Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLM recommender systems that build prompts from user histories leak membership: a black-box adversary can confirm whether a victim's interactions are in the system prompt, with attack advantage above 95% on three open LLMs.

desk verdict First MIA study for ICL-based LLM RecSys; direct inquiry is a real threat, but the contrast-attack headline is overblown. read the letter →

arxiv 2508.18665 v6 pith:YOHT45BQ submitted 2025-08-26 cs.IR cs.AIcs.CLcs.CRcs.LG

Jiajie He , Min-Chun Chen , Xintong Chen , Xinyang Fang , Yuechun Gu , Keke Chen This is my paper
classification cs.IRcs.AIcs.CLcs.CRcs.LG
keywords membershipinferenceattackin-contextlearningLLM-basedrecommendersystemspromptprivacymemorizationblack-boxfew-shotrecommendationleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that recommender systems built on large language models, which customize themselves by pasting user interaction histories into the system prompt, expose whether a given user's data is in that prompt. An adversary who already has a target user's history can confirm membership with only black-box text access: simply asking the model 'have you seen this user?' or contrasting the real history against a fake one reaches above 95% attack advantage on Llama-3, GPT-OSS-20B, and Gemma-3 across three benchmark datasets. A subtler poisoning attack, which replaces items in the user's history with semantically distant ones and watches whether recommendations budge, reaches about 60% advantage. The paper's point is that ICL's low-cost customization is also a privacy channel: the prompt itself is memorized and answerable, which is a different threat from prompt extraction and not obviously blocked by existing defenses. The authors see this as a design warning for ICL RecSys practitioners rather than a solved problem.

What carries the argument

The mechanism that carries the argument is prompt memorization: the few-shot (user, interaction set) to recommendation examples in the system prompt are retained strongly enough that the LLM answers membership questions about prompt users differently from non-members. Direct inquiry exploits this directly with a yes/no question about the target user. The contrast attack strengthens the signal by pairing the victim's real interaction against a fabricated one and asking which the model has seen, drawing on the LLM's reasoning ability. The poisoning attack works through a different channel: the adversary resubmits the user's history with items replaced by their least semantically similar counte

What would settle it

Test the direct-inquiry and contrast attacks against an ICL RecSys whose system prompt uses random pseudonyms instead of real user identifiers. If attack advantage stays above 95%, the leak resides in the interaction items themselves and the paper's mechanism is confirmed; if it collapses, the attacks are keyed to user identity and ID-obfuscation is a complete defense. A complementary check: query the model about a non-member whose items are extremely popular; if the model says 'yes,' the attacks may be detecting topical overlap with the prompt rather than genuine membership.

Watch

Extended reading notes

Core claim

The central claim is that membership inference against ICL-based LLM recommender systems is realistic and largely successful without any model internals: given a target user's known interactions, a black-box adversary can decide whether that user's record sits among the few-shot examples in the system prompt. Of five constructions tested (direct inquiry, contrast, hallucination, poisoning, and the classical similarity attack), three work well. Direct inquiry and contrast yield user-level attack advantage mostly above 95% and F1 near or above 0.9 on Llama-3, GPT-OSS-20B, and Gemma-3 on MovieLens-1M, Amazon Book, and Amazon Beauty; interaction-level results are somewhat lower but still strong.

Load-bearing premise

Every attack assumes the adversary already possesses the target user's complete interaction history; without it, none of the four attacks can start, and the measured advantage comes from a synthetic setup (LightGCN-generated recommendations, one prompt template) that may not match production prompts.

Editorial extensions

If this is right

  • Any ICL RecSys that puts user IDs and interaction histories in the system prompt is probably a membership oracle for anyone who knows a victim's history: the attacks' success is a property of the prompt channel, not of a specific model or dataset.
  • Defenses must intervene in that channel: the paper points to input monitoring, model alignment, pseudonymizing user IDs, and structural separation of instructions from user data, while noting that differentially private ICL prompt generation exists but may reduce utility.
  • The threat will likely grow with model capability, since the authors find newer and larger models (Llama-3, GPT-OSS) memorize prompts better than smaller ones (Mistral) and are therefore more vulnerable to inquiry-style attacks.
  • Classical RecSys MIA does not transfer: similarity between a user's history and recommended items in collaborative-filtering embedding space fails on LLM RecSys, whereas semantic text similarity carries the poisoning attack.
  • The hallucination-based attack direction is empirically closed for modern LLMs: counting out-of-domain recommendations does not separate members from non-members, steering future MIA design toward memorization and reasoning signals.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attacks confirm membership but extract nothing new: the adversary already holds the victim's full history, so the realistic harm is verification (establishing that a specific user's data is being processed, or confirming a suspect identity in a prompt), not bulk data theft; the paper's own framing stops short of saying so.
  • A natural extension the authors do not pursue is scaling: because direct inquiry is a single yes/no question, an adversary with a candidate pool could enumerate many users against the same prompt, and the open question is how attack advantage degrades as the prompt's shot count and the queried pool grow.
  • The poisoning attack's dependence on the mismatch between semantic embeddings and interaction-matrix embeddings suggests a testable design rule: an ICL RecSys that builds item representations from textual semantics alone should be largely immune to this particular attack, since the 'stubbornness' signal would disappear.
  • How the numbers transfer to production is untested: the evaluation uses LightGCN-generated recommendations and one published prompt template, so the measured advantages are best read as an upper bound for what an attacker would face against a hardened, real-world prompt design.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper studies membership inference against in-context-learning (ICL) LLM-based recommender systems, where user interaction histories appear in system prompts. The authors propose four named attacks: Direct Inquiry (ask the model whether it has seen a user), Contrast (compare a real interaction with a fake one), Hallucination (count out-of-domain recommendations), and Poisoning (inject modified interactions and measure recommendation stability). They also mention a Similarity attack. The attacks are evaluated on Llama-3 8B, GPT-OSS 20B, Gemma-3 4B, and Mistral 7B using MovieLens-1M, Amazon Book, and Amazon Beauty. The central claim is that direct inquiry, contrast, and poisoning achieve high attack advantage (with direct inquiry and contrast 'mostly higher than 95%' in the introduction), while hallucination fails. The paper discusses possible defenses and concludes that the MIA threat to ICL RecSys is realistic.

Significance. If the results hold, this is a useful first study of membership inference against ICL-based recommender systems. The strongest contribution is the Direct Inquiry attack: it is simple, black-box, and empirically very effective at user level across models and datasets. The paper also evaluates on multiple open-weight LLMs and standard RecSys datasets, and it correctly identifies that classical RecSys MIA assumptions (item embeddings, shadow models) need rethinking in the LLM setting. However, the quantitative claims are currently weakened by an internal inconsistency in the contrast-attack reporting, by in-sample threshold selection for poisoning/hallucination, and by the lack of a control separating prompt membership from pretraining memorization. The threat model assumes the attacker already knows the target user's full history, so the practical impact is membership verification of known data rather than extraction of unknown data; this is a scope limitation, not an error.

major comments (5)
  1. [Abstract, §1, §6.2, Table 2(b)] The abstract and introduction state that 'direct-inquiry and contrast attacks achieve mostly higher than 95% attack advantage ... and around or higher than 0.9 F1-score' and the abstract lists contrast as significantly high. This is contradicted by §6.2 ('the observed performance is actually worse, except for GPT-OSS') and Table 2(b): user-level F1 for the contrast/Confusion attack on MovieLens is 0.6688 (Llama-3), 0.7722 (Gemma-3), and 0.6768 (Mistral); only GPT-OSS reaches 0.9690. For a balanced set, F1 ≈ 0.67 corresponds to an attack advantage of roughly 0.34, far below 95%. Because contrast is a named component of the central claim, the headline must be revised to report model-dependent results.
  2. [§5.3, §5.4, Table 3] The poisoning threshold τ is described as 'determined in experiments' (§5.4), and Table 3(a) reports the F1 obtained at that same threshold; similarly λ for hallucination (§5.3, Table 3(b)) is set on the evaluation data. With only 100 balanced trials and no held-out threshold selection, the reported 'best' F1 values (e.g., Gemma-3 poisoning F1=0.565 on Music; GPT-OSS poisoning F1=0.7758) are in-sample optima, not predictive attack performance. The authors should either fix thresholds on a separate validation set or report the full threshold/advantage curve with confidence intervals.
  3. [§6.1] The paper acknowledges that 'the user-specific information may also be used in pre-training' and asserts that the effect is marginal based on a prior study. However, Direct Inquiry asks 'Have you seen user u?' and a positive answer could be driven by parametric memorization rather than by the in-context prompt. Since the paper's target is prompt membership, the experiments need a control that separates prompt membership from pretraining exposure (e.g., synthetic users/items not in the training data, or a same-user membership contrast with different prompt inclusion). Without such a control, the attribution of the attack to the ICL prompt is not established.
  4. [§6.1, Figures 6–8] Only 100 member/non-member pairs are constructed per dataset, and the figures report a single attack-advantage point per condition without error bars, standard deviations, or significance tests. Some comparisons (e.g., the contrast attack across models in Fig. 7) differ by moderate amounts, so it is impossible to judge whether statements like 'mostly higher than 95%' are stable. The authors should report variance over the 100 trials and ideally confidence intervals or a paired significance test.
  5. [Abstract, §6.4] The abstract claims the attacks 'cannot be easily mitigated with existing defense methods on prompt extraction,' but §6.4 only lists possible defenses (SelfDefense, JBShield, StruQ, DP-ICL) and presents no experiment measuring their effect on the proposed attacks. This unsupported claim should be removed or rephrased, or a defense evaluation must be added.
minor comments (5)
  1. [§1, §5] The introduction says 'five membership inference attacks' but the bullet list names only four (Direct Inquiry, Contrast, Hallucination, Poisoning); §5 introduces a fifth Similarity attack, and §6 does not report its effectiveness except in Figure 9. Clarify the number and where the Similarity results are evaluated.
  2. [Table 2(b)] Table 2(b) is labeled 'Confusion attacks' while the text calls this the Contrast attack; align the terminology.
  3. [§6.1] The description of Mistral-7B as 'the best fine-tuned model based on Llama-2' is inaccurate and should be corrected.
  4. [Figures 6–8] The x-axis labels read 'Movie Book Beauty' but the datasets are MovieLens-1M, Amazon Book, and Amazon Beauty; use consistent dataset names.
  5. [§5.3, §6.1] The hallucination attack uses GPT-OSS-120B as an LLM judge for the Book and Beauty domains, but no validation of the judge's accuracy is reported; a small manual verification sample would improve confidence.

Circularity Check

1 steps flagged · score 4.0 of 10

Poisoning attack's reported advantage is partly an in-sample threshold fit; direct inquiry and contrast remain empirical, though the contrast claim is overstated in the abstract.

  1. fitted input called prediction [Section 5.4, Poisoning Attack (Eq. 2 and decision rule); Section 6.2, Table 3(a)]
    "The membership inference decision is based on the similarity threshold. If the similarity is higher than the predefined τ, it implies that the LLM’s decision is less likely to be influenced by the modified list, and the user’s historical record may have been used in the system prompt. We use experiments to determine the ideal τ. ... The threshold τ was obtained in experiments. For different datasets and models, we have observed that τ is located between 0.7 and 0.9 to produce satisfactory attack accuracy."

    The poisoning attack converts a continuous similarity score into a membership decision using threshold τ, and the paper states that τ was chosen 'by experiments' and reports 'best threshold settings' per model/dataset in Table 3(a). The resulting F1/attack-advantage numbers are therefore in-sample optimized values, not out-of-sample predictions of attack performance. Choosing τ on the evaluation data makes the reported 'around 60% attack advantage' partly an artifact of fitting, rather than an independent confirmation that the attack transfers.

full rationale

The paper's core claims are empirical MIA evaluations rather than derivations, and most attacks do not reduce to their inputs. Direct inquiry and contrast are parameter-free queries: membership is decided by the LLM's yes/no or A/B answer, and the paper's own results show contrast is actually worse than direct inquiry except on GPT-OSS, contradicting the abstract/introduction's 'mostly higher than 95%' claim for contrast. That contradiction is a report-consistency problem, not circularity. The only genuine fitted-input issue is the poisoning attack: its threshold τ is selected on the experimental data, so the reported best F1/advantage is in-sample. The hallucination attack's λ is similarly tuned, but since that attack failed (advantage ≤ 0.15), the tuning does not support a positive claim. Self-citations [23, 26] are not load-bearing; the prompt template and LightGCN recommendations come from external work and are not fitted to the attack outcomes. Overall, the central direct-inquiry result is independent and empirically meaningful, but the poisoning component has partial fit-induced circularity, giving a score of 4.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The central claim depends on a handful of modeling choices and fitted thresholds. The two thresholds (tau for poisoning, lambda for hallucination) are tuned to the test data, so the reported attack performance is not a fully out-of-sample prediction. The attacks also assume a particular synthetic prompt construction and black-box model behavior.

free parameters (2)
  • Poisoning attack similarity threshold tau = per model/dataset, e.g., 0.92 (Llama3, Movie), 0.71 (Llama3, Music), 0.76 (Llama3, Beauty); see Table 3(a)
    The decision rule for poisoning attack uses Sim(R,H) compared against tau, and tau is chosen 'by experiments' to maximize accuracy on the evaluation set (Section 5.4).
  • Hallucination attack threshold lambda = per model/dataset, e.g., 1 (Movie), 5 (Music), 3 (Beauty) for Llama3; see Table 3(b)
    The number of out-of-domain items that triggers a non-member decision is set per model/dataset to obtain best F1 (Section 5.3, Table 3(b)).
assumptions (6)
  • domain assumption LLMs will comply with binary yes/no instructions about prompt content
    Direct inquiry and contrast attacks rely on the model answering 'yes' or 'no' about whether it has seen a user. If models refuse or output arbitrary text, the attacks fail. Invoked in Sections 5.1 and 5.2.
  • domain assumption The model has no prior knowledge of the synthetic users in the datasets
    The evaluation partitions users into member/non-member and treats 'yes' as prompt membership. If the model knew a user from pretraining, a 'yes' would not necessarily indicate prompt membership. Acknowledged in Section 6.1 where pretraining effects are called 'marginal'.
  • domain assumption LightGCN-generated top-10 recommendations are a valid proxy for the in-prompt recommendation example H
    Section 6.1: 'For each (user, interactions), we apply Light GCN to generate the recommended items.' The entire poisoning and similarity setup uses this H as ground truth.
  • domain assumption The Liu et al. prompt template is representative of production ICL RecSys
    The prompts are 'adapted from the template proposed by Liu et al. [15, 34]' (Section 6.1). Attack transferability depends on this template being typical.
  • domain assumption GPT-OSS-120B as judge reliably detects out-of-domain hallucinations
    For Book and Beauty, hallucinations are detected by LLM-as-a-Judge with GPT-OSS-120B (Section 5.3). If the judge is unreliable, the hallucination attack's failed result could be an artifact.
  • domain assumption Sentence-Transformer semantic similarity captures item relatedness in a way that distinguishes interaction-based embeddings
    The poisoning attack computes item similarity via Sentence-Transformer embeddings (Section 5.4). The entire method assumes semantic similarity differs from the interaction-matrix embeddings used by traditional RecSys, as visualized in Figure 9.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems." pith.science (2026). https://pith.science/paper/YOHT45BQ

@misc{pith2026250818665,
  author       = {Pith},
  title        = {Pith review of: Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YOHT45BQ}},
  note         = {Machine review of arXiv:2508.18665}
}
read the original abstract

Large language models (LLMs) based recommender systems (RecSys) can adapt flexibly across different domains. It uses in-context learning (ICL), i.e., prompts, including sensitive historical user-specific item interactions, to customize the recommendation functions. However, no study has examined whether such private information may be exposed by novel privacy attacks. We design two membership inference attacks (MIAs): \emph{ItemMem}, and \emph{RecInertia}, aiming to identify whether system prompts contain the victim's information. We have carefully evaluated them on the latest open-source LLMs and three well-known RecSys datasets. The results confirm that the MIA threat to LLM RecSys is realistic and can be more sophisticated than prompt extraction. They utilize the unique prompt structures in ICL RecSys and cannot be easily mitigated with existing defense methods on prompt extraction.

Figures

Figures reproduced from arXiv: 2508.18665 by the authors.

Figure 1
Figure 1. Prompting Example for LLM RecSys One of the most fundamental privacy attacks is the membership inference attack (MIA) [5, 25, 30] that tries to determine whether a record is used in the model’s training dataset. While most MIAs arXiv:2508.18665v3 [cs.IR] 8 Oct 2025 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. System Architecture for ICL-RecSys ICL has proven effective in adapting LLMs to various down￾stream tasks, particularly in recommendation systems (RecSys). According to Gao et al. [19], its success stems from the design of prompts and in-context demonstrations. In other words, the key innovation of ICL is to elicit the in-context ability of LLMs for learn￾ing (new or unseen) downstream tasks from context during the … view at source ↗
Figure 4
Figure 4. The contrast attack. Method. It consists of the following steps (see [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (12 more)
Figure 3
Figure 3. Figure 3: The direct inquiry attack Method. The attack methodology is structured as follows (refer to [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 5
Figure 5. Figure 5: The poisoning attack: the example in the user [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Best attack advantages on Direct Inquiry across models on (a) user level and (b) interaction level. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Best attack advantages on Contrast Attack across models on (a) user level and (b) interaction level. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Comparison of two user-level only attacks: (a) Poisoning, (b) Hallucination [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: Top-10 nearest neighbors of sample movies based [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Inquiry Attack: Affecting Factors at User Level. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Inquiry Attack: Affecting Factors at Interaction-level [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: Contrast Attack: Affecting Factors at User-level [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: Contrast Attack: Affecting Factors at Interaction-level [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Poisoning attack: the number of shots and the attacked shot position. [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 15
Figure 15. Figure 15: Poisoning attack: the number of poisoned interactions. poison-10 means all interactions are poisoned. [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Prompt Governance? On Governing Technologies Governed by Natural Language

    cs.CY 2026-04 unverdicted novelty 4.0 of 10

    Literature on system prompts for AI shows fragmented and contradictory claims that complicate policy efforts to use them as reliable governance mechanisms.

Reference graph

Works this paper leans on

56 extracted references · 23 canonical work pages · cited by 1 Pith paper

  1. [1]

    https://developer.imdb.com/non-commercial-datasets/

    2024.IMDB. https://developer.imdb.com/non-commercial-datasets/

    work page 2024

  2. [2]

    Anthropic. 2025. The "think" tool: Enabling Claude to stop and think in complex tool use situations. https://www.anthropic.com/engineering/claude-think-tool

    work page 2025

  3. [3]

    Keqin Bao, Jizhi Zhang, Yang Zhang, Wenjie Wang, Fuli Feng, and Xiangnan He. 2023. TALLRec: An Effective and Efficient Tuning Framework to Align Large Language Model with Recommendation. InProceedings of the 17th ACM Conference on Recommender Systems (RecSys ’23). ACM, 1007–1014. https://doi. org/10.1145/3604915.3608857

    arXiv 2023

  4. [4]

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin...

    arXiv 2020

  5. [5]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1897–1914

    work page 2022

  6. [6]

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramèr, and Chiyuan Zhang. 2023. Quantifying Memorization Across Neu- ral Language Models. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net. https://openreview.net/forum?id=TatRHT_1cK

    2023

  7. [7]

    Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. In28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 267–284. https://www.usenix.org/conference/ usenixsecurity19/presentation/carlini

    work page 2019

  8. [8]

    Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting Training Data from Large Lan- guage Models. In30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2633–2650. https://www.usenix.org...

    2021

Show all 56 references
  1. [9]

    Chong Chen, Fei Sun, Min Zhang, and Bolin Ding. 2022. Recommendation unlearning. InProceedings of the ACM Web Conference 2022. 2768–2777

    2022

  2. [10]

    Jiao Chen, Luyi Ma, Xiaohan Li, Nikhil Thakurdesai, Jianpeng Xu, Jason H. D. Cho, Kaushiki Nag, Evren Korpeoglu, Sushant Kumar, and Kannan Achan. 2023. Knowledge Graph Completion Models are Few-shot Learners: An Empirical Study of Relation Labeling in E-commerce with LLMs. arX...

    2023 arXiv

  3. [11]

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2025. StruQ: Defending against prompt injection with structured queries. InUSENIX Security Symposium

    2025

  4. [12]

    Xiao Chen, Wenqi Fan, Jingfan Chen, Haochen Liu, Zitao Liu, Zhaoxiang Zhang, and Qing Li. 2023. Fairly Adaptive Negative Sampling for Recommendations. InProceedings of the ACM Web Conference 2023(Austin, TX, USA)(WWW ’23). Association for Computing Machinery, New York, NY, USA...

    2023

  5. [13]

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nico- las Papernot. 2021. Label-only membership inference attacks. InInternational conference on machine learning. PMLR, 1964–1974

    2021

  6. [14]

    Zeyu Cui, Jianxin Ma, Chang Zhou, Jingren Zhou, and Hongxia Yang. 2022. M6- Rec: Generative Pretrained Language Models are Open-Ended Recommender Systems. arXiv:2205.08084 [cs.IR] https://arxiv.org/abs/2205.08084

    2022 arXiv

  7. [15]

    Sunhao Dai, Ninglu Shao, Haiyuan Zhao, Weijie Yu, Zihua Si, Chen Xu, Zhongx- iang Sun, Xiao Zhang, and Jun Xu. 2023. Uncovering ChatGPT’s Capabilities in Recommender Systems. InProceedings of the 17th ACM Conference on Recom- mender Systems (RecSys ’23). ACM, 1126–1132. https:...

    2023 doi

  8. [16]

    Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Tianyu Liu, Baobao Chang, Xu Sun, Lei Li, and Zhifang Sui. 2024. A Survey on In-context Learning. arXiv:2301.00234 [cs.CL] https://arxiv.org/abs/2301.00234

    2024 arXiv

  9. [17]

    Haonan Duan, Adam Dziedzic, Mohammad Yaghini, Nicolas Papernot, and Franziska Boenisch. 2024. On the Privacy Risk of In-context Learning. arXiv:2411.10512 [cs.LG] https://arxiv.org/abs/2411.10512

    2024 arXiv

  10. [18]

    Ahmed El-Kishky, Daniel Selsam, Francis Song, Giambattista Parascandolo, Hongyu Ren, Hunter Lightman, Hyung Won Chung, Ilge Akkaya, Ilya Sutskever, Jason Wei, Jonathan Gordon, Karl Cobbe, Kevin Yu, Lukas Kondraciuk, Max Schwarzer, Mostafa Rohaninejad, Noam Brown, Shengjia Zhao...

    2024

  11. [19]

    Tianyu Gao, Adam Fisch, and Danqi Chen. 2021. Making Pre-trained Language Models Better Few-shot Learners. arXiv:2012.15723 [cs.CL] https://arxiv.org/ abs/2012.15723

    2021 arXiv

  12. [20]

    Yunfan Gao, Tao Sheng, Youlin Xiang, Yun Xiong, Haofen Wang, and Jiawei Zhang. 2023. Chat-REC: Towards Interactive and Explainable LLMs-Augmented Recommender System. arXiv:2303.14524 [cs.IR] https://arxiv.org/abs/2303.14524

    2023 arXiv

  13. [21]

    Shijie Geng, Shuchang Liu, Zuohui Fu, Yingqiang Ge, and Yongfeng Zhang. 2022. Recommendation as Language Processing (RLP): A Unified Pretrain, Personalized Prompt & Predict Paradigm (P5). InProceedings of the 16th ACM Conference on Rec- ommender Systems(Seattle, WA, USA)(RecSy...

    2022

  14. [22]

    Google DeepMind and Google Research. 2024. Gemma: Open Models Based on Gemini Research. https://ai.google.dev/gemma. Technical report; cite together with the specific model card

    2024

  15. [23]

    Yuechun Gu, Jiajie He, and Keke Chen. 2024. Demo: FT-PrivacyScore: Personal- ized Privacy Scoring Service for Machine Learning Participation. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (Salt Lake City, UT, USA)(CCS ’24). Associat...

    2024

  16. [24]

    Maxwell Harper and Joseph A

    F. Maxwell Harper and Joseph A. Konstan. 2015. The MovieLens Datasets: History and Context.ACM Trans. Interact. Intell. Syst.5, 4, Article 19 (Dec. 2015), 19 pages. https://doi.org/10.1145/2827872

    2015 doi

  17. [25]

    Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. [n. d.]. LOGAN: Membership Inference Attacks Against Generative Models.Proceedings on Privacy Enhancing Technologies2019, 1 ([n. d.]), 133–152

  18. [26]

    Jiajie He, Yuechun Gu, and Keke Chen. 2025. RecPS: Privacy Risk Scoring for Recommender Systems. InProceedings of the Nineteenth ACM Conference on Recommender Systems (RecSys ’25). Association for Computing Machinery, New York, NY, USA, 432–440. https://doi.org/10.1145/3705328.3748052

    2025

  19. [27]

    Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. 2017. Neural collaborative filtering. InProceedings of the 26th international conference on world wide web. 173–182

    2017

  20. [28]

    Zhankui He, Zhouhang Xie, Rahul Jha, Harald Steck, Dawen Liang, Yesu Feng, Bodhisattwa Prasad Majumder, Nathan Kallus, and Julian Mcauley. 2023. Large Language Models as Zero-Shot Conversational Recommenders. InProceedings of the 32nd ACM International Conference on Informatio...

    2023

  21. [29]

    Yupeng Hou, Jiacheng Li, Zhankui He, An Yan, Xiusi Chen, and Julian McAuley

  22. [30]

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR)54, 11s (2022), 1–37

    2022

  23. [31]

    Amir Jalalirad, Marco Scavuzzo, Catalin Capota, and Michael Sprague. 2019. A Simple and Efficient Federated Recommender System. InProceedings of the 6th IEEE/ACM International Conference on Big Data Computing, Applications and Technologies(Auckland, New Zealand)(BDCAT ’19). As...

    2019

  24. [32]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, De- vendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thoma...

    2023 arXiv

  25. [33]

    Zheng Li and Yang Zhang. 2021. Membership Leakage in Label-Only Exposures. arXiv:2007.15528 [cs.LG] https://arxiv.org/abs/2007.15528

    2021 arXiv

  26. [34]

    Junling Liu, Chao Liu, Peilin Zhou, Renjie Lv, Kang Zhou, and Yan Zhang. 2023. Is ChatGPT a Good Recommender? A Preliminary Study. arXiv:2304.10149 [cs.IR] https://arxiv.org/abs/2304.10149

    2023 arXiv

  27. [35]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. In33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadel- phia, PA, 1831–1847. https://www.usenix.org/c...

    2024

  28. [36]

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. 2022. Membership Inference Attacks by Exploiting Loss Trajectory. arXiv:2208.14933 [cs.CR] https://arxiv.org/abs/2208.14933

    2022 arXiv

  29. [37]

    Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. 2023. Membership inference attacks against diffusion models. In2023 IEEE Security and Privacy Workshops (SPW). IEEE, 77–83

    2023

  30. [38]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. In2019 IEEE Symposium on Security and Privacy (SP). IEEE, 739–753. https://doi.org/10...

    2019

  31. [39]

    OpenAI, :, Sandhini Agarwal, Lama Ahmad, Jason Ai, Sam Altman, Andy Apple- baum, Edwin Arbus, Rahul K. Arora, Yu Bai, Bowen Baker, Haiming Bao, Boaz Barak, Ally Bennett, Tyler Bertao, Nivedita Brett, Eugene Brevdo, Greg Brockman, Sebastien Bubeck, Che Chang, Kai Chen, Mark Che...

    2025 arXiv

  32. [40]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Confer- ence on Natural Language Processing (EMNLP-IJ...

    2019 doi

  33. [41]

    Xinyu Tang, Richard Shin, Huseyin A Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

  34. [42]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guil- laume Lample. 2023. LLaMA: Open and Efficient Foundation ...

    2023 arXiv

  35. [43]

    InThe Twelfth International Conference on Learning Representa- tions

    Privacy-Preserving In-Context Learning with Differentially Private Few- Shot Generation. InThe Twelfth International Conference on Learning Representa- tions. https://openreview.net/forum?id=oZtt0pRnOl

  36. [44]

    Xunguang Wang, Daoyuan Wu, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Shuai Wang, Yingjiu Li, Yang Liu, Ning Liu, and Juergen Rahmel. 2025. SELFDEFEND: LLMs can defend themselves against jailbreaking in a practical manner. InPro- ceedings of the 34th USENIX Conference on Security S...

    2025

  37. [45]

    Xiang Wang, Xiangnan He, Yixin Cao, Meng Liu, and Tat-Seng Chua. 2019. KGAT: Knowledge Graph Attention Network for Recommendation. InProceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD ’19). ACM, 950–958. https://doi.org/10.114...

    2019

  38. [46]

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. Membership Inference Attacks Against In-Context Learning. arXiv:2409.01380 [cs.CR] https://arxiv. org/abs/2409.01380

    2024 arXiv

  39. [47]

    Zihan Wang, Na Huang, Fei Sun, Pengjie Ren, Zhumin Chen, Hengliang Luo, Maarten de Rijke, and Zhaochun Ren. 2022. Debiasing learning for membership inference attacks against recommender systems. InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mi...

    2022

  40. [48]

    Wei Yuan, Chaoqun Yang, Quoc Viet Hung Nguyen, Lizhen Cui, Tieke He, and Hongzhi Yin. 2023. Interaction-level membership inference attack against fed- erated recommender systems. InProceedings of the ACM Web Conference 2023. 1053–1062

    2023

  41. [49]

    Rui Wen, Tianhao Wang, Michael Backes, Yang Zhang, and Ahmed Salem. 2023. Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learning. arXiv:2310.11397 [cs.CR] https://arxiv.org/abs/2310.11397

    2023 arXiv

  42. [50]

    Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. 2025. JBShield: defending large language models from jailbreak attacks through activated concept analysis and manipulation. InProceedings of the 34th...

    2025

  43. [51]

    Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021. Membership inference attacks against recom- mender systems. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 864–879

    2021

  44. [52]

    Zihuai Zhao, Wenqi Fan, Jiatong Li, Yunqing Liu, Xiaowei Mei, Yiqi Wang, Zhen Wen, Fei Wang, Xiangyu Zhao, Jiliang Tang, and Qing Li. 2024. Recommender Systems in the Era of Large Language Models (LLMs).IEEE Transactions on Knowledge and Data Engineering36, 11 (Nov. 2024), 688...

    2024

  45. [53]

    Wanrong Zhang, Shruti Tople, and Olga Ohrimenko. 2021. Leakage of dataset properties in{Multi-Party} machine learning. In30th USENIX security symposium (USENIX Security 21). 2687–2704

    2021

  46. [54]

    Da Zhong, Xiuling Wang, Zhichao Xu, Jun Xu, and Wendy Hui Wang. 2024. Interaction-level Membership Inference Attack against Recommender Systems with Long-tailed Distribution. InProceedings of the 33rd ACM International Con- ference on Information and Knowledge Management. 3433...

    2024

  47. [55]

    Aakas Zhiyuli, Yanfang Chen, Xuan Zhang, and Xun Liang. 2023. BookGPT: A General Framework for Book Recommendation Empowered by Large Language Model. arXiv:2305.15673 [cs.IR] https://arxiv.org/abs/2305.15673

    2023 arXiv

  48. [2024]

    Bridging Language and Items for Retrieval and Recommendation.arXiv preprint arXiv:2403.03952(2024)

    2024 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.