mlsanityData to 14 Oct 2026

Membership Inference Attacks Against Recommender Systems

arXiv 2109.08045 ↗First posted 16 Sep 2021cs.CR cs.LGcited by 57

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Recently, recommender systems have achieved promising performances and become one of the most widely used web applications. However, recommender systems are often trained on highly sensitive user data, thus potential data leakage from recommender systems may lead to severe privacy problems. In this paper, we make the first attempt on quantifying the privacy leakage of recommender systems through the lens of membership inference. In contrast with traditional membership inference against machine learning classifiers, our attack faces two main differences. First, our attack is on the user-level but not on the data sample-level. Second, the adversary can only observe the ordered recommended items from a recommender system instead of prediction results in the form of posterior probabilities. To address the above challenges, we propose a novel method by representing users from relevant items. Moreover, a shadow recommender is established to derive the labeled training data for training the attack model. Extensive experimental results show that our attack framework achieves a strong performance. In addition, we design a defense mechanism to effectively mitigate the membership inference threat of recommender systems.

Key facts. Cited by 57 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 55 references that are in the map. First posted on arXiv 16 Sep 2021.

Builds on

29 of 55 references.

References · 29

  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2017Neural Collaborative Filteringcited by 1,111
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  7. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  9. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  10. 2016Ups and Downs: Modeling the Visual Evolution of Fashion Trends with One-Class Collaborative Filteringcited by 520
  11. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  12. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
17 more
  1. 2020Label-Only Membership Inference Attackscited by 388
  2. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  3. 2018Scalable Private Learning with PATEcited by 269
  4. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 225
  5. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  6. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
  7. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
  8. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  9. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
  10. 2020Membership Leakage in Label-Only Exposurescited by 168
  11. 2020Stealing Links from Graph Neural Networkscited by 115
  12. 2017Fast Matrix Factorization for Online Recommendation with Implicit Feedbackcited by 101
  13. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  14. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 66
  15. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28
  16. 2019Joint Neural Collaborative Filtering for Recommender Systemscited by 11
  17. 2017walk2friends: Inferring Social Links from Mobility Profilescited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 17; 2023: 13; 2024: 11; 2025: 10; 2026: 5.

57 papers.

Sort:

By area:

  1. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  2. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  3. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
  4. 2022Recommendation Unlearningcited by 80
  5. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 51
  6. 2022M^4I: Multi-modal Models Membership Inferencecited by 34
  7. 2021Property Inference Attacks Against GANscited by 33
  8. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  9. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 29
  10. 2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 23
  11. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Modelscited by 22
  12. 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
38 more
  1. 2023Machine Unlearning: A Surveycited by 19
  2. 2022Membership Inference Attacks and Generalization: A Causal Perspectivecited by 17
  3. 2022Debiasing Learning for Membership Inference Attacks Against Recommender Systemscited by 12
  4. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  5. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
  6. 2023Code Membership Inference for Detecting Unauthorized Data Use in Code Pre-trained Language Modelscited by 8
  7. 2024Federated Graph Condensation with Information Bottleneck Principlescited by 8
  8. 2023User Consented Federated Recommender System Against Personalized Attribute Inference Attackcited by 7
  9. 2022LegoNet: A Fast and Exact Unlearning Architecturecited by 6
  10. 2023Recommendation Unlearning via Matrix Correctioncited by 6
  11. 2024Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thoughtcited by 6
  12. 2022On the Privacy Risks of Cell-Based NAS Architecturescited by 5
  13. 2022Finding MNEMON: Reviving Memories of Node Embeddingscited by 4
  14. 2023SecurityNet: Assessing Machine Learning Vulnerabilities on Public Modelscited by 4
  15. 2025Unlearning Inversion Attacks for Graph Neural Networkscited by 4
  16. 2025RecPS: Privacy Risk Scoring for Recommender Systemscited by 4
  17. 2022Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)cited by 3
  18. 2022Privacy-preserving Generative Framework Against Membership Inference Attackscited by 3
  19. 2022Emerging Threats in Deep Learning-Based Autonomous Driving: A Comprehensive Surveycited by 3
  20. 2023SoK: Comparing Different Membership Inference Attacks with a Comprehensive Benchmarkcited by 3
  21. 2023Private Matrix Factorization with Public Item Featurescited by 3
  22. 2025Membership Inference Attacks on Recommender System: A Surveycited by 3
  23. 2024Privacy in LLM-based Recommendation: Recent Advances and Future Directionscited by 2
  24. 2024Inference Attacks: A Taxonomy, Survey, and Promising Directionscited by 2
  25. 2024SoK: Security and Privacy Risks of Healthcare AIcited by 2
  26. 2025Membership Inference Attacks with False Discovery Rate Controlcited by 2
  27. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  28. 2022Data Provenance via Differential Auditingcited by 1
  29. 2022Data Leakage via Access Patterns of Sparse Features in Deep Learning-based Recommendation Systemscited by 1
  30. 2023Inferring Communities of Interest in Collaborative Learning-based Recommender Systemscited by 1
  31. 2023Defense Against Model Extraction Attacks on Recommender Systemscited by 1
  32. 2024On Active Privacy Auditing in Supervised Fine-tuning for White-Box Language Modelscited by 1
  33. 2024Hide in Plain Sight: Clean-Label Backdoor for Auditing Membership Inferencecited by 1
  34. 2025Learning to Attack: Uncovering Privacy Risks in Sequential Data Releasescited by 1
  35. 2025IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotioncited by 1
  36. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  37. 2026Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networkscited by 1
  38. 2022Membership Inference Attacks Against Latent Factor Modelcited by 0

50 most cited of 57 All 57 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Reference Recommendation based Membership Inference Attack against Hybrid-based Recommender Systems ↗
  2. 2025Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm
  3. 2025RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems
  4. 2026A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks
  5. 2026A Full-Pipeline Framework for Evaluating Membership Inference Attacks in Machine Learning
  6. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attacks
  7. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systems
  8. 2023Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems