A differential privacy protection and utility optimization method for a generative recommendation system

Abstract

This invention proposes an optimization method for generative recommender systems based on differential privacy. Using a user's historical interaction matrix as input, a generator G and a discriminator D constitute the recommender model. The discriminator is responsible for preference modeling and recommendation ranking. First, robust parameter pre-training is performed on a public dataset: bounded perturbations are added to the discriminator parameters, and the objective function is optimized to make the model resistant to noise, resulting in insensitive initial parameters. Then, differential privacy fine-tuning is performed on a private dataset: user-level privacy protection is applied only to the discriminator. The gradient norm for each user is clipped, and the gradient is aggregated after adding Gaussian noise perturbation according to a privacy budget before updating the discriminator. The generator is updated using conventional adversarial methods, iterating until convergence. During deployment, users input their historical interactions, the model predicts scores, and the unobserved items are sorted in descending order to recommend the top K items. This invention coordinates pre-training and privacy fine-tuning, balancing privacy protection and recommendation accuracy.

Description

Technical Field

[0001] This invention belongs to the fields of computer recommendation systems and information security, and relates to a differential privacy protection and utility optimization method for generative recommendation systems. Background Technology

[0002] With the rapid development of internet technology, recommender systems have become a core component of e-commerce, social media, and streaming media platforms, providing personalized content recommendations by analyzing users' historical behavior data. However, the reliance of recommender systems on large-scale user data has also brought serious privacy risks. In recent years, Membership Inference Attack (MIA), a typical privacy attack method, has been proven to pose a serious threat to various recommender systems by analyzing model outputs to infer whether specific user data was used for model training. Generative recommender systems have attracted much attention because they can provide personalized recommendations to users who did not participate in training, effectively alleviating the cold start problem of traditional recommender systems. However, this characteristic also makes existing membership inference attack methods based on differences in recommendation patterns difficult to apply directly, but this does not mean that generative recommender systems are inherently immune to privacy attacks. Research shows that attackers can still construct personalized auxiliary models and use statistical features such as the overlap rate and ranking consistency between recommendation lists to effectively infer the membership identity of users.

[0003] Differential privacy (DP), as the most theoretically secure privacy protection mechanism, can strictly limit the impact of individual user data on model output in a probabilistic sense, making it an effective means of defending against member inference attacks. However, directly introducing differential privacy into generative recommender systems faces significant challenges: generative adversarial networks are highly sensitive to gradient accuracy and parameter stability. The gradient clipping and random noise introduced by differential privacy can disrupt the dynamic balance between the generator and discriminator, leading to unstable model training, slow convergence, and a significant drop in recommender performance. Therefore, how to maintain the usability and stability of generative recommender systems while ensuring strict privacy constraints has become an urgent technical problem to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a differential privacy protection and utility optimization method for generative recommendation systems. Through the collaborative design of parameter robustness pre-training and differential privacy fine-tuning, it effectively mitigates the negative impact of noise on recommendation performance while providing strict privacy protection, and achieves a good balance between privacy protection strength and recommendation utility.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] S1: Use an implicit feedback matrix composed of historical user interaction data to represent user preference information for items. Let the user set be... The project collection is , and Let these represent the number of users and the number of projects, respectively. Define a user-project implicit feedback matrix.

[0007] ,in:

[0008] ,

[0009] Build a generative recommender system, including a generator. and discriminator Two parts. Generator With random noise vector and user condition information As input, generate a user preference distribution for the project:

[0010] ,

[0011] Discriminator Receive real user-project interaction samples Or generate samples Output the probability that the sample originates from the true data distribution:

[0012] ,

[0013] Discriminator parameters It is the primary carrier of user privacy information, and subsequent privacy protection mechanisms will mainly focus on... .

[0014] S2: Utilizing publicly available, non-sensitive user interaction datasets For discriminator parameters Perform robust parameter pre-training. By applying bounded random perturbations to the discriminator parameters, optimize the model's loss function under the worst-case perturbation condition to obtain noise-insensitive discriminator initialization parameters. The standard loss function of the discriminator is defined as:

[0015] ,

[0016] in Expressing expectations, Represents the true data distribution. This represents the prior distribution of noise. During robust pre-training, bounded perturbations are applied to the discriminator parameters. Optimize the objective function:

[0017] ,

[0018] The generator is updated using a standard stochastic gradient optimization strategy at this stage to maintain the model’s basic generative ability and anti-convergence properties.

[0019] S3: The pre-trained data As initial parameters, in a private dataset containing real sensitive information Model fine-tuning is performed on the discriminator. During fine-tuning, user-level differential privacy protection is applied only to the parameter updates of the discriminator. Let the training round t involve randomly sampling a subset of users from the user set. For each user Based on its historical interaction data Calculate the gradient of the discriminator loss function:

[0020] ,

[0021] To limit the maximum impact of a single user on model updates, gradients for each user are processed. Norm clipping:

[0022] ,

[0023] in To ensure the pruning threshold is met The clipped gradient satisfies the sensitivity constraint:

[0024] ,

[0025] in Represents the gradient aggregation function Sensitivity. Based on a preset privacy budget. and failure probability Calculate the Gaussian noise scale .for - Differential privacy requires meeting the following noise scale requirements:

[0026] .

[0027] Subsequently, Gaussian noise is added to the aggregated gradient to obtain the perturbed gradient:

[0028] ,

[0029] in This indicates that the mean is 0 and the covariance matrix is... The discriminator parameters are updated using the perturbed gradient, following a Gaussian distribution.

[0030] ,

[0031] in Let be the learning rate for round t. The generator employs conventional adversarial training at this stage, updating parameters using privacy-preserved feedback signals from the discriminator. Based on the post-processing invariance property of differential privacy, any subsequent computation based on the output of the differential privacy mechanism will not introduce additional privacy leakage risks; therefore, the overall model satisfies the formal differential privacy constraints.

[0032] S4: Repeat step S3 for multiple rounds of iterative training until the model converges. Let the total number of training rounds be T. The privacy loss during the entire training process can be analyzed using the combinatorial theorem of differential privacy. For Rényi differential privacy (RDP), the RDP parameters updated in round t are... After T iterations, the overall RDP parameters satisfy:

[0033] ,

[0034] Convert RDP parameters to Differential privacy includes:

[0035] ,

[0036] When the model converges, the final discriminator parameters are obtained. :

[0037] ,

[0038] The entire training process meets user-level requirements. Differential privacy protection means that the impact of adding or removing any single user's data on the model's output distribution is strictly limited:

[0039] ,

[0040] in Indicates the training algorithm, and Let H be adjacent datasets (differences exist only in the data of one user), and H be any set of output events.

[0041] S5: Deploy the trained model to the recommendation system server. For any target user... Input the user's historical interaction data, and the model calculates the user's preference score for each item based on the discriminator's output. Let the user... The implicit feedback vector is The model outputs a preference prediction vector as follows: :

[0042] ,

[0043] in Indicates user Conditional information. The set of items that the user has not interacted with is denoted as... ,right The items are sorted from highest to lowest predicted score:

[0044] ,

[0045] The top K items are selected as the recommendation list and returned to the user.

[0046] ,

[0047] The quality of the recommendation list can be evaluated using hit rate (HR@K) and normalized depreciation cumulative gain (NDCG@K):

[0048] ;

[0049] ,

[0050] in Represents the set of test users. Indicates user In the test set, projects with real-world interactions were tested. This invention addresses the training instability and performance degradation caused by directly applying differential privacy in generative recommender systems. It proposes a two-stage training framework of robust parameter pre-training and differential privacy fine-tuning. First, robust pre-training on a public dataset enables the discriminator to acquire natural adaptability to noise. Then, user-level differential privacy protection is applied only to the discriminator on a private dataset, while maintaining the generator's regular update strategy. This method effectively mitigates the negative impact of differential privacy noise on recommender performance while providing strict privacy guarantees, achieving a synergistic optimization of privacy protection strength and system utility. Attached Figure Description

[0051] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0052] Figure 1 A framework diagram of a differential privacy protection and utility optimization method for generative recommender systems;

[0053] Figure 2 : Comparison of the HR metrics between this invention and other methods for ML-100K data under different privacy budgets;

[0054] Figure 3: Comparison of the NDCG metric between this invention and other methods for ML-100K data under different privacy budgets;

[0055] Figure 4 : Comparison of the HR metrics between this invention and other methods under different privacy budgets for ML-1M data;

[0056] Figure 5 Comparison of this invention with other methods on the NDCG metric for ML-1M data under different privacy budgets. Detailed Implementation

[0057] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0058] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0059] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0060] Step S1: Conduct experiments using a publicly available recommender system dataset containing implicit user feedback on items. Transform the implicit user feedback data into an implicit feedback matrix consisting of 0s and 1s. ,in Represents a set of users. Represents a collection of items. and These represent the number of users and the number of projects, respectively. For any user... and projects , Indicates user and projects There is interaction (positive feedback). This indicates no interaction (negative feedback).

[0061] The dataset is divided into training, validation, and test sets. The training set is further divided into public datasets. and private datasets The public dataset is used for robust parameter pre-training, while the private dataset is used for differential privacy fine-tuning. A generative recommender system is built, including a generator. and discriminator Both parts employ a multi-layer fully connected neural network structure. The hidden factor dimension is set to 'd', and the hidden layer dimensions of the generator and discriminator are determined based on the specific task. The activation function is LeakyReLU, and the output layer uses the Sigmoid function. Model parameters are initialized using the Xavier initialization method.

[0062] Step S2: In the public dataset Perform robust parameter pre-training on the discriminator. Set the perturbation radius. Learning rate Batch size and number of pre-training rounds The standard loss function of the discriminator is defined as:

[0063] .

[0064] In robust pre-training, bounded perturbations are applied to the discriminator parameters. Optimize the objective function:

[0065] ,

[0066] For each training batch, perform the following operations:

[0067] • from Randomly sample a batch of user-project interaction data

[0068] • Apply random perturbations to the discriminator parameters ,satisfy

[0069] • Calculate the loss after the disturbance

[0070] • Update discriminator parameters:

[0071] • Update generator parameters: The generator loss function go through Through rounds of iterative training, the initial parameters of the discriminator, which are insensitive to noise, are obtained. .

[0072] Step S3: The pre-trained data... As initial parameters, in the private dataset Differential privacy fine-tuning is performed on top of this. The privacy budget ε, failure probability δ, pruning threshold C, and learning rate are set. Batch size and fine-tuning rounds Based on the privacy budget, the noise scale σ is calculated. For (ε,δ)-differential privacy, the Gaussian mechanism requires:

[0073] ,

[0074] For the t-th training round, perform the following operations:

[0075] 1. Randomly sample a subset of users from the user set. , For batch size

[0076] 2. For each user Based on its historical interaction data Calculate the gradient of the discriminator loss function:

[0077] ;

[0078] 3. Perform gradient analysis for each user. Norm pruning limits the maximum impact of a single user on model updates:

[0079] ;

[0080] 4. Gradient after aggregation and clipping:

[0081] ;

[0082] 5. Add Gaussian noise to the aggregated gradient to obtain the perturbed gradient:

[0083] ;

[0084] 6. Update the discriminator parameters using the perturbed gradient:

[0085] ;

[0086] 7. Update generator parameters, maintaining the usual anti-update strategy:

[0087] .

[0088] During training, the model performance is evaluated periodically on the validation set. Training can be stopped early if the evaluation metrics on the validation set show no significant improvement for several consecutive rounds.

[0089] Step S4: Repeat step 3 for multiple rounds of iterative training until the model converges, obtaining the final discriminator parameters. and generator parameters The privacy loss during the entire training process can be analyzed using the combinatorial theorem of differential privacy. For Rényi Differential Privacy (RDP), the RDP parameters updated in round t are: .go through After rounds of iteration, the overall RDP parameters satisfy:

[0090] ,

[0091] Convert RDP parameters to Differential privacy includes:

[0092] ,

[0093] The entire training process meets user-level requirements. Differential privacy protection means that the impact of adding or removing any single user's data on the model's output distribution is strictly limited:

[0094] ,

[0095] in Indicates the training algorithm, and Let H be adjacent datasets (differences exist only in the data of one user), and H be any set of output events.

[0096] Step S5: Deploy the trained model to the recommendation system server. For any target user... Input the user's historical interaction data, and the model calculates the user's preference score for each item based on the discriminator output. Then, it sorts the items in the set of items that the user has not interacted with from highest to lowest according to the predicted score, and selects the top K items as a recommendation list to return to the user.

[0097] In terms of recommendation performance, experimental results show that, under the same privacy budget, the proposed method significantly outperforms the baseline method that directly incorporates differential privacy in both HR@K and NDCG@K metrics. The performance advantage is particularly pronounced in scenarios with strong privacy protection, demonstrating the effectiveness of robust parameter pre-training in mitigating the negative impact of differential privacy noise.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A differential privacy protection and utility optimization method for generative recommender systems, characterized in that, The method includes the following steps: S1: Build a generative recommender system, including a generator. and discriminator An implicit feedback matrix is ​​constructed using historical user interaction data to represent user preferences for projects. S2: Perform robust pre-training of the discriminator on a public dataset. Obtain noise-insensitive discriminator initialization parameters by applying bounded random perturbations to the discriminator parameters. ; S3: The pre-trained data As initial parameters, the discriminator is fine-tuned for privacy at the user level on a private dataset, the gradient of each user is clipped and Gaussian noise is added, while the generator’s regular adversarial update strategy is maintained. S4: Repeat step S3 iteratively until the model converges, obtaining the final discriminator parameters. ; S5: Deploy the trained model into the recommendation system, calculate the user's preference score for non-interactive items based on the discriminator output, and select the top K items to generate a recommendation list.

2. The differential privacy protection and utility optimization method for generative recommender systems according to claim 1, characterized in that: Step S1 specifically includes: Let the user set be... The project collection is Define the user-project implicit feedback matrix , Indicates user and projects There is interaction (positive feedback). Indicates no interaction (negative feedback), generator random noise vector and user condition information As input, generate a user preference distribution for the project. ,in Discriminator Receive real interaction samples Or generate samples Output the probability that the sample originates from the true data distribution. and .

3. The differential privacy protection and utility optimization method for generative recommender systems according to claim 1, characterized in that: The parameter robustness pre-training in step S2 specifically includes: utilizing a public dataset. For discriminator parameters Apply bounded perturbation Optimize the objective function: ， Where γ is the disturbance radius. Describing the L2 norm, The discriminator loss function is defined as follows: ， in Expressing expectations, Represents the true data distribution. The noise prior distribution is represented; the discriminator initialization parameters are obtained by solving the above optimization problem. .

4. The differential privacy protection and utility optimization method for generative recommender systems according to claim 1, characterized in that: The user-level differential privacy fine-tuning in step S3 specifically includes the following sub-steps: S31: Randomly sample a subset of users from the user set. , Batch size, based on its historical interaction data Calculate the gradient of the discriminator loss function: ； S32: Perform gradient processing for each user Norm pruning limits the maximum impact of a single user on model updates: ， in To ensure the pruning threshold is met The clipped gradient satisfies the sensitivity constraint: ,in Represents the gradient aggregation function Sensitivity; based on a preset privacy budget and failure probability Calculate the Gaussian noise scale ,for - Differential privacy requires meeting the following noise scale requirements: ; S33: Add Gaussian noise to the aggregated gradient to obtain the perturbed gradient: ； S34: Update the discriminator parameters using the perturbed gradient: ， in Let be the learning rate in round t; S35: Update generator parameters, maintaining the usual adversarial update strategy: 。 5. The differential privacy protection and utility optimization method for generative recommender systems according to claim 1, characterized in that: The privacy guarantee after model convergence in step S4 satisfies user-level requirements. Differential privacy, that is, for any adjacent datasets and (The difference exists only in the data of one user), algorithm satisfy: ， Where H is an arbitrary set of output events, after... After rounds of iteration, for Rényi differential privacy, the overall privacy loss satisfies: ， Convert RDP parameters to Differential privacy includes: 。 6. The differential privacy protection and utility optimization method for generative recommender systems according to claim 1, characterized in that: The recommendation list generation in step S5 specifically includes: for target users Input their historical interaction data, and the model outputs a preference prediction vector: ， in Indicates user Conditional information; the set of items that the user has not interacted with is denoted as ,right The items are sorted from highest to lowest predicted score: ， The top K items are selected as the recommendation list and returned to the user. 。

Images