Privacy training data leakage risk detection method for sequence recommendation system

Abstract

The invention discloses a sequence recommendation system-oriented privacy training data leakage risk detection method, and belongs to the technical field of sequence recommendation models and privacy protection. Aiming at the problems that the privacy training data leakage risk exists in a sequence recommendation model and the risk is difficult to accurately evaluate in a Top-K label black box scene in an existing method, the method comprises the following steps of: firstly, obtaining a target model and an auxiliary data set, dividing, training a shadow model, obtaining agent model integration through knowledge distillation, extracting comparison performance characteristics to generate a training sample, and finally obtaining a sequence recommendation model; and finally, the dichotomy attack model is used for evaluating the privacy leakage risk of the target data set. The method is mainly used for detecting the privacy training data leakage risk of the sequence recommendation model, and is suitable for third-party model security audit and privacy compliance check scenes.

Description

Technical Field

[0001] This invention relates to the fields of sequence recommendation models and privacy protection technology. More specifically, this invention relates to a method for detecting the risk of privacy training data leakage in sequence recommendation systems. Background Technology

[0002] With the development of deep learning technology, sequence recommendation systems have been widely used in digital platforms such as e-commerce, video streaming, and social media. These systems analyze users' historical interaction sequences to capture their dynamic changes in interest, thereby predicting the products or content that users may be interested in in the future. Deep sequence models, such as those based on recurrent neural networks (RNNs), convolutional neural networks (CNNs), and Transformers, have become the mainstream paradigm for sequence recommendation, effectively modeling long-range temporal dependencies.

[0003] However, sequence recommendation models face serious privacy risks during training. Membership inference attacks (MIA) are one of the most typical threats. Attackers analyze the model's recommendation output for specific user interaction sequences to determine whether the sequence was used for model training, potentially revealing sensitive user behavioral information such as browsing history, purchase records, and demographic characteristics. This type of attack not only threatens personal privacy but can also be used for identity theft or targeted exploitation. Given the increasingly stringent data protection regulations (such as GDPR), privacy risk assessment of sequence recommendation models is particularly important.

[0004] Member leakage is often associated with model overfitting: models that over-memorize training data can exhibit exploitable behavioral differences between member and non-member data. Early MIA research primarily targeted traditional machine learning tasks such as image classification. Based on the attacker's access permissions, it can be categorized into white-box attacks (access to model parameters and architecture) and black-box attacks (only able to query model output). In black-box scenarios, attackers typically utilize statistical signals such as confidence scores, entropy values, and loss functions, or approximate the target model's behavior using shadow models.

[0005] However, MIA (Mean Intervention) for sequence recommendation systems faces unique challenges. First, sequence recommendation systems typically only expose the Top-K recommendation list without providing confidence scores, creating a "Top-K label black box" scenario, which renders traditional confidence-based attack methods ineffective. Second, the input to sequence recommendation systems is a discrete sequence of product IDs rather than a continuous input, making it difficult to probe the decision boundary through controlled perturbations. Third, unlike transduction-based recommendation systems, sequence recommendation systems provide personalized recommendations to all users, reducing the difference in recommendation patterns between members and non-members.

[0006] Existing MIA methods for recommendation systems have the following limitations: 1. Methods based on recommendation pattern differences (such as Biased-MIA and DL-MIA) do not perform well in sequence recommendation systems because sequence recommendation provides personalized recommendations to both members and non-members, lacking obvious pattern differences.

[0007] 2. Heuristic methods (such as GAP) make inferences based solely on the correctness of the target model's predictions, ignoring the differences in prediction difficulty among different sequences: easily predictable sequences may be correctly predicted regardless of whether they are members, while difficult sequences may be incorrectly predicted, leading to systematic misclassification.

[0008] 3. Although model extraction methods (such as ME-MIA) use surrogate models to approximate the target model, the features extracted through knowledge distillation cannot accurately retain the discriminative signals that distinguish members from non-members, thus limiting their effectiveness.

[0009] Therefore, there is an urgent need to develop a detection method that can effectively identify the privacy leakage risk of sequence recommendation models in black-box scenarios. This method should overcome the limitation of only being able to obtain the Top-K list and explicitly consider the impact of the difficulty of sequence prediction. Summary of the Invention

[0010] One objective of this invention is to provide a method for detecting the risk of privacy training data leakage in sequence recommendation systems, so as to at least solve the above-mentioned problems.

[0011] To achieve the objectives and other advantages of this invention, a method for detecting the risk of privacy training data leakage in sequence recommendation systems is provided, comprising: S1. Obtain the target sequence recommendation model to be detected and the auxiliary dataset that conforms to the input and output format of the model, and divide the auxiliary dataset into shadow dataset and proxy dataset; S2. Train a shadow model using the shadow dataset. The architecture of the shadow model is the same as or similar to that of the target sequence recommendation model. S3. Based on the proxy dataset, using the shadow model as the teacher model, and employing the knowledge distillation method, a proxy model ensemble is trained and generated by adjusting the distillation weight α. The proxy model ensemble contains multiple proxy models with different prediction capabilities. S4. For each user interaction sequence in the shadow dataset, the shadow model and the proxy model are integrated to generate a Top-K recommendation list, and the recommendation performance index of each model on the user interaction sequence is calculated. S5. Extract comparative performance features, wherein the comparative performance features are the differences in the recommendation performance indicators of each proxy model in the integration of the shadow model and the proxy model; S6. Generate a training sample set based on the shadow dataset, wherein the training sample set includes the comparative performance features and the corresponding member or non-member labels; S7. Train a binary classification attack model using the training sample set; S8. Obtain the target dataset; using the same method as in S3, with the target sequence recommendation model as the teacher model, train and generate the proxy model ensemble corresponding to the target sequence recommendation model based on the proxy dataset; for each user interaction sequence to be evaluated in the target dataset, use the target sequence recommendation model and its corresponding proxy model ensemble to generate a Top-K recommendation list, and calculate the recommendation performance index of each model on the user interaction sequence, extracting the comparative performance features between the target sequence recommendation model and its proxy model ensemble; input the comparative performance features into the binary classification attack model trained in S7, and output the probability that the user interaction sequence belongs to a member of the training data, in order to assess the privacy leakage risk.

[0012] Preferably, the distillation weight α in S3 ranges from 0 to 1, and is used to control the balance between the proxy model imitating the behavior of the target sequence recommendation model and learning real labels; wherein, when α=0, the proxy model learns only from real labels; when α=1, the proxy model completely imitates the target sequence recommendation model; when α∈(0,1), the proxy model is trained by combining two supervision signals.

[0013] Preferably, the recommended performance metric described in S4 is NDCG@K.

[0014] Preferably, in S6, the method for generating the training sample set includes: extracting all prefix subsequences from the user interaction sequences in the shadow dataset, and extracting comparative performance features for each prefix subsequence; then, averaging and aggregating the comparative performance features of all prefix subsequences in each user interaction sequence to generate aggregated comparative performance features for each user interaction sequence; dividing the shadow dataset into a training subset and a test subset according to a ratio, marking the aggregated comparative performance features of user interaction sequences in the training subset as members with a label of 1, and marking the aggregated comparative performance features of user interaction sequences in the test subset as non-members with a label of 0.

[0015] Preferably, in S7, the binary classification attack model is one of logistic regression, XGBoost, or random forest.

[0016] Preferably, in S8, multiple risk levels are set based on the member probabilities output by the binary classification attack model. The higher the probability, the higher the risk of privacy leakage. Specifically, a probability ∈ [0, 0.25] represents level 1 risk; a probability ∈ (0.25, 0.5] represents level 2 risk; a probability ∈ (0.5, 0.75] represents level 3 risk; a probability ∈ (0.75, 0.9] represents level 4 risk; and a probability ∈ (0.9, 1.0] represents level 5 risk.

[0017] Preferably, the method further includes: when auxiliary data is unavailable, creating a synthetic sequence using the autoregressive generation capability of the target sequence recommendation model, and using the synthetic sequence to replace the auxiliary dataset for training the shadow model and the surrogate model integration; wherein, creating the synthetic sequence includes: sampling a random item as a starting marker, inputting it into the target sequence recommendation model to obtain a recommendation list, randomly sampling an item from the recommendation list and appending it to the sequence, iteratively repeating this process to generate a synthetic sequence that the target sequence recommendation model considers reasonable.

[0018] The present invention also provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the above-described method for detecting the risk of leakage of privacy training data for a sequence recommendation system.

[0019] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for detecting the risk of privacy training data leakage in a sequence-oriented recommendation system.

[0020] The present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the above-described method for detecting the risk of privacy training data leakage in a sequence recommendation system.

[0021] This invention offers at least the following advantages: First, by introducing comparative performance features representing performance differences as member inference indicators, it explicitly considers the difficulty of sequence prediction, effectively improving the accuracy of distinguishing model privacy leakage risks and achieving efficient risk assessment in a black-box environment. Second, this invention employs a collaborative design of surrogate model integration. By adjusting distillation weights to generate surrogate models with different fitting degrees, it establishes a robust prediction difficulty baseline distribution, providing high-quality supervision signals for attack classifiers and significantly improving detection performance and stability. Third, this invention achieves model risk assessment under a completely black-box setting, accurately predicting the privacy risk level of a model without accessing its training parameters, internal structure, or training process. It possesses good practicality and deployability, making it particularly suitable for third-party model security audits and privacy compliance checks.

[0022] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Detailed Implementation

[0023] The present invention will be further described in detail below with reference to embodiments, so that those skilled in the art can implement it based on the description.

[0024] It should be understood that terms such as “having,” “comprising,” and “including” as used herein do not exclude the presence or addition of one or more other elements or combinations thereof.

[0025] It should be noted that, unless otherwise specified, the experimental methods described in the following implementation plan are all conventional methods, and the reagents and materials described are all commercially available unless otherwise specified.

[0026] In a first aspect, the present invention provides a method for detecting the risk of privacy training data leakage in sequence recommendation systems.

[0027] In one embodiment of the present invention, the method includes the following steps: S1. Obtain the target sequence recommendation model to be detected and the auxiliary dataset that conforms to the input and output format of the model, and divide the auxiliary dataset into shadow dataset and proxy dataset; S2. Train a shadow model using the shadow dataset. The architecture of the shadow model is the same as or similar to that of the target sequence recommendation model. S3. Based on the proxy dataset, using the shadow model as the teacher model, and employing the knowledge distillation method, a proxy model ensemble is trained and generated by adjusting the distillation weight α. The proxy model ensemble contains multiple proxy models with different prediction capabilities. S4. For each user interaction sequence in the shadow dataset, the shadow model and the proxy model are integrated to generate a Top-K recommendation list, and the recommendation performance index of each model on the user interaction sequence is calculated. S5. Extract comparative performance features, wherein the comparative performance features are the differences in the recommendation performance indicators of each proxy model in the integration of the shadow model and the proxy model. S6. Generate a training sample set based on the shadow dataset, wherein the training sample set includes the comparative performance features and the corresponding member or non-member labels; S7. Train a binary classification attack model using the training sample set; S8. Obtain the target dataset; using the same method as in S3, with the target sequence recommendation model as the teacher model, train and generate the proxy model ensemble corresponding to the target sequence recommendation model based on the proxy dataset; for each user interaction sequence to be evaluated in the target dataset, use the target sequence recommendation model and its corresponding proxy model ensemble to generate a Top-K recommendation list, and calculate the recommendation performance index of each model on the user interaction sequence, extracting the comparative performance features between the target sequence recommendation model and its proxy model ensemble; input the comparative performance features into the binary classification attack model trained in S7, and output the probability that the user interaction sequence belongs to a member of the training data, in order to assess the privacy leakage risk.

[0028] Specifically, during the acquisition and partitioning of the auxiliary dataset, the auxiliary dataset must maintain consistency with the input and output format of the target sequence recommendation model. Its source can be publicly available sequence recommendation datasets, or anonymized user interaction log data from e-commerce or video platforms. When partitioning the auxiliary dataset into shadow and proxy datasets, the partition ratio can be 5:5, 7:3, 8:2, or 9:1, with 5:5 being the preferred ratio. During partitioning, it is necessary to ensure that the user interaction sequences in the two datasets maintain similar statistical characteristics in terms of length distribution and the proportion of interactive item types. After partitioning, the datasets need to be preprocessed to remove empty sequences without effective interactions and to truncate or pad sequences that are too long or too short, ensuring a unified data format to adapt to subsequent model training.

[0029] During model training, the architecture of the shadow model should be selected based on the target sequence recommendation model. For example, if the target model is a Transformer-based SASRec architecture, the shadow model can directly adopt the same SASRec architecture. The optimizer for training the shadow model can be Adam or SGD, with a learning rate set between 1e-5 and 1e-3. The number of training epochs is adjusted according to the dataset size, typically between 50 and 200 epochs. When training the surrogate model ensemble, the distillation weight α can be set to 0, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, or 1. Each α value corresponds to training one surrogate model. The final surrogate model ensemble can contain 3 to 11 surrogate models trained with different α values. During training, the Top-K recommendation output of the shadow model is used as the soft label, and the real interaction labels of the surrogate dataset are used as the hard label. The learning weights of the two labels are adjusted by α to enable different surrogate models to develop differentiated predictive capabilities.

[0030] In the feature extraction and sample set construction phase, the K value in the Top-K recommendation list can be selected as 5, 10, or 20. The recommendation performance metric is NDCG@K. When calculating this metric, the Top-K recommendation list generated by the model needs to be compared with the user's actual subsequent interaction items. The metric value for each user interaction sequence is obtained according to the standard NDCG calculation process. When extracting comparative performance features, for each proxy model in the proxy model ensemble, the NDCG@K difference between the shadow model and the proxy model on the same user interaction sequence is calculated separately. These differences are then integrated into the comparative performance feature of the sequence. When generating the training sample set, all prefix subsequences are first extracted from each user interaction sequence in the shadow dataset. Comparative performance features are extracted from each prefix subsequence and then averaged to obtain the aggregated comparative performance feature of the user interaction sequence. Then, the shadow dataset is divided into a training subset and a test subset in a 5:5 ratio. The aggregated comparative performance feature of the training subset is labeled as member label 1, and the test subset is labeled as non-member label 0. Finally, the feature values ​​of the sample set are normalized so that the feature values ​​are within the range of 0 to 1.

[0031] In the attack model training and risk assessment phase, the binary classification attack model can use logistic regression, XGBoost, or random forest. During training, the training samples are divided into training and validation sets at a 9:1 ratio. A 5-fold cross-validation method is used to determine the model hyperparameters. For logistic regression, the regularization coefficient can be 0.01, 0.1, or 1; for XGBoost, the tree depth can be 3, 5, or 7; and for random forest, the number of trees can be 100 or 200. Classification accuracy is used as the evaluation metric during training. Training stops when the classification accuracy on the validation set shows no significant improvement over several consecutive rounds. For privacy leakage risk assessment, after obtaining the target dataset, a Top-K recommendation list is generated for each user interaction sequence to be evaluated, following the same method as the shadow dataset, and NDCG@K is calculated. Comparative performance features of the target sequence recommendation model and the proxy model are extracted. These features are then input into the trained attack model, which outputs the probability that the sequence belongs to a member of the training data. This probability is used to assess the corresponding privacy leakage risk.

[0032] The method described in this embodiment can detect the risk of privacy training data leakage in sequence recommendation models in a black-box scenario where only the model's Top-K recommendation list is obtained. By extracting comparative performance features and combining them with a proxy model integration design, it overcomes the problem of poor performance of traditional detection methods in sequence recommendation scenarios, improving the accuracy and stability of risk detection. Furthermore, this method does not require access to the target model's internal parameters and training process; detection can be performed solely based on the model's output. This makes it adaptable to practical applications such as third-party model security audits and privacy compliance checks, demonstrating strong practicality and deployability. In contrast, existing model extraction methods (such as ME-MIA), while using proxy models to approximate the target model, cannot accurately retain the discriminative signals distinguishing members from non-members due to the limitations of features extracted through knowledge distillation, resulting in limited detection effectiveness.

[0033] In another embodiment of the present invention, the distillation weight α in S3 ranges from 0 to 1, and is used to control the balance between the proxy model in imitating the behavior of the target sequence recommendation model and learning real labels; wherein, when α=0, the proxy model learns only from real labels; when α=1, the proxy model completely imitates the target sequence recommendation model; when α∈(0,1), the proxy model is trained by combining two supervision signals.

[0034] Specifically, the distillation weight α ranges from 0 to 1. This range is set to control the learning direction of the surrogate model. In practical applications, specific values ​​for α include 0, 0.2, 0.4, 0.6, 0.8, and 1.0. These values ​​are adjusted based on the size of the surrogate dataset, the fitting effect of the shadow model, and the subsequent requirements for the predictive power of the surrogate model. For example, when the surrogate dataset has a large sample size and its data distribution is similar to that of the target model's training data, intermediate values ​​such as 0.3 and 0.5 can be considered first; when it is necessary to focus on verifying the impact of the true labels on the surrogate model, smaller values ​​such as 0 and 0.1 can be selected. In the process of training the surrogate model through knowledge distillation, the specific value of α is first determined, and then it is substituted into the distillation loss function to start the training process of the surrogate model.

[0035] When α=0, the proxy model learns solely from the real labels. These real labels originate from the proxy dataset, which is partitioned from an auxiliary dataset conforming to the input / output format of the target sequence recommendation model. The proxy dataset contains the user's actual historical interaction sequences and the corresponding subsequent item labels. During training, the loss function at this stage only calculates the difference between the proxy model's predictions and the real labels, excluding the output information of the shadow model. The proxy model's parameter updates rely entirely on fitting the real labels, ultimately giving it only predictive capabilities based on real user interaction patterns.

[0036] When α=1, the surrogate model completely mimics the target sequence recommendation model. Since the shadow model's architecture is the same as or similar to the target sequence recommendation model, and it is trained on a shadow dataset, its behavior is already quite close to the target model. In this case, during surrogate model training, the loss function only calculates the difference between the surrogate model's prediction and the shadow model's output on the shadow dataset, without considering the true labels of the shadow dataset. The parameter update direction of the surrogate model is entirely aimed at matching the shadow model's output, ultimately making the surrogate model's recommendation behavior as consistent as possible with the shadow model, thus indirectly mimicking the behavior of the target sequence recommendation model.

[0037] When α∈(0,1), the surrogate model is trained using both supervisory signals. The specific value of α can be determined based on actual needs. For example, if the surrogate model is expected to retain more patterns from real data, values ​​such as 0.3 or 0.4 can be chosen; if the surrogate model is expected to more closely resemble the behavior of the target model, values ​​such as 0.6 or 0.7 can be chosen. During training, the loss function simultaneously calculates the difference between the surrogate model's prediction and the real label, and the difference between the surrogate model's prediction and the shadow model's output. The weight of these two differences in the total loss is assigned based on the value of α. The larger α is, the higher the weight of the difference in the shadow model's output and the lower the weight of the difference in the real label, and vice versa. Ultimately, this allows the surrogate model to learn real user interaction patterns while also partially mimicking the behavior of the target sequence recommendation model.

[0038] In this embodiment, by limiting the range of values ​​for the distillation weight α and the training methods of the proxy model under different values, the proxy model can achieve different degrees of balance between imitating the behavior of the target sequence recommendation model and learning real labels, thereby generating proxy models with different predictive capabilities. This provides a diverse benchmark for extracting the comparative performance features of the shadow model and the proxy model integration, which helps to more accurately capture the behavioral differences of the target sequence recommendation model on member and non-member data, and provides a reliable foundation for privacy leakage risk detection.

[0039] In another embodiment of the present invention, the recommended performance metric mentioned in S4 is NDCG@K.

[0040] Specifically, S4 explicitly specifies that the recommended performance metric used is Normalized Discounted Cumulative Gain (NDCG@K). This metric is commonly used in sequence recommendation scenarios to evaluate the degree of fit between the model-generated recommendation list and the user's actual interaction behavior. It can effectively reflect the relevance and ranking rationality of the recommendation results, and is suitable for the requirement in S4 to quantitatively compare the recommendation performance of different models. In NDCG@K, "K" represents the length of the recommendation list. When setting it, a suitable value can be selected based on the typical application scenarios of the target sequence recommendation model. Common K values ​​include 5, 10, and 20.

[0041] In this embodiment, by using NDCG@K as the recommendation performance metric, the performance evaluation standard of each model in the integration of the shadow model and the proxy model can be unified. Its normalization characteristics eliminate the bias of evaluation results under different user interaction sequence lengths and different recommendation scenarios, ensuring that the comparative performance features extracted later can truly reflect the performance differences between the models, providing high-quality input data for training the binary classification attack model, and thus ensuring the accuracy of subsequent privacy leakage risk detection.

[0042] In another embodiment of the present invention, in S6, the method for generating the training sample set includes: extracting all prefix subsequences from the user interaction sequences of the shadow dataset, and extracting comparative performance features for each prefix subsequence; then, averaging and aggregating the comparative performance features of all prefix subsequences of each user interaction sequence to generate aggregated comparative performance features for each user interaction sequence; dividing the shadow dataset into a training subset and a test subset according to a ratio, marking the aggregated comparative performance features of the user interaction sequences in the training subset as members with a label of 1, and marking the aggregated comparative performance features of the user interaction sequences in the test subset as non-members with a label of 0.

[0043] Specifically, all possible prefix subsequences are extracted from each user interaction sequence in the shadow dataset. For example, if a user interaction sequence contains 5 consecutive interactive items (item 1, item 2, item 3, item 4, item 5), the corresponding prefix subsequences include (item 1) of length 1, (item 1, item 2) of length 2, (item 1, item 2, item 3) of length 3, and (item 1, item 2, item 3, item 4) of length 4. All non-empty prefix subsequences with a length shorter than the original sequence must be extracted completely, without omitting any possible prefix form. For each extracted prefix subsequence, the corresponding comparative performance features are extracted for each prefix subsequence, following the methods used in S4 to generate a Top-K recommendation list (K can be 5, 10, or 20, determined according to the standard recommendation length of the target sequence recommendation model) and calculate NDCG@K, and in S5 to calculate the differences in NDCG@K between each proxy model in the integration of the shadow model and the proxy model. This ensures that each prefix subsequence has a complete set of comparative performance feature data.

[0044] For all prefix subsequences extracted from the same user interaction sequence, the comparative performance features corresponding to each prefix subsequence are collected, and the feature values ​​of the same dimension are averaged and aggregated. For example, if a user interaction sequence has 4 prefix subsequences, and the comparative performance feature of each prefix subsequence contains 3 dimensions (corresponding to the 3 proxy models in the proxy model ensemble), then the average value of the feature values ​​of the 4 prefix subsequences under the first dimension, the average value of the 4 feature values ​​under the second dimension, and the average value of the 4 feature values ​​under the third dimension are calculated respectively. These three average values ​​are combined to generate a unique aggregated comparative performance feature for the user interaction sequence, so that each user interaction sequence corresponds to a unified set of feature data, avoiding the influence of randomness in the features of individual prefix subsequences.

[0045] The complete shadow dataset is divided into training and testing subsets according to a preset ratio. Commonly used ratios include 5:5, 7:3, 8:2, or 9:1. The specific ratio can be determined based on the total size of the shadow dataset. If the shadow dataset contains a large number of user interaction sequences (e.g., more than 1000), a ratio of 5:5, 7:3, or 8:2 can be chosen, with 5:5 being the preferred ratio to maintain a balanced training data for the attack model. If the dataset is small (e.g., less than 500 sequences), a 9:1 ratio is preferred to ensure that the training subset has a sufficient sample size. Before partitioning, the user interaction sequences in the shadow dataset should be randomly shuffled to ensure that the training and testing subsets maintain consistency in statistical characteristics such as the length distribution of user interaction sequences and the proportion of different types of interactive items. This avoids data distribution deviations affecting the rationality of subsequent labeling.

[0046] After partitioning the shadow dataset, the aggregated comparative performance features corresponding to the user interaction sequences in the training and test subsets are labeled. The user interaction sequences in the training subset are the data used in training the shadow model and are therefore members of the shadow model's training data; thus, their aggregated comparative performance features are labeled as members with a value of 1. The user interaction sequences in the test subset were not involved in the shadow model's training process and are therefore non-members of the shadow model's training data; thus, their aggregated comparative performance features are labeled as non-members with a value of 0. After labeling, each aggregated comparative performance feature and its corresponding label form a training sample. All samples together constitute the training sample set used to train the binary classification attack model.

[0047] In this embodiment, generating the training sample set in the above manner ensures that each sample in the sample set contains representative aggregated comparison performance features and accurate member / non-member labels. The average aggregation operation reduces the impact of the randomness of individual prefix subsequence features on sample quality. Reasonable dataset partitioning and labeling provide a data distribution that conforms to the actual scenario for the binary classification attack model, enabling the attack model to learn effective features that distinguish between member and non-member sequences, laying the foundation for subsequent accurate detection of privacy leakage risks in the target sequence recommendation model.

[0048] In another embodiment of the present invention, in S7, the binary classification attack model is one of logistic regression, XGBoost, or random forest.

[0049] Specifically, the type of binary classification attack model used for training in S7 is determined through empirical comparison. Specifically, models such as logistic regression, XGBoost, and random forest can be selected as candidates, trained and hyperparameter tuned on the training sample set generated in S6, and their performance evaluated on reserved test data. Finally, the model with the highest AUC (Area Under the ROC Curve) on the test data is selected as the final binary classification attack model. This method, through data-driven evaluation, ensures that the selected model most effectively adapts to the data distribution and feature patterns of the current task, thereby achieving optimal member inference attack performance.

[0050] When logistic regression is chosen as the binary classification attack model, key parameters need to be set to ensure training effectiveness. The regularization coefficient can be chosen as 0.01, 0.1, or 1 to avoid overfitting. The optimizer is typically Adam, with the learning rate set between 1e-4 and 1e-2. During training, the training samples generated by S6 are divided into a training set and a validation set in a 9:1 ratio. Cross-entropy is used as the loss function, and gradient descent is used to minimize the loss. After each training round, the classification accuracy of the validation set is calculated. Training stops when the validation set accuracy shows no significant change for three consecutive rounds, resulting in the final logistic regression attack model.

[0051] If XGBoost is chosen as the binary classification attack model, the core parameter settings need to be adjusted based on the sample features. The tree depth can be selected as 3, 5, or 7; too deep a tree can easily lead to overfitting, while too shallow a tree may lead to underfitting. The learning rate can be selected as 0.01 or 0.1 to control the contribution of each tree to the model's prediction results. The number of trees can be set to 100 or 200 to ensure that the model has sufficient learning capacity. During training, a 9:1 sample set partitioning method is also used, and the gradient boosting algorithm is used to iteratively build the decision tree. After each iteration, the parameters are adjusted based on the performance of the validation set until the model performance is stable, thus completing the training of the XGBoost attack model.

[0052] When using random forest as the binary classification attack model, the main parameters include the number of trees and the tree depth. The number of trees can be chosen as 100, 200, or 300. Too few trees may lead to insufficient generalization ability of the model, while too many trees will increase the computational cost. The tree depth can be set to 10, 15, or unrestricted (automatically determined by the sample data). The Gini coefficient is used as the evaluation criterion for feature selection. During training, the training sample set is randomly sampled with replacement to generate an independent training subset for each decision tree. After each tree is trained independently, the final prediction result of the model for the samples is determined by majority voting. After training, the model performance is verified using a validation set to ensure the reliability of the model.

[0053] This implementation clearly defines the selectable types of binary classification attack models and provides reasonable parameter settings and training procedures for each model. This enables the attack model to effectively learn the correlation between comparative performance features and member / non-member labels in the training sample set generated by S6. Different types of models can adapt to sample sets of different sizes and feature complexities, ensuring that the attack model has stable classification capabilities. This provides reliable support for the comparative performance features of the subsequent input target sequence recommendation model and the output of accurate member probabilities, thereby ensuring the effectiveness of privacy leakage risk assessment.

[0054] In another embodiment of the present invention, in S8, multiple risk levels are set according to the member probabilities output by the binary classification attack model. The higher the probability, the higher the risk of privacy leakage. Among them, probability ∈ [0, 0.25] is level 1 risk; probability ∈ (0.25, 0.5] is level 2 risk; probability ∈ (0.5, 0.75] is level 3 risk; probability ∈ (0.75, 0.9] is level 4 risk; and probability ∈ (0.9, 1.0] is level 5 risk.

[0055] Specifically, in S8, when assessing the privacy leakage risk of user interaction sequences in the target dataset, the member probability output by the binary classification attack model trained in S7 is used as the core basis. This member probability is the probability value obtained by the attack model after analyzing each user interaction sequence to be evaluated, indicating that the sequence belongs to the training data member of the target sequence recommendation model. Its value range is naturally between 0 and 1. The entire risk level setting process requires obtaining this member probability first, and then carrying out subsequent classification work based on it to ensure that the level setting is directly related to the model output results.

[0056] Based on the above member probabilities, multiple privacy leakage risk levels are set, and the correlation rules between probability and risk are clarified. That is, the higher the member probability value, the greater the possibility that the sequence to be evaluated is identified as a member of the target model training data, and the higher the corresponding privacy leakage risk. Here, five risk levels are specifically set. This number can cover different risk scenarios from low to high, making it easy to clearly distinguish the degree of risk. When working, this correlation rule and the total number of levels need to be determined first to provide a basis for subsequent interval division.

[0057] The probability range of members from 0 to 1 is divided into specific intervals following the principle of uniform gradient, with the numerical span between adjacent intervals remaining consistent to achieve a smooth transition of risk levels. Specifically, the probability range is divided into 5 consecutive and non-overlapping intervals with a gradient of 0.25. Each interval corresponds to a fixed risk level label. During the division process, it is necessary to ensure that the interval boundaries are not repeated or omitted, covering all possible probability values, and avoiding situations where the probability value cannot match the corresponding level.

[0058] The specific correspondence between each probability interval and risk level is clearly defined. A member probability in the range of [0, 0.25] corresponds to Level 1 risk, in the range of (0.25, 0.5] it corresponds to Level 2 risk, in the range of (0.5, 0.75] it corresponds to Level 3 risk, in the range of (0.75, 0.9] it corresponds to Level 4 risk, and in the range of (0.9, 1.0] it corresponds to Level 5 risk. In actual assessment, simply substitute the member probability to be assessed into the above intervals to directly determine its risk level. The operation process is simple and clear.

[0059] In this embodiment, by setting such risk levels, the abstract member probabilities output by the binary classification attack model can be transformed into intuitive risk levels. Users do not need to deeply understand the probability calculation logic to quickly determine the degree of privacy leakage risk of each user interaction sequence in the target dataset. The division of different levels also provides a clear basis for taking differentiated privacy protection measures in the future, which helps to carry out privacy risk management work efficiently and accurately in practical applications.

[0060] In another embodiment of the present invention, the method further includes: when auxiliary data is unavailable, creating a synthetic sequence using the autoregressive generation capability of the target sequence recommendation model, and using the synthetic sequence to replace the auxiliary dataset for training the shadow model and the surrogate model integration; wherein, creating the synthetic sequence includes: sampling a random item as a starting marker, inputting it into the target sequence recommendation model to obtain a recommendation list, randomly sampling an item from the recommendation list and appending it to the sequence, iteratively repeating this process to generate a synthetic sequence that the target sequence recommendation model considers reasonable.

[0061] Specifically, when auxiliary data conforming to the input / output format of the target sequence recommendation model cannot be obtained, a backup plan is activated, which utilizes the autoregressive generation capability of the target sequence recommendation model itself to create synthetic sequences. "Unable to obtain auxiliary data" typically includes situations such as the lack of publicly available sequence recommendation datasets or the inability to obtain real user interaction logs in private scenarios. In these cases, there is no need to introduce additional external data resources; subsequent operations can be carried out solely relying on the target model's own functionality, ensuring that the entire detection process remains uninterrupted.

[0062] The created synthetic sequences will completely replace the original auxiliary dataset and be used throughout the entire process of training the shadow model and surrogate model integration. Specifically, the data processing method after replacement is consistent with that when using real auxiliary data. The synthetic sequence set needs to be divided into shadow dataset and surrogate dataset. The division ratio can be selected as 7:3, 8:2, or 9:1 depending on the total number of synthetic sequences. If the number of synthetic sequences is large (e.g., more than 2000), a 7:3 ratio can be used. If the number is small (e.g., 500-1000), a 9:1 ratio should be used. After division, they are used for knowledge distillation training of shadow model training and surrogate model integration, respectively.

[0063] The first step in creating a synthetic sequence is to determine the starting marker. This requires randomly sampling an item from the item library covered by the target sequence recommendation model. This item library is the set of all items involved in the training of the target model. During the sampling process, it is necessary to ensure that each item has an equal probability of being selected to avoid a lack of diversity in the subsequently generated synthetic sequences due to a single type of starting item. For example, if the item library contains 1500 different items, the probability of each item being selected as the starting marker is 1 / 1500.

[0064] After determining the starting markers, the iterative generation process of the synthetic sequence begins. First, the initial short sequence formed by the starting markers is input into the target sequence recommendation model. The model outputs a Top-K recommendation list, where K can be 5, 10, or 20, consistent with the length of the recommendation list output by the target model. Next, an item is randomly sampled from this recommendation list, ensuring that each item in the list has an equal probability of being selected. The sampled item is appended to the end of the current sequence, forming a new sequence with a length increased by 1. This new sequence is then input into the target model again to obtain a new recommendation list. The above sampling and appending operations are repeated until the length of the generated sequence reaches the length of the sequence typically processed by the target model (usually 10-20 items). Finally, a synthetic sequence that the target sequence recommendation model considers to conform to user interaction patterns is obtained. This method is repeated multiple times to generate a sufficient number of synthetic sequences to meet the subsequent model training requirements.

[0065] In this way, even in scenarios where real auxiliary data is unavailable, the target model can generate a synthetic sequence that meets the requirements, filling the gaps in the data. This ensures that the process of training the shadow model and the agent model integration can proceed normally, thereby guaranteeing the smooth implementation of the privacy training data leakage risk detection method for the entire sequence recommendation system. It also avoids the detection work being unable to proceed due to data problems, and improves the applicability and flexibility of the detection method in different application scenarios.

[0066] A second aspect of the present invention provides an electronic device.

[0067] The electronic device includes a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements each step of the above-described method for detecting the risk of leakage of privacy training data in a sequence recommendation system and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0068] A third aspect of the present invention provides a computer-readable storage medium.

[0069] The computer-readable storage medium stores a computer program. When executed by a processor, the computer program implements each step of the aforementioned method for detecting the risk of privacy training data leakage in sequence recommendation systems, and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0070] In a fourth aspect, the present invention provides a computer program product.

[0071] The computer program product includes computer instructions. When the computer instructions are executed by the processor, they implement each step of the above-described method for detecting the risk of leakage of privacy training data in sequence recommendation systems and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0072] The method of the present invention will be further explained and illustrated below with a specific embodiment.

[0073] (I) Experimental Preparation This embodiment uses a sequence recommendation scenario on an e-commerce platform as its background. The target sequence recommendation model to be tested adopts the SASRec model based on the Transformer architecture. The input of this model is a user product interaction sequence of length 15 (including discrete features such as product ID and interaction timestamp), and the output is a Top-10 product recommendation list, used to predict the products that users may click or purchase next. The training data of the target model comes from the Electronics subset of the publicly available e-commerce dataset Amazon Reviews. 5000 valid user interaction sequences were selected from this dataset (empty sequences with fewer than 3 interactions and abnormal sequences were removed), covering 1200 different product IDs. The auxiliary dataset also selects 6000 user interaction sequences from the Amazon Reviews subset with the same input and output format as the target model (these sequences were not used in the training of the target model to ensure that the data distribution is similar to the training data of the target model, and the deviation in product type proportion and sequence length distribution is less than 5%). The hardware used in the experiment is an Intel Xeon Gold 6248 CPU and an NVIDIA Tesla V100 GPU. The software environment is Python 3.8 and the deep learning framework PyTorch 1.10.

[0074] (II) Privacy Leakage Risk Detection Process 1. Auxiliary dataset partitioning The 6000 auxiliary dataset entries were divided into a shadow dataset (4200 entries) and a proxy dataset (1800 entries) in a 7:3 ratio. Before the division, all sequences were randomly shuffled, and stratified sampling was used to ensure that the proportion of each product type in the shadow dataset and the proxy dataset was consistent (e.g., "mobile phone accessories" accounted for 25% and "laptops" accounted for 18%), and that the proportion of sequences with a length of 10-20 remained above 90% to avoid the impact of data distribution bias on subsequent model training. After the division, the two datasets were standardized, mapping product IDs to consecutive integers and sorting timestamps according to the order of interaction to ensure compliance with the input requirements of the target model.

[0075] 2. Shadow Model Training The shadow model adopts the exact same architecture as the target SASRec model, including a 6-layer Transformer encoder, 512 hidden layers, 8 attention heads, and a dropout probability of 0.2. During training, the shadow dataset was used as the training data, the Adam optimizer was selected, the initial learning rate was set to 1e-4, and a cosine annealing strategy was used to adjust the learning rate. The training epochs were set to 100. Every 5 epochs, NDCG@10 was calculated using the validation subset of the shadow dataset (subsequent partitions) as the performance metric. Training stopped when there was no improvement in NDCG@10 on the validation set for 3 consecutive epochs. The resulting converged shadow model had an NDCG@10 on the validation set that stabilized at around 0.65.

[0076] 3. Synthesis training of proxy models Using the trained shadow model as the teacher model, knowledge distillation training was conducted based on the proxy dataset to generate a proxy model ensemble. The distillation weights α were set to 0, 0.25, 0.5, 0.75, and 1.0, corresponding to the training of 5 proxy models, forming an ensemble containing 5 models with different prediction capabilities. During training, the distillation loss function consists of two parts: When α=0, the loss function only calculates the cross-entropy loss between the surrogate model's prediction and the real interaction labels (the items the user will interact with next) in the surrogate dataset, and the surrogate model learns only from the real labels; When α=1, the loss function is a combination of ranking information loss and positive sample loss (using BPR loss), where the ranking information loss aims to keep the order of the recommended list output by the surrogate model as much as possible in the Top-10 recommended list output by the shadow model, and the positive sample loss ensures that positive sample items in the recommended list output by the surrogate model maintain a high position, and the surrogate model completely imitates the ranking behavior of the shadow model; When α=0.25, 0.5, 0.75, the loss function = α × BPR loss (ranking information loss + positive sample loss) + (1-α) × cross-entropy loss, and the surrogate model is trained by combining the real labels and the ranking signals of the shadow model. The training rounds of each surrogate model are the same as those of the shadow model (100 rounds), and the optimizer and learning rate adjustment strategies are the same to ensure uniform training conditions.

[0077] 4. Calculation of Recommended Performance Indicators For 4200 user interaction sequences in the shadow dataset, the shadow model and five proxy models were invoked, with each model outputting a Top-10 recommendation list for that sequence. Using the user's next actual interaction item as a benchmark, the NDCG@10 for each model on that sequence was calculated: First, the number and position of items overlapping with the actual items in the recommendation list were counted, and the Discounted Cumulative Gain (DCG) was calculated. Then, the Ideal Discounted Cumulative Gain (IDCG) under ideal conditions (the recommendation list completely contains the actual items and is sorted by relevance) was calculated. Finally, the NDCG@10 value was obtained by dividing DCG by IDCG. This value ranges from 0 to 1, with higher values ​​indicating better recommendation performance. Each sequence corresponds to six NDCG@10 values ​​(one from the shadow model and five from the proxy models).

[0078] 5. Comparative performance feature extraction For each user interaction sequence in the shadow dataset, extract comparative performance features: using the NDCG@10 value of the shadow model as a benchmark, calculate the difference between it and the NDCG@10 values ​​of the 5 proxy models to obtain 5 difference features (e.g., the NDCG@10 value of the shadow model is 0.72, and that of a certain proxy model is 0.65, with a difference of 0.07). These 5 differences together constitute the comparative performance features of the sequence, with a feature dimension of 5.

[0079] 6. Training sample set generation Extract all prefix subsequences (i.e., subsequences of length 1 to 14, totaling 14 prefix subsequences) from each user interaction sequence (length 15) in the shadow dataset. Extract comparative performance features for each prefix subsequence using steps 4 and 5. Then, average and aggregate the comparative performance features of the 14 prefix subsequences of the same original sequence: for each feature dimension (5 in total), calculate the average of the 14 prefix subsequences along that dimension to obtain a 5-dimensional aggregated comparative performance feature, ensuring that each original sequence corresponds to a unique set of aggregated features. Divide the 4200 shadow sequences into a training subset (2940 sequences) and a test subset (1260 sequences) in a 7:3 ratio. Sequences in the training subset that participated in shadow model training are labeled as member labels (label 1); sequences in the test subset that did not participate in shadow model training are labeled as non-member labels (label 0), ultimately forming a training sample set containing 4200 samples (each sample containing 5-dimensional features + 1 label).

[0080] 7. Training the binary classification attack model XGBoost was chosen as the binary classification attack model, with the following parameters: tree depth of 5 (to avoid overfitting), learning rate of 0.1 (to control the contribution of each tree), number of trees of 200 (to ensure sufficient model learning), regularization coefficient L2 of 0.1, and objective function of binary classification cross-entropy. The model was trained using 5-fold cross-validation: the training sample set was randomly divided into 5 parts, with 4 parts used as training data and 1 part as validation data in each iteration, repeated 5 times. The average of the 5 validation results was used as the model performance metrics (classification accuracy and F1 score). During training, training was stopped when the F1 score on the validation set showed no improvement for 5 consecutive rounds, resulting in a converged XGBoost attack model.

[0081] 8. Privacy Risk Assessment of Target Dataset Obtain the target dataset, which consists of 1000 real user interaction sequences (in the same format as the target model's input) from a subset of Amazon Reviews that were not used in the training of the target SASRec model. This dataset includes 100 "simulated member sequences" (randomly selected from the target model's training data to verify the attack's effectiveness) and 900 "non-member sequences." For each sequence, extract comparative performance features (NDCG@10 difference between the target model and the five proxy models) using the methods in steps 4 and 5 (replacing the shadow model with the target SASRec model). Input these features into the trained XGBoost attack model, and output the probability that the sequence belongs to a member of the target model's training data. Risk levels were categorized based on probability: probability ∈ [0, 0.25] was level 1 (low risk), (0.25, 0.5] was level 2 (relatively low risk), (0.5, 0.75] was level 3 (medium risk), (0.75, 0.9] was level 4 (relatively high risk), and (0.9, 1.0] was level 5 (high risk). Experimental results showed that among 100 simulated member sequences, 82% had a risk level of 4-5; among 900 non-member sequences, 78% had a risk level of 1-2, indicating a high degree of correlation between risk levels and actual member identities.

[0082] II. Comparison with Membership Inference Attack Methods for Recommender Systems Based on Single Agent Model (ME-MIA) The core ME-MIA solution is as follows: knowledge distillation is performed on the target recommendation model through a single proxy model. The attack feature is only the "difference in prediction accuracy between the proxy model and the target model" to determine whether a sequence is a member. When the feature value is higher than a preset threshold, it is judged as a member, and when it is lower, it is not a member. There is no risk level classification. However, it does not consider the difference in the difficulty of sequence prediction, which can easily lead to the problem that "easy-to-predict sequences (such as high-frequency product sequences) are misjudged regardless of whether they are members or not".

[0083] 1. Feature Effectiveness Comparison: ME-MIA uses a single "prediction accuracy difference" feature, failing to differentiate between sequence prediction difficulty. In experiments, it exhibits a high misclassification rate for easily predictable sequences (such as sequences composed of high-frequency items like "mobile phone chargers" and "earphones"), mistakenly classifying 35% of non-member easily predictable sequences as members. This invention uses the "NDCG difference between the shadow model and five surrogate models with different α values" as a comparative performance feature, explicitly considering prediction difficulty. For easily predictable sequences, the NDCG difference between the shadow model and the surrogate model is small; for difficult-to-predict sequences (such as sequences composed of unpopular items), the difference is large, effectively distinguishing sequences with different prediction difficulties. In experiments, the misclassification rate for easily predictable sequences is significantly reduced, and the misclassification rate for non-member easily predictable sequences drops below 12%.

[0084] 2. Performance Comparison of Attack Models: ME-MIA uses logistic regression as its attack model. Due to its single feature dimension and lack of consideration for prediction difficulty, its member / non-member classification accuracy on the same target dataset is low. This invention uses the XGBoost attack model, combined with 5-dimensional performance features. The attack model's classification accuracy is significantly higher than ME-MIA, and its F1 score is better, enabling more accurate identification of member and non-member sequences.

[0085] 3. Comparison of Risk Quantification Capabilities: ME-MIA only outputs a binary judgment of "member / non-member," which cannot quantify the risk of privacy leakage. Users cannot know the specific risk level of a sequence, making it difficult to formulate differentiated protection strategies. This invention, through a 5-level risk classification, can intuitively present the privacy risk of each sequence. In experiments, the matching degree between risk level and actual member identity is significantly higher than that of ME-MIA's binary judgment. For example, in sequences with risk level 5, 91% are actual member sequences; in sequences with risk level 1, 89% are actual non-member sequences, providing a clear basis for prioritizing privacy protection measures.

[0086] In summary, this invention, through its design of "proxy model integration (multiple alpha values) + comparative performance features (multi-dimensional)," not only significantly improves attack accuracy in scenarios with auxiliary data but also explicitly addresses the technical pain point of "predictable sequence misjudgment" in existing technologies through multi-dimensional features. Furthermore, the risk level classification scheme of this invention transforms the abstract "member probability" into a practical risk management basis, overcoming the limitation of existing technologies in "inability to quantify risk." This upgrades privacy risk detection from "qualitative judgment" to "quantitative assessment," making it more suitable for privacy compliance checks in real-world scenarios and providing a more practical and accurate technical solution for privacy protection in sequence recommendation models.

[0087] The number of devices and processing scale described herein are for the purpose of simplifying the description of the invention. Applications, modifications, and variations of the present invention's vehicle wading warning system will be readily apparent to those skilled in the art.

[0088] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details.

Claims

1. A method for detecting the risk of privacy-preserving training data leakage in sequence recommendation systems, characterized in that, include: S1. Obtain the target sequence recommendation model to be detected and the auxiliary dataset that conforms to the input and output format of the model. Divide the auxiliary dataset into shadow dataset and proxy dataset. S2. Train a shadow model using the shadow dataset. The architecture of the shadow model is the same as or similar to that of the target sequence recommendation model. S3. Based on the proxy dataset, using the shadow model as the teacher model, and employing the knowledge distillation method, a proxy model ensemble is trained and generated by adjusting the distillation weight α. The proxy model ensemble contains multiple proxy models with different prediction capabilities. S4. For each user interaction sequence in the shadow dataset, use the shadow model and the proxy model to integrate and generate a Top-K recommendation list, and calculate the recommendation performance index of each model on the user interaction sequence. S5. Extract comparative performance features, which are the differences in recommendation performance metrics among the various proxy models in the integration of shadow model and proxy model. S6. Generate a training sample set based on the shadow dataset. The training sample set contains comparative performance features and corresponding member or non-member labels. S7. Train a binary classification attack model using the training sample set; S8. Obtain the target dataset; using the same method as S3, use the target sequence recommendation model as the teacher model, and train the corresponding proxy model ensemble based on the proxy dataset; for each user interaction sequence to be evaluated in the target dataset, according to S4 and S5, replace the shadow model with the target sequence recommendation model, extract the comparative performance features between the target sequence recommendation model and its proxy model ensemble, and input them into the binary classification attack model trained in S7, outputting the probability that the user interaction sequence belongs to a member of the training data, in order to assess the risk of privacy leakage.

2. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, The distillation weight α mentioned in S3 ranges from 0 to 1 and is used to control the balance between the surrogate model's ability to imitate the target sequence recommendation model's behavior and its ability to learn real labels. Specifically, when α=0, the surrogate model learns only from real labels; when α=1, the surrogate model completely imitates the target sequence recommendation model; and when α∈(0,1), the surrogate model is trained by combining two types of supervision signals.

3. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, The recommended performance metric described in S4 is NDCG@K.

4. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, In S6, the training sample set is generated by: extracting all prefix subsequences from the user interaction sequences in the shadow dataset, and extracting comparative performance features for each prefix subsequence; then, averaging and aggregating the comparative performance features of all prefix subsequences in each user interaction sequence to generate aggregated comparative performance features for each user interaction sequence; dividing the shadow dataset into a training subset and a test subset according to a ratio, marking the aggregated comparative performance features of user interaction sequences in the training subset as members with a label of 1, and marking the aggregated comparative performance features of user interaction sequences in the test subset as non-members with a label of 0.

5. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, In S7, the binary classification attack model is one of logistic regression, XGBoost, or random forest.

6. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, In S8, multiple risk levels are set based on the member probabilities output by the binary classification attack model. The higher the probability, the higher the risk of privacy leakage. Specifically, a probability ∈ [0, 0.25] represents level 1 risk; a probability ∈ (0.25, 0.5] represents level 2 risk; a probability ∈ (0.5, 0.75] represents level 3 risk; a probability ∈ (0.75, 0.9] represents level 4 risk; and a probability ∈ (0.9, 1.0] represents level 5 risk.

7. The method for detecting the risk of privacy training data leakage in sequence recommendation systems as described in claim 1, characterized in that, Also includes: When auxiliary data is unavailable, a synthetic sequence is created using the autoregressive generation capability of the target sequence recommendation model. This synthetic sequence is then used to replace the auxiliary dataset for training the shadow model and the surrogate model ensemble. The creation of the synthetic sequence includes sampling a random item as a starting marker, inputting it into the target sequence recommendation model to obtain a recommendation list, randomly sampling an item from the recommendation list and appending it to the sequence, iteratively repeating this process to generate a synthetic sequence that the target sequence recommendation model deems reasonable.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the privacy training data leakage risk detection method for a sequence-oriented recommendation system as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the privacy training data leakage risk detection method for a sequence-oriented recommendation system as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The method includes computer instructions that, when executed by a processor, implement the steps of the privacy training data leakage risk detection method for a sequence-oriented recommendation system as described in any one of claims 1 to 6.