P riv N et: Safeguarding Private Attributes in Transfer Learning for Recommendation (2020)

Abstract: Transfer learning is an effective technique to improve a target recommender system with the knowledge from a source domain. Existing research focuses on the recommendation performance of the target domain while ignores the privacy leakage of the source domain. The transferred knowledge, however, may unintendedly leak private information of the source domain. For example, an attacker can accurately infer user demographics from their historical purchase provided by a source domain data owner. This paper addresses the above privacy-preserving issue by learning a privacy-aware neural representation by improving target performance while protecting source privacy. The key idea is to simulate the attacks during the training for protecting unseen users’ privacy in the future, modeled by an adversarial game, so that the transfer learning model becomes robust to attacks. Experiments show that the proposed PrivNet model can successfully disentangle the knowledge benefitting the transfer from leaking the privacy.

## introduction recommender systems (rss) are widely used in everyday life ranging from amazon products @xcite and youtube videos @xcite to twitter microblogs @xcite and news feeds @xcite . rss estimate user preferences on items from their historical interactions. rss, however, cannot learn a reliable preference model if there are too few interactions in the case of new users and items, i.e., suffering from the data sparsity issues. transfer learning is an effective technique for alleviating the issues of data sparsity by exploiting the knowledge from related domains @xcite . we may infer user preferences on videos from their tweet texts @xcite , from movies to books @xcite , 2009), and from news to apps @xcite . these behaviors across domains are different views of the same user and may be driven by some inherent user interests @xcite . there is a privacy concern when the source domain shares their data to the target domain due to the ever-increasing user data abuse and privacy regulations @xcite . private information contains those attributes that users do not want to disclose, such as gender and age @xcite . they can be used to train better recommendation models by alleviating the data sparsity issues to build better user profiles @xcite . previous work @xcite shows that an attacker can accurately infer a user's gender, age, and occupation from their ratings, recommendation results, and a small amount of users who reveal their demographics. a technical challenge for protecting user privacy in transfer learning is that the transferred knowledge has dual roles: usefulness to improve target recommendation and uselessness to infer source user privacy. in this work, we propose a novel model (privnet) to achieve the two goals by learning privacy-aware transferable knowledge such that it is useful for improving recommendation performance in the target domain while it is useless to infer private information of the source domain. the key idea is to simulate the attack during the training for protecting unseen users' privacy in the future. the privacy attacker and the recommender are naturally modeled by an adversarial learning game. the main contributions are two-fold: ## problem statement we have two domains, a source domain s and a target domain t . user sets in two domains are shared, denoted by u (of size @xmath0. denote item sets in two domains by i s and i t (of size n @xmath1, respectively. for the target domain, a binary matrix r @xmath2, where the entry r @xmath3, 1} equals 1 if user u has an interaction with item i and 0 otherwise. similarly, for the source domain, we have r @xmath4, 1}. we reserve i and j to index the target and source items, respectively. let y @xmath5.g., @xmath6,p is the value of the p-th private information for user u (e.g., y u,@xmath7. denote all n private attributes data by @xmath8.g., gender, age). we can define the problem as follows: problem: privacy-aware transfer learning in recommendation. input: r t , r s , y . output: generate a ranked list of items for users in the target domain. require: an attacker is difficult to infer the source user private attributes from the knowledge transferred to the target domain. assumption: some users u pub ⊂ u share their private information with the public profile. ## the proposed framework the architecture of privnet is shown in figure 2 . it has two components, a recommender and an attacker. we introduce the recommender (section 4.1) and present an attack against it (section 4.2). we propose privnet to protect source user privacy during the knowledge transfer (section 4.3). ## experiments in this section, we conduct experiments to evaluate both recommendation performance and privacy protection of privnet. ## conclusion we presented an attack scenario to infer the private user attributes from the transferred knowledge in recommendation, raising the issues of source privacy leakage beyond target performance. to protect user privacy in the source domain, a privacy-aware transfer model (privnet) is proposed beyond improving the performance in the target domain. it is effective in terms of recommendation performance and privacy protection, achieving a good trade-off between the utility and privacy of the transferred knowledge. in future works, we want to relax the assumption that the private user attributes need to provide in advance in order to train the privacy inference component for protecting unseen users.