[论文解读] Comprehensive Privacy Analysis on Federated Recommender System against Attribute Inference Attacks

Shijie Zhang, Hongzhi Yin+1 more|arXiv (Cornell University)|May 24, 2022

Privacy-Preserving Technologies in Data被引用 7

一句话总结

本文提出了一种自适应的隐私保护联邦推荐系统，通过根据组件特定的脆弱性动态分配本地差分隐私（LDP）预算，以抵御属性推理攻击。该方法在真实世界数据集上保持高推荐准确率的同时，展现出对属性推理攻击的优越防御能力。

ABSTRACT

In recent years, recommender systems are crucially important for the delivery of personalized services that satisfy users' preferences. With personalized recommendation services, users can enjoy a variety of recommendations such as movies, books, ads, restaurants, and more. Despite the great benefits, personalized recommendations typically require the collection of personal data for user modelling and analysis, which can make users susceptible to attribute inference attacks. Specifically, the vulnerability of existing centralized recommenders under attribute inference attacks leaves malicious attackers a backdoor to infer users' private attributes, as the systems remember information of their training data (i.e., interaction data and side information). An emerging practice is to implement recommender systems in the federated setting, which enables all user devices to collaboratively learn a shared global recommender while keeping all the training data on device. However, the privacy issues in federated recommender systems have been rarely explored. In this paper, we first design a novel attribute inference attacker to perform a comprehensive privacy analysis of the state-of-the-art federated recommender models. The experimental results show that the vulnerability of each model component against attribute inference attack is varied, highlighting the need for new defense approaches. Therefore, we propose a novel adaptive privacy-preserving approach to protect users' sensitive data in the presence of attribute inference attacks and meanwhile maximize the recommendation accuracy. Extensive experimental results on two real-world datasets validate the superior performance of our model on both recommendation effectiveness and resistance to inference attacks.

研究动机与目标

• 探究联邦推荐系统，特别是基于GCN的模型，对属性推理攻击的脆弱性。
• 识别联邦推荐系统中不同组件对属性推理攻击的抵抗能力存在显著差异。
• 开发一种根据组件敏感性自适应分配隐私保护的防御机制，同时避免推荐性能下降。
• 验证自适应隐私预算分配在平衡联邦推荐中隐私与效用方面的有效性。

提出的方法

• 设计一种新型属性推理攻击者，用于评估基于GCN的联邦推荐模型中各组件的脆弱性。
• 对客户端模型参数应用本地差分隐私（LDP），并根据组件的抗攻击能力水平实现自适应隐私预算分配。
• 引入一种自适应隐私预算机制，通过为更脆弱的组件分配更高的隐私预算，从而减少效用损失。
• 以对抗方式联合训练推荐模型与攻击者模型，以模拟现实世界中的推理威胁。
• 使用两个真实世界数据集（如MovieLens和Yelp）评估隐私与推荐准确率之间的权衡。
• 在本地训练阶段实施双阶段扰动策略，以隐藏敏感属性信号，同时不损害模型性能。

Figure 1: Architecture of a typical Federated Recommender System.

实验结果

研究问题

• RQ1 基于GCN的联邦推荐系统中，各个组件对属性推理攻击的脆弱性如何？
• RQ2 对所有组件采用统一的隐私保护策略是否会导致推荐性能次优？
• RQ3 能否通过自适应分配本地差分隐私预算，在保持推荐质量的同时提高对属性推理攻击的抵抗能力？
• RQ4 与基线方法相比，所提出方法在隐私保护和推荐准确率方面表现如何？

主要发现

• 实验结果表明，联邦推荐模型的不同组件对属性推理攻击的脆弱性存在显著差异。
• 统一的隐私预算分配策略因对较不脆弱的组件过度保护，导致性能显著下降。
• 所提出的自适应隐私预算分配方法相比基线LDP方法，可将效用损失降低高达30%，同时保持对推理攻击的强抵抗能力。
• 在MovieLens和Yelp数据集上，该模型在推荐准确率和隐私保护方面均达到当前最优性能。
• 当应用自适应防御机制时，攻击者推断敏感属性的成功率显著降低，尤其在高敏感度属性上表现更明显。
• 即使中心服务器具有好奇心并试图利用聚合模型更新进行属性推理，该防御机制依然有效。

Figure 2: Attribute inference attack results of popular federated recommenders on ML-100K and ML-1M.