed after "include" or "comprises" and their equivalents, and do not exclude other elements or objects.

[0035] In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0036] Figure 1 A flowchart of a method for assessing privacy risks of a recommendation list provided by an exemplary embodiment of the present disclosure is shown, and the method can be executed by a computer device. Figure 1 , the method comprising:

[0037] In step 101, based on multiple items in a recommendation database and an alignment model, a first recommendation list of a victim user is enhanced to obtain a second recommendation list.

[0038] The first recommendation list is a recommendation list pushed to the victim user by the target recommendation model.

[0039] Here, the recommendation database includes multiple items, which are items that the target recommendation model may push to the victim user (items include but are not limited to multimodal information such as pictures, videos, texts, and audios). The alignment model is used to align the recommendation embeddings of multiple items. After obtaining the recommendation embeddings of multiple items, the first recommendation list can be enhanced based on the recommendation embeddings of each item. The enhanced first recommendation list is the second recommendation list.

[0040] The victimized users are those who need to conduct privacy risk assessment on the recommendation list.

[0041] The second recommendation list can improve the accuracy of the inferred first private information of the victim user.

[0042] In step 102, an adaptive weight allocation model is used to allocate different weights to items of different ranks in the second recommendation list.

[0043] The adaptive weight assignment model can dynamically assign different weights to each item in the second recommendation list.

[0044] In step 103, based on the weights of the items in the second recommendation list, a multi-layer perceptron is used to infer the first private information of the victim user.

[0045] Multilayer Perceptron (MLP) is a basic artificial neural network model, including a multi-layer structure composed of multiple neurons, and is a feedforward neural network. Multilayer Perceptron is usually used to solve classification and regression problems.

[0046] In step 104, the privacy risk of the first recommendation list is determined based on the accuracy of the inferred first privacy information.

[0047] Here, the accuracy of the inferred first private information is positively correlated with the privacy risk of the first recommendation list. The higher the accuracy of the first private information, the greater the privacy leakage risk of the first recommendation list. In some embodiments, the accuracy of the inferred first private information can also be directly used as the privacy risk of the first recommendation list.

[0048] The risk of privacy leakage is brought by the attacker. Assuming that the attacker attacks the user through the recommendation list, the success rate of the attack indicates the risk of privacy leakage of the user, and the accuracy of the first privacy information reflects the success rate of the attack. Therefore, the higher the accuracy of the first privacy information, the greater the privacy leakage risk of the first recommendation list.

[0049] In the disclosed embodiment, the first recommendation list of the victim user is enhanced by using multiple items in the recommendation database and the alignment model, which can improve the accuracy of the first private information of the victim user that is finally inferred, and thus accurately implement the privacy risk assessment of the first recommendation list. In addition, the disclosed embodiment is model-independent, and privacy risk assessment can be performed on the recommendation list generated by any type of target recommendation model.

[0050] Figure 2 A flowchart of a method for assessing privacy risks of a recommendation list provided by another exemplary embodiment of the present disclosure is shown, and the method can be executed by a computer device. Figure 2 , the method comprising:

[0051] In step 201, based on multiple items in a recommendation database and an alignment model, the first recommendation list of the victim user is enhanced to obtain a second recommendation list.

[0052] The related contents such as the recommendation database, victim users, and the first recommendation list refer to the aforementioned step 101, and the detailed description is omitted here.

[0053] In the disclosed embodiment, steps 201-204 are actually a simulation of an attacker. Before executing step 201, the attacker may have attacked other users of the target recommendation model and obtained the related items of these users in the recommendation database. These users can be called leaking users (that is, users who have leaked private information), and the items related to the leaking users can be called first items. Among them, the first items include: items that the leaking users have interacted with and items in the recommendation list generated by the recommendation model used by the leaking users that have not been interacted with by the leaking users.

[0054] Depending on whether the attacker obtains the first item related to the leaking user, step 201 can be divided into the following two situations.

[0055] Optionally, the first situation is that the attacker obtains the first item related to the leaking user, then step 201 includes the following steps af.

[0056] In step a, a pre-trained large language model is used to extract the modal feature information of each item in the recommendation database to obtain the content embedding of each item.

[0057] Multiple items in the recommendation database may belong to different modalities, so when extracting modal feature information, we are actually extracting the modal feature information of multimodal items.

[0058] The recommendation database includes multiple items, and the multiple items may belong to different modalities, such as pictures, videos, text, audio and other modalities. When extracting modal feature information, the modal feature information extracted from items of different modalities is different. For example, for text items, the title data is extracted as the modal feature information; for pictures, videos or audio items, items with titles can extract title data as modal feature information, and items with text can extract text data as modal feature information. For items with neither titles nor text, content data can be extracted as modal feature information.

[0059] The pre-trained large language model is, for example, a BERT (Bidirectional Encoder Representations from Transformers) type large language model. There are many related technologies for implementing the method of extracting modal feature information of multimodal items through a pre-trained large language model, which will not be described in detail here.

[0060] Finally, a modal feature information can be extracted for each item in the recommendation database, which is the content embedding of the item. In this way, the content embedding of each item in the recommendation database can be obtained, and these content embeddings constitute the content embedding matrix .

[0061] Step b: obtaining the false recommendation model that is closest to the target recommendation model.

[0062] Optionally, step b includes the following three steps:

[0063] In the first step, the first item related to the leaking user is input into the target recommendation model to obtain a third recommendation list.

[0064] Before being hacked, the target recommendation model is equivalent to a black box. The attacker can only input it and obtain the corresponding output without knowing its internal data. Therefore, after inputting the first item related to the leaked user into the target recommendation model, the third recommendation list generated by the target recommendation model can be obtained.

[0065] Alternatively, the first step can be expressed as formula (1).

[0066] (1)

[0067] In formula (1), For the third recommended list, Recommend a model for the target, A collection of leaked users. The item that the leaking user has interacted with and is part of the first item related to the leaking user. A plurality of first items associated with the leaking user.

[0068] In the second step, multiple first items related to the leaking user are input into multiple candidate recommendation models respectively to obtain multiple candidate recommendation lists.

[0069] The candidate recommendation models are open source recommendation models, which are equivalent to multiple white boxes, and the internal data of multiple candidate recommendation models are known. In this way, after the relevant items of the leaking user are input into multiple candidate recommendation models respectively, each candidate recommendation model can generate a candidate recommendation list, thereby obtaining multiple candidate recommendation lists.

[0070] Optionally, the second step can be expressed as formula (2).

[0071] (2)

[0072] In formula (2), The recommendation list generated by the candidate recommendation model, is a candidate recommendation model. The meanings of other parameters in formula (2) are the same as those in formula (1), and their detailed description is omitted here.

[0073] In the third step, the similarities between the third recommendation list and multiple candidate recommendation lists are calculated respectively, and the candidate recommendation model corresponding to the candidate recommendation list with the highest similarity is used as the false recommendation model of the target recommendation model.

[0074] Optionally, formula (3) is used to calculate the similarity between the third recommendation list and the plurality of candidate recommendation lists.

[0075] (3)

[0076] In formula (3), is the similarity, The first Leaked users Recommended list of The first Leaked users The meanings of other parameters in formula (3) are the same as those in formula (1), and their detailed description is omitted here. , is the number of leaked users in the leaked user set.

[0077] In this way, for any candidate recommendation model, a similarity can be obtained by using formula (3). These similarities are sorted from large to small, and the candidate recommendation model with the largest similarity is the false recommendation model.

[0078] Step c: determining recommendation embeddings of multiple first items related to the leaking user based on the false recommendation model.

[0079] After obtaining the fake recommendation model, the recommendation embeddings of the relevant items of the leaking user can be determined through the data in the fake recommendation model.

[0080] There are many implementation methods for determining the recommendation embedding of related items of the leaking user through the data in the false recommendation model in the related technology, and the detailed description is omitted here.

[0081] Step d: using the recommendation embedding and content embedding of multiple first items related to the leaking user in the recommendation database to train the alignment model, and obtaining a trained alignment model.

[0082] When there are multiple first items related to the leaking user, the multiple items in the recommendation database can be divided into two parts: first items and second items, where the first items are items related to the leaking user, and the second items are items in the recommendation database other than the first items.

[0083] In implementation, the content embeddings and recommendation embeddings of the multiple first items can be used as training sets to train the alignment model, and then the multiple second items can be used as test sets to perform predictions on the trained alignment model, thereby obtaining the recommendation embeddings of the multiple second items.

[0084] Optionally, the alignment model is expressed as formula (4):

[0085] (4)

[0086] In formula (4), To align the output of the model, Content embeddings generated for the alignment model, is the content embedding matrix for multiple items in the recommendation database, For items (when there are multiple first items related to the leaking user, For multiple first items, when there are no multiple first items related to the leaking user, for all items in the recommendation database), is the weight of the alignment model, is the bias vector for aligning the model.

[0087] Optionally, the training loss of the alignment model is expressed as formula (5).

[0088] (5)

[0089] In formula (5), Indicates items Content embeddings generated from the alignment model, Indicates items The content embedding derived from the pre-trained large language model is the content embedding in step a. The meanings of other parameters in formula (5) are the same as those in formula (3) and formula (4), and their detailed description is omitted here.

[0090] In step e, the content embeddings of the multiple second items in the recommendation database are input into the trained alignment model for prediction to obtain the recommendation embeddings of the multiple second items, and then the recommendation embedding of each item in the recommendation database is obtained.

[0091] The plurality of second items are items in the recommendation database other than the plurality of first items.

[0092] After the recommended embeddings of multiple first items and the recommended embeddings of multiple second items are known, the recommended embedding of each item in the recommendation database is equivalent to the union of the recommended embeddings of multiple first items and the recommended embeddings of multiple second items, that is, the recommended embedding of each item in the recommendation database includes the recommended embeddings of multiple first items and the recommended embeddings of multiple second items.

[0093] Alternatively, the recommendation embedding for each item in the recommendation database can be expressed as formula (6).

[0094] (6)

[0095] In formula (6), The recommendation embedding matrix is ​​composed of the recommendation embeddings of each item in the recommendation database, Represents alignment model through multiple second items Content embedding The predicted recommendation embeddings of multiple second items, Representation alignment model by leaking multiple first items associated with users Content embedding Generated recommendation embeddings for multiple first items.

[0096] Step f: Based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list, data enhancement is performed on the first recommendation list to obtain a second recommendation list.

[0097] Optionally, step f includes the following three steps.

[0098] In the first step, the item similarity of each candidate item is determined based on the recommendation embedding of each candidate item and the recommendation embedding of items in the first recommendation list.

[0099] The candidate items are items in the recommendation database other than the items in the first recommendation list.

[0100] Optionally, the item similarity of each candidate item is determined using formula (7):

[0101] (7)

[0102] In formula (7), Indicates candidate items With the first recommended list The similarity of items, is the length of the first recommendation list, Indicates an item in the first recommendation list under the Euclidean distance metric Recommendation embedding and candidate items The similarity of the recommended embeddings.

[0103] Optionally, It is calculated using formula (8).

[0104] (8)

[0105] In formula (8), The length of the top-k2 recommendation list can be set as required. Indicates an item in the first recommendation list Recommended embedding Bit, Indicates candidate items Recommended embedding Bit.

[0106] In the second step, multiple candidate items are ranked according to the item similarity of each candidate item to determine the top-k2 recommendation list.

[0107] When sorting, multiple candidate items can be sorted in descending order according to the item similarity, and the first order is obtained, and then the first order in the first order is candidate items as the top-k2 recommendation list.

[0108] The third step is to concatenate the top-k2 recommendation list with the first recommendation list to obtain the second recommendation list.

[0109] Optionally, the second recommendation list can be expressed by formula (9).

[0110] (9)

[0111] In formula (9), is the second recommendation list, the length of the second recommendation list is , Represents the top-k2 recommendation list. The meanings of other parameters in formula (9) are the same as those in formula (7) and are not described in detail here.

[0112] Through the above steps af, the relevance of the generated second recommendation list to the victim user can be improved, thereby improving the accuracy of the inferred first private information.

[0113] Optionally, in the second case, the attacker does not obtain the first item related to the leaking user, then step 201 includes the following step gi.

[0114] Step g: Use the pre-trained large language model to extract the modal feature information of each item in the recommendation database to obtain the content embedding of each item.

[0115] Step g is the same as step a, and detailed description is omitted here.

[0116] In step h, the content embedding of each item is input into the alignment model to obtain the recommended embedding of each item.

[0117] The content embedding, recommendation embedding and alignment model of each item in step h are the same as those in the above steps af, and detailed description is omitted here.

[0118] Step i: Based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list, data enhancement is performed on the first recommendation list to obtain a second recommendation list.

[0119] Step i is the same as step f, and detailed description is omitted here.

[0120] In the disclosed embodiment, through the above step gi, it is possible to infer the first private information of the victim user through the recommendation list without leaking multiple first items related to the user. Therefore, through the above steps af and step gi, a second recommendation list can be generated, and the second recommendation list is used to infer the first private information of the victim user. Therefore, the recommendation list may lead to user privacy leakage, and it is necessary to evaluate the possibility of privacy leakage of the recommendation list that the user may use.

[0121] In step 202, an adaptive weight assignment model is used to assign different weights to items of different ranks in the second recommendation list.

[0122] Optionally, the adaptive weight allocation model is expressed using formula (10).

[0123] (10)

[0124] In formula (10), The second recommended list The weight of an item, is the parameter matrix of the adaptive weight assignment model, For the The recommended embeddings for items, Assign the model's bias vector to the adaptive weights.

[0125] Optionally, the loss function of the adaptive weight allocation model is expressed by formula (11).

[0126] (11)

[0127] In formula (11), is the loss function of the adaptive weight assignment model, is the real label of the first private information of the victim user, is the predicted first private information of the victim user, For the first privacy information, is a private information set of a victim user, and the private information set of a victim user includes private information of multiple victim users.

[0128] In step 203, based on the weight of each item in the second recommendation list, the recommendation embeddings of each item in the second recommendation list are weighted summed to obtain the user representation of the victim user.

[0129] Optionally, step 203 is represented by formula (12).

[0130] (12)

[0131] In formula (12), For the User representation of victim users, For the Second recommended list of victim users Middle Items The weight of Indicates Second recommended list of victim users The Items Recommended embeds.

[0132] In step 204, based on the user representation of the victim user, a multi-layer perceptron is used to infer the first private information of the victim user.

[0133] (13)

[0134] is the predicted first private information of the victim user, is a multi-layer perceptron. The meanings of other parameters in formula (13) are the same as those in formula (12), and their detailed description is omitted here.

[0135] There are many methods for implementing multi-layer perceptrons in related technologies, so detailed description is omitted here.

[0136] In step 205, the privacy risk of the first recommendation list is determined based on the accuracy of the inferred first privacy information.

[0137] In the embodiment of the present disclosure, the ML-1M dataset and the LastFM-1k dataset are used to verify the recommendation list privacy risk assessment method in the embodiment of the present disclosure. The detailed information of the ML-1M dataset and the LastFM-1k dataset is shown in Table 1.

[0138] Table 1: Details of the ML-1M dataset and the LastFM-1k dataset

[0139]

[0140] When the two data sets in Table 1 are used to verify the recommendation list privacy risk assessment method in the embodiment of the present disclosure, taking the gender of the victim user as an example, when the attacker knows different proportions of the first items related to the leaked user, the accuracy is shown in Table 2.

[0141] Table 2: Accuracy of inferring the gender of the victim in different scenarios.

[0142]

[0143] In Table 2, is the accuracy, which is calculated using formula (14).

[0144] (14)

[0145] In formula (14), True Positive means the number of positive samples predicted to be positive and correct. That is, True Negative, which means the number of negative samples predicted as negative and predicted correctly. That is, False Positive, which means the number of false predictions that negative samples are predicted to be positive but are actually negative. That is, False Negative, which indicates the number of incorrect predictions where the positive sample is predicted to be negative but is actually positive.

[0146] There are many methods for implementing accuracy calculation in the related art, and detailed description is omitted here.

[0147] In Table 2, It indicates the proportion of the first items related to the leaked users known to the attacker in the recommendation database, for example That is, the first item related to the leaking user accounts for 10% in the recommendation database. Scenario 1 is to infer the gender of the victim user directly from the recommendation list without any other processing; Scenario 2 is to infer the gender of the victim user when the attacker can obtain the recommendation embedding of the item in the target recommendation model; Scenario 3 is to infer the gender of the victim user using the method in the embodiment of the present disclosure. DT (Decision Trees), KNN (K-NearestNeighbour), and DNN (Deep Neural Network) are several common ways to infer the privacy information of the victim user.

[0148] It can be seen from Table 2 that, on the one hand, in different scenarios, when the attacker infers the user's privacy information through the recommendation list, a certain accuracy rate can be achieved, indicating that the user's recommendation list has the risk of leaking user privacy. On the other hand, it can be found that the classification accuracy of scenario one is the worst, and the classification accuracy of scenario three is better than that of scenario 2. The reason is that in scenario one, the attacker only uses the item serial number to represent the item, and in scenario two, the attacker has the additional ability to use the item recommendation embedding. The algorithm in the embodiment of the present disclosure in scenario three trains an alignment model through the recommendation embedding of multiple first items related to the leaking user, and then obtains the recommendation embedding of all items in the recommendation database through the alignment model, and then enhances the first recommendation list through the recommendation embedding of all items to obtain the second recommendation list. Finally, when the victim user's privacy information is inferred through the second recommendation list, the victim user's privacy information can be inferred more accurately. The more accurate the inferred victim user's privacy information is, the greater the privacy risk of the recommendation list.

[0149] When the MovieLens-1M dataset in Table 1 is used to verify the recommendation list privacy risk assessment method in the embodiment of the present disclosure, taking the age of the victim user as an example of the first private information, when the attacker knows different proportions of the first items related to the leaked user, the accuracy is shown in Table 3.

[0150] Table 3: The accuracy of inferring the victim’s age in different scenarios.

[0151]

[0152] Figure 3 yes Figure 1 and Figure 2 Schematic diagram of the different methods in the Figure 3 It can be seen from Table 2 and Table 3 that the accuracy of inferring the victim's age is generally lower than the accuracy of inferring the victim's gender. This is because the gender inference problem is a binary classification problem, while the age inference problem is a multi-classification problem. In addition, the algorithm in the embodiment of the present disclosure can still infer the age range of the victim with a higher accuracy than other algorithms.

[0153] Figure 4 This is a schematic diagram of the impact of different weight allocation methods on the accuracy of the MovieLens-1M dataset. Figure 4 As shown, the horizontal axis is , the vertical axis is the accuracy. sum indicates that the weights are allocated in an accumulated manner, stasitic indicates that the weights are allocated in a static manner, and dynamic indicates that the weights are allocated in a dynamic manner (that is, the adaptive weight model in the embodiment of the present disclosure).

[0154] Figure 5 This is a diagram showing the impact of different weight allocation methods on the accuracy of the LastFM-1k dataset. Figure 5 The various parameters in Figure 4 The same as in, detailed description is omitted here.

[0155] pass Figure 4 and Figure 5 It can be seen that the dynamic weight allocation method in the embodiment of the present disclosure is more suitable for embedding the items in the aggregated recommendation list and can achieve a higher accuracy. At the same time, the classification accuracy finally obtained by the three aggregation methods will increase with the increase in the proportion of the first items related to the leaking user. This is because the higher the proportion of leaking users, the more supervisory information will be involved in the training.

[0156] In summary, the experimental results on two public data sets show that the recommendation list privacy risk assessment method in the embodiment of the present disclosure has obvious advantages in inferring the user privacy information of the recommendation system, and can accurately infer the user's privacy information from the first recommendation list of the victim user. The more accurate the inferred privacy information is, the greater the privacy leakage risk of the first recommendation list is. Therefore, the privacy leakage risk of the first recommendation list can be accurately assessed.

[0157] The following are device embodiments of the present application. For details not described in detail in the device embodiments, reference may be made to the above method embodiments.

[0158] Figure 6 A schematic diagram of a device for evaluating privacy risk of a recommendation list provided by an exemplary embodiment of the present disclosure is shown. Figure 6 The recommendation list privacy risk assessment device 600 includes: a recommendation list enhancement module 601, a weight allocation module 602, a privacy information inference module 603 and a privacy risk assessment module 604.

[0159] The recommendation list enhancement module 601 is used to enhance the first recommendation list of the victim user based on multiple items in the recommendation database and the alignment model to obtain a second recommendation list. The first recommendation list is the recommendation list pushed to the victim user by the target recommendation model. The alignment model is used to align the recommendation embeddings of multiple items.

[0160] The weight allocation module 602 is used to use an adaptive weight allocation model to allocate different weights to items of different ranks in the second recommendation list.

[0161] The private information inference module 603 is used to infer the first private information of the victim user by using a multi-layer perceptron based on the weights of the items in the second recommendation list.

[0162] The privacy risk assessment module 604 is used to determine the privacy risk of the first recommendation list based on the accuracy of the inferred first privacy information.

[0163] Optionally, the recommendation list enhancement module 601 is also used to extract modal feature information of each item in the recommendation database using a pre-trained large language model to obtain content embedding of each item; input the content embedding of each item into the alignment model to obtain recommendation embedding of each item; and perform data enhancement on the first recommendation list based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list to obtain a second recommendation list.

[0164] Optionally, the recommendation list enhancement module 604 is also used to use a pre-trained large language model to extract modal feature information of each item in the recommendation database to obtain the content embedding of each item; obtain a false recommendation model that is closest to the target recommendation model; based on the false recommendation model, determine the recommendation embeddings of multiple first items, the first items include items that have been interacted with by the leaking user and items in the recommendation list generated by the recommendation model that have been used by the leaking user but have not been interacted with by the leaking user; use the recommendation embeddings and content embeddings of multiple first items related to the leaking user in the recommendation database to train the alignment model to obtain a trained alignment model; input the content embeddings of multiple second items in the recommendation database into the trained alignment model for prediction to obtain the recommendation embeddings of multiple second items, and then obtain the recommendation embedding of each of the items in the recommendation database, the multiple second items are items in the recommendation database other than the multiple first items, and the recommendation embedding of each item in the recommendation database includes the recommendation embeddings of multiple first items and the recommendation embeddings of multiple second items; based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list, perform data enhancement on the first recommendation list to obtain a second recommendation list.

[0165] Optionally, the recommendation list enhancement module 601 is also used to determine the item similarity of each candidate item based on the recommendation embedding of each candidate item and the recommendation embedding of items in the first recommendation list, the candidate items being items in the recommendation database other than the items in the first recommendation list; sorting multiple candidate items according to the item similarity of each candidate item to determine a top-k2 recommendation list; and concatenating the top-k2 recommendation list with the first recommendation list to obtain a second recommendation list.

[0166] Optionally, the weight allocation module 602 is also used to perform weighted summation of the recommendation embeddings of each item in the second recommendation list based on the weight of each item in the second recommendation list to obtain a user representation of the victim user; based on the user representation of the victim user, a multi-layer perceptron is used to infer the first private information of the victim user.

[0167] It should be noted that: when the recommendation list privacy risk assessment device provided in the above embodiment assesses the privacy risk of the recommendation list, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the recommendation list privacy risk assessment device provided in the above embodiment and the recommendation list privacy risk assessment method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0168] The division of modules in the embodiments of the present disclosure is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present disclosure may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0169] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a terminal device (which can be a personal computer, mobile phone, or communication device, etc.) or a processor (processor) to execute all or part of the steps of the method of each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0170] Figure 7 Schematic diagram of the structure of the computer device provided by the embodiment of the present disclosure. Figure 7 As shown, the computer device 700 includes: a processor 701 and a memory 702 .

[0171] The processor 701 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 701 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 701 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 701 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 701 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0172] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 702 is used to store at least one instruction, which is used to be executed by the processor 701 to implement the recommendation list privacy risk assessment method provided in the embodiments of the present disclosure.

[0173] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation on the computer device 700, and the computer device 700 may include more or less components than shown in the figure, or combine some components, or adopt a different arrangement of components.

[0174] The embodiments of the present disclosure also provide a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by a processor of a computer device, the computer device can execute the recommendation list privacy risk assessment method provided in the embodiments of the present disclosure.

[0175] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the recommendation list privacy risk assessment method provided in the embodiments of the present disclosure.

[0176] The above description is only an optional embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for assessing privacy risk of a recommendation list, characterized in that: The method comprises: Based on multiple items in the recommendation database and the alignment model, a first recommendation list of the victim user is enhanced to obtain a second recommendation list, wherein the first recommendation list is a recommendation list pushed to the victim user by the target recommendation model, and the alignment model is used to align the recommendation embeddings of the multiple items; Using an adaptive weight allocation model to allocate different weights to items of different ranks in the second recommendation list; Inferring the first private information of the victim user using a multi-layer perceptron based on the weights of the items in the second recommendation list; determining a privacy risk of the first recommendation list based on the inferred accuracy of the first privacy information; The alignment model is expressed by the following formula: in, is the output of the alignment model, The content embedding generated for the alignment model, is a content embedding matrix of multiple items in the recommendation database, For items, is the weight of the alignment model, is the bias vector of the alignment model.

2. The method according to claim 1, characterized in that The method enhances the first recommendation list of the victim user based on the multiple items in the recommendation database and the alignment model to obtain a second recommendation list, including: Using a pre-trained large language model to extract modal feature information of each item in the recommendation database, and obtaining content embedding of each item; Inputting the content embedding of each of the items into the alignment model to obtain a recommended embedding for each of the items; Based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list, data enhancement is performed on the first recommendation list to obtain the second recommendation list.

3. The method according to claim 1, characterized in that: The method uses an alignment model to enhance the first recommendation list of the victim user based on multiple items in the recommendation database to obtain a second recommendation list, including: Using a pre-trained large language model to extract modal feature information of each item in the recommendation database, and obtaining content embedding of each item; Obtaining a false recommendation model that is closest to the target recommendation model; Determining recommendation embeddings of a plurality of first items based on the fake recommendation model, the first items including items that the leaking user has interacted with and items in a recommendation list generated by a recommendation model used by the leaking user that have not been interacted with by the leaking user; Using the recommendation embedding and content embedding of the plurality of first items related to the leaking user in the recommendation database to train the alignment model, to obtain the trained alignment model; Inputting the content embeddings of the plurality of second items in the recommendation database into the trained alignment model for prediction, obtaining the recommended embeddings of the plurality of second items, and then obtaining the recommended embedding of each of the items in the recommendation database, wherein the plurality of second items are items in the recommendation database other than the plurality of first items, and the recommended embedding of each of the items in the recommendation database includes the recommended embeddings of the plurality of first items and the recommended embeddings of the plurality of second items; Based on the recommendation embeddings of items in the recommendation database other than the items in the first recommendation list, data enhancement is performed on the first recommendation list to obtain the second recommendation list.

4. The method according to claim 2 or 3, characterized in that: The step of performing data enhancement on the first recommendation list based on the recommendation embedding of each of the items to obtain the second recommendation list includes: Determining an item similarity of each candidate item based on the recommendation embedding of each candidate item and the recommendation embedding of items in the first recommendation list, wherein the candidate item is an item in the recommendation database other than the items in the first recommendation list; Sorting the plurality of candidate items according to the item similarity of each candidate item to determine a top-k2 recommendation list; The top-k2 recommendation list is concatenated with the first recommendation list to obtain the second recommendation list.

5. The method according to any one of claims 1 to 3, characterized in that: The inferring the first private information of the victim user by using a multi-layer perceptron based on the weights of the items in the second recommendation list includes: Based on the weight of each item in the second recommendation list, weighted summation is performed on the recommendation embeddings of each item in the second recommendation list to obtain a user representation of the victim user; Based on the user representation of the victim user, a multi-layer perceptron is used to infer the first private information of the victim user.

6. The method according to any one of claims 1 to 3, characterized in that: The adaptive weight allocation model is expressed by the following formula: in, The second recommended list The weight of an item, is the parameter matrix of the adaptive weight allocation model, For the The recommended embeddings for items, A bias vector for the adaptive weight assignment model.

7. A recommendation list privacy risk assessment device, characterized in that: The device comprises: A recommendation list enhancement module, configured to enhance a first recommendation list of a victim user based on a plurality of items in a recommendation database and an alignment model to obtain a second recommendation list, wherein the first recommendation list is a recommendation list pushed to the victim user by a target recommendation model, and the alignment model is used to align recommendation embeddings of the plurality of items; A weight allocation module, configured to allocate different weights to items of different ranks in the second recommendation list using an adaptive weight allocation model; a privacy information inference module, configured to infer the first privacy information of the victim user by using a multi-layer perceptron based on the weights of the items in the second recommendation list; a privacy risk assessment module, configured to determine the privacy risk of the first recommendation list based on the accuracy of the inferred first privacy information; The alignment model is expressed by the following formula: in, is the output of the alignment model, The content embedding generated for the alignment model, is a content embedding matrix of multiple items in the recommendation database, For items, is the weight of the alignment model, is the bias vector of the alignment model.

8. A computer device, characterized in that: The computer device comprises: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor to implement the method according to any one of claims 1 to 6.

Images