{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T08:21:23Z","timestamp":1774945283876,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":56,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,4,30]],"date-time":"2023-04-30T00:00:00Z","timestamp":1682812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100017052","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62022077"],"award-info":[{"award-number":["62022077"]}],"id":[{"id":"10.13039\/100017052","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Key R&D Program of China","award":["2021ZD0111801"],"award-info":[{"award-number":["2021ZD0111801"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,4,30]]},"DOI":"10.1145\/3543507.3583447","type":"proceedings-article","created":{"date-parts":[[2023,4,26]],"date-time":"2023-04-26T23:30:25Z","timestamp":1682551825000},"page":"1208-1219","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["Membership Inference Attacks Against Sequential Recommender Systems"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5814-1939","authenticated-orcid":false,"given":"Zhihao","family":"Zhu","sequence":"first","affiliation":[{"name":"University of Science and Technology of China, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4937-0590","authenticated-orcid":false,"given":"Chenwang","family":"Wu","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0643-6505","authenticated-orcid":false,"given":"Rui","family":"Fan","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3507-9607","authenticated-orcid":false,"given":"Defu","family":"Lian","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4835-4102","authenticated-orcid":false,"given":"Enhong","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, China"}]}],"member":"320","published-online":{"date-parts":[[2023,4,30]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Classification with a Reject Option using a Hinge Loss.Journal of Machine Learning Research 9, 8","author":"Bartlett L","year":"2008","unstructured":"Peter\u00a0L Bartlett and Marten\u00a0H Wegkamp. 2008. Classification with a Reject Option using a Hinge Loss.Journal of Machine Learning Research 9, 8 (2008)."},{"key":"e_1_3_2_1_2_1","volume-title":"Interpreting blackbox models via model extraction. arXiv preprint arXiv:1705.08504","author":"Bastani Osbert","year":"2017","unstructured":"Osbert Bastani, Carolyn Kim, and Hamsa Bastani. 2017. Interpreting blackbox models via model extraction. arXiv preprint arXiv:1705.08504 (2017)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3511997"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512068"},{"key":"e_1_3_2_1_6_1","volume-title":"International conference on machine learning. PMLR","author":"Choquette-Choo A","year":"2021","unstructured":"Christopher\u00a0A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In International conference on machine learning. PMLR, 1964\u20131974."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Vasisht Duddu Antoine Boutet and Virat Shejwalkar. 2020. Quantifying privacy leakage in graph embedding. In MobiQuitous 2020-17th EAI International Conference on Mobile and Ubiquitous Systems: Computing Networking and Services. 76\u201385.","DOI":"10.1145\/3448891.3448939"},{"key":"e_1_3_2_1_9_1","unstructured":"Chao Feng Wuchao Li Defu Lian Zheng Liu and Enhong Chen. [n. d.]. Recommender Forest for Efficient Retrieval. In Advances in Neural Information Processing Systems."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3584701"},{"key":"e_1_3_2_1_11_1","volume-title":"The movielens datasets: History and context. Acm transactions on interactive intelligent systems (tiis) 5, 4","author":"Harper F\u00a0Maxwell","year":"2015","unstructured":"F\u00a0Maxwell Harper and Joseph\u00a0A Konstan. 2015. The movielens datasets: History and context. Acm transactions on interactive intelligent systems (tiis) 5, 4 (2015), 1\u201319."},{"key":"e_1_3_2_1_12_1","volume-title":"Logan: Membership inference attacks against generative models. arXiv preprint arXiv:1705.07663","author":"Hayes Jamie","year":"2017","unstructured":"Jamie Hayes, Luca Melis, George Danezis, and Emiliano De\u00a0Cristofaro. 2017. Logan: Membership inference attacks against generative models. arXiv preprint arXiv:1705.07663 (2017)."},{"key":"e_1_3_2_1_13_1","volume-title":"Node-level membership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429","author":"He Xinlei","year":"2021","unstructured":"Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. 2021. Node-level membership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429 (2021)."},{"key":"e_1_3_2_1_14_1","volume-title":"Session-based recommendations with recurrent neural networks. arXiv preprint arXiv:1511.06939","author":"Hidasi Bal\u00e1zs","year":"2015","unstructured":"Bal\u00e1zs Hidasi, Alexandros Karatzoglou, Linas Baltrunas, and Domonkos Tikk. 2015. Session-based recommendations with recurrent neural networks. arXiv preprint arXiv:1511.06939 (2015)."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"e_1_3_2_1_16_1","volume-title":"29th USENIX security symposium (USENIX Security 20). 1345\u20131362.","author":"Jagielski Matthew","unstructured":"Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. 2020. High accuracy and high fidelity extraction of neural networks. In 29th USENIX security symposium (USENIX Security 20). 1345\u20131362."},{"key":"e_1_3_2_1_17_1","first-page":"22629","article-title":"Sampling-decomposable generative adversarial recommender","volume":"33","author":"Jin Binbin","year":"2020","unstructured":"Binbin Jin, Defu Lian, Zheng Liu, Qi Liu, Jianhui Ma, Xing Xie, and Enhong Chen. 2020. Sampling-decomposable generative adversarial recommender. Advances in Neural Information Processing Systems 33 (2020), 22629\u201322639.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00035"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132847.3132926"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484575"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380187"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380151"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403252"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219950"},{"key":"e_1_3_2_1_26_1","volume-title":"Understanding membership inferences on well-generalized learning models. arXiv preprint arXiv:1802.04889","author":"Long Yunhui","year":"2018","unstructured":"Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl\u00a0A Gunter, and Kai Chen. 2018. Understanding membership inferences on well-generalized learning models. arXiv preprint arXiv:1802.04889 (2018)."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403091"},{"key":"e_1_3_2_1_28_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_29_1","volume-title":"Membership inference on word embedding and beyond. arXiv preprint arXiv:2106.11384","author":"Mahloujifar Saeed","year":"2021","unstructured":"Saeed Mahloujifar, Huseyin\u00a0A Inan, Melissa Chase, Esha Ghosh, and Marcello Hasegawa. 2021. Membership inference on word embedding and beyond. arXiv preprint arXiv:2106.11384 (2021)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2766462.2767755"},{"key":"e_1_3_2_1_31_1","first-page":"64","article-title":"Recurrent neural networks","volume":"5","author":"Medsker R","year":"2001","unstructured":"Larry\u00a0R Medsker and LC Jain. 2001. Recurrent neural networks. Design and Applications 5 (2001), 64\u201367.","journal-title":"Design and Applications"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyy001"},{"key":"e_1_3_2_1_35_1","first-page":"61","article-title":"Membership Inference Attack against Differentially Private Deep Learning","volume":"11","author":"Rahman Md\u00a0Atiqur","year":"2018","unstructured":"Md\u00a0Atiqur Rahman, Tanzila Rahman, Robert Lagani\u00e8re, Noman Mohammed, and Yang Wang. 2018. Membership Inference Attack against Differentially Private Deep Learning Model.Trans. Data Priv. 11, 1 (2018), 61\u201379.","journal-title":"Model.Trans. Data Priv."},{"key":"e_1_3_2_1_36_1","volume-title":"BPR: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618","author":"Rendle Steffen","year":"2012","unstructured":"Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. 2012. BPR: Bayesian personalized ranking from implicit feedback. arXiv preprint arXiv:1205.2618 (2012)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772773"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00780"},{"key":"e_1_3_2_1_39_1","volume-title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246","author":"Salem Ahmed","year":"2018","unstructured":"Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 (2018)."},{"key":"e_1_3_2_1_40_1","volume-title":"An MDP-based recommender system.Journal of Machine Learning Research 6, 9","author":"Shani Guy","year":"2005","unstructured":"Guy Shani, David Heckerman, Ronen\u00a0I Brafman, and Craig Boutilier. 2005. An MDP-based recommender system.Journal of Machine Learning Research 6, 9 (2005)."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330885"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3357895"},{"key":"e_1_3_2_1_44_1","volume-title":"25th USENIX security symposium (USENIX Security 16). 601\u2013618.","author":"Tram\u00e8r Florian","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael\u00a0K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction { APIs}. In 25th USENIX security symposium (USENIX Security 16). 601\u2013618."},{"key":"e_1_3_2_1_45_1","volume-title":"Visualizing data using t-SNE.Journal of machine learning research 9, 11","author":"Maaten Laurens Van\u00a0der","year":"2008","unstructured":"Laurens Van\u00a0der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE.Journal of machine learning research 9, 11 (2008)."},{"key":"e_1_3_2_1_46_1","volume-title":"Fast-adapting and privacy-preserving federated recommender system. The VLDB Journal","author":"Wang Qinyong","year":"2021","unstructured":"Qinyong Wang, Hongzhi Yin, Tong Chen, Junliang Yu, Alexander Zhou, and Xiangliang Zhang. 2021. Fast-adapting and privacy-preserving federated recommender system. The VLDB Journal (2021), 1\u201320."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539392"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467335"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3404835.3462914"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449946"},{"key":"e_1_3_2_1_51_1","volume-title":"Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF)","author":"Yeom Samuel","unstructured":"Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF). IEEE, 268\u2013282."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/546"},{"key":"e_1_3_2_1_53_1","unstructured":"Honggang Yu Kaichen Yang Teng Zhang Yun-Yun Tsai Tsung-Yi Ho and Yier Jin. 2020. CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples.. In NDSS."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460231.3474275"},{"key":"e_1_3_2_1_55_1","volume-title":"Label-Only Membership Inference Attacks and Defenses In Semantic Segmentation Models","author":"Zhang Guangsheng","year":"2022","unstructured":"Guangsheng Zhang, Bo Liu, Tianqing Zhu, Ming Ding, and Wanlei Zhou. 2022. Label-Only Membership Inference Attacks and Defenses In Semantic Segmentation Models. IEEE Transactions on Dependable and Secure Computing (2022)."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484770"}],"event":{"name":"WWW '23: The ACM Web Conference 2023","location":"Austin TX USA","acronym":"WWW '23","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2023"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583447","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3543507.3583447","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:47:53Z","timestamp":1750178873000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583447"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,30]]},"references-count":56,"alternative-id":["10.1145\/3543507.3583447","10.1145\/3543507"],"URL":"https:\/\/doi.org\/10.1145\/3543507.3583447","relation":{},"subject":[],"published":{"date-parts":[[2023,4,30]]},"assertion":[{"value":"2023-04-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}