Efficient Federated Matrix Factorization Against Inference Attacks
Abstract
Recommender systems typically require the revelation of users’ ratings to the recommender server, which will subsequently use these ratings to provide personalized services. However, such revelations make users vulnerable to a broader set of inference attacks, allowing the recommender server to learn users’ private attributes, e.g., age and gender. Therefore, in this paper, we propose an efficient federated matrix factorization method that protects users against inference attacks. The key idea is that we obfuscate one user’s rating to another such that the private attribute leakage is minimized under the given distortion budget, which bounds the recommending loss and overhead of system efficiency. During the obfuscation, we apply differential privacy to control the information leakage between the users. We also adopt homomorphic encryption to protect the intermediate results during training. Our framework is implemented and tested on real-world datasets. The result shows that our method can reduce up to 16.7% of inference attack accuracy compared to using no privacy protections.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Various privacy preservation methodologies, such as randomization, differential privacy, secure multiparty computation, and homomorphic encryption, can be applied to build decentralized PPRS.
“To address these vulnerabilities, various privacy preservation methodologies, such as randomization, differential privacy, secure multiparty computation, and homomorphic encryption, can be applied to build decentralized PPRS [14, 129-132, 138, 139, 141].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [138]
Decentralized recommender systems remain vulnerable to threats such as inference attacks and differential attacks.
“Although decentralized RS inherently provides a privacy protocol, as users preserve their entire historical data, and even FedRec prioritizes user privacy over DCS, it remains vulnerable to threats such as inference attacks and differential attacks [105, 138-142].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [138]
DP noise can be introduced at various stages: on the input data, the model parameters, or the final recommendations.
“This carefully calibrated noise can be introduced at various stages: on the input data [14, 124, 138, 172], the model parameters [101, 171, 173], or the final recommendations [172].”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [138]
The authors of [138] used the same hybrid approach in the federated environment by considering inference attacks.
“Conversely, the authors of [138] also used the same hybrid approach in the federated environment by considering inference attacks.”
From A Deep Dive into Fairness, Bias, Threats, and Privacy in Recommender Systems: Insights and Future Research (2024) · cites this paper as [138]
Cites
Matrix Factorization Techniques for Recommender Systems
Koren, Y., Bell, R. M., & Volinsky, C. (2009) · Computer · doi:10.1109/mc.2009.263 · Cited by 11,232 · see citing works
Neural Collaborative Filtering
He, X., Liao, L., Zhang, H., Nie, L., Hu, X., & Chua, T. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052569 · Cited by 7,066 · see citing works
Top 10 algorithms in data mining
Wu, X., Kumar, V., Ross Quinlan, J., Ghosh, J., Yang, Q., Motoda, H., McLachlan, G. J., Ng, A., Liu, B., Yu, P. S., et al. (2008) · Knowledge and Information Systems · doi:10.1007/s10115-007-0114-2 · Cited by 5,667 · see citing works
Self-citationFactorization meets the neighborhood
Koren, Y. (2008) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1401890.1401944 · Cited by 3,959 · see citing works
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · see citing works
Deep Neural Networks for YouTube Recommendations
Covington, P., Adams, J., & Sargin, E. (2016) · Proceedings of the 10th ACM Conference on Recommender Systems · doi:10.1145/2959100.2959190 · Cited by 3,539 · see citing works
DeepFM: A Factorization-Machine based Neural Network for CTR Prediction
Guo, H., Tang, R., Ye, Y., Li, Z., & He, X. (2017) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2017/239 · Cited by 2,615 · see citing works
Homomorphic Encryption for Arithmetic of Approximate Numbers
Cheon, J. H., Kim, A., Kim, M., & Song, Y. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-70694-8_15 · Cited by 2,522 · see citing works
Goldreich, O. (2004) · Cambridge University Press eBooks · doi:10.1017/cbo9780511721656 · Cited by 1,807 · see citing works
Collaborative Deep Learning for Recommender Systems
Wang, H., Wang, N., & Yeung, D.-Y. (2015) · Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2783258.2783273 · Cited by 1,657 · see citing works
Differentially private recommender systems
McSherry, F., & Mironov, I. (2009) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1557019.1557090 · Cited by 676 · see citing works
Oblivious transfer and polynomial evaluation
Naor, M., & Pinkas, B. (1999) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/301250.301312 · Cited by 632 · see citing works
Secure Federated Matrix Factorization
Chai, D., Wang, L., Chen, K., & Yang, Q. (2020) · IEEE Intelligent Systems · doi:10.1109/mis.2020.3014880 · Cited by 473 · see citing works
Self-citationPrivacy against statistical inference
Calmon, F. P., & Fawaz, N. (2012) · Allerton Conference on Communication, Control, and Computing · doi:10.1109/allerton.2012.6483382 · Cited by 351 · see citing works
Collaborative Memory Network for Recommendation Systems
Ebesu, T., Shen, B., & Fang, Y. (2018) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3209978.3209991 · Cited by 287 · see citing works
Privacy-preserving matrix factorization
Nikolaenko, V., Ioannidis, S., Weinsberg, U., Jóye, M., Taft, N., & Boneh, D. (2013) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2508859.2516751 · Cited by 279 · see citing works
Spectral collaborative filtering
Zheng, L., Lu, C.-T., Jiang, F., Zhang, J., & Yu, P. S. (2018) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3240323.3240343 · Cited by 232 · see citing works
Privacy Enhanced Matrix Factorization for Recommendation with Local Differential Privacy
Shin, H., Kim, S., Shin, J., & Xiao, X. (2018) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2018.2805356 · Cited by 229 · see citing works
Federated Collaborative Filtering for Privacy-Preserving Personalized Recommendation SystemPreprint
Ammad-ud-din, M., Ivannikova, E., Khan, S. A., Oyomno, W., Fu, Q., Tan, K. E., & Flanagan, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09888 · Cited by 220 · see citing works
A Survey on Homomorphic Encryption Schemes: Theory and ImplementationPreprint
Acar, A., Aksu, H., Uluagac, A. S., & Conti, M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1704.03578 · Cited by 175 · see citing works
NationTelescope: Monitoring and visualizing large-scale collective behavior in LBSNs
Yang, D., Zhang, D., Chen, L., & Qu, B. (2015) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2015.05.010 · Cited by 152 · see citing works
Applying Differential Privacy to Matrix Factorization
Berlioz, A., Friedman, A., Kâafar, M. A., Boreli, R., & Berkovsky, S. (2015) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/2792838.2800173 · Cited by 126 · see citing works
A Practical Privacy-Preserving Recommender System
Badsha, S., Yi, X., & Khalil, I. (2016) · Data Science and Engineering · doi:10.1007/s41019-016-0020-2 · Cited by 101 · see citing works
Toward Privacy-Preserving Personalized Recommendation Services
Wang, C., Zheng, Y., Jiang, J., & Ren, K. (2018) · Engineering · doi:10.1016/j.eng.2018.02.005 · Cited by 101 · see citing works
Privacy-Preserving Social Media Data Publishing for Personalized Ranking-Based Recommendation
Yang, D., Qu, B., & Cudré-Mauroux, P. (2018) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2018.2840974 · Cited by 93 · see citing works
Privacy-Preserving Personalized Recommendation: An Instance-Based Approach via Differential Privacy
Shen, Y., & Jin, H. (2014) · Proceedings · doi:10.1109/icdm.2014.140 · Cited by 76 · see citing works
Privacy Preserving User-Based Recommender System
Badsha, S., Yi, X., Khalil, I., & Bertino, E. (2017) · 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.248 · Cited by 72 · see citing works
Efficient Privacy-Preserving Matrix Factorization via Fully Homomorphic Encryption
Kim, S., Kim, J., Koo, D., Kim, Y., Yoon, H., & Shin, J. (2016) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/2897845.2897875 · Cited by 61 · see citing works
Yang, D., Zhang, D., Qu, B., & Cudré-Mauroux, P. (2016) · ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp) · doi:10.1145/2971648.2971685 · Cited by 61 · see citing works
Privacy Protection for Recommendation System: A Survey
Huang, W., Liu, B., & Tang, H. (2019) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1325/1/012087 · Cited by 28 · see citing works
Location Privacy Protected Recommendation System in Mobile Cloud
Guan, H., Qian, H., & Zhao, Y. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-48671-0_36 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Xie, Q., Jiang, S., Jiang, L., Huang, Y., Zhao, Z., Khan, S., Dai, W., Liu, Z., & Wu, K. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3382875 · Cited by 209 · see citing works
A Survey on Trustworthy Recommender Systems
Ge, Y., Liu, S., Fu, Z., Tan, J., Li, Z., Xu, S., Li, Y., Xian, Y., & Zhang, Y. (2024) · ACM Transactions on Recommender Systems · doi:10.1145/3652891 · Cited by 144 · see citing works
Ali, W., Zhou, X., & Shao, J. (2024) · ACM Computing Surveys · doi:10.1145/3708982 · Cited by 50 · see citing works
Horizontal Federated Recommender System: A Survey
Wang, L., Zhou, H., Bao, Y., Yan, X., Shen, G., & Kong, X. (2024) · ACM Computing Surveys · doi:10.1145/3656165 · Cited by 37 · see citing works
Self-citationDifferential privacy in collaborative filtering recommender systems: a review
Müllner, P., Lex, E., Schedl, M., & Kowald, D. (2023) · Frontiers in Big Data · doi:10.3389/fdata.2023.1249997 · Cited by 32 · see citing works
On-Device Recommender Systems: A Comprehensive Survey
Yin, H., Qu, L., Chen, T., Yuan, W., Zheng, R., Long, J., Xia, X., Shi, Y., & Chengqi Zhang, B. (2025) · Data Science and Engineering · doi:10.1007/s41019-025-00308-8 · Cited by 67 · see citing works
ReuseKNN: Neighborhood Reuse for Differentially Private KNN-Based Recommendations
Müllner, P., Lex, E., Schedl, M., & Kowald, D. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3608481 · Cited by 27 · see citing works
Efficient federated item similarity model for privacy-preserving recommendation
Ding, X., Li, G., Yuan, L., Zhang, L., & Rong, Q. (2023) · Information Processing & Management · doi:10.1016/j.ipm.2023.103470 · Cited by 26 · see citing works
Federated Matrix Factorization Recommendation Based on Secret Sharing for Privacy Preserving
Zheng, X., Guan, M., Jia, X., Sun, L., & Luo, Y. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3322824 · Cited by 14 · see citing works
A survey on cross-user federated recommendation
Yang, E., Xiong, Y., Yuan, W., Pan, W., Yang, Q., & Ming, Z. (2025) · Science China Information Sciences · doi:10.1007/s11432-024-4310-7 · Cited by 12 · see citing works
Self-citationPersonalized Recommendation Models in Federated Settings: A Survey
Zhang, C., Long, G., Zhang, Z., Li, Z., Zhang, H., Yang, Q., & Yang, B. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3606643 · Cited by 14 · see citing works
Self-citationHydraGAN: A Cooperative Agent Model for Multi-Objective Data Generation
DeSmet, C., & Cook, D. J. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3653982 · Cited by 6 · see citing works
On-Device Recommender Systems: A Tutorial on The New-Generation Recommendation Paradigm
Yin, H., Chen, T., Qu, L., & Cui, B. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589335.3641250 · Cited by 6 · see citing works
A Tutorial of Personalized Federated Recommender Systems: Recent Advances and Future Directions
Jiang, J. B., Zhang, C., Zhang, H., Li, Z., Li, Y., & Yang, B. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715860 · Cited by 5 · see citing works
Communication Efficient Secret Sharing with Dynamic Communication-Computation Conversion
Ren, Z., Cheng, X., Fan, M., Zhang, J., & Cheng, H. (2023) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom53939.2023.10228872 · Cited by 3 · see citing works
Cross-User Federated Recommendation Unlearning
Li, Y., Yang, E., Pan, W., Yang, Q., & Ming, Z. (2025) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3749990 · Cited by 2 · see citing works
Self-citationExploring Personalized Intents with Knowledge Graph for Federated Self-supervised Recommendation
Wang, L., Kong, X., Li, J., Shu, C., & Shen, G. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-5663-6_34
Self-citationSARA: A Sparsity-Aware Efficient Oblivious Aggregation Service for Federated Matrix Factorization
Zheng, Y., Xiong, T., Ouyang, H., Wang, S., Hua, Z., & Gao, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-981-96-0567-5_17
Kong, X., Wang, L., Wang, M., & Shen, G. (2025) · Machine learning · doi:10.1007/978-981-96-3212-1_5
Self-citationFederated Matrix Factorization under Local Differential Privacy via Directional Noise
Saber, N. A., Mekouar, L., & Iraqi, Y. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00046
Roy, F., Ding, X., Choo, K. K. R., & Zhou, P. (2024) · arXiv · doi:10.48550/arxiv.2409.12651
- Authors
- Chai, D., Wang, L., Chen, K., & Yang, Q.
- Affiliations
- Hong Kong University of Science and Technology (HK)
- Peking University (CN)
- Venue
- ACM Transactions on Intelligent Systems and Technology
- Published
- 2022-06-28
- Volume
- 13
- Issue
- 4
- Pages
- 1-20
- ISSN
- 2157-6904 (ISSN-L)
- 2157-6912
- OpenAlex
- W4280588960
- Cited by
- 20
- References
- 31
- Citations by year
- 2026: 1 · 2025: 6 · 2024: 8 · 2023: 5
- FWCI
- 1.56
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ACM Transactions on Intelligent Systems and Technology (publishedVersion)
- Rare & Special e-Zone (The Hong Kong University of Science and Technology) (submittedVersion)
- Funders
- NSFC (61972008)
- PKU-Baidu Fund Project (2019BD005)
- Hong Kong RGC TRS (T41-603/20R)
- National Key Research and Development Program of China (2018AAA0101100)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- inference attacks, recommender systems, differential privacy, homomorphic encryption, privacy-preserving recommendation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
