{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T06:41:34Z","timestamp":1759992094060,"version":"3.41.0"},"reference-count":51,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2025,3,17]],"date-time":"2025-03-17T00:00:00Z","timestamp":1742169600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Basic Research Fund in Shenzhen Natural Science Foundation","award":["JCYJ20240813141441054"],"award-info":[{"award-number":["JCYJ20240813141441054"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62461160311 and 62272315"],"award-info":[{"award-number":["62461160311 and 62272315"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Key Research and Development Program of China","award":["2023YFF0725100"],"award-info":[{"award-number":["2023YFF0725100"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst."],"published-print":{"date-parts":[[2025,5,31]]},"abstract":"<jats:p>Most federated learning-based recommender systems allow clients to access a well-trained high-quality model locally, which provides adversaries with the opportunity to infringe the legitimate copyright of the model. In response, we study an emerging and important problem, i.e., copyright protection of a federated recommendation model, which has not yet been addressed in the community of federated learning or recommender systems. We propose the first backdoor-based ownership verification scheme for federated recommendation (OVFR), which enables the server to claim its ownership for a given suspicious recommendation model. First, we propose to generate a trigger set tailored to recommendation scenarios. In particular, we generate some fake users and items, and then construct a set of fake users with fake interaction records as a trigger set. Moreover, we ensure that the distribution of the popularity of the fake items follows a long-tailed distribution for the effectiveness of the incorporated watermarking. To provide robustness assurance, we propose two different hybrid strategies to make the embeddings of the fake items similar to those of the real items. Second, we focus on effectively learning from a trigger set for recommendation scenarios. In particular, we design an MSE loss function and a contrastive loss function for incorporating the backdoor-based watermarking into the item embeddings, since the item embeddings are often more valuable and easier to be accessed than other parameters of a federated recommendation model. We then design a contrastive loss function to reduce the risk of the fake items being detected. Extensive experiments on three public datasets show the effectiveness of our OVFR in terms of ownership verification, model performance, and robustness.<\/jats:p>","DOI":"10.1145\/3715320","type":"journal-article","created":{"date-parts":[[2025,1,27]],"date-time":"2025-01-27T09:45:48Z","timestamp":1737971148000},"page":"1-27","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Ownership Verification for Federated Recommendation"],"prefix":"10.1145","volume":"43","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0522-2654","authenticated-orcid":false,"given":"Enyue","family":"Yang","sequence":"first","affiliation":[{"name":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6326-9531","authenticated-orcid":false,"given":"Weike","family":"Pan","sequence":"additional","affiliation":[{"name":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8162-7096","authenticated-orcid":false,"given":"Lixin","family":"Fan","sequence":"additional","affiliation":[{"name":"AI Department, WeBank, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8266-4561","authenticated-orcid":false,"given":"Hanlin","family":"Gu","sequence":"additional","affiliation":[{"name":"AI Department, WeBank, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-4136-5846","authenticated-orcid":false,"given":"Zhitao","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5059-8360","authenticated-orcid":false,"given":"Qiang","family":"Yang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Hong Kong University of Science and Technology, Hong Kong, China and AI Department, WeBank, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6933-5760","authenticated-orcid":false,"given":"Zhong","family":"Ming","sequence":"additional","affiliation":[{"name":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China, Shenzhen Technology University, Shenzhen, China and Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ), Shenzhen, China"}]}],"member":"320","published-online":{"date-parts":[[2025,3,17]]},"reference":[{"key":"e_1_3_1_2_2","first-page":"1615","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Adi Yossi","year":"2018","unstructured":"Yossi Adi, Carsten Baum, Moustapha Ciss\u00e9, Benny Pinkas, and Joseph Keshet. 2018. Turning your weakness Into a strength: Watermarking deep neural networks by backdooring. In Proceedings of the 27th USENIX Security Symposium, 1615\u20131631."},{"key":"e_1_3_1_3_2","first-page":"10775","volume-title":"Proceedings of the 38th AAAI Conference on Artificial Intelligence","author":"Agrawal Nimesh","year":"2024","unstructured":"Nimesh Agrawal, Anuj Kumar Sirohi, Sandeep Kumar, and Jayadeva. 2024. No prejudice! Fair federated graph neural networks for personalized recommendation. In Proceedings of the 38th AAAI Conference on Artificial Intelligence, 10775\u201310783."},{"key":"e_1_3_1_4_2","unstructured":"Muhammad Ammad-ud-din Elena Ivannikova Suleiman A. Khan Were Oyomno Qiang Fu Kuan Eeik Tan and Adrian Flanagan. 2019. Federated collaborative filtering for privacy-preserving personalized recommendation system. arXiv:1901.09888. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.1901.09888"},{"issue":"8","key":"e_1_3_1_5_2","first-page":"160:1","article-title":"A critical review on the use (and misuse) of differential privacy in machine learning","volume":"55","author":"Blanco-Justicia Alberto","year":"2023","unstructured":"Alberto Blanco-Justicia, David S\u00e1nchez, Josep Domingo-Ferrer, and Krishnamurty Muralidhar. 2023. A critical review on the use (and misuse) of differential privacy in machine learning. ACM Computing Surveys 55, 8 (2023), 160:1\u2013160:16.","journal-title":"ACM Computing Surveys"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.3389\/fdata.2021.729663"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.3014880"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512192"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103504"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559389"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/963770.963776"},{"key":"e_1_3_1_12_2","first-page":"4716","volume-title":"Proceedings of the 33rd Conference on Neural Information Processing Systems","author":"Fan Lixin","year":"2019","unstructured":"Lixin Fan, Kam Woh Ng, and Chee Seng Chan. 2019. Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. In Proceedings of the 33rd Conference on Neural Information Processing Systems, 4716\u20134725."},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3185101"},{"key":"e_1_3_1_14_2","first-page":"1135","volume-title":"Proceedings of the 29th Annual Conference on Neural Information Processing Systems","author":"Han Song","year":"2015","unstructured":"Song Han, Jeff Pool, John Tran, and William J. Dally. 2015. Learning both weights and connections for efficient neural network. In Proceedings of the 29th Annual Conference on Neural Information Processing Systems, 1135\u20131143."},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052569"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.artint.2023.103996"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3616855.3635830"},{"issue":"3","key":"e_1_3_1_18_2","first-page":"2961","article-title":"Privacy-preserving collaborative filtering using fully homomorphic encryption","volume":"35","author":"Jumonji Seiya","year":"2023","unstructured":"Seiya Jumonji, Kazuya Sakai, Min-Te Sun, and Wei-Shinn Ku. 2023. Privacy-preserving collaborative filtering using fully homomorphic encryption. IEEE Transactions on Knowledge and Data Engineering 35, 3 (2023), 2961\u20132974.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.3390\/make5040070"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3195956"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3265535"},{"issue":"5","key":"e_1_3_1_22_2","doi-asserted-by":"crossref","first-page":"713","DOI":"10.1360\/SSI-2021-0329","article-title":"Survey of recommender systems based on federated learning","volume":"52","author":"Liang Feng","year":"2022","unstructured":"Feng Liang, Enyue Yang, Weike Pan, Qiang Yang, and Zhong Ming. 2022. Survey of recommender systems based on federated learning. Scientia Sinica Informationis 52, 5 (2022), 713\u2013741.","journal-title":"Scientia Sinica Informationis"},{"key":"e_1_3_1_23_2","unstructured":"Junchuan Liang and Rong Wang. 2023. FedCIP: Federated client intellectual property protection with traitor tracking. arXiv:2306.01356. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2306.01356"},{"key":"e_1_3_1_24_2","first-page":"4453","volume-title":"Proceedings of 37th AAAI Conference on Artificial Intelligence","author":"Liao Xinting","year":"2023","unstructured":"Xinting Liao, Weiming Liu, Xiaolin Zheng, Binhui Yao, and Chaochao Chen. 2023. PPGenCDR: A stable and robust framework for privacy-preserving cross-domain recommendation. In Proceedings of 37th AAAI Conference on Artificial Intelligence, 4453\u20134461."},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.3017205"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3383313.3412247"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548456"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3233789"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/SMC52423.2021.9658998"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.5555\/3304222.3304249"},{"key":"e_1_3_1_31_2","volume-title":"Proceedings of the 9th International Conference on Learning Representations","author":"Maini Pratyush","year":"2021","unstructured":"Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. 2021. Dataset inference: Ownership resolution in machine learning. In Proceedings of the 9th International Conference on Learning Representations."},{"key":"e_1_3_1_32_2","first-page":"1273","volume-title":"Proceedings of the 20th International Conference on Artificial Intelligence and Statistics","volume":"54","author":"McMahan Brendan","year":"2017","unstructured":"Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag\u00fcera y Arcas. 2017. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, Vol. 54, 1273\u20131282."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460231.3474262"},{"key":"e_1_3_1_34_2","first-page":"31:1","volume-title":"Proceedings of the 26th Annual International Conference on Mobile Computing and Networking","author":"Niu Chaoyue","year":"2020","unstructured":"Chaoyue Niu, Fan Wu, Shaojie Tang, Lifeng Hua, Rongfei Jia, Chengfei Lv, Zhihua Wu, and Guihai Chen. 2020. Billion-scale federated learning on mobile clients: A submodel design with tunable privacy. In Proceedings of the 26th Annual International Conference on Mobile Computing and Networking, 31:1\u201331:14."},{"key":"e_1_3_1_35_2","first-page":"7653","volume-title":"Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics","author":"Peng Wenjun","year":"2023","unstructured":"Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? Protecting the copyright of large language models for EaaS via backdoor watermark. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics, 7653\u20137668."},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583337"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3604915.3608781"},{"key":"e_1_3_1_38_2","first-page":"452","volume-title":"Proceedings of the 25th Conference on Uncertainty in Artificial Intelligence","author":"Rendle Steffen","year":"2009","unstructured":"Steffen Rendle, Christoph Freudenthaler, Zeno Gantner, and Lars Schmidt-Thieme. 2009. BPR: Bayesian personalized ranking from implicit feedback. In Proceedings of the 25th Conference on Uncertainty in Artificial Intelligence, 452\u2013461."},{"key":"e_1_3_1_39_2","first-page":"485","volume-title":"Proceedings of the 24th International Conference on Architectural Support for Programming Languages and Operating Systems","author":"Rouhani Bita Darvish","year":"2019","unstructured":"Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. 2019. DeepSigns: An end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the 24th International Conference on Architectural Support for Programming Languages and Operating Systems, 485\u2013497."},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.5555\/2981562.2981720"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3390761"},{"key":"e_1_3_1_42_2","first-page":"310","volume-title":"Proceedings of the 40th International Symposium on Reliable Distributed Systems","author":"Tekgul Buse G. A.","year":"2021","unstructured":"Buse G. A. Tekgul, Yuxi Xia, Samuel Marchal, and N. Asokan. 2021. WAFFLE: Watermarking in federated learning. In Proceedings of the 40th International Symposium on Reliable Distributed Systems, 310\u2013320."},{"issue":"6","key":"e_1_3_1_43_2","first-page":"108:1","article-title":"Memory network-based interpreter of user preferences in content-aware recommender systems","volume":"14","author":"Tran Nhu-Thuat","year":"2023","unstructured":"Nhu-Thuat Tran and Hady W. Lauw. 2023. Memory network-based interpreter of user preferences in content-aware recommender systems. ACM Transactions on Intelligent Systems and Technology 14, 6 (2023), 108:1\u2013108:28.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2023.3237638"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3604915.3608785"},{"issue":"5","key":"e_1_3_1_46_2","first-page":"125:1","article-title":"Discrete federated multi-behavior recommendation for privacy-preserving heterogeneous one-class collaborative filtering","volume":"42","author":"Yang Enyue","year":"2024","unstructured":"Enyue Yang, Weike Pan, Qiang Yang, and Zhong Ming. 2024. Discrete federated multi-behavior recommendation for privacy-preserving heterogeneous one-class collaborative filtering. ACM Transactions on Information Systems 42, 5 (2024), 125:1\u2013125:50.","journal-title":"ACM Transactions on Information Systems"},{"issue":"2","key":"e_1_3_1_47_2","first-page":"12:1","article-title":"Federated machine learning: Concept and applications","volume":"10","author":"Yang Qiang","year":"2019","unstructured":"Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology 10, 2 (2019), 12:1\u201312:19.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"e_1_3_1_48_2","unstructured":"Wenyuan Yang Yuguo Yin Gongxi Zhu Hanlin Gu Lixin Fan Xiaochun Cao and Qiang Yang. 2023. FedZKP: Federated model ownership verification with zero-knowledge proof. arXiv:2305.04507. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2305.04507"},{"key":"e_1_3_1_49_2","unstructured":"Senci Ying. 2020. Shared MF: A privacy-preserving recommendation system. arXiv:2008.07759. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2008.07759"},{"key":"e_1_3_1_50_2","volume-title":"2024 IEEE 40th International Conference on Data Engineering (ICDE)","author":"Yuan Wei","year":"2024","unstructured":"Wei Yuan, Chaoqun Yang, Liang Qu, Quoc Viet Hung Nguyen, Jianxin Li, and Hongzhi Yin. 2024. Hide your model: A parameter transmission-free federated recommender system. In 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE. Retrieved from https:\/\/ieeexplore.ieee.org\/document\/10597708"},{"issue":"4","key":"e_1_3_1_51_2","first-page":"90:1","article-title":"LightFR: Lightweight federated recommendation with privacy-preserving matrix factorization","volume":"41","author":"Zhang Honglei","year":"2023","unstructured":"Honglei Zhang, Fangyuan Luo, Jun Wu, Xiangnan He, and Yidong Li. 2023. LightFR: Lightweight federated recommendation with privacy-preserving matrix factorization. ACM Transactions on Information Systems 41, 4 (2023), 90:1\u201390:28.","journal-title":"ACM Transactions on Information Systems"},{"key":"e_1_3_1_52_2","unstructured":"Jujia Zhao Wenjie Wang Chen Xu Zhaochun Ren See-Kiong Ng and Tat-Seng Chua. 2024. LLM-based federated recommendation. arXiv:2402.09959. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2402.09959"}],"container-title":["ACM Transactions on Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3715320","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3715320","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:18Z","timestamp":1750295898000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3715320"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,17]]},"references-count":51,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2025,5,31]]}},"alternative-id":["10.1145\/3715320"],"URL":"https:\/\/doi.org\/10.1145\/3715320","relation":{},"ISSN":["1046-8188","1558-2868"],"issn-type":[{"type":"print","value":"1046-8188"},{"type":"electronic","value":"1558-2868"}],"subject":[],"published":{"date-parts":[[2025,3,17]]},"assertion":[{"value":"2024-04-15","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-01-16","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-03-17","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}