【作者】 赵旭；

【导师】 李浥东；

【作者基本信息】 北京交通大学 ， 计算机技术（专业学位）， 2022， 硕士

【摘要】 推荐系统,作为解决信息超载问题的有效办法,是一种根据用户的历史偏好对用户的潜在兴趣进行挖掘并完成精准推荐的应用。目前,推荐系统已经广泛应用于我们的衣食住行中,为我们的生活带来极大的便利。然而,由于推荐系统需要利用大量用户数据,不可避免地存在着隐私泄露的风险。随着近年来用户隐私问题日益严峻,推荐系统的隐私安全问题也开始受到关注。由于成员推理攻击可以在完全黑盒的情况下对用户的成员属性信息进行攻击,因此尤受关注。在成员推理攻击过程中,攻击者主要通过目标模型在训练数据和非训练数据上表现的不同来判断用户的成员属性。本文分别从攻击和防护两个角度对推荐系统中的成员隐私问题进行研究,主要研究成果如下:在攻击端,本文提出了一种基于对抗思想的成员推理攻击方法。目前针对推荐系统实施成员推理攻击的研究较少,现有方法在推荐系统采用不同个性化推荐算法与非个性化推荐算法组合时,攻击效果并不稳定。为了解决目前方法中存在的问题,本文设计了一种兼具鲁棒性和攻击效用的成员推理攻击方法。首先,本文提出了一种适用于推荐领域成员推理攻击场景的对抗样本生成方法。通过为个性化推荐算法添加正则扰动的方式,模拟成员推理攻击模型输入数据中存在的扰动,为攻击模型生成对抗样本。其次,通过对抗样本生成模型与攻击模型之间的对抗训练,提升攻击模型的鲁棒性。实验证明,该算法在推荐系统采用不同个性化推荐算法与非个性化推荐算法组合的情况下,均能取得显著优于现有方法的攻击效果。在防护端,本文提出了一种融合成员保护机制的推荐方法。根据调研,目前推荐系统领域还没有提出对成员推理攻击进行有效防护的方法。因此,为对推荐系统中用户的成员属性信息进行保护,本文首次考虑了推荐系统中的成员隐私防护问题,设计了一种具有成员隐私保护能力的推荐算法。通过将成员隐私防护能力统一到推荐模型的整体优化目标中,显式地考虑了推荐系统中存在的成员隐私问题。将推荐模型的推荐效用和隐私保护能力形式化为一个最小最大博弈优化问题,并设计了一种对抗训练算法。通过成员推理攻击模型与推荐模型之间的对抗训练,在最小化模型推荐损失的同时降低攻击模型的收益,最终获得一种兼具推荐效用和隐私保护能力的推荐算法。实验证明,该算法在较低推荐效用损失的情况下能够对用户的成员信息进行有效保护。更多还原

【Abstract】 Recommender systems are application that mines users’ potential interests and complete accurate recommendations based on their historical preferences,which is used to solve the problem of Information overload.At present,recommendation systems have been widely used in our daily necessities and bring great convenience to our lives.However,since recommender systems need to utilize a large amount of user data,there is an inevitable risk of privacy leakage.With the increasing user privacy issues in recent years,the privacy issues of recommender systems have also begun to attract the attention.Membership inference attack attracts the most attention because they can attack user’s membership attribute information under black box conditions.In the process of membership inference attack,the attacker mainly judges the membership properties by the difference between the model prediction on training data and non-training data.This paper studies the membership privacy problem in recommender systems from the perspective of attack and defense.The main research results are as follows:On the attack side,this paper proposes a membership inference attack method based on adversarial thinking.At present,there are few studies about membership inference attacks on recommender systems.When the recommender system adopts different combinations of personalized recommendation algorithm and non-personalized recommendation algorithm,the attack effect is not stable.In order to solve existing problems,this paper proposes a membership inference attack method that has both robustness and attack utility.Firstly,this paper proposes an adversarial example generation method that is suitable for membership inference attacks in recommendation systems.We simulate the perturbations existing in the input data by adding regular perturbations to the personalized recommendation algorithm and generate adversarial examples for the attack model.Secondly,we improve the robustness of the attack model by adversarial training between the adversarial example generation model and the attack model.Experiments show that this algorithm can achieve better attack results than existing methods when the recommendation system uses different combinations of personalized recommendation algorithms and non-personalized recommendation algorithms.On the defense side,this paper proposes a recommendation algorithm which combines membership protection mechanisms.According to the research,there is no effective protection method for membership inference attacks in the recommendation system.In order to protect the user’s membership attribute information in the recommendation system,this paper considers the membership privacy protection of the recommender system for the first time and proposes a recommendation algorithm that can protect membership privacy We consider the member privacy problem in the recommender system explicitly by unifying the member privacy protection capability into the objective function of the recommendation model.In our method,the recommendation utility and privacy protection ability of the recommendation model are translated to a minmax optimization problem.Besides,an adversarial training algorithm is designed.Through the adversarial training between the membership inference attack model and the recommendation model,we minimize the recommendation loss of the model and reduce the gain of the attack model simultaneously.Finally,a recommendation algorithm with both recommendation utility and privacy protection ability is obtained.Experiments show that the algorithm can effectively protect the user’s membership information with low recommendation utility loss.更多还原