# RecPS: Privacy Risk Scoring for Recommender Systems

arXiv: https://arxiv.org/abs/2507.18365 · HTML: https://mlsanity.com/paper/2507.18365/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 38 references that are in the map.
- First posted on arXiv 24 Jul 2025.

## Builds on (most cited first, 20 of 20)

- [LightGCN: Simplifying and Powering Graph Convolution Network for Recommendation](https://mlsanity.com/paper/2002.02126/) (2020)
- [Neural Collaborative Filtering](https://mlsanity.com/paper/1708.05031/) (2017)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Image-based Recommendations on Styles and Substitutes](https://mlsanity.com/paper/1506.04757/) (2015)
- [Ups and Downs: Modeling the Visual Evolution of Fashion Trends with One-Class Collaborative Filtering](https://mlsanity.com/paper/1602.01585/) (2016)
- [A Survey of Machine Unlearning](https://mlsanity.com/paper/2209.02299/) (2022)
- [The Composition Theorem for Differential Privacy](https://mlsanity.com/paper/1311.0776/) (2013)
- [Systematic Evaluation of Privacy Risks of Machine Learning Models](https://mlsanity.com/paper/2003.10595/) (2020)
- [Auditing Differentially Private Machine Learning: How Private is Private SGD?](https://mlsanity.com/paper/2006.07709/) (2020)
- [Fast Yet Effective Machine Unlearning](https://mlsanity.com/paper/2111.08947/) (2021)
- [The Privacy Onion Effect: Memorization is Relative](https://mlsanity.com/paper/2206.10469/) (2022)
- [Privacy Auditing with One (1) Training Run](https://mlsanity.com/paper/2305.08846/) (2023)
- [Recommendation Unlearning](https://mlsanity.com/paper/2201.06820/) (2022)
- [Membership Inference Attacks Against Recommender Systems](https://mlsanity.com/paper/2109.08045/) (2021)
- [A Survey on Trustworthy Recommender Systems](https://mlsanity.com/paper/2207.12515/) (2022)
- [A Review on Machine Unlearning](https://mlsanity.com/paper/2411.11315/) (2024)
- [Fast-adapting and Privacy-preserving Federated Recommender System](https://mlsanity.com/paper/2104.00919/) (2021)
- [Selective and Collaborative Influence Function for Efficient Recommendation Unlearning](https://mlsanity.com/paper/2304.10199/) (2023)
- [Interaction-level Membership Inference Attack Against Federated Recommender Systems](https://mlsanity.com/paper/2301.10964/) (2023)
- [Debiasing Learning for Membership Inference Attacks Against Recommender Systems](https://mlsanity.com/paper/2206.12401/) (2022)

## Built on by (most cited first, 4 of 4)

- [Auditing Approximate Machine Unlearning for Differentially Private Models](https://mlsanity.com/paper/2508.18671/) (2025)
- [Membership Inference Attacks on Recommender System: A Survey](https://mlsanity.com/paper/2509.11080/) (2025)
- [Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems](https://mlsanity.com/paper/2508.18665/) (2025)
- [Are LLMs Good Financial User Simulators? Multi-view Investor Logic Alignment (MILA)](https://mlsanity.com/paper/2609.15727/) (2026)

## Abstract (arXiv)

Recommender systems (RecSys) have become an essential component of many web applications. The core of the system is a recommendation model trained on highly sensitive user-item interaction data. While privacy-enhancing techniques are actively studied in the research community, the real-world model development still depends on minimal privacy protection, e.g., via controlled access. Users of such systems should have the right to choose not to share highly sensitive interactions. However, there is no method allowing the user to know which interactions are more sensitive than others. Thus, quantifying the privacy risk of RecSys training data is a critical step to enabling privacy-aware RecSys model development and deployment. We propose a membership-inference attack (MIA)- based privacy scoring method, RecPS, to measure privacy risks at both the interaction and user levels. The RecPS interaction-level score definition is motivated and derived from differential privacy, which is then extended to the user-level scoring method. A critical component is the interaction-level MIA method RecLiRA, which gives high-quality membership estimation. We have conducted extensive experiments on well-known benchmark datasets and RecSys models to show the unique features and benefits of RecPS scoring in risk assessment and RecSys model unlearning.