mlsanityData to 14 Oct 2026

Membership Inference Attacks on Recommender System: A Survey

arXiv 2509.11080 ↗First posted 14 Sep 2025cs.IR cs.AI cs.CRcited by 3

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Recommender systems (RecSys) have been widely applied to various applications, including E-commerce, finance, healthcare, social media and have become increasingly influential in shaping user behavior and decision-making, highlighting their growing impact in various domains. However, recent studies have shown that RecSys are vulnerable to membership inference attacks (MIAs), which aim to infer whether user interaction record was used to train a target model or not. MIAs on RecSys models can directly lead to a privacy breach. For example, via identifying the fact that a purchase record that has been used to train a RecSys associated with a specific user, an attacker can infer that user's special quirks. In recent years, MIAs have been shown to be effective on other ML tasks, e.g., classification models and natural language processing. However, traditional MIAs are ill-suited for RecSys due to the unseen posterior probability. Although MIAs on RecSys form a newly emerging and rapidly growing research area, there has been no systematic survey on this topic yet. In this article, we conduct the first comprehensive survey on RecSys MIAs. This survey offers a comprehensive review of the latest advancements in RecSys MIAs, exploring the design principles, challenges, attack and defense associated with this emerging field. We provide a unified taxonomy that categorizes different RecSys MIAs based on their characterizations and discuss their pros and cons. Based on the limitations and gaps identified in this survey, we point out several promising future research directions to inspire the researchers who wish to follow this area. This survey not only serves as a reference for the research community but also provides a clear description for researchers outside this research domain.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 48 of its 86 references that are in the map. First posted on arXiv 14 Sep 2025.

Builds on

48 of 86 references.

Closest ancestors · 10

Same direction, newest first

  1. 2024Membership Inference Attacks Against In-Context Learning2 Sep
  2. 2024SeqMIA: Sequential-Metric Based Membership Inference Attack21 Jul
  3. 2024Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought11 May
  4. 2023Membership Inference Attacks against Diffusion Models7 Feb
  5. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  6. 2022Debiasing Learning for Membership Inference Attacks Against Recommender Systems24 Jun
  7. 2022Making Recommender Systems Forget: Learning and Unlearning for Erasable Recommendation22 Mar
  8. 2021Membership Inference Attacks From First Principles7 Dec
  9. 2021Membership Inference Attacks Against Recommender Systems16 Sep
  10. 2021Membership Inference Attacks on Machine Learning: A Survey14 Mar

Other references · 38

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  3. 2016Deep Learning with Differential Privacycited by 2,728
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  5. 2018Self-Attentive Sequential Recommendationcited by 1,184
  6. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,139
  7. 2017Neural Collaborative Filteringcited by 1,111
  8. 2019Machine Unlearningcited by 1,061
  9. 2019BERT4Rec: Sequential Recommendation with Bidirectional Encoder Representations from Transformercited by 964
  10. 2015Session-based Recommendations with Recurrent Neural Networkscited by 695
  11. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  12. 2018Personalized Top-N Sequential Recommendation via Convolutional Sequence Embeddingcited by 476
26 more
  1. 2022Recommendation as Language Processing (RLP): A Unified Pretrain, Personalized Prompt & Predict Paradigm (P5)cited by 402
  2. 2019KGAT: Knowledge Graph Attention Network for Recommendationcited by 343
  3. 2023TALLRec: An Effective and Efficient Tuning Framework to Align Large Language Model with Recommendationcited by 337
  4. 2013The Composition Theorem for Differential Privacycited by 297
  5. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  6. 2023Chat-REC: Towards Interactive and Explainable LLMs-Augmented Recommender Systemcited by 242
  7. 2023Recommender Systems in the Era of Large Language Models (LLMs)cited by 189
  8. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  9. 2022M6-Rec: Generative Pretrained Language Models are Open-Ended Recommender Systemscited by 152
  10. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  11. 2019Federated Collaborative Filtering for Privacy-Preserving Personalized Recommendation Systemcited by 79
  12. 2021SimpleX: A Simple and Strong Baseline for Collaborative Filteringcited by 65
  13. 2020DiffNet++: A Neural Influence and Interest Diffusion Network for Social Recommendationcited by 46
  14. 2021Graph Embedding for Recommendation against Attribute Inference Attackscited by 40
  15. 2021Fast-adapting and Privacy-preserving Federated Recommender Systemcited by 30
  16. 2023Selective and Collaborative Influence Function for Efficient Recommendation Unlearningcited by 26
  17. 2023Interaction-level Membership Inference Attack Against Federated Recommender Systemscited by 25
  18. 2023Knowledge Graph Completion Models are Few-shot Learners: An Empirical Study of Relation Labeling in E-commerce with LLMscited by 24
  19. 2023Fairly Adaptive Negative Sampling for Recommendationscited by 22
  20. 2022Comprehensive Privacy Analysis on Federated Recommender System against Attribute Inference Attackscited by 21
  21. 2022ReFRS: Resource-efficient Federated Recommender System for Dynamic and Diversified User Preferencescited by 15
  22. 2023Robust Preference-Guided Denoising for Graph based Social Recommendationcited by 15
  23. 2023User Consented Federated Recommender System Against Personalized Attribute Inference Attackcited by 7
  24. 2025RecPS: Privacy Risk Scoring for Recommender Systemscited by 4
  25. 2025Auditing Approximate Machine Unlearning for Differentially Private Modelscited by 4
  26. 2023Adaptive Domain Inference Attack with Concept Hierarchycited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  2. 2026Quantifying Membership Disclosure Risk for Tabular Synthetic Data Using Kernel Density Estimatorscited by 0
  3. 2026SoK: Rethinking Membership Inference in Tabular Machine Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems
  2. 2025Reference Recommendation based Membership Inference Attack against Hybrid-based Recommender Systems ↗
  3. 2025Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm
  4. 2026CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models
  5. 2021To Trust or Not To Trust Prediction Scores for Membership Inference Attacks
  6. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble
  7. 2024Do Membership Inference Attacks Work on Large Language Models?
  8. 2025Membership Inference Attacks on Large-Scale Models: A Survey