Membership Inference Attacks Against Recommender Systems
Abstract
Recently, recommender systems have achieved promising performances and become one of the most widely used web applications. However, recommender systems are often trained on highly sensitive user data, thus potential data leakage from recommender systems may lead to severe privacy problems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Zhang et al. [95] first introduced the MIA attack in RS.
“Zhang et al. [95] first introduced the MIA attack in RS.”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [95]
A black box attack remains challenging due to the need for knowledge about the RS algorithm or architecture, though possible.
“However, it remains challenging due to the need for knowledge about the RS algorithm or architecture, though possible [10, 8991, 93, 95-97].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [95]
To perform MIA, an adversary needs a target and shadow recommender system, an attack model, lists of members, feature vectors, and a personalized recommendation algorithm.
“To perform MIA, an adversary needs a target and shadow recommender system, an attack model, lists of members, feature vectors, and a personalized recommendation algorithm [95-97].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [95]
Cites
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890 · see citing works
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Xu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164 · see citing works
Chen, C., Sun, F., Zhang, M., & Ding, B. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3511997 · Cited by 110 · see citing works
Self-citationMembership Inference Attacks Against Sequential Recommender Systems
Zhu, Z., Wu, C., Fan, R., Lian, D., & Chen, E. (2023) · Proceedings of the ACM Web Conference 2023 · doi:10.1145/3543507.3583447 · Cited by 24 · see citing works
Roy, F., Ding, X., Choo, K. K. R., & Zhou, P. (2024) · arXiv · doi:10.48550/arxiv.2409.12651
- Authors
- Zhang, M., Ren, Z., Wang, Z., Ren, P., Chen, Z., Hu, P., & Zhang, Y.
- Affiliations
- Shandong University (CN)
- Helmholtz Center for Information Security (DE)
- Venue
- Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2021-11-12
- Pages
- 864-879
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W3211930400
- Cited by
- 76
- References
- 5
- Citations by year
- 2026: 15 · 2025: 16 · 2024: 19 · 2023: 17 · 2022: 9
- FWCI
- 5.20
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Natural Science Foundation of China (61902219, 61972234, 62072279, 62102234)
- the Helmholtz Association within the project ``Trustworthy Federated Data Analytics' (TFDA) (ZT-I-OO1 4)
- National Key R&D Program of China (2020YFB1406704)
- Key Scientific and Technological Innovation Program of Shandong Province (2019JZZY010129)
- Shandong University multidisciplinary research and innovation team of young scholars (2020QNQT017)
- Tencent WeChat Rhino-Bird Focused Research Program (JR-WXG2021411)
- Hybrid Intelligence Center
- A 10-year program funded by the Dutch Ministry of Education, Culture and Science through the Netherlands Organisation for Scientific Research, https://hybrid-intelligence-centre.nl
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- membership inference attacks, recommender systems, privacy leakage, user privacy, sensitive user data, data leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
