# Privacy-Aware Recommendation with Private-Attribute Protection using Adversarial Learning

arXiv: https://arxiv.org/abs/1911.09872 · HTML: https://mlsanity.com/paper/1911.09872/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Nov 2019.

## Built on by (most cited first, 21 of 21)

- [AutoDebias: Learning to Debias for Recommendation](https://mlsanity.com/paper/2105.04170/) (2021)
- [Releasing Graph Neural Networks with Differential Privacy Guarantees](https://mlsanity.com/paper/2109.08907/) (2021)
- [A Comprehensive Survey on Trustworthy Recommender Systems](https://mlsanity.com/paper/2209.10117/) (2022)
- [Fairness in Recommendation: Foundations, Methods and Applications](https://mlsanity.com/paper/2205.13619/) (2022)
- [Ensuring User-side Fairness in Dynamic Recommender Systems](https://mlsanity.com/paper/2308.15651/) (2023)
- [Unlearning Protected User Attributes in Recommendations with Adversarial Training](https://mlsanity.com/paper/2206.04500/) (2022)
- [Comprehensive Fair Meta-learned Recommender System](https://mlsanity.com/paper/2206.04789/) (2022)
- [Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems](https://mlsanity.com/paper/2310.05847/) (2023)
- [NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/2106.11865/) (2021)
- [Debiasing Learning for Membership Inference Attacks Against Recommender Systems](https://mlsanity.com/paper/2206.12401/) (2022)
- [User Consented Federated Recommender System Against Personalized Attribute Inference Attack](https://mlsanity.com/paper/2312.16203/) (2023)
- [Differential Privacy with Random Projections and Sign Random Projections](https://mlsanity.com/paper/2306.01751/) (2023)
- [Path-Specific Causal Reasoning for Fairness-aware Cognitive Diagnosis](https://mlsanity.com/paper/2406.03064/) (2024)
- [Towards Differential Privacy in Sequential Recommendation: A Noisy Graph Neural Network Approach](https://mlsanity.com/paper/2309.11515/) (2023)
- [Automatic Feature Fairness in Recommendation via Adversaries](https://mlsanity.com/paper/2309.15418/) (2023)
- [RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems](https://mlsanity.com/paper/2504.11510/) (2025)
- [Alleviating User-Sensitive bias with Fair Generative Sequential Recommendation Model](https://mlsanity.com/paper/2506.19777/) (2025)
- [Gender In Gender Out: A Closer Look at User Attributes in Context-Aware Recommendation](https://mlsanity.com/paper/2207.14218/) (2022)
- [Multi-Task Learning For Reduced Popularity Bias In Multi-Territory Video Recommendations](https://mlsanity.com/paper/2310.03148/) (2023)
- [LEGO: A Lightweight and Efficient Multiple-Attribute Unlearning Framework for Recommender Systems](https://mlsanity.com/paper/2510.20327/) (2025)
- [Privacy in Personalized AI Is a System Property, Not Just a Model Property](https://mlsanity.com/paper/2609.38289/) (2026)

## Abstract (arXiv)

Recommendation is one of the critical applications that helps users find information relevant to their interests. However, a malicious attacker can infer users' private information via recommendations. Prior work obfuscates user-item data before sharing it with recommendation system. This approach does not explicitly address the quality of recommendation while performing data obfuscation. Moreover, it cannot protect users against private-attribute inference attacks based on recommendations. This work is the first attempt to build a Recommendation with Attribute Protection (RAP) model which simultaneously recommends relevant items and counters private-attribute inference attacks. The key idea of our approach is to formulate this problem as an adversarial learning problem with two main components: the private attribute inference attacker, and the Bayesian personalized recommender. The attacker seeks to infer users' private-attribute information according to their items list and recommendations. The recommender aims to extract users' interests while employing the attacker to regularize the recommendation process. Experiments show that the proposed model both preserves the quality of recommendation service and protects users against private-attribute inference attacks.