{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T16:18:39Z","timestamp":1772727519725,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":44,"publisher":"ACM","funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["DE250100032"],"award-info":[{"award-number":["DE250100032"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,9,22]]},"DOI":"10.1145\/3705328.3748158","type":"proceedings-article","created":{"date-parts":[[2025,9,6]],"date-time":"2025-09-06T10:48:44Z","timestamp":1757155724000},"page":"812-821","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-6088-9907","authenticated-orcid":false,"given":"Yubo","family":"Wang","sequence":"first","affiliation":[{"name":"Monash University, Melbourne, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1088-8523","authenticated-orcid":false,"given":"Min","family":"Tang","sequence":"additional","affiliation":[{"name":"Monash University, Melbourne, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8363-0125","authenticated-orcid":false,"given":"Nuo","family":"Shen","sequence":"additional","affiliation":[{"name":"Monash University, Melbourne, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8124-6800","authenticated-orcid":false,"given":"Shujie","family":"Cui","sequence":"additional","affiliation":[{"name":"Monash University, Melbourne, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9578-819X","authenticated-orcid":false,"given":"Weiqing","family":"Wang","sequence":"additional","affiliation":[{"name":"Monash University, Melbourne, Australia"}]}],"member":"320","published-online":{"date-parts":[[2025,9,7]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"Jinze Bai Shuai Bai Yunfei Chu Zeyu Cui Kai Dang Xiaodong Deng Yang Fan Wenbin Ge Yu Han Fei Huang et\u00a0al. 2023. Qwen technical report. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2309.16609 (2023)."},{"key":"e_1_3_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3604915.3608857"},{"key":"e_1_3_3_2_4_2","first-page":"17","volume-title":"Proceedings of 3rd international workshop on intelligent techniques for web personalization (ITWP 2005), 19th international joint conference on artificial intelligence (IJCAI 2005)","author":"Burke Robin","year":"2005","unstructured":"Robin Burke, Bamshad Mobasher, and Runa Bhaumik. 2005. Limited knowledge shilling attacks in collaborative filtering systems. In Proceedings of 3rd international workshop on intelligent techniques for web personalization (ITWP 2005), 19th international joint conference on artificial intelligence (IJCAI 2005). 17\u201324."},{"key":"e_1_3_3_2_5_2","first-page":"2633","volume-title":"30th USENIX security symposium (USENIX Security 21)","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et\u00a0al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21). 2633\u20132650."},{"key":"e_1_3_3_2_6_2","unstructured":"Yiyi Chen Qiongkai Xu and Johannes Bjerva. 2025. ALGEN: Few-shot Inversion Attacks on Textual Embeddings using Alignment and Generation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2502.11308 (2025)."},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3298689.3347031"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"crossref","unstructured":"Michael\u00a0D. Ekstrand John\u00a0T. Riedl and Joseph\u00a0A. Konstan. 2011. Collaborative Filtering Recommender Systems. Foundations and Trends in Human\u2013Computer Interaction 4 2 (2011) 81\u2013173.","DOI":"10.1561\/1100000009"},{"key":"e_1_3_3_2_9_2","unstructured":"Wenqi Fan Shijie Wang Xiaoyong Wei Xiaowei Mei and Qing Li. 2023. Untargeted black-box attacks for social recommendations. CoRR (2023)."},{"key":"e_1_3_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3523227.3546767"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"crossref","unstructured":"Mukesh Goyani and Nilesh Chaurasiya. 2020. A Review of Movie Recommendation System: Limitations Survey and Challenges. ELCVIA: Electronic Letters on Computer Vision and Image Analysis 19 3 (2020) 18\u201337.","DOI":"10.5565\/rev\/elcvia.1232"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"crossref","unstructured":"F.\u00a0Maxwell Harper and Joseph\u00a0A. Konstan. 2015. The MovieLens Datasets: History and Context. ACM Transactions on Interactive Intelligent Systems (TIIS) 5 4 (2015) 1\u201319.","DOI":"10.1145\/2827872"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671931"},{"key":"e_1_3_3_2_15_2","doi-asserted-by":"crossref","unstructured":"Yehuda Koren Robert Bell and Chris Volinsky. 2009. Matrix factorization techniques for recommender systems. Computer 42 8 (2009) 30\u201337.","DOI":"10.1109\/MC.2009.263"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"crossref","unstructured":"Brian Lester Rami Al-Rfou and Noah Constant. 2021. The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2104.08691 (2021).","DOI":"10.18653\/v1\/2021.emnlp-main.243"},{"key":"e_1_3_3_2_17_2","unstructured":"Xiang\u00a0Lisa Li and Percy Liang. 2021. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2101.00190 (2021)."},{"key":"e_1_3_3_2_18_2","unstructured":"Feng Liu Lixin Zou Xiangyu Zhao Min Tang Liming Dong Dan Luo Xiangyang Luo and Chenliang Li. 2025. Flow Matching based Sequential Recommender Model. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2505.16298 (2025)."},{"key":"e_1_3_3_2_19_2","unstructured":"Han Liu Zhi Xu Xiaotong Zhang Feng Zhang Fenglong Ma Hongyang Chen Hong Yu and Xianchao Zhang. 2023. HQA-attack: toward high quality black-box hard-label adversarial attack on text. Advances in Neural Information Processing Systems 36 (2023) 51347\u201351358."},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-85820-3_3"},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"crossref","unstructured":"John\u00a0X Morris Volodymyr Kuleshov Vitaly Shmatikov and Alexander\u00a0M Rush. 2023. Text embeddings reveal (almost) as much as text. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2310.06816 (2023).","DOI":"10.18653\/v1\/2023.emnlp-main.765"},{"key":"e_1_3_3_2_22_2","unstructured":"John\u00a0X Morris Wenting Zhao Justin\u00a0T Chiu Vitaly Shmatikov and Alexander\u00a0M Rush. 2023. Language model inversion. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2311.13647 (2023)."},{"key":"e_1_3_3_2_23_2","unstructured":"Liangbo Ning Wenqi Fan and Qing Li. 2025. Exploring Backdoor Attack and Defense for LLM-empowered Recommendations. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2504.11182 (2025)."},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671837"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.5555\/1768197.1768209"},{"key":"e_1_3_3_2_26_2","unstructured":"Colin Raffel Noam Shazeer Adam Roberts Katherine Lee Sharan Narang Michael Matena Yanqi Zhou Wei Li and Peter\u00a0J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research 21 140 (2020) 1\u201367."},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3604915.3608845"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/371920.372071"},{"key":"e_1_3_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE48307.2020.00021"},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE48307.2020.00021"},{"key":"e_1_3_3_2_32_2","doi-asserted-by":"crossref","unstructured":"Min Tang Shujie Cui Zhe Jin Shiuan-ni Liang Chenliang Li and Lixin Zou. 2025. Sequential recommendation by reprogramming pretrained transformer. Information Processing & Management 62 1 (2025) 103938.","DOI":"10.1016\/j.ipm.2024.103938"},{"key":"e_1_3_3_2_33_2","unstructured":"Hugo Touvron Thibaut Lavril Gautier Izacard Xavier Martinet Marie-Anne Lachaux Timoth\u00e9e Lacroix Baptiste Rozi\u00e8re Naman Goyal Eric Hambro Faisal Azhar et\u00a0al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2302.13971 (2023)."},{"key":"e_1_3_3_2_34_2","unstructured":"Hongwei Wang Xiaorui Liu Wenqi Fan Xiang Zhao Vihan Kini Divyanshu Yadav and Huan Liu. 2024. Rethinking large language model architectures for sequential recommendations. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2402.09543 (2024)."},{"key":"e_1_3_3_2_35_2","unstructured":"Qian Wang Jiawei Li Shichang Wang Qiang Xing Runze Niu Hao Kong and Chao Zhang. 2024. Towards next-generation LLM-based recommender systems: A survey and beyond. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2410.19744 (2024)."},{"key":"e_1_3_3_2_36_2","unstructured":"Jason Wei Xuezhi Wang Dale Schuurmans Maarten Bosma Fei Xia Ed Chi Quoc\u00a0V Le Denny Zhou et\u00a0al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems 35 (2022) 24824\u201324837."},{"key":"e_1_3_3_2_37_2","unstructured":"Lanling Xu Junjie Zhang Bingqian Li Jinpeng Wang Mingchen Cai Wayne\u00a0Xin Zhao and Ji-Rong Wen. 2024. Prompting large language models for recommender systems: A comprehensive framework and empirical analysis. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2401.04997 (2024)."},{"key":"e_1_3_3_2_38_2","unstructured":"Lanling Xu Junjie Zhang Bingqian Li Jinpeng Wang Sheng Chen Wayne\u00a0Xin Zhao and Ji-Rong Wen. 2024. Tapping the Potential of Large Language Models as Recommender Systems: A Comprehensive Framework and Empirical Analysis. ACM Transactions on Knowledge Discovery from Data (2024)."},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"crossref","unstructured":"Collin Zhang John\u00a0X. Morris and Vitaly Shmatikov. 2024. Extracting prompts by inverting LLM outputs. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2405.15012 (2024).","DOI":"10.18653\/v1\/2024.emnlp-main.819"},{"key":"e_1_3_3_2_40_2","unstructured":"Jinghao Zhang Yuting Liu Qiang Liu Shu Wu Guibing Guo and Liang Wang. 2024. Stealthy attack on large language model based recommendation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2402.14836 (2024)."},{"key":"e_1_3_3_2_41_2","unstructured":"Wenhan Zhang Yifan Bei Liang Yang Haopeng Zou Pan Zhou Anran Liu and Philip\u00a0S. Yu. 2025. Cold-Start Recommendation towards the Era of Large Language Models (LLMs): A Comprehensive Survey and Roadmap. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2501.01945 (2025)."},{"key":"e_1_3_3_2_42_2","doi-asserted-by":"crossref","unstructured":"Yang Zhang Fuli Feng Jizhi Zhang Keqin Bao Qifan Wang and Xiangnan He. 2025. Collm: Integrating collaborative embeddings into large language models for recommendation. IEEE Transactions on Knowledge and Data Engineering (2025).","DOI":"10.1109\/TKDE.2025.3540912"},{"key":"e_1_3_3_2_43_2","doi-asserted-by":"crossref","unstructured":"Zhiwei Zhao Wenqi Fan Jundong Li Yong Liu Xingyu Mei Yefeng Wang and Qi Li. 2024. Recommender Systems in the Era of Large Language Models (LLMs). IEEE Transactions on Knowledge and Data Engineering (2024).","DOI":"10.1109\/TKDE.2024.3392335"},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645347"},{"key":"e_1_3_3_2_45_2","unstructured":"Shengyao Zhuang Bevan Koopman and Guido Zuccon. 2024. Does Vec2Text Pose a New Corpus Poisoning Threat? arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2410.06628 (2024)."}],"event":{"name":"RecSys '25: Nineteenth ACM Conference on Recommender Systems","location":"Prague Czech Republic","acronym":"RecSys '25","sponsor":["SIGCHI ACM Special Interest Group on Computer-Human Interaction","SIGAI ACM Special Interest Group on Artificial Intelligence","SIGIR ACM Special Interest Group on Information Retrieval","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data","SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the Nineteenth ACM Conference on Recommender Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3705328.3748158","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,6]],"date-time":"2025-09-06T11:50:13Z","timestamp":1757159413000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3705328.3748158"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,7]]},"references-count":44,"alternative-id":["10.1145\/3705328.3748158","10.1145\/3705328"],"URL":"https:\/\/doi.org\/10.1145\/3705328.3748158","relation":{},"subject":[],"published":{"date-parts":[[2025,9,7]]},"assertion":[{"value":"2025-09-07","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}