Pith. sign in

REVIEW 3 major objections 5 minor 46 references

Data Watermarking for Sequential Recommender Systems

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Inserting a short consecutive item sequence into a small fraction of user histories watermarks a sequential recommender so that data owners can prove unauthorized training with black-box queries.

desk verdict A genuinely new problem and a plausible empirical method, but the receptive-field mechanism is over-generalized and the statistical support is thin; worth refereeing. read the letter →

arxiv 2411.12989 v2 pith:CRDHBONL submitted 2024-11-20 cs.IR

Sixiao Zhang , Cheng Long , Wei Yuan , Hongxu Chen , Hongzhi Yin This is my paper · ORCID
classification cs.IR
keywords datawatermarkingsequentialrecommendationdatasetownershipuserreceptivefieldbackdoortriggerblack-boxverificationmodelutility
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a data owner can watermark a sequential recommender system by inserting a short run of consecutive items into user interaction histories, and then prove unauthorized training by black-box queries: append the first part of the watermark to benign sequences and check whether the final watermark item ranks at the top. The proposed method, DWRS, has two variants: DWRS-D for watermarking an entire dataset and DWRS-U for protecting a single user's data. Across five sequential recommender architectures and three datasets, a model trained on watermarked data ranks the watermark response at or near the top, while oracle models trained on clean data rank it at essentially zero. The paper argues this gives a practical copyright-claim mechanism that preserves recommendation utility and survives finetuning, distillation, and sequential rule mining.

What carries the argument

The load-bearing object is the Receptive Field (RF) of a target item: the contiguous window of surrounding items whose attention values are much greater than zero. The paper formalizes the mechanism as $x_i \approx \sum_{j \in \text{RF}} \alpha_{ij} V_j$, so the target item's embedding is a weighted sum of value vectors in its local window. The RF justifies both design choices: the watermark body must lie inside the target's RF, hence the watermark items must be consecutive, and DWRS-D enforces a filler-uniqueness constraint so that no non-watermark item inside any RF appears twice across watermarked sequences, preventing the model from learning spurious correlations with the response. For user watermarking, the same local-aggregation idea justifies inserting the watermark before the most unpopular subsequence, which supplies additional learnable dependency.

What would settle it

Train NARM, CL4SRec, and DuoRec on Steam with the DWRS-D watermark inserted under the five-item receptive field and compare watermark Recall@10 against random-position insertion; if the gap disappears on any architecture, or if sensitivity analysis shows the target embedding depends on items far outside the assumed window, the receptive-field mechanism is not what carries the watermark.

Watch

Extended reading notes

Core claim

The central claim is that a watermark can be defined as a sequence of consecutive items $S_{\text{wm}} = \{i_1^{\text{wm}}, \dots, i_l^{\text{wm}}\}$, where the first $l-1$ items form the watermark body $x_{\text{wm}}$ and the last item is the target response $y_{\text{wm}}$. After inserting this sequence into a small fraction of user histories, a trained sequential recommender memorizes the pattern because, by the receptive-field assumption, the embedding of the target item aggregates mainly nearby items. Detection is black-box: the owner appends $x_{\text{wm}}$ to benign user sequences and checks whether $y_{\text{wm}}$ is ranked at the top. The paper's experiments report watermark validity above 0.7 on Bert4Rec and above 0.9 on SASRec, NARM, CL4SRec, and DuoRec with a length-3 watermark inserted into 1% of users, while oracle models give near-zero validity and model utility stays close to the clean-trained oracle.

Load-bearing premise

The method's advantage over random insertion rests on the assumption that every trained recommender builds an item's representation mainly from a small local window of surrounding items, an assumption the paper verifies only through attention heatmaps of SASRec and Bert4Rec on two datasets.

Editorial extensions

If this is right

  • A data owner who suspects a model was trained on their data can test it by querying with the two-item prefix of a length-3 watermark; a top-ranked response is evidence of unauthorized training, since clean models score near zero.
  • A watermark length of 3 is enough for dataset watermarking; length 2 fails, so a single prefix item does not create a memorizable pattern.
  • Inserting into 1% of user histories is sufficient, and increasing the ratio raises validity with diminishing returns.
  • The watermark survives finetuning, distillation, and sequential rule mining, although finetuning and distillation substantially lower both watermark validity and model utility.
  • A single user can be protected with a longer watermark of 10-20 items placed before the most unpopular part of their history, but effectiveness varies across models, with Bert4Rec being the hardest case.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that the method's edge over random insertion would show up mainly under the receptive-field assumption; on models or datasets where attention is not locally concentrated, the filler-uniqueness step may not matter, so a comparison with random insertion on NARM, CL4SRec, or DuoRec on Steam would isolate whether RF guidance is the active ingredient.
  • An attacker who preprocesses sequences by dropping rare items, truncating histories, or reordering interactions before training could weaken the watermark, since every design choice relies on the exact consecutive placement of the trigger; this scenario is not tested in the paper.
  • The same consecutive-pattern idea could transfer to other sequence models, such as large-language-model-based recommenders, but longer-range attention would likely require longer watermarks and raise the detection risk from pattern mining.
  • The filler-uniqueness constraint caps how many users can be watermarked on small datasets; if a dataset cannot supply enough filler-disjoint positions, the 1% ratio cannot be reached and the utility-preservation guarantee may need re-evaluation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper introduces DWRS, a data watermarking method for sequential recommender systems. It defines a watermark as a consecutive item sequence inserted into user interaction histories, with two variants: DWRS-D for dataset-level watermarking and DWRS-U for individual-user watermarking. The method uses a Receptive Field (RF) notion, derived from attention heatmaps of transformers, to guide insertion positions and to enforce a filler-item uniqueness constraint. Experiments on ML-1M, Amazon Beauty, and Steam across five models (SASRec, Bert4Rec, NARM, CL4SRec, DuoRec) report high watermark validity (e.g., Recall/NDCG near 1.0 for DWRS-D), preserved model utility relative to oracle models, near-zero watermark validity on oracle models, and robustness against finetuning, distillation, and sequential rule mining attacks. The paper also includes a comparison of DWRS-D against a random-insertion baseline (DWRS-D-base) and a position ablation for DWRS-U.

Significance. If the reported effectiveness is reliable, DWRS provides a practical black-box-verifiable method for data owners to claim unauthorized training on their datasets, and it is, per the paper's claim, the first data-watermarking method specifically for recommender systems. The paper includes several good practices: a public code repository, a random-insertion baseline to isolate the contribution of the RF-guided placement, oracle-model comparisons that establish discriminability, and full utility tables in the appendix. The main limitations are the absence of error bars or significance tests for the primary comparisons and the unverified generalization of the receptive-field assumption to all tested architectures and datasets. These issues are local in the sense that they can be addressed with additional measurements and reporting, but they currently leave the theoretical explanation for the method's advantage not fully supported.

major comments (3)
  1. [§3.2.1, Eq. (6); §5.4.1] The receptive-field model is inferred from attention heatmaps of SASRec and Bert4Rec on ML-1M and Beauty (Fig. 3), but DWRS-D is evaluated on NARM (an RNN encoder-decoder), the contrastive models CL4SRec and DuoRec, and on Steam without verifying that these models/datasets exhibit the same local RF structure. For Beauty and Steam, §5.4.1 sets RF to the entire sequence, which is not a local window and turns Algorithm 1's filler-uniqueness constraint into a global item-disjointness condition. The proposed explanation for why DWRS-D outperforms the random-insertion baseline is therefore not grounded for these cases. I ask the authors to either measure the RF (e.g., via attention or gradient-based attribution) for each model-dataset pair used in the evaluation and set the RF accordingly, or show that watermark validity is insensitive to the chosen RF size over a reasonable range. Without this, the load-bearing claim that RF-guided placement is the mechanism behind the reported advantage is unsupported.
  2. [§5.4.2, Fig. 4 and Fig. 8] The advantage of DWRS-D over the random-insertion baseline DWRS-D-base is the primary evidence for the benefit of the RF-guided placement, but no error bars or statistical significance tests are reported; the paper states only that results are averaged over five runs. In several panels (e.g., NDCG@k for DuoRec, and Recall@k for DuoRec in Fig. 8), the DWRS-D and DWRS-D-base curves are visually indistinguishable and the differences are on the order of 10^-3. The claim that DWRS-D outperforms DWRS-D-base therefore cannot be distinguished from noise as presented. Please report standard deviations or confidence intervals for all primary watermark-validity comparisons and for the hyperparameter studies in Figs. 5 and 7.
  3. [§4.2.2, §5.8, Fig. 7b] The choice of inserting the watermark before the most unpopular subsequence (BUS) is a central component of DWRS-U, but its superiority is demonstrated on a single model-dataset pair (SASRec on ML-1M) with no error bars. The heuristic that unpopular items after the target provide additional overfitting capacity is not directly verified; the reader cannot tell whether the BUS advantage is a general property of the method or an artifact of that particular dataset. To support the claimed advantage over the other positions, the authors should report the position ablation on at least one additional model-dataset pair, with variance information.
minor comments (5)
  1. [Algorithm 1, line 8] The condition `RF(pos) ∪ I_filler != ∅` appears to be a typo; the textual description indicates that the intent is to resample until the receptive field contains no previously seen filler items, i.e., `RF(pos) ∩ I_filler == ∅`. As written, the union condition is always true whenever RF(pos) is non-empty, which would prevent the loop from terminating as intended.
  2. [§5.5.2 and Table 3] The text says "Taking ML-1M on Bert4Rec for an example" but Table 3 is titled "ML-1M on SASRec". Please correct this inconsistency.
  3. [§4.2.2] The statement "we have empirically verified that, under the default setting of our experiment, by setting l > 30 and using unpopular items as watermark items, the watermark is almost guaranteed to be successful with Recall@10 > 0.9" is not supported by any experiment reported in the paper; please include the verification or revise the statement to avoid an unsupported claim.
  4. [§3.2.1] The definition of RF as "the range where all items within it have attention values much greater than zero" lacks a quantitative criterion; please specify how the RF size (e.g., five items before and after the target for ML-1M) is derived from the heatmaps in Fig. 3.
  5. [Figures 4 and 8] The captions for Figures 4 and 8 are identical, and neither figure labels the y-axis; please differentiate the captions and add metric labels to the axes.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: the default watermark length l=3 is selected from the same ML-1M/Bert4Rec evaluation that is later reported as a success; the RF-based design and self-citations are not themselves circular.

  1. fitted input called prediction [Section 5.5.1 (watermark-length study) and Section 5.4.1 (default settings)]
    "“An interesting observation is that, l = 2 performs poorly with Recall close to 0, which suggests that using a single item as the watermark body is insufficient in memorizing the watermark. Additionally, l = 3 achieves a very high Recall around 0.9, and further increasing l brings minor improvement. Thus, we select l = 3 as our default watermark length to enhance the unnoticeability.” Combined with: “For the watermark S_wm, we set by default its length l = 3.”"

    The default length is chosen after observing watermark validity on the exact ML-1M/Bert4Rec configuration that the main evaluation reports with l=3. Reporting high validity for DWRS-D with l=3 on that configuration is therefore restating the selection criterion, not an independent prediction. The result is not algebraically forced across all datasets and models, and the DWRS-D versus random-insertion comparison retains independent content, so the circularity is partial and localized to the l=3 default claim.

full rationale

The paper's core mechanism is an empirical backdoor: a consecutive watermark sequence is inserted into a fraction of training histories, and validity is measured by the rank of the final watermark item after the body. This is not derived from an equation equivalent to its inputs. The Receptive Field is measured from attention heatmaps (Fig. 3) and used as a heuristic insertion rule; the paper explicitly acknowledges the defender cannot know the true RF (Sec 3.2.2), so applying RF to NARM/CL4SRec/DuoRec/Steam without re-measuring is a generalization and correctness risk, not circularity. The only self-citation ([37]) is a related-work contrast and is not load-bearing. The one genuine circular element is the l=3 default selection in Sec 5.5.1, which uses the same ML-1M/Bert4Rec evaluation later presented as evidence; this is a disclosed hyperparameter choice rather than a hidden fit, but it partially compromises the independence of that reported result.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central method relies on three hand-set design choices: the receptive-field range, the watermark length, and the popularity thresholds. These are not derived from theory but selected using the evaluation datasets and models, which raises the free-parameter count and lowers confidence in the generality of the reported gains. No new physical or conceptual entities are postulated; the receptive field is a descriptive construct built from attention weights.

free parameters (6)
  • Receptive field range per dataset = ML-1M: 5 before + 5 after; Beauty and Steam: entire sequence
    Set by inspecting attention heatmaps in Fig. 3 on the same datasets and models used for evaluation (Sec. 3.2.1, Sec. 5.4.1). Directly controls where watermarks can be inserted and is central to the claimed benefit of DWRS-D over random insertion.
  • Insert ratio p = 1% (ablated 0.1% to 2%)
    The fraction of user sequences that receive the watermark; chosen as a widely accepted threshold from adversarial-attack literature (Sec. 5.4.1, Sec. 5.5.2). Watermark validity depends strongly on p.
  • Watermark length l for DWRS-D = 3 (ablated 2, 3, 5, 10)
    Default 3 selected after observing that l=2 gives near-zero recall while l=3 gives high recall on ML-1M with Bert4Rec (Sec. 5.5.1). A free design choice affecting memorization and unnoticeability.
  • Unpopularity threshold for watermark item pool = top-10% unpopular items
    Watermark items are sampled from the least popular decile; the choice of 10% is stated without derivation (Sec. 5.4.1).
  • Unpopular subsequence length n for DWRS-U = 10
    Length of the subsequence used to find the most unpopular context C_n; empirically found to be a good choice (Sec. 5.7.1).
  • User watermark length l for DWRS-U = 10 (ML-1M, Steam), 20 (Beauty)
    Set per dataset to reach target validity; a longer l is needed on short-sequence Beauty (Sec. 5.7.1, Sec. 5.8).
assumptions (4)
  • domain assumption An item's embedding is approximately a weighted sum of the value vectors of items inside a contiguous receptive field (Eq. 6).
    Used throughout Sec. 3.2 to justify placing the watermark body immediately before the target item. It is inferred from attention heatmaps of two transformer models on two datasets and is not verified for NARM (an RNN) or contrastive models CL4SRec and DuoRec.
  • ad hoc to paper Reducing duplicate filler items in the receptive field across watermarked sequences improves watermark memorization (Algorithm 1 uniqueness constraint).
    This is the paper's core design hypothesis. It is supported only by the DWRS-D versus DWRS-D-base comparison; no ablation isolates the filler-uniqueness mechanism from other factors such as watermark items being new patterns.
  • ad hoc to paper Inserting the watermark before the most unpopular subsequence in the target user's history increases overfitting capacity and compensates for shorter watermark length (Sec. 4.2.2).
    The paper provides a verbal capacity-compensation argument but no mathematical or controlled experimental proof that unpopular context items are what cause memorization.
  • domain assumption The target user or data owner can modify interaction sequences before training, and the modified sequences will not be filtered by the platform.
    The threat model assumes the defender can add or alter user interaction histories with items chosen from popularity data, and that the training pipeline ingests these sequences as-is (Sec. 3.1, Sec. 4.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Data Watermarking for Sequential Recommender Systems." pith.science (2026). https://pith.science/paper/CRDHBONL

@misc{pith2026241112989,
  author       = {Pith},
  title        = {Pith review of: Data Watermarking for Sequential Recommender Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CRDHBONL}},
  note         = {Machine review of arXiv:2411.12989}
}
read the original abstract

In the era of large foundation models, data has become a crucial component in building high-performance AI systems. As the demand for high-quality and large-scale data continues to rise, data copyright protection is attracting increasing attention. In this work, we explore the problem of data watermarking for sequential recommender systems, where a watermark is embedded into the target dataset and can be detected in models trained on that dataset. We focus on two settings: dataset watermarking, which protects the ownership of the entire dataset, and user watermarking, which safeguards the data of individual users. We present a method named Dataset Watermarking for Recommender Systems (DWRS) to address them. We define the watermark as a sequence of consecutive items inserted into normal users' interaction sequences. We define a Receptive Field (RF) to guide the inserting process to facilitate the memorization of the watermark. Extensive experiments on five representative sequential recommendation models and three benchmark datasets demonstrate the effectiveness of DWRS in protecting data copyright while preserving model utility.

Figures

Figures reproduced from arXiv: 2411.12989 by the authors.

Figure 1
Figure 1. An illustration of data watermarking for recom [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Specifically, in each iteration, we insert the watermark into [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Attention heatmaps of the last 20 items of ML-1M and Beauty on SASRec and Bert4Rec. X-axis and Y-axis denote the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: DWRS-D: watermark validity (NDCG). three datasets. Our study aims to address the following research questions: • RQ1: How does DWRS-D compare to baseline methods in terms of watermark validity and model utility? • RQ2: What impact do watermark length 𝑙 and insert ratio…
Figure 5
Figure 5. Figure 5: DWRS-D: (a) watermark validity (Recall) of [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: DWRS-U: watermark validity. For ML-1M and Steam, we set [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: DWRS-U: (a) watermark validity (Recall) of [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: DWRS-D: watermark validity (Recall). unordered items. For example, given 𝑆𝑤𝑚 = {𝑖 𝑤𝑚 1 ,𝑖𝑤𝑚 2 ,𝑖𝑤𝑚 3 }, we can extract five rules: {𝑖 𝑤𝑚 1 } → {𝑖 𝑤𝑚 2 }, {𝑖 𝑤𝑚 1 } → {𝑖 𝑤𝑚 3 }, {𝑖 𝑤𝑚 2 } → {𝑖 𝑤𝑚 3 }, {𝑖 𝑤𝑚 1 } → {𝑖 𝑤𝑚 2 ,𝑖𝑤𝑚 3 }, {𝑖 𝑤𝑚 1 ,𝑖𝑤𝑚 2 } → {𝑖 𝑤𝑚 3 }. Each rule…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 23 canonical work pages

  1. [1]

    Jay Ayres, Jason Flannick, Johannes Gehrke, and Tomi Yiu. 2002. Sequential pattern mining using a bitmap representation. In Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining . 429– 435

    work page 2002

  2. [2]

    James Davidson, Benjamin Liebald, Junning Liu, Palash Nandy, Taylor Van Vleet, Ullas Gargi, Sujoy Gupta, Yu He, Mike Lambert, Blake Livingston, et al . 2010. The YouTube video recommendation system. In Proceedings of the fourth ACM conference on Recommender systems . 293–296

    work page 2010

  3. [3]

    Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin

  4. [4]

    Philippe Fournier-Viger, Ted Gueniche, Souleymane Zida, and Vincent S Tseng

    work page

  5. [5]

    Yingqiang Ge, Shuchang Liu, Zuohui Fu, Juntao Tan, Zelong Li, Shuyuan Xu, Yunqi Li, Yikun Xian, and Yongfeng Zhang. 2024. A survey on trustworthy recommender systems. ACM Transactions on Recommender Systems 3, 2 (2024), 1–68

    work page 2024

  6. [6]

    Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. 2024. Domain watermark: Effective and harmless dataset copyright protection is closed at hand. Advances in Neural Information Processing Systems 36 (2024)

    2024

  7. [7]

    Jiawei Han, Jian Pei, Behzad Mortazavi-Asl, Helen Pinto, Qiming Chen, Umesh- war Dayal, and Meichun Hsu. 2001. Prefixspan: Mining sequential patterns efficiently by prefix-projected pattern growth. In proceedings of the 17th interna- tional conference on data engineering . IEEE Piscataway, NJ, USA, 215–224

    work page 2001

  8. [8]

    Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. 2020. Lightgcn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval . 639–648

    2020

Show all 46 references
  1. [9]

    Yassine Himeur, Shahab Saquib Sohail, Faycal Bensaali, Abbes Amira, and Mamoun Alazab. 2022. Latest trends of security and privacy in recommender systems: a comprehensive review and future perspectives. Computers & Security 118 (2022), 102746

    2022

  2. [10]

    Hongsheng Hu, Zoran Salcic, Gillian Dobbie, Jinjun Chen, Lichao Sun, and Xuyun Zhang. 2022. Membership inference via backdooring. arXiv preprint arXiv:2206.04823 (2022)

    2022 arXiv

  3. [11]

    Wang-Cheng Kang and Julian McAuley. 2018. Self-attentive sequential recom- mendation. In 2018 IEEE international conference on data mining (ICDM) . IEEE, 197–206

    2018

  4. [12]

    Jing Li, Pengjie Ren, Zhumin Chen, Zhaochun Ren, Tao Lian, and Jun Ma. 2017. Neural attentive session-based recommendation. In Proceedings of the 2017 ACM on Conference on Information and Knowledge Management . 1419–1428

    2017

  5. [13]

    Shuai Li, Kejiang Chen, Kunsheng Tang, Wen Huang, Jie Zhang, Weiming Zhang, and Nenghai Yu. 2023. FunctionMarker: Watermarking Language Datasets via Knowledge Injection. arXiv preprint arXiv:2311.09535 (2023)

    2023 arXiv

  6. [14]

    Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. 2022. Un- targeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Advances in Neural Information Processing Systems 35 (2022), 13238– 13250

    2022

  7. [15]

    Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. 2023. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions on Information Forensics and Security (2023)

    2023

  8. [16]

    Yixin Liu, Hongsheng Hu, Xuyun Zhang, and Lichao Sun. 2023. Watermarking text data on large language models for dataset copyright protection.arXiv preprint arXiv:2305.13257 (2023)

    2023 arXiv

  9. [17]

    Jing Long, Tong Chen, Quoc Viet Hung Nguyen, and Hongzhi Yin. 2023. Decen- tralized collaborative learning framework for next POI recommendation. ACM Transactions on Information Systems 41, 3 (2023), 1–25

    2023

  10. [18]

    Aleksandr Petrov and Craig Macdonald. 2022. A systematic review and replica- bility study of bert4rec for sequential recommendation. In Proceedings of the 16th Conference’17, July 2017, Washington, DC, USA Sixiao Zhang, Cheng Long, Wei Yuan, Hongxu Chen, and Hongzhi Yin Table ...

    2022

  11. [19]

    Ruihong Qiu, Zi Huang, Hongzhi Yin, and Zijian Wang. 2022. Contrastive learning for representation degeneration problem in sequential recommendation. In Proceedings of the fifteenth ACM international conference on web search and data mining. 813–823

    2022

  12. [20]

    Xubin Ren, Lianghao Xia, Yuhao Yang, Wei Wei, Tianle Wang, Xuheng Cai, and Chao Huang. 2024. Sslrec: A self-supervised learning framework for recommen- dation. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining. 567–575

    2024

  13. [21]

    Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme

  14. [22]

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. 2020. Radioactive data: tracing through training. InInternational Conference on Machine Learning. PMLR, 8326–8335

    2020

  15. [23]

    J Ben Schafer, Joseph A Konstan, and John Riedl. 2001. E-commerce recommen- dation applications. Data mining and knowledge discovery 5 (2001), 115–153

    2001

  16. [24]

    Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, and Peng Jiang

  17. [25]

    Jiaxi Tang, Hongyi Wen, and Ke Wang. 2020. Revisiting adversarially learned injection attacks against recommender systems. In Proceedings of the 14th ACM Conference on Recommender Systems . 318–327

    2020

  18. [26]

    Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. 2023. Did you train on my dataset? towards public dataset protection with cleanlabel backdoor watermarking. ACM SIGKDD Explorations Newsletter 25, 1 (2023), 43–53

    2023

  19. [27]

    Johnny Tian-Zheng Wei, Ryan Yixiang Wang, and Robin Jia. 2024. Proving membership in LLM pretraining data via data watermarks. arXiv preprint arXiv:2402.10892 (2024)

    2024 arXiv

  20. [28]

    In Proceedings of the 28th ACM international conference on information and knowledge management

    BERT4Rec: Sequential recommendation with bidirectional encoder rep- resentations from transformer. In Proceedings of the 28th ACM international conference on information and knowledge management . 1441–1450

  21. [29]

    Xu Xie, Fei Sun, Zhaoyang Liu, Shiwen Wu, Jinyang Gao, Jiandong Zhang, Bolin Ding, and Bin Cui. 2022. Contrastive learning for sequential recommendation. In 2022 IEEE 38th international conference on data engineering (ICDE) . IEEE, 1259– 1273

    2022

  22. [30]

    Xiaogang Xing, Ming Xu, Yujing Bai, and Dongdong Yang. 2023. A clean- label graph backdoor attack method in node classification task. arXiv preprint arXiv:2401.00163 (2023)

    2023 arXiv

  23. [31]

    Jing Xu and Stjepan Picek. 2022. Poster: Clean-label backdoor attack on graph neural networks. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 3491–3493

    2022

  24. [32]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2022. Graph neural networks in recommender systems: a survey. Comput. Surveys 55, 5 (2022), 1–37

    2022

  25. [33]

    Wei Yuan, Chaoqun Yang, Quoc Viet Hung Nguyen, Lizhen Cui, Tieke He, and Hongzhi Yin. 2023. Interaction-level membership inference attack against fed- erated recommender systems. In Proceedings of the ACM Web Conference 2023 . 1053–1062

    2023

  26. [34]

    Wei Yuan, Chaoqun Yang, Liang Qu, Quoc Viet Hung Nguyen, Guanhua Ye, and Hongzhi Yin. 2025. Ptf-fsr: A parameter transmission-free federated sequential recommender system. ACM Transactions on Information Systems 43, 2 (2025), 1–24

    2025

  27. [35]

    Wei Yuan, Chaoqun Yang, Liang Qu, Quoc Viet Hung Nguyen, Jianxin Li, and Hongzhi Yin. 2024. Hide your model: A parameter transmission-free feder- ated recommender system. In 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 611–624

    2024

  28. [36]

    Junliang Yu, Hongzhi Yin, Xin Xia, Tong Chen, Jundong Li, and Zi Huang. 2023. Self-supervised learning for recommender systems: A survey. IEEE Transactions on Knowledge and Data Engineering 36, 1 (2023), 335–355

    2023

  29. [37]

    Sixiao Zhang, Cheng Long, Wei Yuan, Hongxu Chen, and Hongzhi Yin. 2024. Watermarking Recommender Systems. arXiv preprint arXiv:2407.21034 (2024)

    2024 arXiv

  30. [38]

    Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. 2019. Deep learning based recom- mender system: A survey and new perspectives. ACM computing surveys (CSUR) 52, 1 (2019), 1–38

    2019

  31. [39]

    Sixiao Zhang, Hongzhi Yin, Hongxu Chen, and Cheng Long. 2024. Defense against model extraction attacks on recommender systems. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining . 949–957

    2024

  32. [40]

    Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. 2021. Black-box attacks on sequential recommenders via data-free model extraction. InProceedings of the 15th ACM conference on recommender systems . 44–54

    2021

  33. [41]

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Back- door attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies . 15–26. A POPULAR ITEMS VS. UNPOPULAR ITEMS We show the model performance of p...

    2021

  34. [44]

    Shijie Zhang, Wei Yuan, and Hongzhi Yin. 2023. Comprehensive privacy analysis on federated recommender system against attribute inference attacks. IEEE Transactions on Knowledge and Data Engineering 36, 3 (2023), 987–999

    2023

  35. [46]

    Specifically, sequential rule mining discovers all rules in the form of𝑋→𝑌 in the dataset

    is an effective attack method in detecting the watermark if the watermark items are unpopular. Specifically, sequential rule mining discovers all rules in the form of𝑋→𝑌 in the dataset. The rule indicates that𝑌 appears after𝑋, where𝑋 and𝑌 are both sets of Data Watermarking for...

    2017

  36. [2012]

    arXiv preprint arXiv:1205.2618 (2012)

    BPR: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618 (2012)

    2012 arXiv

  37. [2014]

    In Advances in Intelligent Data Analysis XIII: 13th International Symposium, IDA 2014, Leuven, Belgium, October 30–November 1, 2014

    ERMiner: sequential rule mining using equivalence classes. In Advances in Intelligent Data Analysis XIII: 13th International Symposium, IDA 2014, Leuven, Belgium, October 30–November 1, 2014. Proceedings 13 . Springer, 108–119

    2014

  38. [2019]

    In The world wide web conference

    Graph neural networks for social recommendation. In The world wide web conference. 417–426

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.