{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T00:29:19Z","timestamp":1766449759573},"reference-count":70,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"3","license":[{"start":{"date-parts":[[2020,7,1]],"date-time":"2020-07-01T00:00:00Z","timestamp":1593561600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/3.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020,7,1]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Privacy risks of collaborative filtering (CF) have been widely studied. The current state-of-theart inference attack on user behaviors (e.g., ratings\/purchases on sensitive items) for CF is by Calandrino et al. (S&amp;P, 2011). They showed that if an adversary obtained a moderate amount of user\u2019s public behavior before some time<jats:italic>T<\/jats:italic>, she can infer user\u2019s private behavior<jats:italic>after<\/jats:italic>time<jats:italic>T<\/jats:italic>. However, the existence of an attack that infers user\u2019s private behavior<jats:italic>before T<\/jats:italic>remains open. In this paper, we propose the first inference attack that reveals past private user behaviors. Our attack departs from previous techniques and is based on<jats:italic>model inversion<\/jats:italic>(MI). In particular, we propose the first MI attack on factorization-based CF systems by leveraging data poisoning by Li et al. (NIPS, 2016) in a novel way. We inject malicious users into the CF system so that adversarialy chosen \u201cdecoy\u201d items are linked with user\u2019s private behaviors. We also show how to weaken the assumption made by Li et al. on the information available to the adversary from the whole rating matrix to only the item profile and how to create malicious ratings effectively. We validate the effectiveness of our inference algorithm using two real-world datasets.<\/jats:p>","DOI":"10.2478\/popets-2020-0052","type":"journal-article","created":{"date-parts":[[2020,8,28]],"date-time":"2020-08-28T14:44:05Z","timestamp":1598625845000},"page":"264-283","source":"Crossref","is-referenced-by-count":3,"title":["Exposing Private User Behaviors of Collaborative Filtering via Model Inversion Techniques"],"prefix":"10.56553","volume":"2020","author":[{"given":"Seira","family":"Hidano","sequence":"first","affiliation":[{"name":"KDDI Research, Inc ."}]},{"given":"Takao","family":"Murakami","sequence":"additional","affiliation":[{"name":"National Institute of Advanced Industrial Science and Technology (AIST)"}]},{"given":"Shuichi","family":"Katsumata","sequence":"additional","affiliation":[{"name":"National Institute of Advanced Industrial Science and Technology (AIST)"}]},{"given":"Shinsaku","family":"Kiyomoto","sequence":"additional","affiliation":[{"name":"KDDI Research, Inc."}]},{"given":"Goichiro","family":"Hanaoka","sequence":"additional","affiliation":[{"name":"National Institute of Advanced Industrial Science and Technology (AIST)"}]}],"member":"35752","published-online":{"date-parts":[[2020,8,17]]},"reference":[{"key":"2022042203262366330_j_popets-2020-0052_ref_001_w2aab3b7c22b1b6b1ab1ab1Aa","unstructured":"[1] Chaabane Abdelberi, Gergely \u00c1cs, and Mohamed Ali K\u00e2afar. You are what you like! Information leakage through users\u2019 interests. In Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS), 2012."},{"key":"2022042203262366330_j_popets-2020-0052_ref_002_w2aab3b7c22b1b6b1ab1ab2Aa","doi-asserted-by":"crossref","unstructured":"[2] Scott Alfeld, Xiaojin Zhu, and Paul Barford. Data poisoning attacks against autoregressive models. In Proceedings of the 30th AAAI Conference on Artificial Intelligence (AAAI), pages 1452\u20131458, 2016.","DOI":"10.1609\/aaai.v30i1.10237"},{"key":"2022042203262366330_j_popets-2020-0052_ref_003_w2aab3b7c22b1b6b1ab1ab3Aa","doi-asserted-by":"crossref","unstructured":"[3] Battista Biggio, Giorgio Fumera, and Fabio Roli. Security evaluation of pattern classifiers under attack. IEEE Transactions on Knowledge and Data Engineering, 26(4):984\u2013996, 2014.10.1109\/TKDE.2013.57","DOI":"10.1109\/TKDE.2013.57"},{"key":"2022042203262366330_j_popets-2020-0052_ref_004_w2aab3b7c22b1b6b1ab1ab4Aa","unstructured":"[4] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning (ICML), 2012."},{"key":"2022042203262366330_j_popets-2020-0052_ref_005_w2aab3b7c22b1b6b1ab1ab5Aa","doi-asserted-by":"crossref","unstructured":"[5] Vincent Bindschaedler, Reza Shokri, and Carl A. Gunter. Plausible deniability for privacy-preserving data synthesis. Proceedings of the VLDB Endowment, 10(5):481\u2013492, 2017.10.14778\/3055540.3055542","DOI":"10.14778\/3055540.3055542"},{"key":"2022042203262366330_j_popets-2020-0052_ref_006_w2aab3b7c22b1b6b1ab1ab6Aa","doi-asserted-by":"crossref","unstructured":"[6] Stephen Boyd and Lieven Vandenberghe. Convex Optimization. Cambridge University Press, 2004.10.1017\/CBO9780511804441","DOI":"10.1017\/CBO9780511804441"},{"key":"2022042203262366330_j_popets-2020-0052_ref_007_w2aab3b7c22b1b6b1ab1ab7Aa","doi-asserted-by":"crossref","unstructured":"[7] Jian-Feng Cai, Emmanuel J. Cand\u00e8s, and Zuowei Shen. A singular value thresholding algorithm for matrix completion. SIAM Journal on Optimization, 20(4):1956\u20131982, 2010.10.1137\/080738970","DOI":"10.1137\/080738970"},{"key":"2022042203262366330_j_popets-2020-0052_ref_008_w2aab3b7c22b1b6b1ab1ab8Aa","doi-asserted-by":"crossref","unstructured":"[8] Joseph A Calandrino, Ann Kilzer, Arvind Narayanan, Edward W Felten, and Vitaly Shmatikov. \u201cYou Might Also Like:\u201d Privacy risks of collaborative filtering. In Proceedings of the 32nd IEEE Symposium on Security and Privacy, pages 231\u2013246, 2011.10.1109\/SP.2011.40","DOI":"10.1109\/SP.2011.40"},{"key":"2022042203262366330_j_popets-2020-0052_ref_009_w2aab3b7c22b1b6b1ab1ab9Aa","unstructured":"[9] Colin Campbell and Kristin P. Bennett. A linear programming approach to novelty detection. In Proceedings of the 13th Annual Conference on Neural Information Processing Systems (NIPS), pages 395\u2013401, 2000."},{"key":"2022042203262366330_j_popets-2020-0052_ref_010_w2aab3b7c22b1b6b1ab1ac10Aa","doi-asserted-by":"crossref","unstructured":"[10] Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM Computing Surveys, 41(3):15:1\u201315:58, 2009.","DOI":"10.1145\/1541880.1541882"},{"key":"2022042203262366330_j_popets-2020-0052_ref_011_w2aab3b7c22b1b6b1ab1ac11Aa","doi-asserted-by":"crossref","unstructured":"[11] Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy. Now Publishers, 2014.10.1561\/9781601988195","DOI":"10.1561\/9781601988195"},{"key":"2022042203262366330_j_popets-2020-0052_ref_012_w2aab3b7c22b1b6b1ab1ac12Aa","doi-asserted-by":"crossref","unstructured":"[12] Julian Eggert and Edgar K\u00f6mer. Sparse coding and NMF. In Proceedings of the 2004 IEEE International Joint Conference on Neural Networks (IJCNN), pages 2529\u20132533, 2004.","DOI":"10.1109\/IJCNN.2004.1381036"},{"key":"2022042203262366330_j_popets-2020-0052_ref_013_w2aab3b7c22b1b6b1ab1ac13Aa","doi-asserted-by":"crossref","unstructured":"[13] Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. Poisoning attacks to graph-based recommender systems. In Proceedings of the 34th Annual Computer Security Applications Conference (ACSAC), 2018.10.1145\/3274694.3274706","DOI":"10.1145\/3274694.3274706"},{"key":"2022042203262366330_j_popets-2020-0052_ref_014_w2aab3b7c22b1b6b1ab1ac14Aa","doi-asserted-by":"crossref","unstructured":"[14] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1322\u20131333, 2015.10.1145\/2810103.2813677","DOI":"10.1145\/2810103.2813677"},{"key":"2022042203262366330_j_popets-2020-0052_ref_015_w2aab3b7c22b1b6b1ab1ac15Aa","doi-asserted-by":"crossref","unstructured":"[15] Matthew Fredrikson, Eric Lantz, and Somesh Jha. Model inversion attacks that exploit confidence information and basic countermeasures. In the Proceedings of the 23rd USENIX Security Symposium, pages 17\u201332, 2014.10.1145\/2810103.2813677","DOI":"10.1145\/2810103.2813677"},{"key":"2022042203262366330_j_popets-2020-0052_ref_016_w2aab3b7c22b1b6b1ab1ac16Aa","doi-asserted-by":"crossref","unstructured":"[16] Arik Friedman, Bart P Knijnenburg, Kris Vanhecke, Luc Martens, and Shlomo Berkovsky. Privacy aspects of recommender systems. In Recommender Systems Handbook, pages 649\u2013688. Springer, 2015.10.1007\/978-1-4899-7637-6_19","DOI":"10.1007\/978-1-4899-7637-6_19"},{"key":"2022042203262366330_j_popets-2020-0052_ref_017_w2aab3b7c22b1b6b1ab1ac17Aa","unstructured":"[17] Neil-Zhenqiang Gong and Bin Liu. You are who you know and how you behave: Attribute inference attacks via users\u2019 social friends and behaviors. In Proceedings of the 25th USENIX Security Symposium, pages 979\u2013995, 2016."},{"key":"2022042203262366330_j_popets-2020-0052_ref_018_w2aab3b7c22b1b6b1ab1ac18Aa","doi-asserted-by":"crossref","unstructured":"[18] Neil Zhenqiang Gong and Bin Liu. Attribute inference attacks in online social networks. ACM Transactions on Privacy and Security (TOPS), 21(1):3, 2018.10.1145\/3154793","DOI":"10.1145\/3154793"},{"key":"2022042203262366330_j_popets-2020-0052_ref_019_w2aab3b7c22b1b6b1ab1ac19Aa","unstructured":"[19] GroupLens Research. MovieLens 20M Dataset. http:\/\/grouplens.org\/datasets\/movielens\/, 2016."},{"key":"2022042203262366330_j_popets-2020-0052_ref_020_w2aab3b7c22b1b6b1ab1ac20Aa","unstructured":"[20] Trevor Hastie, Robert Tibshirani, and Jerome Friedman. The Elements of Statistical Learning. Spinger, 2nd edition, 2009.10.1007\/978-0-387-84858-7"},{"key":"2022042203262366330_j_popets-2020-0052_ref_021_w2aab3b7c22b1b6b1ab1ac21Aa","doi-asserted-by":"crossref","unstructured":"[21] Seira Hidano, Takao Murakami, Shuichi Katsumata, Shinsaku Kiyomoto, and Goichiro Hanaoka. Model inversion attacks for online prediction systems: Without knowledge of non-sensitive attributes. In Proceedings of the 15th International Conference on Privacy, Security, and Trust (PST), pages 1\u201310, 2017.10.1109\/PST.2017.00023","DOI":"10.1109\/PST.2017.00023"},{"key":"2022042203262366330_j_popets-2020-0052_ref_022_w2aab3b7c22b1b6b1ab1ac22Aa","doi-asserted-by":"crossref","unstructured":"[22] T Ryan Hoens, Marina Blanton, and Nitesh V Chawla. A private and reliable recommendation system for social networks. In Proceedings of the second IEEE International Conference on Social Computing (SocialCom), pages 816\u2013825, 2010.10.1109\/SocialCom.2010.124","DOI":"10.1109\/SocialCom.2010.124"},{"key":"2022042203262366330_j_popets-2020-0052_ref_023_w2aab3b7c22b1b6b1ab1ac23Aa","doi-asserted-by":"crossref","unstructured":"[23] Kejun Huang, Nicholas D. Sidiropoulos, and Ananthram Swami. Non-negative matrix factorization revisited: Uniqueness and algorithm for symmetric decomposition. IEEE Transactions on Signal Processing, 62(1):211\u2013224, 2014.","DOI":"10.1109\/TSP.2013.2285514"},{"key":"2022042203262366330_j_popets-2020-0052_ref_024_w2aab3b7c22b1b6b1ab1ac24Aa","doi-asserted-by":"crossref","unstructured":"[24] Danesh Irani, Steve Webb, Kang Li, and Calton Pu. Large online social footprints\u2013an emerging threat. In Proceedings of the 12th IEEE International Conference on Computational Science and Engineering (CSE), pages 271\u2013276, 2009.10.1109\/CSE.2009.459","DOI":"10.1109\/CSE.2009.459"},{"key":"2022042203262366330_j_popets-2020-0052_ref_025_w2aab3b7c22b1b6b1ab1ac25Aa","doi-asserted-by":"crossref","unstructured":"[25] Arjan Jeckmans, Qiang Tang, and Pieter Hartel. Privacypreserving collaborative filtering based on horizontally partitioned dataset. In Proceedings of the 2012 International Conference on Collaboration Technologies and Systems (CTS), pages 439\u2013446, 2012.10.1109\/CTS.2012.6261088","DOI":"10.1109\/CTS.2012.6261088"},{"key":"2022042203262366330_j_popets-2020-0052_ref_026_w2aab3b7c22b1b6b1ab1ac26Aa","doi-asserted-by":"crossref","unstructured":"[26] Arjan JP Jeckmans, Michael Beye, Zekeriya Erkin, Pieter Hartel, Reginald L Lagendijk, and Qiang Tang. Privacy in recommender systems. In Social Media Retrieval, pages 263\u2013281. Springer, 2013.10.1007\/978-1-4471-4555-4_12","DOI":"10.1007\/978-1-4471-4555-4_12"},{"key":"2022042203262366330_j_popets-2020-0052_ref_027_w2aab3b7c22b1b6b1ab1ac27Aa","unstructured":"[27] Jinyuan Jia, Binghui Wang, Le Zhang, and Neil Zhenqiang Gong. Attriinfer: Inferring user attributes in online social networks using markov random fields. In Proceedings of the 26th International Conference on World Wide Web (WWW), 2017."},{"key":"2022042203262366330_j_popets-2020-0052_ref_028_w2aab3b7c22b1b6b1ab1ac28Aa","doi-asserted-by":"crossref","unstructured":"[28] Hiromasa Kaneko and Kimito Funatsu. Fast optimization of hyperparameters for support vector regression models with highly predictive ability. Chemometrics and Intelligent Laboratory Systems, 142:64\u201369, 2015.10.1016\/j.chemolab.2015.01.001","DOI":"10.1016\/j.chemolab.2015.01.001"},{"key":"2022042203262366330_j_popets-2020-0052_ref_029_w2aab3b7c22b1b6b1ab1ac29Aa","doi-asserted-by":"crossref","unstructured":"[29] Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recommender systems. Computer and Information Science, 42(8):30\u201337, 2009.10.1109\/MC.2009.263","DOI":"10.1109\/MC.2009.263"},{"key":"2022042203262366330_j_popets-2020-0052_ref_030_w2aab3b7c22b1b6b1ab1ac30Aa","doi-asserted-by":"crossref","unstructured":"[30] Michal Kosinski, David Stillwell, and Thore Graepel. Private traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences, 110(15):5802\u20135805, 2013.10.1073\/pnas.1218772110362532423479631","DOI":"10.1073\/pnas.1218772110"},{"key":"2022042203262366330_j_popets-2020-0052_ref_031_w2aab3b7c22b1b6b1ab1ac31Aa","unstructured":"[31] Shyong K Lam and John Riedl. Shilling recommender systems for fun and profit. In Proceedings of the 13th International Conference on World Wide Web (WWW), pages 393\u2013402, 2004."},{"key":"2022042203262366330_j_popets-2020-0052_ref_032_w2aab3b7c22b1b6b1ab1ac32Aa","unstructured":"[32] Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-based collaborative filtering. In Proceedings of the 30th Annual Conference on Neural Information Processing Systems (NIPS), pages 1885\u20131893, 2016."},{"key":"2022042203262366330_j_popets-2020-0052_ref_033_w2aab3b7c22b1b6b1ab1ac33Aa","doi-asserted-by":"crossref","unstructured":"[33] Yiding Liu, T. Nguyen Pham, Gao Cong, and Quan Yuan. An experimental evaluation of point-of-interest recommendation in location-based social networksk. Proceedings of the VLDB Endowment, 10(10):1010\u20131021, 2017.10.14778\/3115404.3115407","DOI":"10.14778\/3115404.3115407"},{"key":"2022042203262366330_j_popets-2020-0052_ref_034_w2aab3b7c22b1b6b1ab1ac34Aa","doi-asserted-by":"crossref","unstructured":"[34] Ziqi Liu, Yu-Xiang Wang, and Alexander J. Smola. Fast differentially private matrix factorization. In Proceedings of the 9th ACM Conference on Recommender Systems (RecSys), pages 171\u2013178, 2015.10.1145\/2792838.2800191","DOI":"10.1145\/2792838.2800191"},{"key":"2022042203262366330_j_popets-2020-0052_ref_035_w2aab3b7c22b1b6b1ab1ac35Aa","doi-asserted-by":"crossref","unstructured":"[35] Hao Ma, Haixuan Yang, Michael R Lyu, and Irwin King. Sorec: Social recommendation using probabilistic matrix factorization. In Proceedings of the 17th ACM Conference on Information and Knowledge Management (CIKM), pages 931\u2013940, 2008.10.1145\/1458082.1458205","DOI":"10.1145\/1458082.1458205"},{"key":"2022042203262366330_j_popets-2020-0052_ref_036_w2aab3b7c22b1b6b1ab1ac36Aa","doi-asserted-by":"crossref","unstructured":"[36] Julien Mairal, Francis Bach, and Jean Ponce. Sparse Modeling for Image and Vision Processing. Now Publishers, 2014.10.1561\/9781680830095","DOI":"10.1561\/9781680830095"},{"key":"2022042203262366330_j_popets-2020-0052_ref_037_w2aab3b7c22b1b6b1ab1ac37Aa","doi-asserted-by":"crossref","unstructured":"[37] Jonathan R Mayer and John C Mitchell. Third-party web tracking: Policy and technology. In Proceedings of the 33rd IEEE Symposium on Security and Privacy, pages 413\u2013427, 2012.10.1109\/SP.2012.47","DOI":"10.1109\/SP.2012.47"},{"key":"2022042203262366330_j_popets-2020-0052_ref_038_w2aab3b7c22b1b6b1ab1ac38Aa","doi-asserted-by":"crossref","unstructured":"[38] Frank McSherry and Ilya Mironov. Differentially private recommender systems: Building privacy into the Netflix prize contenders. In Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Dining (KDD), pages 627\u2013636, 2009.10.1145\/1557019.1557090","DOI":"10.1145\/1557019.1557090"},{"key":"2022042203262366330_j_popets-2020-0052_ref_039_w2aab3b7c22b1b6b1ab1ac39Aa","unstructured":"[39] Shike Mei and Xiaojin Zhu. The security of latent dirichlet allocation. In Proceedings of the 18th International Conference on Artificial Intelligence and Statistics (AISTATS), pages 681\u2013689, 2015."},{"key":"2022042203262366330_j_popets-2020-0052_ref_040_w2aab3b7c22b1b6b1ab1ac40Aa","doi-asserted-by":"crossref","unstructured":"[40] Xuying Meng, Suhang Wang, Kai Shu, Jundong Li, Bo Chen, Huan Liu, and Yujun Zhang. Personalized privacypreserving social recommendation. In Proceedings of 32nd AAAI Conference on Artificial Intelligence (AAAI), pages 1\u20138, 2018.","DOI":"10.1609\/aaai.v32i1.11714"},{"key":"2022042203262366330_j_popets-2020-0052_ref_041_w2aab3b7c22b1b6b1ab1ac41Aa","doi-asserted-by":"crossref","unstructured":"[41] Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams. Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness. ACM Transactions on Internet Technology (TOIT), 7(4):23, 2007.","DOI":"10.1145\/1278366.1278372"},{"key":"2022042203262366330_j_popets-2020-0052_ref_042_w2aab3b7c22b1b6b1ab1ac42Aa","doi-asserted-by":"crossref","unstructured":"[42] Luis Mu\u00f1oz Gonz\u00e1lez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (AISec), pages 27\u201338, 2017.10.1145\/3128572.3140451","DOI":"10.1145\/3128572.3140451"},{"key":"2022042203262366330_j_popets-2020-0052_ref_043_w2aab3b7c22b1b6b1ab1ac43Aa","unstructured":"[43] Takao Murakami, Koki Hamada, Yusuke Kawamoto, and Takuma Hatano. Privacy-preserving multiple tensor factorization for synthesizing large-scale location traces. CoRR, abs\/1911.04226, 2019."},{"key":"2022042203262366330_j_popets-2020-0052_ref_044_w2aab3b7c22b1b6b1ab1ac44Aa","doi-asserted-by":"crossref","unstructured":"[44] Arvind Narayanan and Vitaly Shmatikov. Robust deanonymization of large sparse datasets. In Proceedings of the 29th IEEE Symposium on Security and Privacy, pages 111\u2013125, 2008.10.1109\/SP.2008.33","DOI":"10.1109\/SP.2008.33"},{"key":"2022042203262366330_j_popets-2020-0052_ref_045_w2aab3b7c22b1b6b1ab1ac45Aa","doi-asserted-by":"crossref","unstructured":"[45] Arvind Narayanan and Vitaly Shmatikov. De-anonymizing social networks. In Proceedings of the 30th IEEE Symposium on Security and Privacy, pages 173\u2013187, 2009.10.1109\/SP.2009.22","DOI":"10.1109\/SP.2009.22"},{"key":"2022042203262366330_j_popets-2020-0052_ref_046_w2aab3b7c22b1b6b1ab1ac46Aa","doi-asserted-by":"crossref","unstructured":"[46] Valeria Nikolaenko, Stratis Ioannidis, Udi Weinsberg, Marc Joye, Nina Taft, and Dan Boneh. Privacy-preserving matrix factorization. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS), pages 801\u2013812, 2013.10.1145\/2508859.2516751","DOI":"10.1145\/2508859.2516751"},{"key":"2022042203262366330_j_popets-2020-0052_ref_047_w2aab3b7c22b1b6b1ab1ac47Aa","doi-asserted-by":"crossref","unstructured":"[47] Michael O\u2019Mahony, Neil Hurley, Nicholas Kushmerick, and Gu\u00e9nol\u00e9 Silvestre. Collaborative recommendation: A robustness analysis. ACM Transactions on Internet Technology (TOIT), 4(4):344\u2013377, 2004.","DOI":"10.1145\/1031114.1031116"},{"key":"2022042203262366330_j_popets-2020-0052_ref_048_w2aab3b7c22b1b6b1ab1ac48Aa","doi-asserted-by":"crossref","unstructured":"[48] Jahna Otterbacher. Inferring gender of movie reviewers: Exploiting writing style, content and metadata. In Proceedings of the 19th ACM International Conference on Information and Knowledge Management (CIKM), pages 369\u2013378, 2010.10.1145\/1871437.1871487","DOI":"10.1145\/1871437.1871487"},{"key":"2022042203262366330_j_popets-2020-0052_ref_049_w2aab3b7c22b1b6b1ab1ac49Aa","unstructured":"[49] Huseyin Polat and Wenliang Du. Privacy-preserving collaborative filtering using randomized perturbation techniques. In Proceedings of the Third IEEE International Conference on Data Mining (ICDM), pages 625\u2013628, 2003."},{"key":"2022042203262366330_j_popets-2020-0052_ref_050_w2aab3b7c22b1b6b1ab1ac50Aa","doi-asserted-by":"crossref","unstructured":"[50] Huseyin Polat and Wenliang Du. Achieving private recommendations using randomized response techniques. In Proceedings of the 10th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining (PAKDD), pages 637\u2013646, 2006.10.1007\/11731139_73","DOI":"10.1007\/11731139_73"},{"key":"2022042203262366330_j_popets-2020-0052_ref_051_w2aab3b7c22b1b6b1ab1ac51Aa","doi-asserted-by":"crossref","unstructured":"[51] Naren Ramakrishnan, Benjamin J Keller, Batul J Mirza, Ananth Y Grama, and George Karypis. Privacy risks in recommender systems. IEEE Internet Computing, 5(6):54, 2001.10.1109\/4236.968832","DOI":"10.1109\/4236.968832"},{"key":"2022042203262366330_j_popets-2020-0052_ref_052_w2aab3b7c22b1b6b1ab1ac52Aa","doi-asserted-by":"crossref","unstructured":"[52] Paul Resnick and Hal R Varian. Recommender systems. Communications of the ACM, 40(3):56\u201358, 1997.10.1145\/245108.245121","DOI":"10.1145\/245108.245121"},{"key":"2022042203262366330_j_popets-2020-0052_ref_053_w2aab3b7c22b1b6b1ab1ac53Aa","doi-asserted-by":"crossref","unstructured":"[53] Badrul Sarwar, George Karypis, Joseph Konstan, and John Riedl. Item-based collaborative filtering recommendation algorithms. In Proceedings of the 10th International Conference on World Wide Web (WWW), pages 285\u2013295, 2001.10.1145\/371920.372071","DOI":"10.1145\/371920.372071"},{"key":"2022042203262366330_j_popets-2020-0052_ref_054_w2aab3b7c22b1b6b1ab1ac54Aa","unstructured":"[54] Bernhard Sch\u00f6lkopf, Robert Williamson, Alex Smola, John Shawe-Taylor, and John Platt. Support vector method for novelty detection. In Proceedings of the 12th Annual Conference on Neural Information Processing Systems (NIPS), pages 582\u2013588, 1999."},{"key":"2022042203262366330_j_popets-2020-0052_ref_055_w2aab3b7c22b1b6b1ab1ac55Aa","doi-asserted-by":"crossref","unstructured":"[55] Guy Shani, Max Chickering, and Christopher Meek. Mining recommendations from the web. In Proceedings of the 2008 ACM Conference on Recommender Systems (RecSys), pages 35\u201342, 2008.10.1145\/1454008.1454015","DOI":"10.1145\/1454008.1454015"},{"key":"2022042203262366330_j_popets-2020-0052_ref_056_w2aab3b7c22b1b6b1ab1ac56Aa","doi-asserted-by":"crossref","unstructured":"[56] Kai Shu, Suhang Wang, Jiliang Tang, Yilin Wang, and Huan Liu. Crossfire: Cross media joint friend and item recommendations. In Proceedings of the 11th ACM International Conference on Web Search and Data Mining (WSDM), 2018.10.1145\/3159652.3159692","DOI":"10.1145\/3159652.3159692"},{"key":"2022042203262366330_j_popets-2020-0052_ref_057_w2aab3b7c22b1b6b1ab1ac57Aa","unstructured":"[57] Nathan Srebro, Jason Rennie, and Tommi S. Jaakkola. Maximum-margin matrix factorization. In Proceedings of the 18th Annual Conference on Neural Information Processing Systems (NIPS), pages 1329\u20131336, 2004."},{"key":"2022042203262366330_j_popets-2020-0052_ref_058_w2aab3b7c22b1b6b1ab1ac58Aa","doi-asserted-by":"crossref","unstructured":"[58] Xiaoyuan Su and Taghi M. Khoshgoftaar. A survey of collaborative filtering techniques. Advances in Artificial Intelligence, 2009(4):1\u201319, 2009.10.1155\/2009\/421425","DOI":"10.1155\/2009\/421425"},{"key":"2022042203262366330_j_popets-2020-0052_ref_059_w2aab3b7c22b1b6b1ab1ac59Aa","doi-asserted-by":"crossref","unstructured":"[59] G\u00e1bor Tak\u00e1cs, Istv\u00e1n Pil\u00e1szy, Botty\u00e1n N\u00e9meth, and Domonkos Tikk. Investigation of various matrix factorization methods for large recommender systems. In Proceedings of the 17th IEEE International Conference on Data Mining Workshops (ICDMW), pages 553\u2013562, 2008.10.1109\/ICDMW.2008.86","DOI":"10.1109\/ICDMW.2008.86"},{"key":"2022042203262366330_j_popets-2020-0052_ref_060_w2aab3b7c22b1b6b1ab1ac60Aa","doi-asserted-by":"crossref","unstructured":"[60] Jiliang Tang, Xia Hu, and Huan Liu. Social recommendation: A review. Social Network Analysis and Mining, 3(4):1113\u20131133, 2013.","DOI":"10.1007\/s13278-013-0141-9"},{"key":"2022042203262366330_j_popets-2020-0052_ref_061_w2aab3b7c22b1b6b1ab1ac61Aa","doi-asserted-by":"crossref","unstructured":"[61] Qiang Tang and Jun Wang. Privacy-preserving friendshipbased recommender systems. IEEE Transactions on Dependable and Secure Computing, 15:784\u2013796, 2016.10.1109\/TDSC.2016.2631533","DOI":"10.1109\/TDSC.2016.2631533"},{"key":"2022042203262366330_j_popets-2020-0052_ref_062_w2aab3b7c22b1b6b1ab1ac62Aa","unstructured":"[62] Yu-Xiang Wang, Stephen E. Fienberg, and Alexander J. Smola. Privacy for free: Posterior sampling and stochastic gradient monte carlo. In Proceedings of the 32nd International Conference on International Conference on Machine Learning (ICML), pages 2493\u20132502, 2015."},{"key":"2022042203262366330_j_popets-2020-0052_ref_063_w2aab3b7c22b1b6b1ab1ac63Aa","doi-asserted-by":"crossref","unstructured":"[63] Udi Weinsberg, Smriti Bhagat, Stratis Ioannidis, and Nina Taft. Blurme: Inferring and obfuscating user gender based on ratings. In Proceedings of the 6th ACM conference on Recommender systems (RecSys), pages 195\u2013202, 2012.10.1145\/2365952.2365989","DOI":"10.1145\/2365952.2365989"},{"key":"2022042203262366330_j_popets-2020-0052_ref_064_w2aab3b7c22b1b6b1ab1ac64Aa","doi-asserted-by":"crossref","unstructured":"[64] Xi Wu, Matthew Fredrikson Somesh Jha, and Jeffrey F. Naughton. A methodology for formalizing model-inversion attacks. In Proceedings of the 29th IEEE Computer Security Foundations Symposium (CSF), pages 355\u2013370, 2016.10.1109\/CSF.2016.32","DOI":"10.1109\/CSF.2016.32"},{"key":"2022042203262366330_j_popets-2020-0052_ref_065_w2aab3b7c22b1b6b1ab1ac65Aa","unstructured":"[65] Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. Is feature selection secure against training data poisoning? In Proceedings of the 32nd International Conference on Machine Learning (ICML), pages 1689\u20131698, 2015."},{"key":"2022042203262366330_j_popets-2020-0052_ref_066_w2aab3b7c22b1b6b1ab1ac66Aa","unstructured":"[66] Xinyu Xing, Wei Meng, Dan Doozan, Alex C Snoeren, Nick Feamster, and Wenke Lee. Take this personally: Pollution attacks on personalized services. In Proceedings of the 22nd USENIX Security Symposium, pages 671\u2013686, 2013."},{"key":"2022042203262366330_j_popets-2020-0052_ref_067_w2aab3b7c22b1b6b1ab1ac67Aa","doi-asserted-by":"crossref","unstructured":"[67] Dingqi Yang, Daqing Zhang, and Bingqing Qu. Participatory cultural mapping based on collective behavior data in location based social networks. ACM Transction on Intelligent Systems and Technology (TIST), 7(30):1\u201323, 2016.10.1145\/2814575","DOI":"10.1145\/2814575"},{"key":"2022042203262366330_j_popets-2020-0052_ref_068_w2aab3b7c22b1b6b1ab1ac68Aa","doi-asserted-by":"crossref","unstructured":"[68] Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. Fake co-visitation injection attacks to recommender systems. In Proceedings of 24th Network and Distributed System Security Symposium (NDSS), 2017.10.14722\/ndss.2017.23020","DOI":"10.14722\/ndss.2017.23020"},{"key":"2022042203262366330_j_popets-2020-0052_ref_069_w2aab3b7c22b1b6b1ab1ac69Aa","unstructured":"[69] William Zeller and Edward W Felten. Cross-site request forgeries: Exploitation and prevention. Technical Report, Princeton University, 2008."},{"key":"2022042203262366330_j_popets-2020-0052_ref_070_w2aab3b7c22b1b6b1ab1ac70Aa","doi-asserted-by":"crossref","unstructured":"[70] Elena Zheleva and Lise Getoor. To join or not to join: The illusion of privacy in social networks with mixed public and private user profiles. In Proceedings of the 18th International Conference on World Wide Web (WWW), pages 531\u2013540, 2009.10.1145\/1526709.1526781","DOI":"10.1145\/1526709.1526781"}],"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/content.sciendo.com\/view\/journals\/popets\/2020\/3\/article-p264.xml","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.sciendo.com\/pdf\/10.2478\/popets-2020-0052","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,12]],"date-time":"2024-08-12T19:41:50Z","timestamp":1723491710000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2020\/popets-2020-0052.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,7,1]]},"references-count":70,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2020,8,17]]},"published-print":{"date-parts":[[2020,7,1]]}},"alternative-id":["10.2478\/popets-2020-0052"],"URL":"https:\/\/doi.org\/10.2478\/popets-2020-0052","relation":{},"ISSN":["2299-0984"],"issn-type":[{"type":"electronic","value":"2299-0984"}],"subject":[],"published":{"date-parts":[[2020,7,1]]}}}