Cluster-based recommendation system interaction level member inference attack method, storage medium and computer device
By constructing a shadow dataset and generating multi-interest user representations through clustering, and combining candidate item similarity to construct attack feature vectors, this approach solves the problems of coarse granularity and ranking bias in existing methods for interaction-level auditing. It achieves fine-grained interaction-level auditing in recommendation systems, improving accuracy and efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- INST OF COMPUTING TECH CHINESE ACAD OF SCI
- Filing Date
- 2026-02-12
- Publication Date
- 2026-06-02
Smart Images
Figure CN122133181A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of system privacy auditing technology, and in particular to a clustering-based method for attacking interactive-level members of a recommendation system, a storage medium, and a computer device, which are used to audit the data usage of a recommendation system for privacy purposes. Background Technology
[0002] Recommender systems are intelligent systems that predict content a user might be interested in based on their historical behavior, interests, and item characteristics. Through personalized sorting and recommendation strategies, they help users quickly find the most relevant items from a large amount of information. They play a crucial role in e-commerce, social media, content platforms, and other similar scenarios.
[0003] Recommender systems, which learn from large-scale user-item interactions to provide personalized experiences, have become the cornerstone of modern online services such as e-commerce, social media, and entertainment platforms. However, user behavior contains sensitive personal information that may be used or leaked without authorization, posing serious privacy risks. To quantify and assess the privacy risks of recommender systems, Membership Inference Attacks (MIAs) are widely used in privacy auditing. The core objective of MIAs is to determine whether a particular sample exists in the model's training data, thereby revealing potential privacy breaches.
[0004] Currently, member inference attacks targeting recommender systems primarily focus on the user level, specifically determining whether a user exists in the system's training set. The core assumption is that users in the training set tend to have similar historical interactions with the items recommended by the system. However, user-level attacks have significant limitations: they treat all user interactions as a single entity—either all are in the training set or none are—making the attack granularity too coarse to meet current auditing requirements. For example, under privacy mechanisms such as the "right to be forgotten," users can request the removal of certain personal data from the model's training set. Users may want to know if a particular piece of data has been correctly deleted. This scenario necessitates fine-grained auditing of each interaction, thus driving the development of interaction-level member inference.
[0005] Furthermore, since attackers can only access the model's output and cannot observe its internal parameters, existing user-level MIA methods typically reconstruct user representations using a sorted list of recommendations, assigning higher weights to top-ranked items to represent users. While this approach is effective at the user level, directly applying it to interaction-level membership inference introduces positional bias: interactions similar to high-ranking items are more likely to be identified as members, while interactions similar to low-ranking items are more likely to be identified as non-members.
[0006] The training process of recommender systems increasingly relies on large-scale user data, and models may misuse personal data (such as user behavior and transaction records in social networks) without permission, leading to privacy risks. To comply with regulations such as GDPR, automated tools need to be developed to audit data usage. However, most current member inference attacks targeting recommender systems focus on the user level, i.e., determining whether a user is in the training set. This level of inference attack is not applicable to auditing scenarios involving partial user data or single data points. Summary of the Invention
[0007] To address the following technical issues in privacy auditing of data usage in existing recommender systems: Traditional member inference attack methods primarily focus on the user level, auditing all historical user interactions as a whole, failing to pinpoint whether specific user-item interactions were used by the model, resulting in coarse audit granularity and low accuracy. Furthermore, existing user-level methods generally rely on ranking discount user representations, which are ineffective for interaction-level member inference attacks, further reducing audit reliability. This invention proposes a clustering-based interaction-level member inference attack method, storage medium, and computer equipment for recommender systems. By clustering the recommender list to model multi-interest representations of users, it effectively alleviates ranking bias and enhances the expressive power of user representations, thereby significantly improving the accuracy and efficiency of privacy auditing of data usage in recommender systems at the interaction level.
[0008] To achieve the aforementioned technical effects, on the one hand, this invention provides a clustering-based method for attacking interaction-level membership inference in recommendation systems, comprising the following steps:
[0009] Construct a shadow dataset with the same distribution as the training dataset of the target recommendation system, and train a shadow recommendation model based on the shadow dataset;
[0010] For each user in the shadow dataset, obtain the recommendation list provided by the shadow recommendation model.
[0011] Cluster the recommendation list to generate user representation vectors that represent users' multiple interest preferences;
[0012] Based on the user representation vector, the vector representation of the candidate item, and the similarity between the candidate item and each cluster, an attack feature vector is constructed; and the attack feature vector is used to train the attack model.
[0013] The attack model, which has been trained, is used to input the interaction to be audited into the target recommendation system in order to determine whether the interaction to be audited belongs to the training data of the target recommendation system.
[0014] Furthermore, the recommendation list is clustered to generate user representation vectors representing users' multiple interest preferences, specifically including:
[0015] The K-means clustering algorithm is used to divide the item vectors in the recommendation list into multiple interest clusters in the cosine similarity space;
[0016] Calculate the cluster center vector for each of the interest clusters;
[0017] The user representation vector is obtained by averaging and aggregating the cluster center vectors of all interest clusters.
[0018] Furthermore, the expression for the user representation vector is:
[0019] ;
[0020] in, , For the number of clusters, For the first Clusters, Let be the embedding vector of the j-th item in the recommendation list.
[0021] Furthermore, the step of constructing an attack feature vector based on the user representation vector, the vector representation of the candidate item, and the similarity between the candidate item and each cluster specifically includes:
[0022] Calculate the cosine similarity between the vector representation of the candidate item and the cluster center vector of each interest cluster;
[0023] The attack feature vector is obtained by concatenating the user representation vector, the vector representation of the candidate item, and all the calculated cosine similarities.
[0024] Furthermore, the expression for the attack feature vector is:
[0025] ;
[0026] in, For user-represented vectors, Let be the vector representation of the candidate item. The similarity between the candidate item and each cluster is given. , Let be the cluster center vector of the interest cluster.
[0027] Furthermore, the construction of a shadow dataset with a distribution consistent with the training dataset of the target recommendation system specifically includes:
[0028] From the benchmark dataset that is distributed in the same way as the target dataset, generate a target dataset and a shadow dataset that are mutually exclusive according to the user's partitioning method.
[0029] Furthermore, the attack model is a multilayer perceptron model trained using the cross-entropy loss function.
[0030] Furthermore, the method is executed under a black-box setting where only the output of the target recommendation system can be queried.
[0031] Secondly, the present invention also provides a storage medium for storing a computer program for executing the above-described clustering-based recommendation system interaction-level member inference attack method.
[0032] Thirdly, the present invention also provides a computer device, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the clustering-based interactive member inference attack method for recommendation systems as described above.
[0033] This invention presents a clustering-based method for attacking interaction-level member inference in recommender systems, used to audit whether a specific user-item interaction data has been used in a recommender system. By clustering user recommendation lists into multiple interest clusters, a multi-interest user representation is constructed. This representation is then combined with candidate item vectors and their similarity to each cluster to form attack features. Finally, an attack model is trained for fine-grained judgment. Thus, this invention achieves fine-grained auditing of recommender system data usage at the interaction level, effectively solving the coarse-grained problem of traditional user-level methods. Through clustering multi-interest representation, it significantly alleviates ranking bias caused by recommender list sorting, improving the accuracy of member inference, especially in low false positive scenarios, providing a reliable technical tool for data compliance and privacy protection. Attached Figure Description
[0034] Figure 1 A flowchart illustrating the steps of the clustering-based recommendation system interaction-level member inference attack method provided in an embodiment of the present invention;
[0035] Figure 2 The flowchart illustrates the working principle of the clustering-based recommendation system interaction-level member inference attack method according to an embodiment of the present invention.
[0036] Figure 3 A schematic diagram of the structure of the computer device provided by the present invention. Detailed Implementation
[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0038] It should be noted that references to "an embodiment," "embodiment," "example embodiment," etc., in this specification refer to the described embodiment including specific features, structures, or characteristics, but not every embodiment must include these specific features, structures, or characteristics. Furthermore, such expressions do not refer to the same embodiment. Moreover, when describing specific features, structures, or characteristics in conjunction with embodiments, whether or not explicitly described, it is indicated that incorporating such features, structures, or characteristics into other embodiments is within the knowledge of those skilled in the art.
[0039] Furthermore, certain terms are used in the specification and subsequent claims to refer to specific components or parts. Those skilled in the art will understand that manufacturers may use different names or terms to refer to the same component or part. This specification and subsequent claims do not distinguish components or parts by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and subsequent claims are open-ended and should be interpreted as "including but not limited to." Additionally, the term "connection" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connections made through other means.
[0040] Research on interaction-level member inference attacks has revealed that user preferences are typically composed of multiple latent interests. In real-world scenarios, a user often simultaneously shows interest in items across multiple categories or themes. For example, a user on a music platform might enjoy pop, classical, and indie rock simultaneously; on an e-commerce platform, they might purchase electronics as well as cosmetics or home goods. Because these interests are diverse and independent, a user's recommendation list will exhibit multiple preference clusters in different directions, rather than revolving around a single primary interest set. This means that user behavior patterns are actually driven by multiple interest structures, rather than determined by a single interest. Based on this, this invention proposes a clustering-based interaction-level member inference attack method for recommendation systems. By dividing the recommendation list into multiple interest groups and aggregating these groups, a multi-interest user representation is constructed. By avoiding the ranking discount weights used in previous methods, this invention mitigates positional bias while preserving meaningful preference structures; it also provides a more accurate and reliable framework for fine-grained privacy auditing in recommendation systems.
[0041] To enable those skilled in the art to reproduce and implement the present invention, the clustering-based recommendation system interaction-level member inference attack method will be described in detail below with reference to the accompanying drawings and specific embodiments. These embodiments are specific illustrations of the present invention, and their descriptions are helpful in understanding the present invention, but should not be construed as limiting the present invention.
[0042] Figure 1 This invention illustrates a clustering-based interaction-level membership inference attack method for recommender systems, applicable to scenarios relying on user-item interaction data, such as e-commerce platforms, content recommendation platforms, social media recommendations, and music / movie / product recommendations. This method enables refined identification of whether a recommender model uses specific user-item interaction data, thereby supporting automated auditing of data usage by enterprises or regulatory agencies, ensuring training data compliance, and reducing the risk of privacy leaks.
[0043] The method provided in this embodiment is specifically executed under a black-box setting where only the output of the target recommendation system can be queried. The executing entity can be a device with auditing capabilities (such as a server). Execution under a black-box setting enables privacy auditing of data usage. The method includes the following steps:
[0044] S101: Construct a shadow dataset with the same distribution as the training dataset of the target recommendation system, and train a shadow recommendation model based on the shadow dataset. Specifically, select a benchmark dataset (such as Amazon-Book, Gowalla, Yelp 2018, etc.) that is from the same source as the training data of the target recommendation system, and divide it into two disjoint parts according to the user dimension: one part is used as the shadow dataset to simulate the audit target, and the other part is reserved as the target dataset to simulate the target system. For example, the first half of the users are divided into the target dataset. The latter half of the users were divided into shadow datasets. , where the interaction set Considered a shadow member As shadow non-members, both constitute the training set of the attack model. Based on this shadow dataset, train a shadow recommendation model with the same architecture as the target recommendation system (such as LightGCN, NGCF, or LFM); the shadow recommendation model is trained using... Train the model to simulate the behavior of the target recommendation model.
[0045] S102: For each user in the shadow dataset, obtain the recommendation list provided by the shadow recommendation model. Specifically, for each user in the shadow dataset, query the trained shadow recommendation model to obtain their personalized recommendation list. This list is a set of items sorted by the model according to the user's potential interests, where each item is represented by an embedding vector.
[0046] S103: Cluster the recommendation list to generate user representation vectors that represent users' multiple interest preferences.
[0047] In one specific implementation, step S103 includes:
[0048] The K-means clustering algorithm is used to divide the item vectors in the recommendation list into multiple interest clusters in the cosine similarity space. The cluster center vector of each interest cluster is calculated, and each cluster represents a potential interest dimension of the user, thereby capturing the user's preference structure composed of multiple potential interests. Then, the cluster center vectors of all interest clusters are averaged and aggregated to obtain the user representation vector. This user representation vector is a multi-interest representation of the user and can be used to realize structured user modeling.
[0049] In practice, let user u's recommendation list be as follows: Each item Each is represented by a d-dimensional vector, denoted as .
[0050] This embodiment uses the K-Means clustering method based on cosine similarity to... The items in the dataset are divided into several interest clusters. The clustering process can be formalized as follows:
[0051] ;
[0052] in, For the number of clusters, This is the c-th cluster.
[0053] For each cluster, its cluster center vector is represented as the mean of all item vectors within the cluster, specifically defined as follows:
[0054] ;in, Let be the embedding vector of the j-th item in the recommendation list.
[0055] The aforementioned cluster centers can respectively characterize different dimensions of user preferences. Based on this, the user is represented as the average of multiple interest cluster vectors, thus obtaining the final multi-interest user representation vector:
[0056] .
[0057] S104: Construct attack feature vectors based on user representation vectors, candidate item vector representations, and the similarity between candidate items and each cluster; and use the attack feature vectors to train the attack model.
[0058] In one specific implementation, step S104 includes:
[0059] The cosine similarity between the vector representation of the candidate item and the cluster center vector of each interest cluster is calculated. The user representation vector, the vector representation of the candidate item, and all calculated cosine similarities are then concatenated to obtain the attack feature vector. Specifically, this embodiment first calculates the cosine similarity between the embedding vector of the candidate item to be audited and the centers of each interest cluster obtained in step S103. Then, the three parts are concatenated to form the attack feature vector, where: the user representation vector reflects the overall preference structure; the candidate item vector reflects the item's own attributes; and the similarity vector between the candidate item and each interest cluster reflects the matching status between the item and each of the user's sub-interests.
[0060] In practice, the candidate item vector is calculated. With each interest cluster center The cosine similarity between them is used to measure the relevance of candidate items across different interest dimensions:
[0061] ;
[0062] This embodiment will use candidate item vectors The user representation vector *u* and the similarity between candidate items and each interest cluster are concatenated to form the input of the attack model. Through this design, the attack model can simultaneously learn the user-item matching relationship, capture the user's overall preference features, and identify the correlation between candidate items and different interest clusters, thereby achieving a more accurate inference as to whether an interaction belongs to the training set. Specifically, the input features of the attack model are defined as follows:
[0063] .
[0064] Then, a classifier (such as a multilayer perceptron (MLP) with 128-128 hidden layers) is trained using the labeled (member / non-member) attack feature vectors, and optimized using the cross-entropy loss function to obtain the final attack model. Specifically, the attack model in this embodiment uses a three-layer multilayer perceptron (MLP) with 128-128 hidden layers, and is trained using cross-entropy loss.
[0065] ;
[0066] For the interaction to be tested (u, i), query the output of the target model, i.e., the recommendation list, query the item embedding in the shadow model, calculate the user features and the cosine similarity between the item i to be tested and the cluster center, and concatenate the user representation as the embedding vector of item i and the cosine similarity as the input of the attack model.
[0067] S105: Input the auditable interaction to the target recommendation system into the trained attack model to determine whether the auditable interaction belongs to the training data of the target recommendation system. Specifically, in the actual auditing phase, for a specific user-item interaction that needs to be audited, obtain the user's recommendation list from the target recommendation system and the item embedding from the shadow recommendation system, repeat the feature construction process in steps S103 and S104 to generate the corresponding attack feature vector. Input this feature vector into the trained attack model, and the model outputs a binary classification result (member or non-member), thereby determining whether the interaction data may have been used for training the target recommendation system, achieving fine-grained privacy auditing at the interaction level.
[0068] Furthermore, by comparing the audit results with the data subject's permitted scope, it can be determined whether the target model has any unauthorized data usage.
[0069] See Figure 2 After constructing a shadow dataset with a distribution consistent with the target dataset, for each shadow user u, the set of that user's real interactions is... Treat them as shadow members, and randomly sample a set of non-member items from items that the user has not interacted with. and keep Then, it is generated through the shadow model. , construct the training set for the attack model The trained attack model can directly query and classify the interactions of the target recommendation system to output its member or non-member identity.
[0070] To verify the effectiveness and technical performance of the clustering-based interaction-level membership inference attack method (CMIA) proposed in this invention, comparative experiments were conducted on various typical recommendation models (LightGCN, NGCF, LFM) and real datasets. The experimental results are shown in Tables 1 to 3 below.
[0071] Table 1 shows the experimental results of LightGCN:
[0072]
[0073] Table 2 shows the experimental results of NGCF:
[0074]
[0075] Table 3 shows the LFM experimental results:
[0076]
[0077] Experimental results demonstrate that the clustering-based interaction-level membership inference attack method (CMIA) described in this invention exhibits significant effectiveness on three representative recommendation models and three real-world datasets. Compared to baseline methods, this method consistently outperforms the baseline method in key evaluation metrics. On the LightGCN and NGCF models, CMIA improves both classification accuracy (ACC) and AUC by approximately 1%–10% compared to the baseline method. For the LFM model, the ACC is slightly lower than the baseline method by about 1%, but in low false positive rate (low FPR) scenarios, this method achieves a significant advantage, typically improving by 10%–20%. This indicates that interest cluster-based user representations can effectively characterize user preferences, enabling the attack model to accurately identify member interactions present in the training set even under strict threshold conditions. Overall, the results validate that the method described in this invention can not only effectively distinguish between member and non-member interactions at the interaction level but also maintain a high true positive rate under low false positive rate conditions.
[0078] In summary, the clustering-based recommendation system interaction-level member inference attack method provided by this invention achieves fine-grained auditing at the interaction level for the first time, solving the problem that traditional user-level methods cannot locate specific data usage; by constructing multi-interest representations through clustering, it effectively overcomes the positional bias caused by the sorting of the recommendation list and significantly improves the inference accuracy.
[0079] This invention also provides a storage medium for storing a computer program for executing the above-described clustering-based recommendation system interaction-level member inference attack method. For example, computer program instructions, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. The program instructions for invoking the methods of this application may be stored in a fixed or removable storage medium, and / or transmitted via data streams in broadcast or other signal carrying media, and / or stored in the storage medium of a computer device operating according to the program instructions. Here, according to one embodiment of this application, it includes a... Figure 3 The computer device 400 shown preferably includes a memory 200 for storing computer programs and a processor 300 for executing computer programs. When the computer program is executed by the processor 300, the computer device 400 is triggered to execute the methods and / or technical solutions based on the foregoing embodiments.
[0080] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of the present invention is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.
[0081] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.
Claims
1. A clustering-based attack method for interactive-level membership inference in recommender systems, characterized in that, Including the following steps: Construct a shadow dataset with the same distribution as the training dataset of the target recommendation system, and train a shadow recommendation model based on the shadow dataset; For each user in the shadow dataset, obtain the recommendation list provided by the shadow recommendation model. Cluster the recommendation list to generate user representation vectors that represent users' multiple interest preferences; Based on the user representation vector, the vector representation of the candidate item, and the similarity between the candidate item and each cluster, an attack feature vector is constructed; and the attack feature vector is used to train the attack model. The attack model, which has been trained, is used to input the interaction to be audited into the target recommendation system in order to determine whether the interaction to be audited belongs to the training data of the target recommendation system.
2. The method according to claim 1, characterized in that, Clustering the recommendation list to generate user representation vectors representing users' multiple interest preferences specifically includes: The K-means clustering algorithm is used to divide the item vectors in the recommendation list into multiple interest clusters in the cosine similarity space; Calculate the cluster center vector for each of the interest clusters; The user representation vector is obtained by averaging and aggregating the cluster center vectors of all interest clusters.
3. The method according to claim 2, characterized in that, The expression for the user representation vector is: ； in, , For the number of clusters, For the first Clusters, Let be the embedding vector of the j-th item in the recommendation list.
4. The method according to claim 2, characterized in that, The step of constructing an attack feature vector based on the user representation vector, the vector representation of the candidate item, and the similarity between the candidate item and each cluster specifically includes: Calculate the cosine similarity between the vector representation of the candidate item and the cluster center vector of each interest cluster; The attack feature vector is obtained by concatenating the user representation vector, the vector representation of the candidate item, and all the calculated cosine similarities.
5. The method according to claim 4, characterized in that, The expression for the attack feature vector is: ； in, For user-represented vectors, Let be the vector representation of the candidate item. The similarity between the candidate item and each cluster is given. , Let be the cluster center vector of the interest cluster.
6. The method according to claim 1, characterized in that, The shadow dataset, which is constructed to have the same distribution as the training dataset of the target recommendation system, specifically includes: From the benchmark dataset that is distributed in the same way as the target dataset, generate a target dataset and a shadow dataset that are mutually exclusive according to the user's partitioning method.
7. The method according to claim 1, characterized in that, The attack model is a multilayer perceptron model trained using the cross-entropy loss function.
8. The method according to claim 1, characterized in that, The method is executed under a black-box setting where only the output of the target recommendation system can be queried.
9. A storage medium, characterized in that, Used to store a computer program for executing any one of the clustering-based recommendation system interaction-level member inference attack methods described in claims 1 to 8.
10. A computer device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the clustering-based interactive member inference attack method for recommender systems as described in any one of claims 1 to 7.