-
摘要: 随着推荐系统的广泛应用, 推荐系统的隐私问题得到越来越多关注. 大语言模型的兴起使得推荐系统与大语言模型的结合开始发展, 在发展过程中涉及的隐私问题比传统推荐系统的隐私问题更为广泛. 本文主要对基于大语言模型的推荐系统的隐私泄漏进行分析, 包括大语言模型推荐系统从传统推荐系统和大语言模型中分别继承的隐私问题以及大语言模型和推荐系统结合后新的隐私隐患, 对基于大语言模型的推荐系统隐私保护方法进行总结, 从传统推荐系统隐私保护角度和大语言模型角度分别阐述可用于大语言模型推荐系统的隐私保护方法, 对目前大语言模型推荐系统隐私保护的挑战进行总结, 对未来方向进行展望.Abstract: With the widespread application of recommender systems, privacy issues in recommender systems have drawn increasing attention. The rise of large language models (LLMs) has spurred the development of combining recommender systems with LLMs, and the privacy issues involved in this process are more extensive than those in traditional recommender systems. This paper primarily analyzes privacy leakage in large language model-based recommender systems, including the privacy issues they inherit from traditional recommender systems and from LLMs respectively, as well as new privacy risks emerging from the combination of the two. It summarizes privacy-preserving methods for LLM-based recommender systems, elaborating on applicable approaches from the perspectives of traditional recommender system privacy protection and large language models. The paper then summarizes the current challenges in privacy protection for LLM-based recommender systems and provides an outlook on future directions.
-
Key words:
- recommender system /
- privacy leakage /
- privacy attack /
- privacy protection /
- large language models
-
图 2 传统推荐系统隐私泄露与保护方法分类
Fig. 2 Taxonomy of privacy leakage and protection methods in traditional recommender systems
图 3 大语言模型可能产生隐私泄漏的阶段
Fig. 3 Potential stages of privacy leakage in large language models
图 4 大语言模型与推荐系统的结合方式
Fig. 4 Ways of combining large language models with recommender systems
图 5 大语言模型辅助的推荐系统隐私保护方法
Fig. 5 Privacy-preserving methods for recommender systems assisted by large language models
表 2 大模型推荐系统继承传统推荐系统的主要隐私问题
Table 2 Main privacy issues inherited by LLM-based recommender systems from traditional recommender systems
类型 子类别 核心思想 攻击优势 攻击劣势 攻击场景 推理攻击 利用模型输出推断训练数据或属性 隐蔽性强 依赖模型访问 对抗攻击 构造扰动输入干扰模型预测 泛化性较强 难适配离散数据 投毒攻击 注入虚假数据影响模型训练 对模型性能影响大 易被检测 数据流通 数据传输与存储泄露 数据在传输中被窃取 覆盖面广 依赖系统安全 模型参数泄露 通过梯度恢复原始数据 无需原始数据 防御复杂 中间表示泄露 从表示向量推断用户信息 攻击隐蔽 难检测 
下载: 导出CSV
表 3 针对大语言模型的提示注入攻击分类
Table 3 Taxonomy of prompt injection attacks on large language models
攻击类型 描述 前缀注入 (prefix injection) 要求大语言模型在回复中带有某些肯定性的前缀, 例如“Absolutely! Here＇s......”等, 利用模型的指令跟随能力绕过模型内部拒绝机制, 难拒绝接下来的攻击性输入. 拒绝抑制 (refusal suppression) 要求大语言模型在回复中不能带有拒绝回答的词汇, 例如“cannot”、“unfortunately”等, 与前缀注入的原理类似. 混淆攻击 (obfuscation) 攻击者通过在字符或词语层面进行混淆处理, 来规避模型的安全检测机制, 例如将字母“O”替换为数字“0”, 使用摩斯电码、故意拼写错误、语义相近词替代, 或将输入内容进行多轮翻译等. 复合注入攻击 同时结合多种提示注入方法 (如前缀注入和拒绝抑制) , 比单一攻击更具破坏力.
下载: 导出CSV
表 4 大语言模型产生隐私风险的不同阶段对比
Table 4 Comparison of privacy risks across different stages of large language models
阶段 典型隐私风险 核心机制 特点 局限性 训练阶段 数据记忆、成员推理风险 参数记忆与过拟合 能捕获复杂模式 隐私信息长期残留, 难以删除 推理阶段 嵌入泄露、提示恢复 表示空间可逆性 推理能力强 输出可能被逆向利用 交互阶段 用户输入泄露、日志泄露 上下文学习与持续记忆 支持个性化交互 隐私易被持续积累 攻击场景 提示注入、越狱、后门攻击 生成控制与鲁棒性不足 攻击方式灵活 防御难度高, 难完全检测
下载: 导出CSV
表 5 基于大语言模型微调的推荐系统部分工作
Table 5 Selected works on recommender systems based on large language model fine-tuning
基座模型 微调数据 微调后的模型 开源地址 CLLM4Rec[108] Amazon Beauty/Toys/Sports, Yelp RecLLM[85] https://github.com/yaochenzhu/llm4rec M6[114] AlipayMiniApp, Taobao, AlipayQuery M6-Rec[86] https://github.com/brightmart/albert_zh T5[115] Amazon Beauty/Toys/Sports, Yelp P5[108] https://github.com/jeykigung/P5 llama2[116] ShareGPT vicuna[109] https://github.com/lm-sys/FastChat#vicuna-weights llama2 ChatGPT构建的对话 baize[110] https://github.com/project-baize/baize-chatbot llama2 Alpaca, Amazon Book, MovieLens TALLREC[111] https://github.com/SAI990323/TALLRec vicuna Amazon Book, MovieLens CoLLM[112] https://github.com/zyang1580/CoLLM vicuna Amazon Book, MovieLens BinLLM[113] https://github.com/zyang1580/BinLLM
下载: 导出CSV
表 6 大模型推荐系统构造方法比较
Table 6 Comparison of construction methods for LLM-based recommender systems
类型 方法 核心思想 优点 辅助式 特征编码 利用大语言模型生成用户/物品嵌入表示 提升语义表达能力 特征工程 使用大语言模型增强数据 (画像/文本/样本) 数据质量提升明显 交互建模 利用大语言模型建模用户行为与兴趣 捕获复杂偏好关系 替代式 评分预测 将推荐任务建模为评分函数 结构统一, 易优化 项目生成 直接生成推荐列表 灵活性高 微调推荐 在推荐数据上微调大语言模型 适用于特定领域任务
下载: 导出CSV
表 7 大模型推荐系统数据构造与转换相关工作
Table 7 Related works on data construction and transformation for LLM-based recommender systems
工作名称 数据集 开源地址 INTERS[131] INTERS dataset https://huggingface.co/datasets/yutaozhu94/INTERS InstructRec[132] Instruments, Amazon Games / DEALRec[133] Amazon Book, Amazon Games, MicroLens-50K / M6[114] taobao / TALLREC[111] Alpaca, Amazon Book, MovieLens https://github.com/SAI990323/TALLRec CoLLM[112] Alpaca, Amazon Book, MovieLens https://github.com/zyang1580/CoLLM BinLLM[113] Alpaca, Amazon Book, MovieLens https://github.com/zyang1580/BinLLM
下载: 导出CSV
表 8 大模型推荐系统中新的隐私隐患总结
Table 8 Summary of new privacy risks in LLM-based recommender systems
维度 数据与参数量 推理与微调机制 交互形式 差异来源 跨域隐私关联、数据删除困难 推理泄露、微调记忆泄露 多模态隐私泄露、生成内容泄露 典型隐私风险 大规模数据融合与参数记忆 上下文推理与参数更新 多轮对话与跨模态表示 特点 隐私难以追踪与撤销 防护方法缺乏系统性 难以统一建模与检测
下载: 导出CSV
表 9 推荐系统隐私攻击方法及对应防御方法相关综述
Table 9 Related surveys on privacy attacks and corresponding defenses in recommender systems
下载: 导出CSV
表 10 面向数据流通中隐私泄露的多种技术结合的隐私防护工作
Table 10 Privacy protection works combining multiple technologies against privacy leakage in data circulation
下载: 导出CSV
表 11 从传统推荐系统角度保护大模型推荐系统的主要方法比较
Table 11 Comparison of main methods for protecting LLM-based recommender systems from the perspective of traditional recommender systems
类别 代表方法/技术 优点 局限性 攻击防御 正则化/对抗训练/数据检测 提升模型鲁棒性, 针对性强 泛化能力有限, 依赖具体攻击假设 联邦学习 分布式训练/参数聚合 无需共享原始数据, 降低数据泄露风险 梯度泄露风险, 系统可信性问题 差分隐私 噪声扰动/PDP 隐私可证明, 理论基础完善 引入噪声导致精度下降 加密技术 HE/SMPC 安全性高, 可在密态计算 计算与通信开销大, 效率较低 区块链 智能合约/共享账本 数据可追溯、透明性强 性能瓶颈, 扩展性受限 多技术融合 FL + DP/HE/ Blockchain等 综合提升隐私与安全性 系统复杂度高, 实现成本高
下载: 导出CSV
表 12 从大语言模型角度保护大模型推荐系统的主要方法比较
Table 12 Comparison of main methods for protecting LLM-based recommender systems from the perspective of large language models
阶段 常见方法 保护机制 优点 缺点 数据处理 差分隐私/数据清理 噪声注入、匿名化、数据最小化 降低训练数据敏感信息泄露风险 数据质量下降、隐私-效用权衡 微调阶段 联邦学习/差分隐私/机器遗忘 分布式训练、梯度扰动、记忆消除 减少数据集中存储风险, 增强隐私控制 梯度泄露风险、性能损失、遗忘困难 推理阶段 同态加密/ SMPC/差分隐私 密态计算、扰动解码与前向传播 推理过程隐私保护能力强 计算开销高、延迟增加、部署复杂
下载: 导出CSV
表 13 根据隐私需求对用户的分类
Table 13 User classification based on privacy needs
用户类别 对个人信息 (如身份、购买历史和评分历史等) 的隐私需求 对产品推荐 (向推荐者暴露自己的推荐信息) 的隐私需求 对其他行为 (浏览记录和实际购买记录) 的隐私需求 无隐私用户 不关心 不关心 不关心 软隐私用户 希望被保护 愿意被暴露 愿意被暴露 强隐私用户 希望被保护 希望被保护 愿意被暴露 完全隐私用户 希望被保护 希望被保护 希望被保护
下载: 导出CSV
表 14 中国互联网行业技术规范与法规
Table 14 Technical standards and regulations in China's internet industry
法规名称 发布年份 来源 信息安全技术 个人信息处理中告知和同意的实施指南 2023年 https://www.cac.gov.cn/2023-02/24/c_1678884830766819.htm 信息技术 安全技术 公有云中个人信息保护实践指南 2023年 https://std.samr.gov.cn/ 信息安全技术 移动互联网应用程序 (App) 收集个人信息基本要求 2022年 https://std.samr.gov.cn/ 信息安全技术 个人信息安全影响评估指南 2021年 https://std.samr.gov.cn/ 信息安全技术 个人信息安全规范 2020年 https://std.samr.gov.cn/ 信息安全技术 个人信息去标识化指南 2020年 https://std.samr.gov.cn/
下载: 导出CSV
表 15 数据隐私信息保护相关法律条例
Table 15 Laws and regulations related to data privacy and information protection
法律条例名称 发布年份/
机构所属领域/
作用范围来源 个人信息保护法、
数据安全法2021年/
人大常务委员会中国法律/
中国全行业http://www.npc.gov.cn/npc/c30834/202108/a8c4e3672c74492a80b53a172bb753fe.shtml 关键信息基础设施
安全保护条例2021年/
国务院中国行政法规/
中国全行业https://www.gov.cn/ CCPA 2018年/
美国加州美国法律/
美国加州https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5 个人信息保护法
(APPI)2017年/
日本日本法律/
日本https://www.ppc.go.jp/en/legal/ 新加坡个人数据
保护法 (PDPA)2019年/
新加坡新加坡法律/
新加坡https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act 加拿大个人信息
保护法 (PIPEDA)2020年/
加拿大加拿大法律/
加拿大https://laws-lois.justice.gc.ca “数据三法”
(个人信息保护法、
信用信息法、信息通信网法)2020年/
韩国韩国法律/
韩国https://www.kcc.go.kr/user.do 一般数据保护法
(LGPD)2020年/
巴西巴西法律/
巴西https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm OECD文件 2013年/
经合组织国际法规/
经合组织成员国https://www.oecd.org/en/topics/digital.html 欧洲通用数据
保护条例 (GDPR)2018年/
欧盟国际法规/
欧盟成员国https://eur-lex.europa.eu/eli/reg/2016/679/oj
下载: 导出CSV
-
[1] Ojokoh B A, Isinkaye F O, Zhang M, et al. Privacy and security in recommenders: an analytical review. Artificial Intelligence Review, 2025, 58(11): 351. doi: 10.1007/s10462-025-11333-4 [2] Feng H, Yin H W, Li X H. Review of privacy-preserving research in recommendation systems. Journal of Frontiers of Computer Science and Technology, 2023, 17(08): 1814−1832. [3] Bashir S R, Raza S, Misic V. Progress in privacy protection: A review of privacy preserving techniques in recommender systems, edge computing, and cloud computing[J]. arXiv preprint, 2024. [4] Aghasian E, Garg S, Montgomery J. User's privacy in recommendation systems applying online social network data, A survey and taxonomy[J]. arXiv preprint arXiv: 1806.07629, 2018. [5] Wang S, Zhu T, Liu B, et al. Unique security and privacy threats of large language models: A comprehensive survey. ACM Computing Surveys, 2025, 58(4): 1−36. doi: 10.1145/3764113 [6] Chen K, Zhou X, Lin Y, et al. A survey on privacy risks and protection in large language models. Journal of King Saud University Computer and Information Sciences, 2025, 37(7): 163. doi: 10.1007/s44443-025-00177-1 [7] Berini A D E, Jamil N, Benrazek A E, et al. Security and privacy in LLMs: A comprehensive survey of threats and mitigation strategies[J]. Information Fusion, 2026: 104241. [8] Luo S, Shao W, Yao Y, et al. Privacy in LLM-based recommendation: Recent advances and future directions[J]. arXiv preprint arXiv: 2406.01363, 2024. [9] Zhu, Z. , Wu, C. , Fan, R. , Lian, D. , Chen, E. (2023, April). Membership Inference Attacks Against Sequential Recommender Systems. In Proceedings of the ACM Web Conference 2023 (pp. 1208-1219). [10] Zhang, M. , Ren, Z. , Wang, Z. , Ren, P. , Chen, Z. , Hu, P. , & Zhang, Y. (2021, November). Membership inference attacks against recommender systems. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 864-879). [11] Hu L, Yan A, Yan H, et al. Defenses to membership inference attacks: A survey. ACM Computing Surveys, 2023, 56(4): 1−34. [12] He J, Chen M C, Chen X, et al. Membership Inference Attacks on LLM-based Recommender Systems[J]. arXiv preprint arXiv: 2508.18665, 2025. [13] Li C, Huang X, Yin C, et al. Membership Inference Attack Against Large Language Model-Based Recommendation Systems: A New Distillation-Based Paradigm[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2026, 40(27): 22859-22868. [14] Chi X, Zhang X, Wang Y, et al. Shadow-free membership inference attacks: recommender systems are more vulnerable than you thought[J]. arXiv preprint arXiv: 2405.07018, 2024. [15] Wang Y, Tang M, Shen N, et al. Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective[C]//Proceedings of the Nineteenth ACM Conference on Recommender Systems. 2025: 812-821. [16] Cui Y, Pan S, Liu Y, et al. Vortexpia: Indirect prompt injection attack against llms for efficient extraction of user privacy[C]//Findings of the Association for Computational Linguistics: EACL 2026. 2026: 587-609. [17] Fu X, Li S, Wang Z, et al. Imprompter: Tricking llm agents into improper tool use[J]. arXiv preprint arXiv: 2410.14923, 2024. [18] Ning L, Fan W, Li Q. Exploring backdoor attack and defense for LLM-empowered recommendations[J]. arXiv preprint arXiv: 2504.11182, 2025. [19] Nazary F, Deldjoo Y, Noia T. Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems[C]//European Conference on Information Retrieval. Cham: Springer Nature Switzerland, 2025: 239-251. [20] McMahan, B. , Moore, E. , Ramage, D. , Hampson, S. , y Arcas, B. A. (2017, April). Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics (pp. 1273-1282). PMLR. [21] Melis L, Song C, De Cristofaro E, et al. Exploiting unintended feature leakage in collaborative learning[C]//2019 IEEE symposium on security and privacy (SP). IEEE, 2019: 691-706. [22] Zhu L, Liu Z, Han S. Deep leakage from gradients[J]. Advances in neural information processing systems, 2019, 32. [23] Dwork, C. (2006, July). Differential privacy. In International colloquium on automata, languages, and programming (pp. 1-12). Berlin, Heidelberg: Springer Berlin Heidelberg. [24] Hou Y, Zhang J, Lin Z, et al. Large language models are zero-shot rankers for recommender systems[C]//European Conference on Information Retrieval. Cham: Springer Nature Switzerland, 2024: 364-381. [25] Plant R, Giuffrida V, Gkatzia D. You are what you write: Preserving privacy in the era of large language models[J]. arXiv preprint arXiv: 2204.09391, 2022. [26] Carlini N, Ippolito D, Jagielski M, et al. Quantifying memorization across neural language models[C]//The Eleventh International Conference on Learning Representations. 2022. [27] Wu X, Li J, Xu M, et al. Depn: Detecting and editing privacy neurons in pretrained language models[J]. arXiv preprint arXiv: 2310.20138, 2023. [28] Yu D, Naik S, Backurs A, et al. Differentially private fine-tuning of language models[J]. arXiv preprint arXiv: 2110.06500, 2021. [29] Raeini M. Privacy-preserving large language models (PPLLMs)[J]. Available at SSRN 4512071, 2023. [30] Shi W, Shea R, Chen S, et al. Just fine-tune twice: Selective differential privacy for large language models[J]. arXiv preprint arXiv: 2204.07667, 2022. [31] Wei A, Haghtalab N, Steinhardt J. Jailbroken: How does llm safety training fail?. Advances in Neural Information Processing Systems, 2023, 36: 80079−80110. [32] Staab R, Vero M, Balunović M, et al. Beyond memorization: Violating privacy via inference with large language models[J]. arXiv preprint arXiv: 2310.07298, 2023. [33] Pan X, Zhang M, Ji S, et al. Privacy risks of general-purpose language models[C]//2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020: 1314-1331. [34] Duan H, Dziedzic A, Yaghini M, et al. On the privacy risk of in-context learning[J]. arXiv preprint arXiv: 2411.10512, 2024. [35] Kandpal N, Wallace E, Raffel C. Deduplicating training data mitigates privacy risks in language models[C]//International Conference on Machine Learning. PMLR, 2022: 10697-10707. [36] Brown H, Lee K, Mireshghallah F, et al. What does it mean for a language model to preserve privacy?[C]//Proceedings of the 2022 ACM conference on fairness, accountability, and transparency. 2022: 2280-2292. [37] Zhang X, Pang Y, Kang Y, et al. No free lunch theorem for privacy-preserving llm inference[J]. Artificial Intelligence, 2025: 104293. [38] Mireshghallah F, Goyal K, Uniyal A, et al. Quantifying privacy risks of masked language models using membership inference attacks[J]. arXiv preprint arXiv: 2203.03929, 2022. [39] Aghasian E, Garg S, Montgomery J. User's privacy in recommendation systems applying online social network data, A survey and taxonomy[J]. arXiv preprint arXiv: 1806.07629, 2018. [40] Wang S, Zhu T, Liu B, et al. Unique security and privacy threats of large language models: A comprehensive survey. ACM Computing Surveys, 2025, 58(4): 1−36. doi: 10.1145/3764113 [41] Chen K, Zhou X, Lin Y, et al. A survey on privacy risks and protection in large language models. Journal of King Saud University Computer and Information Sciences, 2025, 37(7): 163. doi: 10.1007/s44443-025-00177-1 [42] Gu T, Liu K, Dolan-Gavitt B, et al. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 2019, 7: 47230−47244. doi: 10.1109/ACCESS.2019.2909068 [43] W. Fu, H. Wang, C. Gao, G. Liu, Y. Li, T. Jiang, Practical membership inference attacks against fine-tuned large language models via self-prompt calibration, 2023. [44] J. Duan, F. Kong, S. Wang, X. Shi, K. Xu, Are diffusion models vulnerable to membership inference attacks? in: Proceedings of the 40th International Conference on Machine Learning, 2023, pp. 8717–8730. [45] Kong F, Duan J, Ma R P, et al. An efficient membership inference attack for the diffusion model by proximal initialization[J]. arXiv preprint arXiv: 2305.18355, 2023. [46] Shu M, Wang J, Zhu C, et al. On the exploitability of instruction tuning. Advances in Neural Information Processing Systems, 2023, 36: 61836−61856. [47] Shan S, Ding W, Passananti J, et al. Nightshade: Prompt-specific poisoning attacks on text-to-image generative models[C]//2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024: 807-825. [48] Wan A, Wallace E, Shen S, et al. Poisoning language models during instruction tuning[C]//International Conference on Machine Learning. PMLR, 2023: 35413-35425. [49] Aghakhani H, Dai W, Manoel A, et al. Trojanpuzzle: Covertly poisoning code-suggestion models[C]//2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024: 1122-1140. [50] R. Staab, M. Vero, M. Balunović, M. Vechev, Beyond memorization: Violating privacy via inference with large language models, 2023. [51] Berini A D E, Jamil N, Benrazek A E, et al. Security and privacy in LLMs: A comprehensive survey of threats and mitigation strategies[J]. Information Fusion, 2026: 104241. [52] Luo S, Shao W, Yao Y, et al. Privacy in LLM-based recommendation: Recent advances and future directions[J]. arXiv preprint arXiv: 2406.01363, 2024. [53] Yao H, Lou J, Qin Z. Poisonprompt: Backdoor attack on prompt-based large language models[C]//ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024: 7745-7749. [54] Y. Li, S. Liu, K. Chen, X. Xie, T. Zhang, Y. Liu, Multi-target backdoor attacks for code pre-trained models, 2023. [55] Li J, Yang Y, Wu Z, et al. Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger[J]. arXiv preprint arXiv: 2304.14475, 2023. [56] J. Xu, M. D. Ma, F. Wang, C. Xiao, and M. Chen, “Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models, ” arXiv preprint arXiv: 2305.14710, 2023. [57] J. Yan, V. Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V. Srinivasan, X. Ren, and H. Jin, “Backdooring instruction-tuned large language models with virtual prompt injection, ” in NeurIPS 2023 Workshop on Backdoors in Deep Learning-The Good, the Bad, and the Ugly, 2023. [58] X. He, S. Zannettou, Y. Shen, Y. Zhang, You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content, in: 2024 IEEE Symposium on Security and Privacy , SP, 2024. [59] Liu Y, Deng G, Li Y, et al. Prompt Injection attack against LLM-integrated Applications[J]. arXiv preprint arXiv: 2306.05499, 2023. [60] Yan J, Yadav V, Li S, et al. Virtual prompt injection for instruction-tuned large language models[J]. arXiv preprint arXiv: 2307.16888, 2023. [61] Taveekitworachai P, Abdullah F, Gursesli M C, et al. Breaking bad: Unraveling influences and risks of user inputs to ChatGPT for game story generation[C]//International Conference on Interactive Digital Storytelling. Cham: Springer Nature Switzerland, 2023: 285-296. [62] G. Deng, Y. Liu, Y. Li, K. Wang, Y. Zhang, Z. Li, H. Wang, T. Zhang, Y. Liu, MASTERKEY: Automated jailbreaking of large language model chatbots, in: Proceedings of the 31th Annual Network and Distributed System Security Symposium, NDSS’24, 2024. [63] Zou A, Wang Z, Carlini N, et al. Universal and transferable adversarial attacks on aligned language models[J]. arXiv preprint arXiv: 2307.15043, 2023. [64] Yao D, Zhang J, Harris I G, et al. Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models[C]//ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024: 4485-4489. [65] Esmradi A, Yip D W, Chan C F. A comprehensive survey of attack techniques, implementation, and mitigation strategies in large language models[C]//International Conference on Ubiquitous Security. Singapore: Springer Nature Singapore, 2023: 76-95 [66] Harte J, Zorgdrager W, Louridas P, et al. Leveraging large language models for sequential recommendation[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 1096-1102. [67] Rajput S, Mehta N, Singh A, et al. Recommender systems with generative retrieval. Advances in Neural Information Processing Systems, 2023, 36: 10299−10315. [68] Qiu Z, Wu X, Gao J, et al. U-BERT: Pre-training user representations for improved recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2021, 35(5): 4320-4327. [69] Li J, Zhang W, Wang T, et al. GPT4Rec: A generative framework for personalized recommendation and user interests interpretation[J]. arXiv preprint arXiv: 2304.03879, 2023. [70] Liu Q, Chen N, Sakai T, et al. A first look at llm-powered generative news recommendation[J]. CoRR, 2023. [71] Wang Z, Gao C, Xiao C, et al. Anypredict: Foundation model for tabular prediction[J]. CoRR, 2023. [72] Wei W, Ren X, Tang J, et al. Llmrec: Large language models with graph augmentation for recommendation[C]//Proceedings of the 17th ACM International Conference on Web Search and Data Mining. 2024: 806-815. [73] Luo S, Yao Y, He B, et al. Integrating large language models into recommendation via mutual augmentation and adaptive aggregation[J]. arXiv preprint arXiv: 2401.13870, 2024. [74] Liu Y, Zhang W N, Chen Y, et al. Conversational recommender system and large language model are made for each other in E-commerce pre-sales dialogue[J]. arXiv preprint arXiv: 2310.14626, 2023. [75] Leszczynski M, Zhang S, Ganti R, et al. Talk the walk: synthetic data generation for conversational music recommendation[J]. arXiv preprint arXiv: 2301.11489, 2023. [76] Zhang Q, Li J, Jia Q, et al. UNBERT: User-News Matching BERT for News Recommendation[C]//IJCAI. 2021, 21: 3356-3362. [77] Hou Y, Mu S, Zhao W X, et al. Towards universal sequence representation learning for recommender systems[C]//Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2022: 585-593. [78] Jia J, Wang Y, Li Y, et al. LEARN: Knowledge Adaptation from Large Language Model to Recommendation for Practical Industrial Application[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2025, 39(11): 11861-11869. [79] Wu C, Wu F, Qi T, et al. Empowering news recommendation with pre-trained language models[C]//Proceedings of the 44th international ACM SIGIR conference on research and development in information retrieval. 2021: 1652-1656. [80] Hou Y, He Z, McAuley J, et al. Learning vector-quantized item representation for transferable sequential recommenders[C]//Proceedings of the ACM Web Conference 2023. 2023: 1162-1171. [81] Luo S, He B, Zhao H, et al. Recranker: Instruction tuning large language model as ranker for top-k recommendation[J]. ACM Transactions on Information Systems, 2024. [82] Lin J, Chen B, Wang H, et al. Clickprompt: CTR models are strong prompt generators for adapting language models to CTR prediction[C]//Proceedings of the ACM Web Conference 2024. 2024: 3319-3330. [83] Bao K, Zhang J, Wang W, et al. A bi-step grounding paradigm for large language models in recommendation systems. ACM Transactions on Recommender Systems, 2025, 3(4): 1−27. doi: 10.1145/3716393 [84] Liu P, Zhang L, Gulla J A. Pre-train, prompt, and recommendation: A comprehensive survey of language modeling paradigm adaptations in recommender systems. Transactions of the Association for Computational Linguistics, 2023, 11: 1553−1571. doi: 10.1162/tacl_a_00619 [85] Zhu Y, Wu L, Guo Q, et al. Collaborative large language model for recommender systems[C]//Proceedings of the ACM Web Conference 2024. 2024: 3162-3172. [86] Cui Z, Ma J, Zhou C, et al. M6-rec: Generative pretrained language models are open-ended recommender systems[J]. arXiv preprint arXiv: 2205.08084, 2022. [87] Yang F, Chen Z, Jiang Z, et al. Palr: Personalization aware llms for recommendation[J]. arXiv preprint arXiv: 2305.07622, 2023. [88] Yang L, Bagdasaryan E, Gruenstein J, et al. Openrec: A modular framework for extensible and adaptable recommendation algorithms[C]//Proceedings of the Eleventh ACM International Conference on Web Search and Data Mining. 2018: 664-672. [89] Xi Y, Liu W, Lin J, et al. Towards open-world recommendation with knowledge augmentation from large language models[C]//Proceedings of the 18th ACM Conference on Recommender Systems. 2024: 12-22. [90] Torbati G H, Tigunova A, Yates A, et al. Recommendations by Concise User Profiles from Review Text[J]. arXiv preprint arXiv: 2311.01314, 2023. [91] Brinkmann A, Shraga R, Der R C, et al. Product Information Extraction using ChatGPT[J]. arXiv preprint arXiv: 2306.14921, 2023. [92] Yin B, Xie J, Qin Y, et al. Heterogeneous knowledge fusion: A novel approach for personalized recommendation via llm[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 599-601. [93] Christakopoulou K, Lalama A, Adams C, et al. Large language models for user interest journeys[J]. arXiv preprint arXiv: 2305.15498, 2023. [94] Doddapaneni S, Sayana K, Jash A, et al. User Embedding Model for Personalized Language Prompting[J]. arXiv preprint arXiv: 2401.04858, 2024. [95] Lyu H, Jiang S, Zeng H, et al. Llm-rec: Personalized recommendation via prompting large language models[J]. arXiv preprint arXiv: 2307.15780, 2023. [96] Wei J, Wang X, Schuurmans D, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 2022, 35: 24824−24837. doi: 10.59350/hqv3w-d3q61 [97] Li X, Su L, Jia P, et al. Agent4ranking: Semantic robust ranking via personalized query rewriting using multi-agent llm[J]. arXiv preprint arXiv: 2312.15450, 2023. [98] Liu Q, Chen N, Sakai T, et al. A first look at llm-powered generative news recommendation[J]. CoRR, 2023. [99] Li X, Chen C, Zhao X, et al. E4srec: An elegant effective efficient extensible solution of large language models for sequential recommendation[J]. arXiv preprint arXiv: 2312.02443, 2023. [100] Wang D, Salamatian K, Xia Y, et al. Bert4ctr: An efficient framework to combine pre-trained language model with non-textual features for ctr prediction[C]//Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2023: 5039-5050. [101] Zhu Y, Wu L, Guo Q, et al. Collaborative large language model for recommender systems[C]//Proceedings of the ACM Web Conference 2024. 2024: 3162-3172. [102] Tang Z, Huan Z, Li Z, et al. One model for all: Large language models are domain-agnostic recommendation systems[J]. arXiv preprint arXiv: 2310.14304, 2023. [103] Lin J, Shan R, Zhu C, et al. Rella: Retrieval-enhanced large language models for lifelong sequential behavior comprehension in recommendation[C]//Proceedings of the ACM Web Conference 2024. 2024: 3497-3508. [104] Wu X, Zhou H, Yao W, et al. Towards personalized cold-start recommendation with prompts[J]. arXiv preprint arXiv: 2306.17256, 2023. [105] Prakash T, Jalan R, Singh B, et al. Cr-sorec: Bert driven consistency regularization for social recommendation[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 883-889. [106] Bao K, Zhang J, Wang W, et al. A bi-step grounding paradigm for large language models in recommendation systems. ACM Transactions on Recommender Systems, 2025, 3(4): 1−27. doi: 10.1145/3716393 [107] Liu P, Zhang L, Gulla J A. Pre-train, prompt, and recommendation: A comprehensive survey of language modeling paradigm adaptations in recommender systems. Transactions of the Association for Computational Linguistics, 2023, 11: 1553−1571. doi: 10.1162/tacl_a_00619 [108] Geng S, Liu S, Fu Z, et al. Recommendation as language processing (rlp): A unified pretrain, personalized prompt & predict paradigm (p5)[C]//Proceedings of the 16th ACM conference on recommender systems. 2022: 299-315. [109] Zheng L, Chiang W L, Sheng Y, et al. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 2023, 36: 46595−46623. [110] Xu C, Guo D, Duan N, et al. Baize: An open-source chat model with parameter-efficient tuning on self-chat data[J]. arXiv preprint arXiv: 2304.01196, 2023. [111] Bao K, Zhang J, Zhang Y, et al. Tallrec: An effective and efficient tuning framework to align large language model with recommendation[C]//Proceedings of the 17th ACM Conference on Recommender Systems. 2023: 1007-1014. [112] Zhang Y, Feng F, Zhang J, et al. Collm: Integrating collaborative embeddings into large language models for recommendation[J]. IEEE Transactions on Knowledge and Data Engineering, 2025. [113] Zhang Y, Bao K, Yan M, et al. Text-like encoding of collaborative information in large language models for recommendation[J]. arXiv preprint arXiv: 2406.03210, 2024. [114] Lin J, Men R, Yang A, et al. M6: A chinese multimodal pretrainer[J]. arXiv preprint arXiv: 2103.00823, 2021. [115] Warstadt A, Singh A, Bowman S R. Neural network acceptability judgments. Transactions of the Association for Computational Linguistics, 2019, 7: 625−641. doi: 10.1162/tacl_a_00290 [116] Touvron H, Martin L, Stone K, et al. Llama 2: Open foundation and fine-tuned chat models[J]. arXiv preprint arXiv: 2307.09288, 2023. [117] Zhang J, Xie R, Hou Y, et al. Recommendation as instruction following: A large language model empowered recommendation approach[J]. ACM Transactions on Information Systems, 2023. [118] Hayet I, Yao Z, Luo B. Invernet: An inversion attack framework to infer fine-tuning datasets through word embeddings[C]//Findings of the Association for Computational Linguistics: EMNLP 2022. 2022: 5009-5018. [119] Li H, Song Y, Fan L. You don't know my favorite color: Preventing dialogue representations from revealing speakers' private personas[J]. arXiv preprint arXiv: 2205.10228, 2022. [120] Qu L, Yuan W, Zheng R, et al. Towards personalized privacy: User-governed data contribution for federated recommendation[C]//Proceedings of the ACM Web Conference 2024. 2024: 3910-3918. [121] Chen C, Sun F, Zhang M, et al. Recommendation unlearning[C]//Proceedings of the ACM web conference 2022. 2022: 2768-2777. [122] Li Y, Chen C, Zheng X, et al. Making recommender systems forget: Learning and unlearning for erasable recommendation. Knowledge-Based Systems, 2024, 283: 111124. doi: 10.1016/j.knosys.2023.111124 [123] Zhao J, Wang W, Xu C, et al. Llm-based federated recommendation[J]. arXiv preprint arXiv: 2402.09959, 2024. [124] Wang H, Lin J, Chen B, et al. Towards efficient and effective unlearning of large language models for recommendation. Frontiers of Computer Science, 2025, 19(3): 193327. doi: 10.1007/s11704-024-40044-2 [125] Hu Z, Zhang Y, Xiao M, et al. Exact and efficient unlearning for large language model-based recommendation[J]. arXiv preprint arXiv: 2404.10327, 2024. [126] Bourtoule L, Chandrasekaran V, Choquette-Choo C A, et al. Machine unlearning[C]//2021 IEEE symposium on security and privacy (SP). IEEE, 2021: 141-159. [127] Zeng H, Yue Z, Jiang Q, et al. Federated recommendation via hybrid retrieval augmented generation[C]//2024 IEEE International Conference on Big Data (BigData). IEEE, 2024: 8078-8087. [128] Zhang C, Long G, Guo H, et al. Federated adaptation for foundation model-based recommendations[J]. arXiv preprint arXiv: 2405.04840, 2024. [129] Covington P, Adams J, Sargin E. Deep neural networks for youtube recommendations[C]//Proceedings of the 10th ACM conference on recommender systems. 2016: 191-198. [130] Mireshghallah F, Uniyal A, Wang T, et al. An empirical analysis of memorization in fine-tuned autoregressive language models[C]//Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing. 2022: 1816-1826. [131] Zhu Y, Zhang P, Zhang C, et al. INTERS: unlocking the power of large language models in search with instruction tuning[J]. arXiv preprint arXiv: 2401.06532, 2024. [132] Zhang J, Xie R, Hou Y, et al. Recommendation as instruction following: A large language model empowered recommendation approach[J]. ACM Transactions on Information Systems, 2023. [133] Lin X, Wang W, Li Y, et al. Data-efficient Fine-tuning for LLM-based Recommendation[C]//Proceedings of the 47th international ACM SIGIR conference on research and development in information retrieval. 2024: 365-374. [134] Shokri R, Stronati M, Song C, et al. Membership inference attacks against machine learning models[C]//2017 IEEE symposium on security and privacy (SP). IEEE, 2017: 3-18. [135] Yeom, S. , Giacomelli, I. , Fredrikson, M. , & Jha, S. (2018, July). Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF) (pp. 268-282). IEEE. [136] Salem, A. , Zhang, Y. , Humbert, M. , Berrang, P. , Fritz, M. , & Backes, M. (2018). Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv: 1806.01246. [137] Wang, Y. , Wang, C. , Wang, Z. , Zhou, S. , Liu, H. , Bi, J. , . . & Rajasekaran, S. (2020). Against membership inference attack: Pruning is all you need. arXiv preprint arXiv: 2008.13578. [138] Qingrong Chen, Chong Xiang, Minhui Xue, Bo Li, Nikita Borisov, Dali Kaarfar, and Haojin Zhu. 2018. Differentially private data generative models. arXiv preprint arXiv: 1812.02274 (2018). [139] Li Hu, Jin Li, Guanbiao Lin, Shiyu Peng, Zhenxin Zhang, Yingying Zhang, and Changyu Dong. 2022. Defending against membership inference attacks with high utility by GAN. IEEE Transactions on Dependable and Secure Computing 20, 3 (2022), 2144–2157. [140] Goodfellow I, Pouget-Abadie J, Mirza M, et al. Generative adversarial nets[J]. Advances in neural information processing systems, 2014, 27. [141] He X, He Z, Du X, et al. Adversarial personalized ranking for recommendation[C]//The 41st International ACM SIGIR conference on research & development in information retrieval. 2018: 355-364. [142] Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples[J]. arXiv preprint arXiv: 1412.6572, 2014. [143] Yuan F, Yao L, Benatallah B. Adversarial collaborative auto-encoder for top-n recommendation[C]//2019 International Joint Conference on Neural Networks (IJCNN). IEEE, 2019: 1-8. [144] Yuan F, Yao L, Benatallah B. Adversarial collaborative neural network for robust recommendation[C]//Proceedings of the 42nd international ACM SIGIR conference on research and development in information retrieval. 2019: 1065-1068. [145] Li R, Li L, Wu X, et al. Click feedback-aware query recommendation using adversarial examples[C]//The World Wide Web Conference. 2019: 2978-2984. [146] He X, He Z, Du X, et al. Adversarial personalized ranking for recommendation[C]//The 41st International ACM SIGIR conference on research & development in information retrieval. 2018: 355-364. [147] Park D H, Chang Y. Adversarial sampling and training for semi-supervised information retrieval[C]//The World Wide Web Conference. 2019: 1443-1453. [148] Chen H, Li J. Adversarial tensor factorization for context-aware recommendation[C]//Proceedings of the 13th ACM Conference on Recommender Systems. 2019: 363-367. [149] Qinyong Wang, Hongzhi Yin, Tong Chen, Junliang Yu, Alexander Zhou, and Xiangliang Zhang. Fastadapting and privacy-preserving federated recommender system. The VLDB Journal, 2022. [150] Chenwang Wu, Defu Lian, Yong Ge, Zhihao Zhu, Enhong Chen, and Senchao Yuan. Fight fire with fire: towards robust recommender systems via adversarial poisoning training. In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1074–1083, 2021. [151] Wang and Chen, 2023 Zhenlei Wang and Xu Chen. Robust recommendation with adversarial gaussian data augmentation. In Proceedings of the ACM Web Conference 2023, pages 897–905, 2023. [152] Hu H, Salcic Z, Sun L, et al. Membership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR), 2022, 54(11s): 1−37. [153] Bai L, Hu H, Ye Q, et al. Membership Inference Attacks and Defenses in Federated Learning: A Survey. ACM Computing Surveys, 2024, 57(4): 1−35. [154] Niu J, Liu P, Zhu X, et al. A survey on membership inference attacks and defenses in Machine Learning[J]. Journal of Information and Intelligence, 2024. [155] Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021. Membership inference attacks against recommender systems. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 864–879. [156] Jia J, Gong N Z. Defending against machine learning based inference attacks via adversarial examples: Opportunities and challenges[J]. Adaptive autonomous secure cyber systems, 2020: 23-40. [157] Deldjoo Y, Noia T D, Merra F A. A survey on adversarial recommender systems: from attack/defense strategies to generative adversarial networks. ACM Computing Surveys (CSUR), 2021, 54(2): 1−38. [158] Chakraborty A, Alam M, Dey V, et al. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology, 2021, 6(1): 25−45. doi: 10.1049/cit2.12028 [159] Costa J C, Roxo T, Proença H, et al. How deep learning sees the world: A survey on adversarial attacks & defenses[J]. IEEE Access, 2024. [160] Chakraborty A, Alam M, Dey V, et al. Adversarial attacks and defences: A survey[J]. arXiv preprint arXiv: 1810.00069, 2018. [161] Goyal S, Doddapaneni S, Khapra M M, et al. A survey of adversarial defenses and robustness in nlp. ACM Computing Surveys, 2023, 55(14s): 1−39. doi: 10.1145/3593042 [162] Gunes I, Kaleli C, Bilge A, et al. Shilling attacks against recommender systems: a comprehensive survey. Artificial Intelligence Review, 2014, 42: 767−799. doi: 10.1007/s10462-012-9364-9 [163] Si M, Li Q. Shilling attacks against collaborative recommender systems: a review. Artificial Intelligence Review, 2020, 53: 291−319. doi: 10.1007/s10462-018-9655-x [164] Sundar A P, Li F, Zou X, et al. Understanding shilling attacks and their detection traits: A comprehensive survey. IEEE Access, 2020, 8: 171703−171715. doi: 10.1109/ACCESS.2020.3022962 [165] Wang Z, Yu J, Gao M, et al. Poisoning Attacks and Defenses in Recommender Systems: A Survey[J]. arXiv preprint arXiv: 2406.01022, 2024. [166] Wang Z, Ma J, Wang X, et al. Threats to training: A survey of poisoning attacks and defenses on machine learning systems. ACM Computing Surveys, 2022, 55(7): 1−36. [167] Tian Z, Cui L, Liang J, et al. A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Computing Surveys, 2022, 55(8): 1−35. doi: 10.1145/3551636 [168] Ahmed S T, Vinoth Kumar V, Mahesh T R, et al. FedOPT: federated learning-based heterogeneous resource recommendation and optimization for edge computing[J]. Soft Computing, 2024: 1-12. [169] Li, Z. , Bilal, M. , Xu, X. , Jiang, J. , Cui, Y. (2022). Federated Learning-Based Cross-Enterprise Recommendation With Graph Neural Networks. IEEE Transactions on Industrial Informatics, 19(1), 673-682. [170] Duan, S. , Zhang, D. , Wang, Y. , Li, L. , Zhang, Y. (2019). JointRec: A deep-learning-based joint cloud video recommendation framework for mobile IoT. IEEE Internet of Things Journal, 7(3), 1655-1666. [171] Neumann D, Lutz A, Müller K, et al. A privacy preserving system for movie recommendations using federated learning. ACM Transactions on Recommender Systems, 2024, 3(2): 1−51. doi: 10.1145/3634686 [172] Yuan W, Yang C, Nguyen Q V H, et al. Interaction-level membership inference attack against federated recommender systems[C]//Proceedings of the ACM Web Conference 2023. 2023: 1053-1062. [173] Ali, W. , Kumar, R. , Zhou, X. , Shao, J. (2023). Responsible Recommendation Services with Blockchain Empowered Asynchronous Federated Learning. ACM Transactions on Intelligent Systems and Technology. [174] Feng, Y. , Qi, Y. , Li, H. , Wang, X. , & Tian, J. (2024, July). Leveraging federated learning and edge computing for recommendation systems within cloud computing networks. In Third International Symposium on Computer Applications and Information Systems (ISCAIS 2024) (Vol. 13210, pp. 279-287). SPIE. [175] Polat, H. , Du, W. (2003, November). Privacy-preserving collaborative filtering using randomized perturbation techniques. In Third IEEE international conference on data mining (pp. 625-628). IEEE. [176] McSherry F, Mironov I. Differentially private recommender systems: Building privacy into the netflix prize contenders[C]//Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining. 2009: 627-636. [177] Shin, H. , Kim, S. , Shin, J. , Xiao, X. (2018). Privacy enhanced matrix factorization for recommendation with local differential privacy. IEEE Transactions on Knowledge and Data Engineering, 30(9), 1770-1782. [178] Müllner, P. , Lex, E. , Schedl, M. , Kowald, D. (2023). ReuseKNN: Neighborhood Reuse for Differentially Private KNN-Based Recommendations. ACM Transactions on Intelligent Systems and Technology, 14(5), 1-29. [179] Koren Y, Bell R, Volinsky C. Matrix factorization techniques for recommender systems. Computer, 2009, 42(8): 30−37. doi: 10.18297/etd/3661 [180] Berlioz, A. , Friedman, A. , Kaafar, M. A. , Boreli, R. , Berkovsky, S. (2015, September). Applying differential privacy to matrix factorization. In Proceedings of the 9th ACM Conference on Recommender Systems (pp. 107-114). [181] Friedman, A. , Berkovsky, S. , Kaafar, M. A. (2016). A differential privacy framework for matrix factorization recommender systems. User Modeling and User-Adapted Interaction, 26, 425-458. [182] Jorgensen Z, Yu T, Cormode G. Conservative or liberal? Personalized differential privacy[C]//2015 IEEE 31St international conference on data engineering. IEEE, 2015: 1023-1034. [183] Johnson, W. B. , Lindenstrauss, J. , Schechtman, G. (1986). Extensions of Lipschitz maps into Banach spaces. Israel Journal of Mathematics, 54(2), 129-138. [184] Meng X, Wang S, Shu K, et al. Personalized privacy-preserving social recommendation[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2018, 32(1). [185] Zhu X, Sun Y. Differential privacy for collaborative filtering recommender algorithm[C]//Proceedings of the 2016 ACM on international workshop on security and privacy analytics. 2016: 9-16. [186] Machanavajjhala A, Korolova A, Sarma A D. Personalized social recommendations-accurate or private?[J]. arXiv preprint arXiv: 1105.4254, 2011. [187] Zhu T, Ren Y, Zhou W, et al. An effective privacy preserving algorithm for neighborhood-based collaborative filtering. Future Generation Computer Systems, 2014, 36: 142−155. doi: 10.1016/j.future.2013.07.019 [188] Shen Y, Jin H. Privacy-preserving personalized recommendation: An instance-based approach via differential privacy[C]//2014 IEEE international conference on data mining. IEEE, 2014: 540-549. [189] Jorgensen Z, Yu T. A privacy-preserving framework for personalized, social recommendations[C]//EDBT. 2014, 582. [190] Gentry C. Fully homomorphic encryption using ideal lattices[C]//Proceedings of the forty-first annual ACM symposium on Theory of computing. 2009: 169-178. [191] Canny J. Collaborative filtering with privacy[C]//Proceedings 2002 IEEE symposium on security and privacy. IEEE, 2002: 45-57. [192] Goldreich O. Secure multi-party computation[J]. Manuscript. Preliminary version, 1998, 78(110): 1-108. [193] Shamir A. How to share a secret. Communications of the ACM, 1979, 22(11): 612−613. doi: 10.1145/359168.359176 [194] Li D, Chen C, Lv Q, et al. An algorithm for efficient privacy-preserving item-based collaborative filtering. Future Generation Computer Systems, 2016, 55: 311−320. doi: 10.1016/j.future.2014.11.003 [195] Nakamoto S. Bitcoin: A peer-to-peer electronic cash system[J]. 2008. [196] Patel S B, Bhattacharya P, Tanwar S, et al. Kirti: A blockchain-based credit recommender system for financial institutions. IEEE Transactions on Network Science and Engineering, 2020, 8(2): 1044−1054. doi: 10.1109/tnse.2020.3005678 [197] Wang S, Huang C, Li J, et al. Decentralized construction of knowledge graphs for deep recommender systems based on blockchain-powered smart contracts. IEEE Access, 2019, 7: 136951−136961. doi: 10.1109/ACCESS.2019.2942338 [198] Mantey E A, Zhou C, Anajemba J H, et al. Blockchain-enabled technique for privacy-preserved medical recommender system. IEEE Access, 2023, 11: 40944−40953. doi: 10.1109/ACCESS.2023.3267431 [199] HU TY L. Contractual security and privacy security of smart contract: a system mapping study. Chinese journal of computers, 2021, 44(12): 2485−2514. [200] Xu J, Lin J, Liang W, et al. Privacy preserving personalized blockchain reliability prediction via federated learning in IoT environments. Cluster Computing, 2022, 25(4): 2515−2526. doi: 10.1007/s10586-021-03399-w [201] Teimoori Z, Yassine A, Hossain M S. A secure cloudlet-based charging station recommendation for electric vehicles empowered by federated learning. IEEE Transactions on Industrial Informatics, 2022, 18(9): 6464−6473. doi: 10.1109/TII.2022.3148997 [202] Ali W, Kumar R, Zhou X, et al. Responsible recommendation services with blockchain empowered asynchronous federated learning. ACM Transactions on Intelligent Systems and Technology, 2024, 15(4): 1−24. doi: 10.1145/3633520 [203] Wang Q, Yin H, Chen T, et al. Fast-adapting and privacy-preserving federated recommender system. The VLDB Journal, 2022, 31(5): 877−896. doi: 10.1007/s00778-021-00700-6 [204] Jiang X, Liu B, Qin J, et al. FedNCF: federated neural collaborative filtering for privacy-preserving recommender system[C]//2022 International joint conference on neural networks (IJCNN). IEEE, 2022: 1-8. [205] Hu R, Guo Y, Gong Y. Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy. IEEE Transactions on Mobile Computing, 2023, 23(8): 8242−8255. doi: 10.1109/tmc.2023.3343288/mm1 [206] Tang L T, Chen Z N, Zhang L F, et al. Research progress of privacy issues in federated learning[J]. Chinese J. Comput, 2023, 34(01): 197-229. [207] Liu Y X, Chen H, Liu Y H, et al. Privacy-preserving techniques in federated learning. Journal of Software, 2022, 33(3): 1057−1092. [208] Jianming Z, Qinnan Z, Sheng G, et al. Privacy preserving and trustworthy federated learning model based on blockchain. Chinese journal of computers, 2021, 44(12): 2464−2484. [209] Mantey E A, Zhou C, Anajemba J H, et al. Federated learning approach for secured medical recommendation in internet of medical things using homomorphic encryption. IEEE Journal of Biomedical and Health Informatics, 2024, 28(6): 3329−3340. doi: 10.1109/JBHI.2024.3350232 [210] Mai P, Pang Y. Privacy-preserving multiview matrix factorization for recommender systems. IEEE Transactions on Artificial Intelligence, 2023, 5(1): 267−277. doi: 10.1109/tai.2023.3240700 [211] Ouyang L, Wu J, Jiang X, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 2022, 35: 27730−27744. [212] Yu S, Muñoz J P, Jannesari A. Federated foundation models: Privacy-preserving and collaborative learning for large models[J]. arXiv preprint arXiv: 2305.11414, 2023. [213] Miranda M, Ruzzetti E S, Santilli A, et al. Preserving privacy in large language models: A survey on current threats and solutions[J]. arXiv preprint arXiv: 2408.05212, 2024. [214] Salas J. Sanitizing and measuring privacy of large sparse datasets for recommender systems. Journal of Ambient Intelligence and Humanized Computing, 2023, 14(11): 15073−15084. doi: 10.1007/s12652-019-01391-2 [215] Mandal B, Amariucai G, Wei S. Initial exploration of zero-shot privacy utility tradeoffs in tabular data using gpt-4[C]//2024 International Joint Conference on Neural Networks (IJCNN). IEEE, 2024: 1-8. [216] Zhang J, Vahidian S, Kuo M, et al. Towards building the federatedgpt: Federated instruction tuning[C]//ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024: 6915-6919. [217] Fan T, Kang Y, Ma G, et al. Fate-llm: A industrial grade federated learning framework for large language models[J]. arXiv preprint arXiv: 2310.10049, 2023. [218] Behnia R, Ebrahimi M R, Pacheco J, et al. Ew-tune: A framework for privately fine-tuning large language models with differential privacy[C]//2022 IEEE International Conference on Data Mining Workshops (ICDMW). IEEE, 2022: 560-566. [219] Wu X, Gong L, Xiong D. Adaptive differential privacy for language model training[C]//Proceedings of the First Workshop on Federated Learning for Natural Language Processing (FL4NLP 2022). 2022: 21-26. [220] Chen J, Yang D. Unlearn what you want to forget: Efficient unlearning for llms[J]. arXiv preprint arXiv: 2310.20150, 2023. [221] Jang J, Yoon D, Yang S, et al. Knowledge unlearning for mitigating privacy risks in language models[J]. arXiv preprint arXiv: 2210.01504, 2022. [222] Liu Z, Kalinli O. Forgetting private textual sequences in language models via leave-one-out ensemble[C]//ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024: 10261-10265. [223] Pochinkov N, Schoots N. Dissecting language models: Machine unlearning via selective pruning[J]. arXiv preprint arXiv: 2403.01267, 2024. [224] Ilharco G, Ribeiro M T, Wortsman M, et al. Editing models with task arithmetic[J]. arXiv preprint arXiv: 2212.04089, 2022. [225] Liu Z, Dou G, Tan Z, et al. Towards safer large language models through machine unlearning[J]. arXiv preprint arXiv: 2402.10058, 2024. [226] Majmudar J, Dupuy C, Peris C, et al. Differentially private decoding in large language models[J]. arXiv preprint arXiv: 2205.13621, 2022. [227] Du M, Yue X, Chow S S M, et al. Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass[C]//Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 2023: 2665-2679. [228] Chen T, Bao H, Huang S, et al. The-x: Privacy-preserving transformer inference with homomorphic encryption[J]. arXiv preprint arXiv: 2206.00216, 2022. [229] Lu W, Huang Z, Gu Z, et al. Bumblebee: Secure two-party inference framework for large transformers[J]. Cryptology ePrint Archive, 2023. [230] Ding Y, Guo H, Guan Y, et al. East: Efficient and accurate secure transformer framework for inference[J]. arXiv preprint arXiv: 2308.09923, 2023. [231] Tharwat A. Classification assessment methods. Applied computing and informatics, 2021, 17(1): 168−192. doi: 10.1016/j.aci.2018.08.003 [232] Hinton G, Vinyals O, Dean J. Distilling the knowledge in a neural network[J]. arXiv preprint arXiv: 1503.02531, 2015. [233] Tirkel A Z, Rankin G A, Van Schyndel R M, et al. Electronic watermark[J]. Digital Image Computing, Technology and Applications (DICTA’93), 1993: 666-673. [234] Cao Y, Li S, Liu Y, et al. A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt[J]. arXiv preprint arXiv: 2303.04226, 2023. [235] Wang T, Zhang Y, Qi S, et al. Security and privacy on generative data in aigc: A survey. ACM Computing Surveys, 2024, 57(4): 1−34. doi: 10.1145/3703626 [236] Chen C, Wu Z, Lai Y, et al. Challenges and remedies to privacy and security in AIGC: Exploring the potential of privacy computing, blockchain, and beyond[J]. arXiv preprint arXiv: 2306.00419, 2023. [237] Zhang S, Yuan W, Yin H. Comprehensive privacy analysis on federated recommender system against attribute inference attacks. IEEE Transactions on Knowledge and Data Engineering, 2023, 36(3): 987−999. doi: 10.1109/tkde.2023.3295601 [238] Aïmeur E, Brassard G, Fernandez J M, et al. Alambic: a privacy-preserving recommender system for electronic commerce. International Journal of Information Security, 2008, 7(5): 307−334. doi: 10.1007/s10207-007-0049-3 [239] Ghazinour K, Matwin S, Sokolova M. YOURPRIVACYPROTECTOR, A recommender system for privacy settings in social networks[J]. arXiv preprint arXiv: 1602.01937, 2016. [240] Javeed D, Saeed M S, Kumar P, et al. Federated learning-based personalized recommendation systems: An overview on security and privacy challenges. IEEE Transactions on Consumer Electronics, 2023, 70(1): 2618−2627. doi: 10.1109/tce.2023.3318754 [241] Jiang J Y, Li C T, Lin S D. Towards a more reliable privacy-preserving recommender system. Information Sciences, 2019, 482: 248−265. doi: 10.1016/j.ins.2018.12.085 [242] Hu Q, Song Y. User consented federated recommender system against personalized attribute inference attack[C]//Proceedings of the 17th ACM International Conference on Web Search and Data Mining. 2024: 276-285. [243] Xin Y, Jaakkola T. Controlling privacy in recommender systems[J]. Advances in neural information processing systems, 2014, 27. [244] Sinha R, Swearingen K. The role of transparency in recommender systems[C]//CHI'02 extended abstracts on Human factors in computing systems. 2002: 830-831. [245] Regulation P. General data protection regulation. Intouch, 2018, 25: 1−5. [246] Kayaalp M. Patient privacy in the era of big data. Balkan medical journal, 2018, 35(1): 8−17. doi: 10.4274/balkanmedj.2017.0966 [247] Price W N, Cohen I G. Privacy in the age of medical big data. Nature medicine, 2019, 25(1): 37−43. doi: 10.1038/s41591-018-0272-7 [248] Alpert S A. Protecting medical privacy: challenges in the age of genetic information. Journal of Social Issues, 2003, 59(2): 301−322. doi: 10.1111/1540-4560.00066 [249] Li M, Zeng Y, Guo Y, et al. A movie recommendation system based on differential privacy protection. Security and Communication Networks, 2020, 2020(1): 6611463. [250] Neumann D, Lutz A, Müller K, et al. A privacy preserving system for movie recommendations using federated learning. ACM Transactions on Recommender Systems, 2024, 3(2): 1−51. doi: 10.1145/3634686 [251] Li M, Zeng Y, Guo Y, et al. The movie recommendation system based on differential privacy[C]//Security and Privacy in Social Networks and Big Data: 6th International Symposium, SocialSec 2020, Tianjin, China, September 26–27, 2020, Proceedings 6. Springer Singapore, 2020: 318-328. [252] Nehf J P. Shopping for Privacy on the Internet. Journal of Consumer Affairs, 2007, 41(2): 351−375. doi: 10.1111/j.1745-6606.2007.00085.x [253] Virupaksha S, Gavini D, Venkatesulu D. Data privacy in online shopping[C]//Computer Communication, Networking and Internet Security: Proceedings of IC3T 2016. Springer Singapore, 2017: 199-207. [254] Guo D, Chen H, Wu R, et al. AIGC challenges and opportunities related to public safety: a case study of ChatGPT. Journal of Safety Science and Resilience, 2023, 4(4): 329−339. doi: 10.1016/j.jnlssr.2023.08.001 [255] Bang J, Lee B T, Park P. Examination of ethical principles for llm-based recommendations in conversational ai[C]//2023 International Conference on Platform Technology and Service (PlatCon). IEEE, 2023: 109-113. [256] Liu X, Xie L, Wang Y, et al. Privacy and security issues in deep learning: A survey. IEEE Access, 2020, 9: 4566−4593. [257] Novelli C, Taddeo M, Floridi L. Accountability in artificial intelligence: what it is and how it works. Ai & Society, 2024, 39(4): 1871−1882. doi: 10.1007/s00146-023-01635-y -
下载:
计量
- 文章访问数: 11
- HTML全文浏览量: 5
- 被引次数: 0
