Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

RecPS: Privacy Risk Scoring for Recommender Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes RecPS, a framework that assigns each user-item interaction in a recommender system a quantitative privacy risk, derived from differential privacy and estimated with a membership inference attack.

desk verdict Useful privacy-scoring framework for RecSys with a strong interaction-level MIA, but the score estimation overfits shadow models and the user-level score is a heuristic. read the letter →

arxiv 2507.18365 v4 pith:76DCEVJP submitted 2025-07-24 cs.IR cs.AIcs.CR

Jiajie He , Yuechun Gu , Keke Chen This is my paper · ORCID
classification cs.IRcs.AIcs.CR
keywords privacyscoringmembershipinferenceattackrecommendersystemsLiRAmachineunlearningdifferentialprivacy-utilitytradeoffRec
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Recommender systems train on highly sensitive user-item interactions, but today a user has no quantitative way to know which interactions carry the most privacy risk. This paper proposes RecPS, a framework that assigns each interaction a privacy score derived from differential privacy: the score is $\ln(\mathrm{TPR}/\mathrm{FPR})$ of a membership inference attack, measuring how easily an attacker can tell whether that interaction was in the training set. A user-level score is then the average of the interaction scores. The paper argues that these scores let users and model owners remove only the most sensitive interactions, preserving far more recommendation utility than removing entire users, and demonstrates the idea with a new interaction-level attack, RecLiRA, on NCF and LightGCN models over three benchmark datasets.

What carries the argument

The load-bearing mechanism pairs a differential-privacy-derived score definition with a LiRA-style membership inference attack adapted to recommender models. RecLiRA treats a recommender's probability output $p$ for an interaction $(u,i)$ as a binary classifier confidence, forms $q=|2p-1|$, applies the logit transform $\phi(q)=\log(q/(1-q))$, and models the OUT-record distribution of $\phi(q)$ as a shared Gaussian estimated from shadow models trained on random 50% subsets of the data. For each interaction it computes per-shadow-model likelihoods, probes candidate thresholds, and selects the threshold that maximizes $\ln(\mathrm{TPR}/\mathrm{FPR})$, directly estimating the score. This machinery converts an abstract privacy bound into a computable per-record number that can guide data removal.

What would settle it

Train many target models on the same dataset with a known interaction $(u,i)$ included or excluded, and compare the true likelihood ratio of model outputs to RecLiRA's estimated $\ln(\mathrm{TPR}/\mathrm{FPR})$. If the estimate systematically misses the measured ratio, or if the empirical OUT distribution of $\phi(q)$ deviates materially from the Gaussian, the scoring method's calibration claim is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that the privacy risk of a single user-item interaction in a recommender model can be quantified by the sample-specific differential-privacy bound, estimated as $\ln(\mathrm{TPR}/\mathrm{FPR})$ of a membership inference attack. Equation (2) defines the interaction-level score as the supremum of a log-likelihood ratio between model outputs on datasets that differ by that interaction; a powerful attack's $\ln(\mathrm{TPR}/\mathrm{FPR})$ is argued to be an empirical lower bound for this quantity. User-level risk is defined as the average of the interaction scores, avoiding overestimation for heavy users. The paper establishes that scoring is practical: the custom RecLiRA attack achieves high quality in the low-FPR region, and selectively removing top-scored interactions demotes targeted users' scores below a cutoff while causing smaller hit-rate drops than removing those users entirely.

Load-bearing premise

The shadow models trained on random half-subsets, together with the assumption that non-member outputs share one Gaussian distribution, must faithfully represent how the real target model behaves for member and non-member records; if the target model's training distribution or architecture differs, the estimated $\mathrm{TPR}/\mathrm{FPR}$ and every privacy score built from it are biased.

Editorial extensions

If this is right

  • Interaction-level scores enable selective unlearning: removing the top 70% of sensitive interactions for the top 5% of users on Amazon Digital Music demotes 100% of those users below the privacy cutoff while losing only 15.56% NCF utility, versus 37.05% when removing entire users.
  • User-level scores, computed as averages of interaction scores, differ across models (LightGCN scores run higher than NCF), suggesting the score tracks how strongly the model memorizes interactions.
  • Privacy scores are dynamic: removing sensitive users changes remaining users' scores by a small amount, and interaction-level removal weakens this privacy onion effect compared with user-level removal.
  • RecLiRA's high true-positive rates at low false-positive rates make the TPR/FPR ratio a usable score estimator on NCF and LightGCN, with AUC above 0.9 on all tested datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the estimated score is $\ln(\mathrm{TPR}/\mathrm{FPR})$, it is a lower bound on the true differential-privacy risk; any future attack that raises TPR at fixed FPR will tighten the score, so the framework improves automatically as membership inference improves.
  • The same score could be used proactively, before training, to flag data that should be excluded or down-weighted, not just after training for removal; nothing in the method prevents computing shadow-model scores before a production model is trained.
  • The RecPS framework should extend to any recommender that emits a probability-like interaction score; testing it on sequential or LLM-based recommenders, and on score-only models like matrix factorization, would show whether the Gaussian logit assumption survives outside NCF/LightGCN.
  • The average-based user-level score hides the worst-interaction risk; a max or quantile aggregation might better match regulatory notions of the right to erasure for a single harmful record.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes RecPS, a privacy risk scoring framework for recommender systems. It defines an interaction-level privacy score as an empirical estimate of a per-record differential-privacy-style bound, computed as ln(TPR/FPR) of a likelihood-ratio membership inference attack adapted to recommendation models (RecLiRA). The user-level score is defined as the average of the interaction-level scores. The paper evaluates RecLiRA against the existing MINER attack on three benchmark datasets and two recommender models (NCF and LightGCN), and demonstrates that interaction-level score-guided removal of sensitive records preserves recommendation utility better than full user removal. The authors claim to be the first to study privacy scoring in recommender systems.

Significance. If the scores are well-calibrated, the interaction-level score is a practically useful tool for data contributors and model owners, and the fine-grained unlearning scenario is timely. The paper ships reproducible code and the RecLiRA attack appears to yield strong membership inference performance. However, the user-level score derivation is mathematically unjustified, and Algorithm 2's threshold selection on the same shadow models used for evaluation introduces an in-sample optimism that undermines the validity of the reported scores and the utility-preservation experiments. These issues are central to the paper's claims and need to be addressed before the contribution can be fully assessed.

major comments (4)
  1. [Section 4.2, Eq. (3)] The derivation of the user-level score is invalid. The equality Pr(M_0(D_{0,u}) ∈ O) = ∏_{i∈I_u} Pr(M_0(D_{0,(u,i)}) ∈ O) assumes independence across a user's interactions in the model's output distribution, which does not hold for recommender models whose predictions for user u share the same user embedding and are therefore jointly distributed. Consequently, the claimed bound by ∑_{i∈I_u} ε_{u,i} does not follow, and the average in Eq. (3) is not a principled privacy bound; it is an ad hoc heuristic. Please either replace this with a valid composition or group-privacy argument, or present the user-level score as an empirical aggregation and remove the theoretical claims.
  2. [Section 4.3, Algorithm 2] The per-interaction score is computed as the maximum of ln(TPR/FPR) over thresholds T that are exactly the Λ values of the OUT shadow models, evaluated on the same shadow models. With m ≈ 500, this is a maximization over roughly 250 noisy operating points; even for an interaction with no true membership signal, the empirical ROC path will typically yield some threshold with a positive ln(TPR/FPR), so the reported score is an in-sample optimum rather than an unbiased estimate of Eq. (2). The bias is not a constant offset: it depends on m and on the empirical distribution of Λ, so scores are not comparable across interactions, users, or datasets. This directly affects the headline removal experiments (Figures 4–5), which select "top sensitive" interactions using this same overfit statistic. Please re-estimate scores with a fixed threshold or with thresholds selected on a set of shadow models disjoint from the evaluation shadow models, and report the bias.
  3. [Section 4.3, Algorithm 1] The shared Gaussian OUT distribution N_out is estimated from roughly 30 OUT samples and is assumed to hold across all models and all interactions. The paper does not test this normality or the exchangeability assumption for recommender models; if the true OUT distribution is non-Gaussian or interaction-dependent, the Λ values and hence the TPR/FPR estimates are miscalibrated. Please add a goodness-of-fit analysis and a sensitivity study over k (e.g., k = 30, 100, 500) to show that the scores and the conclusions of Figure 5 are stable.
  4. [Section 5.2, Figures 4–5] The "privacy protection" criterion used in the interaction-removal experiment is that the re-evaluated score falls below a cut-off θ derived from the same score estimator. Since the score estimator is the same biased quantity from Algorithm 2, the experiment demonstrates only that removing the interactions that the overfit statistic ranks highest reduces that same overfit statistic; it does not demonstrate a reduction in actual membership risk. Please validate the removal experiment with an independent evaluation, e.g., an attack on a held-out target model not used to select thresholds, and report the resulting TPR/FPR.
minor comments (6)
  1. [Notation] Equation (2) uses ε(u,i) while Section 4.3 uses \hat{ε}(u,i) inconsistently; the hat is introduced but the notation is not applied consistently throughout the experiments.
  2. [Section 4.3] The definition q = |2p - 1| and the logit transform log(q/(1-q)) are undefined at q = 0 and q = 1 (i.e., p = 0, 0.5, or 1). Please specify how these edge cases are handled in practice.
  3. [Algorithm 1] Algorithm 1 collects φ_out for all (u,i) ∈ D \ S_j, but the text says "a few OUT-training samples" and later mentions k ≈ 30. Please clarify how the k OUT samples are selected and whether the loop over all OUT samples is consistent with the stated k.
  4. [Figure 6 caption] The caption of Figure 6 contains a typo: "Histagram" should be "Histogram."
  5. [Section 5.2] The statement that user-level scores are "approximately divided into three bands" is not supported by any quantitative analysis; please either provide a statistical description or remove the claim.
  6. [Related work] The related work discussion for privacy scores (Gu et al. [7]) is too brief; please elaborate on the differences between FT-PrivacyScore and RecPS, particularly the interaction-level granularity and the DP-based derivation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the privacy score is defined independently from the DP hypothesis-testing interpretation, and the estimation and evaluation chains are not self-referential reductions.

full rationale

The interaction-level privacy score is defined in Eq. (2) directly from the differential-privacy hypothesis-testing interpretation as a supremum of a log-likelihood ratio, with no reference to any MIA. The estimate ε̂(u,i)=ln(TPR/FPR) is explicitly presented as an approximation that approaches the defined quantity as MIA quality improves ('With the quality of MIA improving, ε̂(u,i)→ε(u,i)'). RecLiRA is adapted from the external LiRA method [2], and the Gaussian OUT-distribution assumption is also imported from that external work, not from the authors' own prior results. Algorithm 2's per-interaction threshold sweep maximizes TPR/FPR on the shadow models; this creates an in-sample optimism and cross-interaction comparability concern, but it is a statistical estimation issue rather than a definitional circularity: the score is not defined as the argmax over thresholds, and no parameter is fitted to a target outcome and then renamed a prediction. The only self-citation is [7] (Gu et al., CCS '24), which is used in related work to contrast LLM privacy scoring with the new RecSys setting and is not load-bearing for the derivation; there is no imported uniqueness theorem or ansatz from the authors' prior work. The evaluation is anchored to external baselines (MINER) and benchmark datasets. Therefore, the derivation chain does not reduce to its own inputs.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central scoring method rests on shadow-model representativeness, a Gaussian approximation, and a heuristic user-level aggregation. The threshold optimization is a free parameter selection that biases scores. No invented physical or conceptual entities are introduced.

free parameters (4)
  • interaction-specific threshold T(u,i) = selected to maximize ln(TPR/FPR)
    Algorithm 2 searches over candidate thresholds derived from OUT shadow models and picks the one maximizing the TPR/FPR ratio for each interaction, making the score an optimized estimate.
  • user-level aggregation scheme = arithmetic mean of interaction scores
    Eq. (3) replaces the sum bound with an average to avoid overestimating users with many interactions; this is an ad hoc modeling choice, not derived.
  • OUT distribution sample size k = 30
    The minimum of 30 OUT samples is used to estimate the Gaussian parameters, following a central limit theorem heuristic, but is not systematically justified.
  • number of shadow models m = 500
    The paper states m should be greater than 500 for statistically significant TPR/FPR estimation, but does not validate this scaling for RecSys models.
assumptions (5)
  • domain assumption The logit-transformed confidence difference phi(q) follows an approximately Gaussian distribution for OUT samples, and this distribution is shared across shadow models.
    Section 4.3, offline LiRA paragraph. This underpins the likelihood computation in Eq. (4) and the entire RecLiRA scoring framework; no empirical validation is provided for RecSys outputs.
  • domain assumption Shadow models trained on random 50% subsets of the same dataset D are representative of the target model's output distribution for IN and OUT records.
    Section 4.3, Algorithm 1. The entire TPR/FPR estimation relies on this representativeness; if the target model's training distribution or data differs, the scores are biased.
  • domain assumption For user-level scoring, the probability of a model output under a dataset containing a user's interaction set factorizes as a product over interactions.
    Section 4.2, paragraph above Eq. (3). The product decomposition is used to claim a bound on user-level risk; it is not generally valid because model outputs for a user's interactions are correlated.
  • standard math The sample-specific bound epsilon_r in Eq. (1) exists for any non-private modeling method M0.
    Section 4.2. This is true by definition of the supremum over a finite set of outputs, but treating it as a true privacy risk is an interpretive step.
  • standard math Hypothesis testing interpretation of DP: ln(TPR/FPR) <= epsilon for an (epsilon,0)-DP mechanism.
    Section 4.2, Background. This is a known result used to justify the score definition.

how reviews work

0 comments
Cite this review

Pith. "Pith review of RecPS: Privacy Risk Scoring for Recommender Systems." pith.science (2026). https://pith.science/paper/76DCEVJP

@misc{pith2026250718365,
  author       = {Pith},
  title        = {Pith review of: RecPS: Privacy Risk Scoring for Recommender Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/76DCEVJP}},
  note         = {Machine review of arXiv:2507.18365}
}
read the original abstract

Recommender systems (RecSys) have become an essential component of many web applications. The core of the system is a recommendation model trained on highly sensitive user-item interaction data. While privacy-enhancing techniques are actively studied in the research community, the real-world model development still depends on minimal privacy protection, e.g., via controlled access. Users of such systems should have the right to choose \emph{not} to share highly sensitive interactions. However, there is no method allowing the user to know which interactions are more sensitive than others. Thus, quantifying the privacy risk of RecSys training data is a critical step to enabling privacy-aware RecSys model development and deployment. We propose a membership-inference attack (MIA)- based privacy scoring method, RecPS, to measure privacy risks at both the interaction and user levels. The RecPS interaction-level score definition is motivated and derived from differential privacy, which is then extended to the user-level scoring method. A critical component is the interaction-level MIA method RecLiRA, which gives high-quality membership estimation. We have conducted extensive experiments on well-known benchmark datasets and RecSys models to show the unique features and benefits of RecPS scoring in risk assessment and RecSys model unlearning.

Figures

Figures reproduced from arXiv: 2507.18365 by the authors.

Figure 1
Figure 1. Interaction level: TPR vs FPR on RecLiRA vs MINER. [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Combined Analysis: user index vs privacy risk score(ln(TPR/FPR)) [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Model utility is significantly reduced if sensitive users’ interactions are all removed. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Partially removing sensitive users’ interactions will preserve RecSys performance better. x-axis: percentage of the [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Removing top-k% sensitive interactions of the top-5% sensitive users. Y-axis: the percentage of users whose scores are [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Histagram of users’ privacy score difference after removing entire top-5% sensitive users on each dataset. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Auditing Approximate Machine Unlearning for Differentially Private Models

    cs.LG 2025-08 conditional novelty 6.0 of 10

    Approximate machine unlearning can raise the privacy risk of retained samples in differentially private models, according to a new augmentation-based membership inference audit.

Reference graph

Works this paper leans on

39 extracted references · 22 canonical work pages · cited by 1 Pith paper

  1. [1]

    California Consumer Privacy Act of 2018 (CCPA)

    2018. California Consumer Privacy Act of 2018 (CCPA). Legislation enacted by the State of California. Available at https://oag.ca.gov/privacy/ccpa

    work page 2018

  2. [2]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1897–1914

    2022

  3. [3]

    Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. 2022. The Privacy Onion Effect: Memorization is Rela- tive. InAdvances in Neural Information Processing Systems, S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (Eds.), Vol. 35. Curran Associates, Inc., 13263–13276. https://proceedin...

    work page 2022

  4. [4]

    Chong Chen, Fei Sun, Min Zhang, and Bolin Ding. 2022. Recommendation unlearning. InProceedings of the ACM Web Conference 2022. 2768–2777

    2022

  5. [5]

    Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2021. A survey on adversarial recommender systems: from attack/defense strategies to generative adversarial networks.ACM Computing Surveys (CSUR)54, 2 (2021), 1–38

    work page 2021

  6. [6]

    Yingqiang Ge, Shuchang Liu, Zuohui Fu, Juntao Tan, Zelong Li, Shuyuan Xu, Yunqi Li, Yikun Xian, and Yongfeng Zhang. 2024. A survey on trustworthy recommender systems.ACM Transactions on Recommender Systems3, 2 (2024), 1–68

    2024

  7. [7]

    Yuechun Gu, Jiajie He, and Keke Chen. 2024. Demo: FT-PrivacyScore: Personal- ized Privacy Scoring Service for Machine Learning Participation. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (Salt Lake City, UT, USA)(CCS ’24). Association for Computing Machinery, New York, NY, USA, 5075–5077. https://doi.org/10.11...

    arXiv 2024

  8. [8]

    F Maxwell Harper and Joseph A Konstan. 2015. The movielens datasets: History and context.Acm transactions on interactive intelligent systems (tiis)5, 4 (2015), 1–19

    2015

Show all 39 references
  1. [9]

    Maxwell Harper and Joseph A

    F. Maxwell Harper and Joseph A. Konstan. 2015. The MovieLens Datasets: History and Context.ACM Trans. Interact. Intell. Syst.5, 4, Article 19 (Dec. 2015), 19 pages. https://doi.org/10.1145/2827872

    2015 doi

  2. [10]

    Ruining He and Julian McAuley. 2016. Ups and Downs: Modeling the Vi- sual Evolution of Fashion Trends with One-Class Collaborative Filtering. In Proceedings of the 25th International Conference on World Wide Web(Mon- tréal, Québec, Canada)(WWW ’16). International World Wide We...

    2016

  3. [11]

    Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. 2020. Lightgcn: Simplifying and powering graph convolution network for recommendation. InProceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval. 639–648

    2020

  4. [12]

    Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. 2017. Neural collaborative filtering. InProceedings of the 26th international conference on world wide web. 173–182

    2017

  5. [13]

    Grant Ho, Aashish Sharma, Mobin Javed, Vern Paxson, and David Wagner. 2017. Detecting credential spearphishing in enterprise settings. In26th USENIX security symposium (USENIX security 17). 469–485

    2017

  6. [14]

    Matthew Jagielski, Jonathan Ullman, and Alina Oprea. 2020. Auditing differen- tially private machine learning: How private is private SGD?Advances in Neural Information Processing Systems33 (2020), 22205–22216

    2020

  7. [15]

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2015. The Composition Theorem for Differential Privacy.IEEE Transactions on Information Theory61, 6 (2015), 3469–3481

    2015

  8. [16]

    Alex Kantchelian, Michael Carl Tschantz, Sadia Afroz, Brad Miller, Vaishaal Shankar, Rekha Bachwani, Anthony D Joseph, and J Doug Tygar. 2015. Better malware ground truth: Techniques for weighting anti-virus vendor labels. In Proceedings of the 8th ACM Workshop on Artificial I...

    2015

  9. [17]

    J Zico Kolter and Marcus A Maloof. 2006. Learning to detect and classify malicious executables in the wild.Journal of Machine Learning Research7, 12 (2006)

    2006

  10. [18]

    Yehuda Koren, Robert Bell, and Chris Volinsky. 2009. Matrix Factorization Techniques for Recommender Systems.Computer42, 8 (2009), 30–37. https: //doi.org/10.1109/MC.2009.263

    2009 doi

  11. [19]

    Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Yizhao Zhang, Biao Gong, Jun Wang, and Linxun Chen. 2023. Selective and collaborative influence function for efficient recommendation unlearning.Expert Systems with Applications234 (2023), 121025

    2023

  12. [20]

    Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel

  13. [21]

    Peter Müllner, Elisabeth Lex, Markus Schedl, and Dominik Kowald. 2023. Differ- ential privacy in collaborative filtering recommender systems: a review.Frontiers in big Data6 (2023), 1249997

    2023

  14. [22]

    Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis. 2023. Tight auditing of differen- tially private machine learning. In32nd USENIX Security Symposium (USENIX Security 23). 1631–1648

    2023

  15. [23]

    Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee- Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A survey of machine unlearning.arXiv preprint arXiv:2209.02299(2022)

    2022 arXiv

  16. [24]

    Fatemeh Rezaimehr and Chitra Dadkhah. 2021. A survey of attack detection approaches in collaborative filtering recommender systems.Artificial Intelligence Review54 (2021), 2011–2066

    2021

  17. [25]

    Zachary R Smith and Craig S Wells. 2006. Central limit theorem and sample size. Inannual meeting of the Northeastern Educational Research Association, Kerhonkson, New York

    2006

  18. [26]

    Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In30th USENIX Security Symposium (USENIX Security 21). 2615–2632

    2021

  19. [27]

    Thomas Steinke, Milad Nasr, and Matthew Jagielski. 2024. Privacy auditing with one (1) training run.Advances in Neural Information Processing Systems36 (2024)

    2024

  20. [28]

    Gábor Takács and Domonkos Tikk. 2012. Alternating least squares for personal- ized ranking. InProceedings of the sixth ACM conference on Recommender systems. 83–90

    2012

  21. [29]

    Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli

  22. [30]

    Paul Voigt and Axel Von dem Bussche. 2017. The eu general data protection reg- ulation (gdpr).A Practical Guide, 1st Ed., Cham: Springer International Publishing 10, 3152676 (2017), 10–5555

    2017

  23. [31]

    Qinyong Wang, Hongzhi Yin, Tong Chen, Junliang Yu, Alexander Zhou, and Xiangliang Zhang. 2022. Fast-adapting and privacy-preserving federated recom- mender system.The VLDB Journal31, 5 (2022), 877–896

    2022

  24. [32]

    Zihan Wang, Na Huang, Fei Sun, Pengjie Ren, Zhumin Chen, Hengliang Luo, Maarten de Rijke, and Zhaochun Ren. 2022. Debiasing learning for membership inference attacks against recommender systems. InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mi...

    2022

  25. [33]

    Wei Yuan, Chaoqun Yang, Quoc Viet Hung Nguyen, Lizhen Cui, Tieke He, and Hongzhi Yin. 2023. Interaction-level membership inference attack against fed- erated recommender systems. InProceedings of the ACM Web Conference 2023. 1053–1062

    2023

  26. [34]

    Haibo Zhang, Toru Nakamura, Takamasa Isohara, and Kouichi Sakurai. 2023. A review on machine unlearning.SN Computer Science4, 4 (2023), 337

    2023

  27. [35]

    Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021. Membership inference attacks against recom- mender systems. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 864–879

    2021

  28. [36]

    Da Zhong, Xiuling Wang, Zhichao Xu, Jun Xu, and Wendy Hui Wang. 2024. Interaction-level Membership Inference Attack against Recommender Systems with Long-tailed Distribution. InProceedings of the 33rd ACM International Con- ference on Information and Knowledge Management. 3433–3442

    2024

  29. [37]

    Zhihao Zhu, Chenwang Wu, Rui Fan, Defu Lian, and Enhong Chen. 2023. Mem- bership inference attacks against sequential recommender systems. InProceedings of the ACM Web Conference 2023. 1208–1219. RecSys ’25, September 22–26, 2025, Prague, Czech Republic Jiajie He, Yuechun Gu, ...

    2023

  30. [2015]

    InProceedings of the 38th international ACM SIGIR conference on research and development in information retrieval

    Image-based recommendations on styles and substitutes. InProceedings of the 38th international ACM SIGIR conference on research and development in information retrieval. 43–52

  31. [2023]

    Fast yet effective machine unlearning.IEEE Transactions on Neural Networks and Learning Systems(2023)

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.