Privacy risk assessment method and system in federated social matching

Abstract

The invention discloses a privacy risk assessment method and system of a federated social matching system, and belongs to the technical field of information security. The method comprises the following steps: acquiring public model parameters and private latent feature vectors of part of users in a federated social matching training process; constructing a reconstruction model containing linear transformation and nonlinear transformation, wherein the reconstruction model is used for capturing a mapping relation between a public latent feature vector and a private latent feature vector of the user; training a reconstruction model by using the data of the part of users; inputting a public latent feature vector of a target user to be deduced into the trained reconstruction model to obtain a reconstructed private latent feature vector; and calculating the connection probability between the target user and other users based on the reconstructed private latent feature vector, deducing a real friend relationship list, and evaluating the privacy risk of the system by comparing a prediction list with the real friend list. According to the method, the public information can be effectively utilized to reconstruct the user privacy data, and the privacy leakage risk in the federated social matching scene is revealed.

Description

Technical Field

[0001] This invention relates to the fields of network information security and federated learning technology, specifically to a method and system for assessing privacy risks in federated social matching, which is mainly used to evaluate the privacy security of federated recommendation systems. Background Technology

[0002] With the rapid development of mobile internet and online social networks, social matching has become one of the core functions of various social matching platforms. Unlike traditional recommendation systems that recommend items to users, social matching is a special scenario that recommends users to users, aiming to recommend potential friends to users based on their existing social relationships or personal preferences. On these platforms, user interaction records (such as likes, swipes, and establishing friend relationships) often contain highly sensitive personal privacy information that users are unwilling to disclose to the platform. Traditional centralized recommendation algorithms require collecting all user interaction data to a central server for training, which not only raises public concerns about privacy leaks but is also subject to strict restrictions from data protection regulations such as GDPR. To address this issue, researchers have introduced federated learning into recommendation systems, proposing the Federated Recommendation framework. In this framework, model training is performed on the user's local device; users only need to upload model gradients or public parameters, without uploading raw interaction data.

[0003] In a typical federated recommendation architecture, the system protects user privacy by separating publicly available latent feature vectors stored on the server side from private latent feature vectors maintained only locally. Since social matching is considered a sub-scenario of recommender systems, traditional federated recommendation methods are often directly applied to federated social matching scenarios. However, this method, directly transferred from user-item recommendation, ignores the bidirectional nature of friend relationships in social matching scenarios. This bidirectionality leads to a similarity or strong mapping relationship between a user's publicly available and private latent feature vectors after model training convergence, thus constituting a serious security vulnerability. Attackers could exploit this correlation to infer a user's private features and true social relationships using only legally obtained publicly available parameters.

[0004] Existing federated recommendation systems lack a quantitative assessment mechanism specifically for privacy risks in social matching scenarios. Current technical solutions primarily focus on implementing privacy protection mechanisms, failing to provide effective risk assessment methods and thus unable to help system designers identify and measure potential privacy leakage risks. This lack of an assessment mechanism makes it difficult for system developers to accurately understand the security status of their systems and to make targeted improvements to privacy protection measures. Therefore, it is crucial to provide a privacy risk assessment scheme specifically for federated social matching scenarios that can effectively reveal and quantify the privacy leakage risks caused by the bidirectional nature of social relationships, providing a reliable technical means for assessing and improving the security of federated social recommendation systems. Solving this problem has significant theoretical and practical value for promoting the application of federated learning in the field of social matching. Summary of the Invention

[0005] To address the problems in the prior art, this invention proposes a method and system for assessing privacy risks in federated social matching.

[0006] The technical solution of the present invention is as follows: In a first aspect, the present invention discloses a method and system for assessing privacy risks in federated social matching, comprising the following steps: (1) The target federated social matching system is trained using a simulated social dataset to obtain a trained system containing recommendation model parameters, user public latent feature vectors and user private latent feature vectors; (2) Divide the system users into a first user set, a second user set and a third user set, wherein the private latent feature vectors of the second user set can be accessed by authorization during the evaluation phase; (3) Construct a training sample set based on the public and private latent feature vectors of the second user set; (4) Construct a residual reconstruction model and use the training sample set to supervise the training of the model; the residual reconstruction model includes a parallel linear transformation path and a nonlinear transformation path; the linear transformation path performs a direct linear mapping of the input public latent feature vector through a learnable weight matrix, and the nonlinear transformation path performs nonlinear feature extraction of the input through a multilayer perceptron; the outputs of the two paths are added through a residual connection to obtain the reconstructed private latent feature vector. (5) Input the public latent feature vectors of the target users in the third user set into the trained residual reconstruction model to obtain the reconstructed private latent feature vectors; (6) Calculate the interaction score based on the reconstructed private latent feature vector, generate a predicted friend list, and assess the system privacy risk by comparing the predicted list with the real friend list.

[0007] Furthermore, the simulated social dataset mentioned in step (1) is generated based on the topology of a real social network. All users participate in the system training through the federated learning framework. Each user trains a local model using private data on their local device and only uploads the model gradient to the server for secure aggregation. In the trained system, the public latent feature vectors are stored on the server, while the private latent feature vectors are stored only on the user's local device.

[0008] Furthermore, the simulated social dataset includes a user relationship graph generated based on the topology of real social networks, time-series data simulating user interaction behavior, and a user attribute feature matrix.

[0009] Furthermore, in step (2), the division ratio of the three user sets is as follows: the second user set accounts for 2%-10% of the total number of users, the third user set accounts for 10%-30%, and the rest is the first user set; the second user set serves as an auxiliary training user, and its private latent feature vector is used for supervised training of model reconstruction.

[0010] Furthermore, the mathematical expression of the reconstruction model is as follows: ; in, This represents the reconstructed private latent feature vector. This represents the input public latent feature vector. This represents a non-linear path, specifically a multilayer perceptron containing at least two hidden layers and employing a non-linear activation function between the layers. and Let represent the learnable weight matrix and bias vector of the linear transformation path, respectively.

[0011] Furthermore, the supervised training in step (4) uses a hybrid loss function to optimize the model parameters. The hybrid loss function combines mean squared error loss and contrast loss, and introduces learnable uncertainty parameters to adaptively balance the loss weights.

[0012] Furthermore, the total loss function is expressed as follows: ; in, and The learnable uncertainty parameter used to balance the weights of the two loss terms takes a value from 0 to 1; The mean squared error loss is calculated as follows: for each sample in the batch training samples, calculate the average of the squared Euclidean norms between the reconstructed vector and the true vector. To compare the loss, it is calculated as follows: compare the similarity between positive sample pairs consisting of reconstructed vectors and corresponding real vectors and negative sample pairs consisting of reconstructed vectors and other real vectors. Using the principle of noise contrast estimation, maximize the similarity of positive sample pairs while minimizing the similarity of negative sample pairs. That is the total loss.

[0013] Furthermore, the generation of the predicted friend list in step (6) includes: Using the publicly available recommendation model of the system, the interaction score between the private latent feature vector reconstructed by the target user and the public latent feature vectors of all other users in the system is calculated; the interaction scores are sorted from high to low to generate a candidate user sequence; based on a preset threshold K, the top K users in the sequence are selected as the predicted friend list, where K is a positive integer and its value is determined based on the accuracy requirements of privacy risk assessment.

[0014] Secondly, this invention discloses a privacy risk assessment system for a federated social matching system, used to implement the aforementioned privacy risk assessment method for a federated social matching system.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: First, this invention effectively captures the complex mapping relationship between public and private latent feature vectors in federated social matching by constructing a residual reconstruction model that incorporates both linear and nonlinear paths. Compared to a single linear or nonlinear model, this structure has stronger robustness and can adapt to various recommendation algorithm architectures based on both linear and nonlinear approaches.

[0016] Secondly, this invention designs a hybrid loss function optimization strategy combining MSE and InfoNCE, avoiding the problem of inaccurate recommendation ranking caused by traditional methods that only focus on numerical fitting and ignore vector directionality. By achieving adaptive balancing of loss weights through learnable uncertainty parameters, the accuracy of inferring the target user's real friend list is significantly improved, providing a more scientific and rigorous technical means for evaluating the privacy protection capabilities of federated social systems.

[0017] Third, this invention develops a complete framework for assessing privacy risks in federated social systems, systematically revealing for the first time the privacy protection challenges in this scenario. This approach requires only a very small percentage of baseline user data to complete accurate assessments, providing an important technical tool and experimental benchmark for building the privacy protection capabilities of federated learning systems. This invention can serve as a crucial auxiliary tool for system developers, helping them identify potential risks during the system design phase and providing theoretical basis and practical guidance for the research and development of privacy enhancement technologies. Attached Figure Description

[0018] Figure 1This is a schematic diagram of the overall process of the method of the present invention.

[0019] Figure 2 This is a schematic diagram of the reconstructed model in this invention.

[0020] Figure 3 This is a flowchart illustrating the specific process of model training in this invention.

[0021] Figure 4 This is a flowchart illustrating the specific process of privacy risk assessment in this invention. Detailed Implementation

[0022] The present invention will be further described and illustrated below with reference to specific embodiments. The embodiments described are merely examples of the content of this disclosure and do not limit the scope of the invention. The technical features of each embodiment in the present invention can be combined accordingly, provided that there is no mutual conflict.

[0023] The accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0024] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0025] This invention proposes a method for assessing privacy risks in federated social matching, which mainly includes the following steps: S1, a target federated social matching system is trained using a simulated social dataset. The simulated social dataset contains user relationship data generated based on the topology of real social networks. All users in the dataset participate in system training through a federated learning framework. Each user trains a local model on their local device using private data and only uploads the model gradient to the server for secure aggregation. The trained system includes publicly available recommendation model parameters, publicly available latent feature vectors stored on the server, and private latent feature vectors stored only on the user's local device. S2 divides the users participating in training into three sets: the first set of users are ordinary users, the second set of users are auxiliary training users, and the third set of users are privacy risk assessment objects; only the private latent feature vectors of the second set of users can be authorized to be accessed during the evaluation stage for reconstructing the supervised training of the model. S3, obtain the publicly available recommendation model parameters and public latent feature vectors of all users, and obtain the private latent feature vectors of authorized users in the second user set; use the public latent feature vectors of the authorized users as input features and their corresponding private latent feature vectors as supervision labels to construct a pair of training sample sets; S4. Construct a residual reconstruction model, which includes parallel linear transformation paths and nonlinear transformation paths. The linear transformation path performs a direct linear mapping of the input public latent feature vector through a learnable weight matrix, and the nonlinear transformation path performs nonlinear feature extraction of the input through a multilayer perceptron. The outputs of the two paths are added together through a residual connection to obtain the reconstructed private latent feature vector. S5, the residual reconstruction model is supervised and trained using the training sample set. During the training process, a hybrid loss function is used to optimize the model parameters. The hybrid loss function combines mean squared error loss and contrast loss, and adaptively balances the weights of the two types of losses through learnable uncertainty parameters. S6, input the public latent feature vectors of the target users in the third user set into the trained residual reconstruction model to obtain the reconstructed private latent feature vectors; S7. Using the publicly available recommendation model of the system, calculate the interaction score between the reconstructed private latent feature vector and the public latent feature vectors of other users in the system, and generate a predicted friend list based on the interaction score; calculate the evaluation index value of the predicted friend list and the real friend list, and quantify the privacy risk level of the target federated social matching system according to the index value.

[0026] like Figure 1 As shown, the above method is mainly implemented based on four modules, including a data acquisition module, a reconstructed model building module, a model training module, and a risk assessment module. Each module is described in detail below: (a) Data Acquisition Module The data acquisition module is used to acquire the data resources needed for evaluation after the training phase of the federated social matching system. This module has significant value in various application scenarios such as professional social networks and dating platforms. For example, on a certain social platform, the system needs to assess the risk of privacy breaches during the user matching and recommendation process. The platform contains millions of users, each with detailed personal profiles, dating preferences, and historical matching records. This data is highly sensitive and requires strict protection.

[0027] Specifically, the data resources required for the assessment include: (1) Public system parameters: The platform server regularly publishes updated recommendation model parameters. (e.g., dot product functions or neural network parameters in matrix factorization models) and the public latent feature vector matrix of all users. These parameters are provided externally through an API interface, and the evaluation system can legally access them.

[0028] (2) Assisting in data leakage: Under the premise of simulating user authorization, obtain a portion of the system data (denoted as...). The private latent feature vectors of users are used as "baseline sample users". Their data is only used for subsequent model training and does not participate in the final risk assessment.

[0029] (3) Constructing a training sample set: Using the public latent feature vectors of the benchmark sample users as input features The corresponding private latent feature vector is used as the label. Construct paired supervised training datasets.

[0030] It should be noted that the federated social matching system is trained using a simulated social dataset, which is generated based on real social network topologies and selected from the YouTube social network dataset, the Gowalla social network dataset, and the Brightkite social network dataset. All users participate in system training through the federated learning framework. Each user trains their local model on their local device using private data, and only uploads the model gradients to the server for secure aggregation. In the trained system, public latent feature vectors are stored on the server, while private latent feature vectors are stored only on the user's local device.

[0031] To obtain the knowledge and data required for evaluation, the system users are divided into a first user set, a second user set, and a third user set. The private latent feature vectors of the second user set can be accessed with authorization during the evaluation phase. In this embodiment, the division ratio of the three user sets is as follows: the second user set accounts for 2%-10% of the total number of users, the third user set accounts for 10%-30%, and the remainder is the first user set. The second user set serves as auxiliary training users, and its private latent feature vectors are used for supervised training to reconstruct the model.

[0032] In this design, the first user set (ordinary users) serves as the foundation for the system's normal operation, representing the vast majority of regular users who do not participate in the evaluation. Their data is used solely to maintain the integrity of the federated learning training process, ensuring the evaluation environment is consistent with the real system and avoiding bias introduced by evaluation intervention. The second user set (auxiliary training users) provides training samples for the reconstructed model, and their private latent feature vectors are authorized for access during the evaluation phase. This design simulates a common "benchmark knowledge" scenario in privacy evaluation, where evaluators may obtain some data as prior information through legitimate means, such as user authorization or cooperation agreements. By limiting the proportion of the second set (e.g., 2%-10%), this invention can quantify the impact of a very small proportion of auxiliary data on privacy risks, revealing the system's sensitivity to data leakage. The third user set (evaluation targets) serves as the target of privacy risk testing; their data is not used for model training at all, but only for testing the inference accuracy of the reconstructed model. By comparing the predicted friend list of the third set with the real friend list, the actual privacy leakage risk of the system can be objectively quantified. It is important to emphasize that the private latent feature vectors of the second user set are authorized for access during the evaluation phase. This access only occurs during the evaluation phase and requires a clear authorization agreement in real-world applications. This access is not a malicious attack but rather a means of verifying privacy enhancement technologies. Its ultimate goal is to improve system security, not to infringe on privacy.

[0033] (II) Reconstructing the Model Building Module like Figure 2 As shown, the Reconstruction Model building module is used to construct a neural network model (ReconModel) that maps public latent feature vectors to private latent feature vectors. Addressing the linear and nonlinear mapping relationships present in federated social matching, this module constructs a residual network structure with a dual-path approach. Specifically, it includes: The first step is to construct a linear transformation path. This involves using a linear layer to directly transform the input public latent feature vector. A transformation is performed to capture the low-order linear correlation between public and private embeddings. The calculation formula is as follows: in It is a linear weight matrix. This is the bias vector.

[0034] The second step is to construct a nonlinear transformation path. A multilayer perceptron (MLP) is used to extract features from the input to capture higher-order nonlinear biases introduced by negative sampling or nonlinear recommendation algorithms. The MLP contains at least two hidden layers, with ReLU activation functions used between layers. The calculation formula is as follows: The third step is feature fusion. This involves outputting the linear path. With nonlinear path output Perform residual connections (addition) to obtain the final reconstructed private latent feature vector. : This structure ensures that the model can capture both low-order, linear mappings between user-public and private latent feature vectors, as well as complex, non-linear mappings.

[0035] (III) Model Training Module like Figure 3 As shown, the data processing flow of the model training module specifically includes the following steps: The first step is parameter initialization. This involves initializing the weight parameters of the reconstructed model and the learnable uncertainty parameters in the loss function. and For example, uncertainty parameters and It is initialized to 0.5 and automatically learns the optimal weight balance during training.

[0036] The second step is forward propagation. A batch of data is sampled from the training sample set constructed by the data acquisition module. Input the reconstruction model and obtain the reconstruction output. .

[0037] The third step is to calculate the mean squared error loss and the contrast loss. To make the reconstructed vector numerically approximate the true vector, the mean squared error (MSE) loss is calculated: in, For batch size, This represents the square of the Euclidean norm.

[0038] To ensure the consistency of the reconstructed vector's orientation in the vector space, the contrastive loss is calculated: in, This represents the L2-normalized vector. The temperature coefficient is set to 0.5 in this embodiment. This loss function brings the reconstructed vector closer to the corresponding true vector, while widening the distance to other user vectors.

[0039] The fourth step is to calculate the total loss and update the parameters. An uncertainty-weighted strategy is used to fuse the two types of losses to calculate the total loss: Based on total loss Calculate the gradient and use an optimizer (such as Adam) to update and reconstruct the model parameters and uncertainty parameters. , (Values ​​range from 0 to 1). Repeat the above steps until the model converges.

[0040] (iv) Risk Assessment Module The risk assessment module applies the trained model to quantify real-world privacy risks, providing actionable security recommendations for social media platforms. For example... Figure 4 As shown, the data processing flow of the risk assessment module specifically includes the following steps: The first step is to identify the target users. Several target users are randomly selected from the third user set. Then obtain its public latent feature vector. For example, based on user activity levels, 1000 target users can be selected for evaluation in the test, with a ratio of 30% highly active users, 50% moderately active users, and 20% inactive users.

[0041] The second step is privacy reconstruction. This involves batch retrieving the publicly available latent feature vectors of target users through the system's provided API. Input the trained reconstruction model and output the reconstructed private latent feature vector. .

[0042] The third step is to simulate recommendation ratings. This involves using the system's publicly available recommendation model. , will be reconstructed As its private vector input recommendation model Calculate the relationship between each user and all other users in the system. Public latent feature vectors Interaction score between them: The higher the calculated score, the greater the probability that the two users are friends.

[0043] Step 4: Generate results. For each target user, generate all interaction scores. Sort by height from highest to lowest, and select the top-ranked items. The system outputs a list of the top-k target users' real friends, calculates the evaluation index values ​​of the predicted friend list and the real friend list, and quantifies the privacy risk level of the target federated social matching system based on these index values. This invention uses any one of the commonly used recommendation system metrics: AUC, Precision@K (top K precision), and Recall@K (top K recall). Before defining the specific formula, the following notation is first defined: for any target user... ,remember Let be the inferred set of the top 10 users with the highest matching scores (i.e., the inferred friend list); Let be... For this user The set of real friends in the original data (i.e., Ground Truth).

[0044] 1. AUC (Area Under the Curve): Used to measure the overall quality of the predicted ranking list. The higher the AUC value (the closer to 1), the higher the probability of giving scores to real friends than to non-friends, meaning the stronger the ranking ability of the residual reconstruction model.

[0045] 2. Precision@k (Precision of the first k): This represents the proportion of actual target user friends among the first k inferred potential friends. In this embodiment, Precision@K is calculated by averaging over all users in the system: The higher the value of this indicator, the more real friends make up the generated list, and the more accurate the prediction.

[0046] 3. Recall@K (Top K Recall Rate): This metric represents the proportion of real friends among the top k inferred potential friends, out of the user's total number of real friends. Recall@K is calculated by averaging across all users in the system. The higher the value of this indicator, the more comprehensive the real friends of the target user identified.

[0047] By setting threshold values, risks are categorized into low, medium, and high risks. For example, an AUC < 0.7 indicates low risk, suggesting good privacy protection and an inference accuracy close to random guessing; 0.7 ≤ AUC ≤ 0.9 indicates medium risk, suggesting some privacy leakage that requires attention; and AUC > 0.9 indicates high risk, suggesting serious privacy leakage that requires immediate protective measures.

[0048] The effects of the present invention will be further explained below with reference to simulation experiments.

[0049] Simulation test conditions: The simulation test environment for this invention is Ubuntu Server, equipped with four NVIDIA GeForce RTX 2080 Ti GPUs, an Intel Xeon CPU E5-2680 v4 processor, and 128GB of memory. The deep learning framework used is PyTorch.

[0050] The dataset used in the simulation is the YouTube social network dataset. This dataset is a real-world social network dataset, and for experimental purposes, it has been cropped to some extent. After cropping, the YouTube dataset contains 8,687 users and 328,766 friend relationships.

[0051] The existing comparison methods used in the simulation are as follows: 1. RPA (Replace Attack): This attack method is a weakened version of the present invention. It assumes the attacker directly uses the target user's publicly available latent feature vectors. Use it to replace private vectors for inference.

[0052] 2. PPA (Popular Attack): Attackers infer predicted scores between users based on their popularity; users with more friend relationships have higher predicted scores. This attack method is only related to the dataset being attacked, not to the model.

[0053] 3. RDA (Random Attack): An attacker randomly infers the predicted scores between users. In this case, the predicted users' friends are also completely random, and the prediction results are unrelated to the model and the dataset.

[0054] To verify the universality of the method of this invention for federated recommendation models with different structures, this embodiment selects two representative basic recommendation models for testing: a typical linear model and a typical nonlinear model. 1. Fed-MF (Matrix Factorization): A classic matrix factorization model, representing a linear recommendation model. Its scoring function uses the dot product of the user's private vector and public vector, exhibiting strong structural symmetry.

[0055] 2. Fed-MLP (Multi-Layer Perceptron): A deep learning recommendation model based on multi-layer perceptrons, representing a non-linear model. It captures high-order features by cascading user vectors and then inputting them into a multi-layer neural network.

[0056] In the experiment, the embedding dimension d of the above models was fixed at 32.

[0057] To quantify the effectiveness of the method of this invention, this embodiment uses AUC, Precision@K (first K precision) and Recall@K (first K recall) commonly used in recommendation systems as core evaluation metrics.

[0058] Simulation Experiment 1: Compare the attack performance of the present invention with existing baseline methods under different recommendation models. The attack performance is used to characterize the depth and accuracy of privacy risk assessment. The better the attack performance, the more accurate the privacy risk assessment.

[0059] The simulation process is as follows: First, Fed-MF, Fed-MLP, Fed-NCF, and Fed-LightGCN recommendation models are trained in a federated learning environment until convergence.

[0060] Secondly, the method of this invention and existing comparative methods were used to infer friends among users on the test set. Finally, the AUC, Precision@20, and Recall@20 metrics of the inference results were calculated. The results are shown in Table 1 below (using the YouTube dataset as an example): Table 1 Table 1 above shows that, on the YouTube dataset, whether targeting the linear Fed-MF model or the nonlinear Fed-MLP model, the attack performance of this invention is significantly better than existing RPA, PPA, and RDA methods on all metrics, indicating that it can reliably detect privacy leakage risks in federated social matching systems and provide accurate basis for system security improvements.

[0061] Simulation Experiment 2: Investigating the Proportion of Users Who Leaked Information Impact on attack effectiveness The simulation process is as follows: First, Fed-MF, Fed-MLP, Fed-NCF, and Fed-LightGCN recommendation models are trained in a federated learning environment until convergence.

[0062] Secondly, using the method of this invention, different proportions of users who leaked information were used to infer friends among users in the test set. Finally, the AUC, Precision@20, and Recall@20 metrics of the inference results were calculated. The results are shown in Table 2 below (using the YouTube dataset as an example): Table 2 Table 2 above shows that even in In smaller cases, the friend list prediction based on the reconstructed vector still maintains high accuracy. This result reveals the privacy risk of federated social matching systems: prediction accuracy is positively correlated with privacy risk, and high accuracy means that the system needs to strengthen privacy protection mechanisms, which has strong practical significance.

[0063] This embodiment also provides a privacy risk assessment system for a federal social matching system that implements the above-described privacy risk assessment method for the federal social matching system, comprising: The data acquisition module is used to acquire the public recommendation model parameters of the federated social matching system, the public latent feature vectors of all users, and the private latent feature vectors of authorized users in the second user set, and to construct a training sample set. The recommendation model of the federated social matching system is trained on a simulated social dataset. The system users in the simulated social dataset are divided into a first user set, a second user set, and a third user set. The private latent feature vectors of the second user set can be accessed with authorization during the evaluation phase. The model reconstruction module is used to build residual reconstruction models; A model training module is used to perform supervised training of the residual reconstruction model using the training sample set; The risk assessment module is used to input the public latent feature vectors of target users in the third user set into the trained residual reconstruction model to obtain the reconstructed private latent feature vectors; calculate the interaction score based on the reconstructed private latent feature vectors, generate a predicted friend list, and assess the system's privacy risks by comparing the predicted list with the real friend list.

[0064] For the system embodiments, since they basically correspond to the method embodiments, relevant details can be found in the descriptions of the method embodiments; the implementation methods of the remaining modules will not be repeated here. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0065] The system embodiments of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The system embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.

[0066] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. Those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for privacy risk assessment of a federated social matching system, the method comprising: The method comprises the following steps: (1) training a target federated social matching system using a simulated social data set to obtain a trained system comprising recommended model parameters, user public latent feature vectors, and user private latent feature vectors; (2) dividing system users into a first user set, a second user set, and a third user set, wherein the private latent feature vectors of the second user set can be authorized to be accessed during the evaluation stage; (3) constructing a training sample set based on the public latent feature vectors and the private latent feature vectors of the second user set; (4) constructing a residual reconstruction model and performing supervised training of the model using the training sample set; the residual reconstruction model comprises a linear transformation path and a nonlinear transformation path arranged in parallel; the linear transformation path directly linearly maps the input public latent feature vectors through a learnable weight matrix, and the nonlinear transformation path performs nonlinear feature extraction on the input through a multilayer perceptron; the outputs of the two paths are added through a residual connection to obtain a reconstructed private latent feature vector; (5) inputting the public latent feature vectors of target users in the third user set into the trained residual reconstruction model to obtain reconstructed private latent feature vectors; (6) calculating an interaction score based on the reconstructed private latent feature vectors, generating a predicted friend list, and evaluating the system privacy risk by comparing the predicted list with the real friend list.

2. The method of privacy risk assessment of a federated social matching system of claim 1, wherein, In step (1), the simulated social data set is generated based on a real social network topology, all users participate in system training through a federated learning framework, each user trains a local model using private data on a local device, and only uploads model gradients to the server for secure aggregation; in the trained system, the public latent feature vectors are stored on the server, and the private latent feature vectors are only stored on the user's local device.

3. The method of privacy risk assessment of a federated social matching system of claim 2, wherein, The simulated social data set includes a user relationship graph generated based on a real social network topology, time series data simulating user interaction behavior, and a user attribute feature matrix.

4. The method of privacy risk assessment of a federated social matching system of claim 1, wherein, In step (2), the division ratio of the three user sets is: the second user set accounts for 2%-10% of the total number of users, the third user set accounts for 10%-30%, and the rest is the first user set; the second user set is used as auxiliary training users, and their private latent feature vectors are used for supervised training of the reconstruction model.

5. The method of privacy risk assessment of a federated social matching system of claim 4, wherein, The mathematical expression of the reconstruction model is: ； wherein, denotes the reconstructed private latent feature vector, denotes the input public latent feature vector, denotes a nonlinear path, in particular a multilayer perceptron comprising at least two hidden layers with a nonlinear activation function between the layers; and denote the learnable weight matrix and bias vector of the linear transformation path, respectively.

6. The method of privacy risk assessment of a federated social matching system of claim 1, wherein, In step (4), the supervised training optimizes the model parameters using a hybrid loss function, which combines mean square error loss and contrastive loss and introduces a learnable uncertainty parameter to adaptively balance the loss weights.

7. The method of privacy risk assessment of a federated social matching system of claim 6, wherein, The total loss function expression is: ； wherein, and is a learnable uncertainty parameter for balancing the two loss terms, taking values from 0 to 1; is the mean squared error loss, which is calculated as follows: for each sample in the batch of training samples, the average of the squared Euclidean norm between the reconstructed vector and the true vector is calculated; is the contrastive loss, which is calculated by comparing the similarity of positive sample pairs consisting of a reconstructed vector and the corresponding true vector, and negative sample pairs consisting of a reconstructed vector and other true vectors, maximizing the similarity of positive sample pairs while minimizing the similarity of negative sample pairs using the noise-contrastive estimation principle; is the total loss.

8. The method of privacy risk assessment of a federated social matching system of claim 1, wherein, In step (6), the generation of the predicted friend list comprises: Using the public recommended model of the system, the interaction scores between the reconstructed private latent feature vectors of the target user and the public latent feature vectors of all other users in the system are calculated; the interaction scores are sorted from high to low to generate a candidate user sequence; based on a preset threshold K, the top K users in the sequence are selected as the predicted friend list, where K is a positive integer and is determined based on the accuracy requirement of the privacy risk evaluation.

9. A privacy risk assessment system of a federated social matching system, configured to implement the method of privacy risk assessment of the federated social matching system of claim 1, wherein the system It comprises: a data acquisition module configured to acquire public recommendation model parameters of a federated social matching system, public latent feature vectors of all users, and private latent feature vectors of authorized users in a second user set, and to construct a training sample set; the recommendation model of the federated social matching system is trained by a simulated social data set, and system users in the simulated social data set are divided into a first user set, a second user set, and a third user set, wherein the private latent feature vectors of the second user set can be authorized to access in an evaluation stage; a reconstruction model construction module configured to construct a residual reconstruction model; a model training module configured to supervise training of the residual reconstruction model by using the training sample set; a risk evaluation module configured to input a public latent feature vector of a target user in the third user set into the trained residual reconstruction model to obtain a reconstructed private latent feature vector, to calculate an interaction score based on the reconstructed private latent feature vector, to generate a predicted friend list, and to evaluate a system privacy risk by comparing the predicted list with an actual friend list.

10. The privacy risk assessment system of the federated social matching system of claim 9, wherein, The supervised training optimizes model parameters by using a hybrid loss function, the hybrid loss function combines a mean square error loss and a contrastive loss, and introduces a learnable uncertainty parameter to adaptively balance loss weights.

Images