Cited By
View all- Du TBi N(2025)Application of Artificial Intelligence Advances in Athletics Industry: A ReviewConcurrency and Computation: Practice and Experience10.1002/cpe.837237:3Online publication date: 14-Jan-2025
Post-Training Attribute Unlearning in Recommender Systems
Authors: 
Chaochao Chen, Yizhao Zhang, Yuyuan Li, Jun Wang, Lianyong Qi, Xiaolong Xu, Xiaolin Zheng, Jianwei YinAuthors Info & Claims
Chaochao Chen, Yizhao Zhang, Yuyuan Li, Jun Wang, Lianyong Qi, Xiaolong Xu, Xiaolin Zheng, Jianwei YinAuthors Info & ClaimsArticle No.: 25, Pages 1 - 28
Abstract
With the growing privacy concerns in recommender systems, recommendation unlearning is getting increasing attention. Existing studies predominantly use training data, i.e., model inputs, as unlearning target. However, attackers can extract private information from the model even if it has not been explicitly encountered during training. We name this unseen information as attribute and treat it as unlearning target. To protect the sensitive attribute of users, Attribute Unlearning (AU) aims to make target attributes indistinguishable. In this article, we focus on a strict but practical setting of AU, namely Post-Training Attribute Unlearning (PoT-AU), where unlearning can only be performed after the training of the recommendation model is completed. To address the PoT-AU problem in recommender systems, we propose a two-component loss function. The first component is distinguishability loss, where we design a distribution-based measurement to make attribute labels indistinguishable from attackers. We further extend this measurement to handle multi-class attribute cases with efficient computational overhead. The second component is regularization loss, where we explore a function-space measurement that effectively maintains recommendation performance compared to parameter-space regularization. We use stochastic gradient descent algorithm to optimize our proposed loss. Extensive experiments on four real-world datasets demonstrate the effectiveness of our proposed methods.
References
[1]
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 308–318.
[2]
Martial Agueh and Guillaume Carlier. 2011. Barycenters in the Wasserstein space. SIAM Journal on Mathematical Analysis 43, 2 (2011), 904–924.
[3]
S. Basu, P. Pope, and S. Feizi. 2021. Influence functions in deep learning are fragile. In International Conference on Learning Representations (ICLR).
[4]
Ghazaleh Beigi, Ahmadreza Mosallanezhad, Ruocheng Guo, Hamidreza Alvari, Alexander Nou, and Huan Liu. 2020. Privacy-aware recommendation with private-attribute protection using adversarial learning. In Proceedings of the 13th International Conference on Web Search and Data Mining, 34–42.
[5]
Ari Benjamin, David Rolnick, and Konrad Kording. 2018. Measuring and regularizing networks in function space. In Proceedings of the International Conference on Learning Representations.
[6]
Albrecht Böttcher and David Wenzel. 2008. The Frobenius norm and the commutator. Linear Algebra and Its Applications 429, 8–9 (2008), 1864–1885.
[7]
Léon Bottou. 2012. Stochastic gradient descent tricks. In Neural Networks: Tricks of the Trade. Springer, 421–436.
[8]
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In Proceedings in the 42nd IEEE Symposium on Security and Privacy (SP).
[9]
Chris Burges, Tal Shaked, Erin Renshaw, Ari Lazier, Matt Deeds, Nicole Hamilton, and Greg Hullender. 2005. Learning to rank using gradient descent. In Proceedings of the 22nd International Conference on Machine Learning, 89–96.
[10]
Department of Justice California. 2018. California Consumer Privacy Act. Retrieved from https://oag.ca.gov/privacy/ccpa
[11]
Government Canada. 2019. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5). Retrieved from https://laws-lois.justice.gc.ca/ENG/ACTS/P-8.6/index.html
[12]
Yinzhi Cao and Junfeng Yang. 2015. Towards making systems forget with machine unlearning. In Proceedings of the 36th IEEE Symposium on Security and Privacy (SP), 463–480.
[13]
Antoine Chatalic, Nicolas Schreuder, Lorenzo Rosasco, and Alessandro Rudi. 2022. Nyström kernel mean embeddings. In Proceedings of the International Conference on Machine Learning. PMLR, 3006–3024.
[14]
Chong Chen, Fei Sun, Min Zhang, and Bolin Ding. 2022. Recommendation unlearning. In Proceedings of the ACM Web Conference, 2768–2777.
[15]
Chaochao Chen, Huiwen Wu, Jiajie Su, Lingjuan Lyu, Xiaolin Zheng, and Li Wang. 2022. Differential private knowledge transfer for privacy-preserving cross-domain recommendation. In Proceedings of the ACM Web Conference, 1455–1465.
[16]
Chaochao Chen, Jiaming Zhang, Yizhao Zhang, Li Zhang, Lingjuan Lyu, Yuyuan Li, Biao Gong, and Chenggang Yan. 2024. CURE4Rec: A benchmark for recommendation unlearning with deeper influence. arXiv:2408.14393. Retrieved from https://arxiv.org/abs/2408.14393
[17]
Marco Cuturi and Arnaud Doucet. 2014. Fast computation of Wasserstein barycenters. In Proceedings of the International Conference on Machine Learning. PMLR, 685–693.
[18]
Council EU. 2014. Council Regulation (EU) on 2012/0011. Retrieved from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52012PC0011
[19]
Christian Ganhör, David Penz, Navid Rekabsaz, Oleg Lesota, and Markus Schedl. 2022. Unlearning protected user attributes in recommendations with adversarial training. In Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR ’22). ACM, New York, NY, 2142–2147. DOI:
[20]
Matt W. Gardner and S. R. Dorling. 1998. Artificial neural networks (the multilayer perceptron)—A review of applications in the atmospheric sciences. Atmospheric Environment 32, 14–15 (1998), 2627–2636.
[21]
Claudio Gentile and Manfred K. K. Warmuth. 1998. Linear hinge loss and average margin. In Proceedings of the 11th International Conference on Neural Information Processing Systems.
[22]
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. 2020. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 9304–9312.
[23]
Margherita Grandini, Enrico Bagli, and Giorgio Visani. 2020. Metrics for multi-class classification: An overview. arXiv:2008.05756. Retrieved from https://arxiv.org/abs/2008.05756
[24]
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. 2012. A kernel two-sample test. The Journal of Machine Learning Research 13, 1 (2012), 723–773.
[25]
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. 2020. Certified data removal from machine learning models. In Proceedings of the 37th International Conference on Machine Learning, 3832–3842.
[26]
Tao Guo, Song Guo, Jiewei Zhang, Wenchao Xu, and Junxiao Wang. 2022. Efficient attribute unlearning: Towards selective removal of input attributes from feature representations. arXiv:2202.13295. Retrieved from https://arxiv.org/abs/2202.13295
[27]
Zhongxuan Han, Xiaolin Zheng, Chaochao Chen, Wenjie Cheng, and Yang Yao. 2023. Intra and inter domain hypergraph convolutional network for cross-domain recommendation. In Proceedings of the ACM Web Conference, 449–459.
[28]
F. Maxwell Harper and Joseph A. Konstan. 2015. The movielens datasets: History and context. ACM Transactions on Interactive Intelligent Systems 5, 4 (2015), 1–19.
[29]
Ruining He and Julian McAuley. 2016. Ups and downs: Modeling the visual evolution of fashion trends with one-class collaborative filtering. In Proceedings of the 25th International Conference on World Wide Web (WWW), 507–517.
[30]
Xiangnan He, Tao Chen, Min-Yen Kan, and Xiao Chen. 2015. Trirank: Review-aware explainable recommendation by modeling aspects. In Proceedings of the 24th ACM International on Conference on Information and Knowledge Management (CIKM), 1661–1670.
[31]
Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang. 2020. Lightgcn: Simplifying and powering graph convolution network for recommendation. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, 639–648.
[32]
Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. 2017. Neural collaborative filtering. In Proceedings of the 26th International Conference on World Wide Web (WWW), 173–182.
[33]
Xiangnan He, Hanwang Zhang, Min-Yen Kan, and Tat-Seng Chua. 2016. Fast matrix factorization for online recommendation with implicit feedback. In Proceedings of the 39th International ACM SIGIR Conference on Research and Development in Information Retrieval, 549–558.
[34]
Yifan Hu, Yehuda Koren, and Chris Volinsky. 2008. Collaborative filtering for implicit feedback datasets. In Proceedings of the 8th IEEE International Conference on Data Mining. IEEE, 263–272.
[35]
Folasade Olubusola Isinkaye, Yetunde O. Folajimi, and Bolande Adefowoke Ojokoh. 2015. Recommendation systems: Principles, methods and evaluation. Egyptian Informatics Journal 16, 3 (2015), 261–273.
[36]
Jinyuan Jia and Neil Zhenqiang Gong. 2018. Attriguard: A practical defense against attribute inference attacks via adversarial machine learning. In Proceedings of the 27th {USENIX} Security Symposium ({USENIX} Security ’18), 513–529.
[37]
Minsoo Kang, Jaeyoo Park, and Bohyung Han. 2022. Class-incremental learning by knowledge distillation with adaptive feature consolidation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 16071–16080.
[38]
Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In Proceedings of the International Conference on Machine Learning, 1885–1894.
[39]
Pang Wei W. Koh, Kai-Siang Ang, Hubert Teo, and Percy S. Liang. 2019. On the accuracy of influence functions for measuring group effects. In Proceedings of the 33rd International Conference on Neural Information Processing Systems, Vol. 32.
[40]
Walid Krichene and Steffen Rendle. 2020. On sampled metrics for item recommendation. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 1748–1757.
[41]
Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. 2016. Data poisoning attacks on factorization-based collaborative filtering. In Proceedings of the 30th International Conference on Neural Information Processing Systems.
[42]
Yuyuan Li, Chaochao Chen, Yizhao Zhang, Weiming Liu, Lingjuan Lyu, Xiaolin Zheng, Dan Meng, and Jun Wang. 2023a. UltraRE: Enhancing RecEraser for recommendation unlearning via error decomposition. In Proceedings of the 37th International Conference on Neural Information Processing Systems.
[43]
Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Junlin Liu, and Jun Wang. 2024. Making recommender systems forget: Learning and unlearning for erasable recommendation. Knowledge-Based Systems 283 (2024), 111124.
[44]
Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Yizhao Zhang, Biao Gong, Jun Wang, and Linxun Chen. 2023. Selective and collaborative influence function for efficient recommendation unlearning. Expert Systems with Applications (2023), 121025. 0957–4174 DOI:
[45]
Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Yizhao Zhang, Zhongxuan Han, Dan Meng, and Jun Wang. 2023. Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems. In Proceedings of the 31st ACM International Conference on Multimedia, 984–994.
[46]
Zhizhong Li and Derek Hoiem. 2017. Learning without forgetting. IEEE Transactions on Pattern Analysis and Machine Intelligence 40, 12 (2017), 2935–2947.
[47]
Alessandro B. Melchiorre, Navid Rekabsaz, Emilia Parada-Cabaleiro, Stefan Brandl, Oleg Lesota, and Markus Schedl. 2021. Investigating gender fairness of recommendation algorithms in the music domain. Information Processing & Management 58, 5 (2021), 102666.
[48]
Andriy Mnih and Russ R. Salakhutdinov. 2007. Probabilistic matrix factorization. In Proceedings of the 20th International Conference on Neural Information Processing Systems.
[49]
Eduardo Fernandes Montesuma and Fred Maurice Ngole Mboula. 2021. Wasserstein barycenter for multi-source domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 16785–16793.
[50]
Saemi Moon, Seunghyuk Cho, and Dongwoo Kim. 2023. Feature unlearning for pre-trained GANs and VAEs. arXiv:2303.05699. Retrieved from https://arxiv.org/abs/2303.05699
[51]
Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A survey of machine unlearning. arXiv:2209.02299. Retrieved from https://arxiv.org/abs/2209.02299
[52]
Amal Rannen, Rahaf Aljundi, Matthew B. Blaschko, and Tinne Tuytelaars. 2017. Encoder based lifelong learning. In Proceedings of the IEEE International Conference on Computer Vision, 1320–1328.
[53]
Sashank Reddi, Rama Kumar Pasumarthi, Aditya Menon, Ankit Singh Rawat, Felix Yu, Seungyeon Kim, Andreas Veit, and Sanjiv Kumar. 2021. Rankdistil: Knowledge distillation for ranking. In Proceedings of the International Conference on Artificial Intelligence and Statistics. PMLR, 2368–2376.
[54]
Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. 2009. BPR: Bayesian personalized ranking from implicit feedback. In Proceedings of the 25th Conference on Uncertainty in Artificial Intelligence, 452–461.
[55]
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Proceedings of the Network and Distributed Systems Security (NDSS) Symposium.
[56]
J Ben Schafer, Dan Frankowski, Jon Herlocker, and Shilad Sen. 2007. Collaborative filtering recommender systems. In The Adaptive Web. Springer, 291–324.
[57]
Bernhard Scholkopf, Kah-Kay Sung, Christopher J. C. Burges, Federico Girosi, Partha Niyogi, Tomaso Poggio, and Vladimir Vapnik. 1997. Comparing support vector machines with Gaussian kernels to radial basis function classifiers. IEEE Transactions on Signal Processing 45, 11 (1997), 2758–2765.
[58]
Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. 2021. Remember what you want to forget: Algorithms for machine unlearning. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NeurIPS).
[59]
Ilya Shenbin, Anton Alekseev, Elena Tutubalina, Valentin Malykh, and Sergey I Nikolenko. 2020. Recvae: A new variational autoencoder for top-n recommendations with implicit feedback. In Proceedings of the 13th International Conference on Web Search and Data Mining, 528–536.
[60]
Yue Shi, Martha Larson, and Alan Hanjalic. 2014. Collaborative filtering beyond the user-item matrix: A survey of the state of the art and future challenges. ACM Computing Surveys 47, 1 (2014), 1–45.
[61]
Chiappa Silvia, Jiang Ray, Stepleton Tom, Pacchiano Aldo, Jiang Heinrich, and Aslanides John. 2020. A general approach to fairness with optimal transport. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34, 3633–3640.
[62]
Bharath K Sriperumbudur, Arthur Gretton, Kenji Fukumizu, Bernhard Schölkopf, and Gert RG Lanckriet. 2010. Hilbert space embeddings and metrics on probability measures. The Journal of Machine Learning Research 11 (2010), 1517–1561.
[63]
Jiaxi Tang and Ke Wang. 2018. Ranking distillation: Learning compact ranking models with high performance for recommender system. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2289–2298.
[64]
Ilya O Tolstikhin, Bharath K Sriperumbudur, and Bernhard Schölkopf. 2016. Minimax estimation of maximum mean discrepancy with radial kernels. In Proceedings of the 30th International Conference on Neural Information Processing Systems.
[65]
Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. 2023. Machine unlearning of features and labels. In Proceedings of the Network and Distributed System Security (NDSS) Symposium.
[66]
William Webber, Alistair Moffat, and Justin Zobel. 2010. A similarity measure for indefinite rankings. ACM Transactions on Information Systems 28, 4 (2010), 1–38.
[67]
Hong-Jian Xue, Xinyu Dai, Jianbing Zhang, Shujian Huang, and Jiajun Chen. 2017. Deep matrix factorization models for recommender systems. In Proceedings of the 26th International Joint Conference on Artificial Intelligence (IJCAI), Vol. 17, 3203–3209.
[68]
Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. 2022. Arcane: An efficient architecture for exact machine unlearning. In Proceedings of the 31st International Joint Conference on Artificial Intelligence (IJCAI-22), 4006–4013.
[69]
Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez-Rodriguez, and Krishna P Gummadi. 2019. Fairness constraints: A flexible approach for fair classification. The Journal of Machine Learning Research 20, 1 (2019), 2737–2778.
[70]
Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Lizhen Cui, and Xiangliang Zhang. 2021. Graph embedding for recommendation against attribute inference attacks. In Proceedings of the Web Conference, 3002–3014.
[71]
Shijie Zhang, Wei Yuan, and Hongzhi Yin. 2023. Comprehensive privacy analysis on federated recommender system against attribute inference attacks. IEEE Transactions on Knowledge and Data Engineering 36, 3 (2023), 987–999.
[72]
Yang Zhang, Zhiyu Hu, Yimeng Bai, Fuli Feng, Jiancan Wu, Qifan Wang, and Xiangnan He. 2023. Recommendation unlearning via influence function. arXiv:2307.02147. Retrieved from https://arxiv.org/abs/2307.02147
[73]
Xinping Zhao, Chaochao Chen, Jiajie Su, Yizhao Zhang, and Baotian Hu. 2024a. Enhancing Attributed Graph Networks with Alignment and Uniformity Constraints for Session-based Recommendation. In Proceedings of the IEEE International Conference on Web Services (ICWS), 247–257.
[74]
Xinping Zhao, Yan Zhong, Zetian Sun, Xinshuo Hu, Zhenyu Liu, Dongfang Li, Baotian Hu, and Min Zhang. 2024b. FunnelRAG: A coarse-to-fine progressive retrieval paradigm for RAG. arXiv:2410.10293.
[75]
Zhihao Zhu, Chenwang Wu, Rui Fan, Defu Lian, and Enhong Chen. 2023. Membership inference attacks against sequential recommender systems. In Proceedings of the ACM Web Conference, 1208–1219.
Index Terms
- Post-Training Attribute Unlearning in Recommender Systems
Recommendations
Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems
MM '23: Proceedings of the 31st ACM International Conference on MultimediaWith the growing privacy concerns in recommender systems, recommendation unlearning, i.e., forgetting the impact of specific learned targets, is getting increasing attention. Existing studies predominantly use training data, i.e., model inputs, as the ...
A Scalable, Accurate Hybrid Recommender System
WKDD '10: Proceedings of the 2010 Third International Conference on Knowledge Discovery and Data MiningRecommender systems apply machine learning techniques for filtering unseen information and can predict whether a user would like a given resource. There are three main types of recommender systems: collaborative filtering, content-based filtering, and ...
A Clustering Approach for Personalizing Diversity in Collaborative Recommender Systems
UMAP '17: Proceedings of the 25th Conference on User Modeling, Adaptation and PersonalizationMuch of the focus of recommender systems research has been on the accurate prediction of users' ratings for unseen items. Recent work has suggested that objectives such as diversity and novelty in recommendations are also important factors in the ...
Comments
Information & Contributors
Information
Published In
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 20 December 2024
Online AM: 06 November 2024
Accepted: 17 October 2024
Revised: 29 August 2024
Received: 08 December 2023
Published in TOIS Volume 43, Issue 1
Check for updates
Author Tags
Qualifiers
- Research-article
Funding Sources
- Zhejiang Province for Leading Experts
- National Natural Science Foundation of China
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- View Citations1Total Citations
- 199Total Downloads
- Downloads (Last 12 months)199
- Downloads (Last 6 weeks)50
Reflects downloads up to 06 Feb 2025
Other Metrics
Citations
Cited By
View all- Du TBi N(2025)Application of Artificial Intelligence Advances in Athletics Industry: A ReviewConcurrency and Computation: Practice and Experience10.1002/cpe.837237:3Online publication date: 14-Jan-2025
View Options
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in