Technology Category
Machine Learning: PrivacyComputer Vision: Adversarial Attacks & RobustnessData Mining & Knowledge Management: Recommender Systems
RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems
🤖 AI Summary
To address privacy leakage from user attribute inference attacks (e.g., gender, political orientation) in recommender systems, this paper proposes RAID, the first end-to-end trainable defense framework. RAID’s core innovation lies in formulating the Wasserstein barycenter problem as a theoretical foundation for attribute indistinguishability and designing an adversarial optimal transport alignment mechanism with performance constraints, jointly optimizing recommendation accuracy and sensitive attribute indistinguishability during training. This enables dynamic distribution-level privacy protection in the embedding space, overcoming the inflexibility of post-hoc defenses and the instability of conventional adversarial training. Evaluated on four real-world datasets, RAID reduces attribute inference attack success rates by over 40%, while preserving recommendation accuracy—HR@10 and NDCG@10 degrade by less than 0.3%. It significantly outperforms baseline methods including differential privacy and attribute forgetting.
Technology Category
Application Category
📝 Abstract
In various networks and mobile applications, users are highly susceptible to attribute inference attacks, with particularly prevalent occurrences in recommender systems. Attackers exploit partially exposed user profiles in recommendation models, such as user embeddings, to infer private attributes of target users, such as gender and political views. The goal of defenders is to mitigate the effectiveness of these attacks while maintaining recommendation performance. Most existing defense methods, such as differential privacy and attribute unlearning, focus on post-training settings, which limits their capability of utilizing training data to preserve recommendation performance. Although adversarial training extends defenses to in-training settings, it often struggles with convergence due to unstable training processes. In this paper, we propose RAID, an in-training defense method against attribute inference attacks in recommender systems. In addition to the recommendation objective, we define a defensive objective to ensure that the distribution of protected attributes becomes independent of class labels, making users indistinguishable from attribute inference attacks. Specifically, this defensive objective aims to solve a constrained Wasserstein barycenter problem to identify the centroid distribution that makes the attribute indistinguishable while complying with recommendation performance constraints. To optimize our proposed objective, we use optimal transport to align users with the centroid distribution. We conduct extensive experiments on four real-world datasets to evaluate RAID. The experimental results validate the effectiveness of RAID and demonstrate its significant superiority over existing methods in multiple aspects.
Problem
Research questions and friction points this paper is trying to address.
Defend against attribute inference attacks in recommender systems
Maintain recommendation performance while protecting user privacy
Stabilize adversarial training for robust defense convergence
Innovation
Methods, ideas, or system contributions that make the work stand out.
In-training defense method against attribute inference attacks
Constrained Wasserstein barycenter for centroid distribution
Optimal transport for user alignment with centroid
🔎 Similar Papers
No similar papers found.
