{"type":"ScholarlyArticle","title":"Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought","authors":[{"name":"Xiaoxiao Chi","slug":"xiaoxiao-chi","given":"Xiaoxiao","family":"Chi","affiliation":"Macquarie University"},{"name":"Xuyun Zhang","slug":"xuyun-zhang","given":"Xuyun","family":"Zhang","affiliation":"Macquarie University"},{"name":"Yan Wang","slug":"yan-wang","given":"Yan","family":"Wang","affiliation":"Macquarie University"},{"name":"Lianyong Qi","slug":"lianyong-qi","given":"Lianyong","family":"Qi","affiliation":"China University of Petroleum (East China)"},{"name":"Amin Beheshti","slug":"amin-beheshti","given":"Amin","family":"Beheshti","affiliation":"Macquarie University"},{"name":"Xiaolong Xu","slug":"xiaolong-xu","given":"Xiaolong","family":"Xu","affiliation":"Nanjing University of Information Science and Technology"},{"name":"Kim-Kwang Raymond Choo","slug":"kim-kwang-raymond-choo","given":"Kim-Kwang Raymond","family":"Choo","affiliation":"The University of Texas at San Antonio"},{"name":"Shuo Wang","slug":"shuo-wang","given":"Shuo","family":"Wang","affiliation":"Shanghai Jiao Tong University"},{"name":"Hongsheng Hu","slug":"hongsheng-hu","given":"Hongsheng","family":"Hu","affiliation":"CSIRO's Data61"}],"abstract":"Recommender systems have been successfully applied in many applications. Nonetheless, recent studies demonstrate that recommender systems are vulnerable to membership inference attacks (MIAs), leading to the leakage of users’ membership privacy. However, existing MIAs relying on shadow training suffer a large performance drop when the attacker lacks knowledge of the training data distribution and the model architecture of the target recommender system. To better understand the privacy risks of recommender systems, we propose shadow-free MIAs that directly leverage a user’s recommendations for membership inference. Without shadow training, the proposed attack can conduct MIAs efficiently and effectively under a practice scenario where the attacker is given only black-box access to the target recommender system. The proposed attack leverages an intuition that the recommender system personalizes a user’s recommendations if his historical interactions are used by it. Thus, an attacker can infer membership privacy by determining whether the recommendations are more similar to the interactions or the general popular items. We conduct extensive experiments on benchmark datasets across various recommender systems. Remarkably, our attack achieves far better attack accuracy with low false positive rates than baselines while with a much lower computational cost.","doi":"10.24963/ijcai.2024/639","url":"https://ijcai.org/proceedings/2024/639","pdf":"https://ijcai.org/proceedings/2024/0639.pdf","markdown":"https://ijcai.org/proceedings/2024/639.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/639","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":639,"pages":{"first":5781,"last":5789},"keywords":["Multidisciplinary Topics and Applications: MTA: Security and privacy","AI Ethics, Trust, Fairness: ETF: Trustworthy AI","AI Ethics, Trust, Fairness: ETF: Safety and robustness"],"videos":[],"references":[{"position":1,"raw":"[Abadi et al., 2016] Martin Abadi, Andy Chu, Ian Goodfel- low, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In CCS, pages 308-318, 2016.","title":"Deep learning with differential privacy","authors":"Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan Mcmahan, Ilya Mironov, Kunal Talwar, Li Zhang","year":"2016","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Burke, 2002] Robin Burke. Hybrid recommender systems: Survey and experiments. User Modeling and User- adapted Interaction, 12:331-370, 2002.","title":"Hybrid recommender systems: Survey and experiments","authors":"Robin Burke, Burke","year":"2002","venue":"User Modeling and Useradapted Interaction","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini et al., 2019] Nicholas Carlini, Chang Liu, Úlfar Er- lingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security, pages 267-284, 2019.","title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","authors":"Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, Dawn Song","year":"2019","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini et al., 2021] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large lan- guage models. In USENIX Security, pages 2633-2650, 2021.","title":"Extracting training data from large language models","authors":"Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson","year":"2021","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Carlini et al., 2022] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In S&P, pages 1897-1914. IEEE, 2022.","title":"Membership inference attacks from first principles","authors":"Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, Florian Tramer","year":"2022","venue":"S&P","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen et al., 2017] Jingyuan Chen, Hanwang Zhang, Xiang- nan He, Liqiang Nie, Wei Liu, and Tat-Seng Chua. Atten- tive collaborative filtering: Multimedia recommendation with item-and component-level attention. In SIGIR, pages 335-344, 2017.","title":"Attentive collaborative filtering: Multimedia recommendation with item-and component-level attention","authors":"Jingyuan Chen, Hanwang Zhang, Xiangnan He, Liqiang Nie, Wei Liu, Tat-Seng Chua","year":"2017","venue":"SIGIR","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dwork et al., 2006] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptog- raphy: Theory of Cryptography Conference (TCC), pages 265-284. Springer, 2006.","title":"Calibrating noise to sensitivity in private data analysis","authors":"Cynthia Dwork, Frank Mcsherry, Kobbi Nissim, Adam Smith","year":"2006","venue":"Theory of Cryptography: Theory of Cryptography Conference (TCC)","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Fan et al., 2019] Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin. Graph neural net- works for social recommendation. In WWW, pages 417- 426, 2019.","title":"Graph neural networks for social recommendation","authors":"Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, Dawei Yin","year":"2019","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Harper and Konstan, 2015] F Maxwell Harper and Joseph A Konstan. The movielens datasets: History and context. Acm Transactions on Interactive Intelligent Systems (TIIS), 5(4):1-19, 2015.","title":"The movielens datasets: History and context","authors":"Maxwell Harper, Joseph A Konstan","year":"2015","venue":"Acm Transactions on Interactive Intelligent Systems (TIIS)","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hayes et al., 2017] Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Member- ship inference attacks against generative models. arXiv preprint arXiv:1705.07663, 2017.","title":"Logan: Membership inference attacks against generative models","authors":"Jamie Hayes, Luca Melis, George Danezis, Emiliano De, Cristofaro","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[He et al., 2017] Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. Neural collabo- rative filtering. In WWW, pages 173-182, 2017.","title":"Neural collaborative filtering","authors":"He","year":"2017","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[He et al., 2020] Yang He, Shadi Rahimian, Bernt Schiele, and Mario Fritz. Segmentations-leak: Membership infer- ence attacks and defenses in semantic image segmentation. In Computer Vision-ECCV, pages 519-535. Springer, 2020.","title":"Segmentations-leak: Membership inference attacks and defenses in semantic image segmentation","authors":"He","year":"2020","venue":"Computer Vision-ECCV","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[He et al., 2021] Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node-level mem- bership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429, 2021.","title":"Node-level membership inference attacks against graph neural networks","authors":"He","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Hidasi et al., 2015] Balázs Hidasi, Alexandros Karat- zoglou, Linas Baltrunas, and Domonkos Tikk. Session- based recommendations with recurrent neural networks. arXiv preprint arXiv:1511.06939, 2015.","title":"Sessionbased recommendations with recurrent neural networks","authors":"Balázs Hidasi, Alexandros Karatzoglou, Linas Baltrunas, Domonkos Tikk","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Hu et al., 2022] Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Mem- bership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR), 54(11s):1-37, 2022.","title":"Membership inference attacks on machine learning: A survey","authors":"Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, Xuyun Zhang","year":"2022","venue":"ACM Computing Surveys (CSUR)","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Koren et al., 2009] Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recom- mender systems. Computer, 42(8):30-37, 2009.","title":"Matrix factorization techniques for recommender systems","authors":"Koren","year":"2009","venue":"Computer","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Liu et al., 2018] Qiao Liu, Yifu Zeng, Refuoe Mokhosi, and Haibin Zhang. Stamp: short-term attention/memory pri- ority model for session-based recommendation. In KDD, pages 1831-1839, 2018.","title":"Stamp: short-term attention/memory priority model for session-based recommendation","authors":"Qiao Liu, Yifu Zeng, Refuoe Mokhosi, Haibin Zhang","year":"2018","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[McAuley et al., 2015] Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel. Image-based recommendations on styles and substitutes. In SIGIR, pages 43-52, 2015.","title":"Image-based recommendations on styles and substitutes","authors":"Julian Mcauley, Christopher Targett, Qinfeng Shi, Anton Van Den, Hengel","year":"2015","venue":"SIGIR","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Narducci et al., 2015] Fedelucio Narducci, Cataldo Musto, Marco Polignano, Marco de Gemmis, Pasquale Lops, and Giovanni Semeraro. A recommender system for connect- ing patients to the right doctors in the healthnet social net- work. In WWW, pages 81-82, 2015.","title":"A recommender system for connecting patients to the right doctors in the healthnet social network","authors":"Narducci","year":"2015","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Pardau, 2018] Stuart L Pardau. The california consumer pri- vacy act: Towards a european-style privacy regime in the united states. J. Tech. L. & Pol'y, 23:68, 2018.","title":"The california consumer privacy act: Towards a european-style privacy regime in the united states","authors":"L Stuart, Pardau","year":"2018","venue":"J. Tech. L. & Pol'y","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Ribeiro et al., 2015] Mauro Ribeiro, Katarina Grolinger, and Miriam AM Capretz. Mlaas: Machine learning as a service. In ICMLA, pages 896-902, 2015.","title":"Mlaas: Machine learning as a service","authors":"Mauro Ribeiro, Katarina Grolinger, Miriam Am Capretz","year":"2015","venue":"ICMLA","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Rosen, 2011] Jeffrey Rosen. The right to be forgotten. Stan- ford Law Review, 64:88, 2011.","title":"The right to be forgotten","authors":"Jeffrey Rosen","year":"2011","venue":"Stanford Law Review","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Salem et al., 2019] Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In NDSS Sym- posium. Internet Society, 2019.","title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models","authors":"Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, Michael Backes","year":"2019","venue":"NDSS Symposium","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Sarwar et al., 2001] Badrul Sarwar, George Karypis, Joseph Konstan, and John Riedl. Item-based collaborative filter- ing recommendation algorithms. In WWW, pages 285- 295, 2001.","title":"Item-based collaborative filtering recommendation algorithms","authors":"Badrul Sarwar, George Karypis, Joseph Konstan, John Riedl","year":"2001","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Sedhain et al., 2014] Suvash Sedhain, Scott Sanner, Darius Braziunas, Lexing Xie, and Jordan Christensen. Social collaborative filtering for cold-start recommendations. In RecSys, pages 345-348, 2014.","title":"Social collaborative filtering for cold-start recommendations","authors":"Sedhain","year":"2014","venue":"RecSys","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Sedhain et al., 2015] Suvash Sedhain, Aditya Krishna Menon, Scott Sanner, and Lexing Xie. Autorec: Au- toencoders meet collaborative filtering. In WWW, pages 111-112, 2015.","title":"Autorec: Autoencoders meet collaborative filtering","authors":"Sedhain","year":"2015","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Sedhain et al., 2017] Suvash Sedhain, Aditya Menon, Scott Sanner, Lexing Xie, and Darius Braziunas. Low-rank lin- ear cold-start recommendation from social data. In AAAI, volume 31, 2017.","title":"Low-rank linear cold-start recommendation from social data","authors":"Sedhain","year":"2017","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. In S&P, pages 3-18. IEEE, 2017.","title":"Membership inference attacks against machine learning models","authors":"Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov","year":"2017","venue":"S&P","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Song and Mittal, 2021] Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learn- ing models. In USENIX Security, pages 2615-2632, 2021.","title":"Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models","authors":"Mittal Song","year":"2021","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Song and Shmatikov, 2019] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. In KDD, pages 196-206, 2019.","title":"Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models","authors":"Shmatikov Song","year":"2019","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Sun et al., 2019] Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, and Peng Jiang. Bert4rec: Sequen- tial recommendation with bidirectional encoder represen- tations from transformer. In CIKM, pages 1441-1450, 2019.","title":"Bert4rec: Sequential recommendation with bidirectional encoder representations from transformer","authors":"Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, Peng Jiang","year":"2019","venue":"CIKM","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Tang and Wang, 2018] Jiaxi Tang and Ke Wang. Person- alized top-n sequential recommendation via convolutional sequence embedding. In WSDM, pages 565-573, 2018.","title":"Personalized top-n sequential recommendation via convolutional sequence embedding","authors":"Wang ; ] Jiaxi Tang, Ke Tang, Wang","year":"2018","venue":"WSDM","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Tang et al., 2016] Jiliang Tang, Charu Aggarwal, and Huan Liu. Recommendations in signed social networks. In WWW, pages 31-40, 2016.","title":"Recommendations in signed social networks","authors":"Tang","year":"2016","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Wang et al., 2022] Zihan Wang, Na Huang, Fei Sun, Pengjie Ren, Zhumin Chen, Hengliang Luo, Maarten de Rijke, and Zhaochun Ren. Debiasing learning for mem- bership inference attacks against recommender systems. In KDD, pages 1959-1968, 2022.","title":"Debiasing learning for membership inference attacks against recommender systems","authors":"Zihan Wang, Na Huang, Fei Sun, Pengjie Ren, Zhumin Chen, Hengliang Luo, Maarten De Rijke, Zhaochun Ren","year":"2022","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Wu et al., 2019] Le Wu, Peijie Sun, Yanjie Fu, Richang Hong, Xiting Wang, and Meng Wang. A neural influ- ence diffusion model for social recommendation. In SI- GIR, pages 235-244, 2019.","title":"A neural influence diffusion model for social recommendation","authors":"Le Wu, Peijie Sun, Yanjie Fu, Richang Hong, Xiting Wang, Meng Wang","year":"2019","venue":"SI-GIR","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Ye et al., 2022] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. En- hanced membership inference attacks against machine learning models. In CCS, pages 3093-3106, 2022.","title":"Enhanced membership inference attacks against machine learning models","authors":"Ye","year":"2022","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Yeom et al., 2018] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In CSF, pages 268-282. IEEE, 2018.","title":"Privacy risk in machine learning: Analyzing the connection to overfitting","authors":"Yeom","year":"2018","venue":"CSF","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Zhang et al., 2019] Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. Deep learning based recommender system: A survey and new perspectives. ACM Computing Surveys (CSUR), 52(1):1-38, 2019.","title":"Deep learning based recommender system: A survey and new perspectives","authors":"Shuai Zhang, Lina Yao, Aixin Sun, Yi Tay","year":"2019","venue":"ACM Computing Surveys (CSUR)","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Zhang et al., 2021] Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. Membership inference attacks against rec- ommender systems. In CCS, pages 864-879, 2021.","title":"Membership inference attacks against recommender systems","authors":"Zhang","year":"2021","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Zhou et al., 2018] Meizi Zhou, Zhuoye Ding, Jiliang Tang, and Dawei Yin. Micro behaviors: A new perspective in e- commerce recommender systems. In WSDM, pages 727- 735, 2018.","title":"Micro behaviors: A new perspective in ecommerce recommender systems","authors":"Zhou","year":"2018","venue":"WSDM","doi":null,"url":null,"internal_url":null},{"position":41,"raw":"[Zhou et al., 2019] Guorui Zhou, Na Mou, Ying Fan, Qi Pi, Weijie Bian, Chang Zhou, Xiaoqiang Zhu, and Kun Gai. Deep interest evolution network for click-through rate pre- diction. In AAAI, volume 33, pages 5941-5948, 2019.","title":"Deep interest evolution network for click-through rate prediction","authors":"Guorui Zhou, Na Mou, Ying Fan, Qi Pi, Weijie Bian, Chang Zhou, Xiaoqiang Zhu, Kun Gai","year":"2019","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":42,"raw":"[Zhu et al., 2023] Zhihao Zhu, Chenwang Wu, Rui Fan, Defu Lian, and Enhong Chen. Membership inference at- tacks against sequential recommender systems. In WWW, pages 1208-1219, 2023.","title":"Membership inference attacks against sequential recommender systems","authors":"Zhihao Zhu, Chenwang Wu, Rui Fan, Defu Lian, Enhong Chen","year":"2023","venue":"WWW","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}