Forget Me If You Can: Auditing User Data Revocation in Recommendation Systems

References

• Abbasi A, Parsons J, Pant G, Sheng ORL, Sarker S (2024) Pathways for design research on artificial intelligence. Inform. Systems Res. 35(2):441–459.Link, Google Scholar
• Adomavicius G, Tuzhilin A (2005) Toward the next generation of recommender systems: A survey of the state-of-the-art and possible extensions. IEEE Trans. Knowledge Data Engrg. 17(6):734–749.Crossref, Google Scholar
• Adomavicius G, Bockstedt J, Curley S, Zhang J (2019) Reducing recommender systems biases: An investigation of rating display designs. MIS Quart. 43(4):1321–1341.Crossref, Google Scholar
• Bai T, Nie JY, Zhao WX, Zhu Y, Du P, Wen JR (2018) An attribute-aware neural attentive model for next basket recommendation. SIGIR’18: 41st Internat. ACM SIGIR Conf. Res. Development Inform. Retrieval (Association for Computing Machinery, New York), 1201–1204.Google Scholar
• Beigi G, Mosallanezhad A, Guo R, Alvari H, Nou A, Liu H (2020) Privacy-aware recommendation with private-attribute protection using adversarial learning. WSDM’20: Proc. 13th Internat. Conf. Web Search Data Mining (Association for Computing Machinery, New York), 34–42.Google Scholar
• Bélanger F, Crossler RE (2011) Privacy in the digital age: A review of information privacy research in information systems. MIS Quart. 35(4):1017–1041.Crossref, Google Scholar
• Berente N, Gu B, Recker J, Santhanam R (2021) Managing artificial intelligence. MIS Quart. 45(3):1433–1450.Crossref, Google Scholar
• Bi X, Yang M, Adomavicius G (2024) Consumer acquisition for recommender systems: A theoretical framework and empirical evaluations. Inform. Systems Res. 35(1):339–362.Link, Google Scholar
• Bourtoule L, Chandrasekaran V, Choquette-Choo CA, Jia H, Travers A, Zhang B, Lie D, Papernot N (2021) Machine unlearning. 2021 IEEE Sympos. Security Privacy (SP) (IEEE, Piscataway, NJ), 141–159.Google Scholar
• Calandrino JA, Kilzer A, Narayanan A, Felten EW, Shmatikov V (2011) “You might also like:” Privacy risks of collaborative filtering. 2011 IEEE Sympos. Security Privacy (IEEE, Piscataway, NJ), 231–246.Google Scholar
• Canny J (2002) Collaborative filtering with privacy. Proceedings 2002 IEEE Sympos. Security Privacy (IEEE, Piscataway, NJ), 45–57.Google Scholar
• Carlini N, Chien S, Nasr M, Song S, Terzis A, Tramer F (2022) Membership inference attacks from first principles. 2022 IEEE Sympos. Security Privacy (SP) (IEEE, Piscataway, NJ), 1897–1914.Google Scholar
• Chen C, Sun F, Zhang M, Ding B (2022) Recommendation unlearning. Laforest F, Troncy R, Simperl E, Agarwal D, Gionis A, Herman I, Médini L, eds. WWW’22: Proc. ACM Web Conf. 2022 (Association for Computing Machinery, New York), 2768–2777.Google Scholar
• Chen M, Gao W, Liu G, Peng K, Wang C (2023) Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. Proc. IEEE/CVF Conf. Comput. Vision Pattern Recognition (IEEE, Piscataway, NJ), 7766–7775.Google Scholar
• Chen J, He L, Liu H, Yang Y, Bi X (2024) Background music recommendation on short video sharing platforms. Inform. Systems Res. 35(4):1890–1908.Link, Google Scholar
• Chow R, Pathak MA, Wang C (2012) A practical system for privacy-preserving collaborative filtering. 2012 IEEE 12th Internat. Conf. Data Mining Workshops (IEEE, Piscataway, NJ), 547–554.Google Scholar
• Chung TS, Rust RT, Wedel M (2009) My mobile music: An adaptive personalization system for digital audio players. Marketing Sci. 28(1):52–68.Link, Google Scholar
• Dowson D, Landau B (1982) The Fréchet distance between multivariate normal distributions. J. Multivariate Anal. 12(3):450–455.Crossref, Google Scholar
• Friedman A, Knijnenburg BP, Vanhecke K, Martens L, Berkovsky S (2015) Privacy aspects of recommender systems. Ricci F, Rokach L, Shapira B, eds. Recommender Systems Handbook (Springer, Boston), 649–688.Crossref, Google Scholar
• Golatkar A, Achille A, Soatto S (2020) Eternal sunshine of the spotless net: Selective forgetting in deep networks. Proc. IEEE/CVF Conf. Comput. Vision Pattern Recognition (IEEE, Piscataway, NJ), 9304–9312.Google Scholar
• Gregor S, Hevner AR (2013) Positioning and presenting design science research for maximum impact. MIS Quart. 37(2):337–355.Crossref, Google Scholar
• Guo L, Sun L, Jiang R, Luo Y, Zheng X (2023) Recommendation based on attributes and social relationships. Expert Systems Appl. 234:121027.Crossref, Google Scholar
• Harper FM, Konstan JA (2015) The MovieLens data sets: History and context. ACM Trans. Interactive Intelligent Systems 5(4):1–19.Crossref, Google Scholar
• He R, McAuley J (2016) Ups and downs: Modeling the visual evolution of fashion trends with one-class collaborative filtering. WWW’16: Proc. 25th Internat. Conf. World Wide Web (International World Wide Web Conferences Steering Committee, Geneva), 507–517.Google Scholar
• Hidasi B, Karatzoglou A, Baltrunas L, Tikk D (2016) Session-based recommendations with recurrent neural networks. Proc. 4th Internat. Conf. Learn. Representations (ICLR, Appleton, WI), 1–10.Google Scholar
• Hu H, Salcic Z, Sun L, Dobbie G, Yu PS, Zhang X (2022) Membership inference attacks on machine learning: A survey. ACM Comput. Surveys 54(11s):1–37.Google Scholar
• Kang WC, McAuley J (2018) Self-attentive sequential recommendation. 2018 IEEE International Conference on Data Mining (ICDM) (IEEE, Piscataway, NJ), 197–206.Google Scholar
• Kartal HB, Li XB (2020) Protecting privacy when sharing and releasing data with multiple records per person. J. Assoc. Inform. Systems 21(6):1461–1485.Google Scholar
• Kosinski M, Stillwell D, Graepel T (2013) Private traits and attributes are predictable from digital records of human behavior. Proc. Natl. Acad. Sci. USA 110(15):5802–5805.Crossref, Google Scholar
• Lee D, Hosanagar K (2021) How do product attributes and reviews moderate the impact of recommender systems through purchase stages? Management Sci. 67(1):524–546.Link, Google Scholar
• Li XB, Qin J (2017) Anonymizing and sharing medical text records. Inform. Systems Res. 28(2):332–352.Link, Google Scholar
• Li XB, Sarkar S (2006) Privacy protection in data mining: A perturbation approach for categorical data. Inform. Systems Res. 17(3):254–270.Link, Google Scholar
• Li XB, Sarkar S (2013) Class-restricted clustering and microperturbation for data privacy. Management Sci. 59(4):796–812.Link, Google Scholar
• Li XB, Sarkar S (2014) Digression and value concatenation to enable privacy-preserving regression. MIS Quart. 38(3):679–698.Crossref, Google Scholar
• Li P, Tuzhilin A (2024) When variety seeking meets unexpectedness: Incorporating variety-seeking behaviors into design of unexpected recommender systems. Inform. Systems Res. 35(3):1257–1273.Link, Google Scholar
• Li XB, Liu X, Motiwalla L (2021) Valuing personal data with privacy consideration. Decision Sci. 52(2):393–426.Crossref, Google Scholar
• Li Z, Fang X, Bai X, Sheng ORL (2017b) Utility-based link recommendation for online social networks. Management Sci. 63(6):1938–1952.Link, Google Scholar
• Li S, Schneider MJ, Yu Y, Gupta S (2023) Reidentification risk in panel data: Protecting for k-anonymity. Inform. Systems Res. 34(3):1066–1088.Link, Google Scholar
• Li J, Ren P, Chen Z, Ren Z, Lian T, Ma J (2017a) Neural attentive session-based recommendation. CIKM‘17: Proc. 2017 ACM Conf. Inform. Knowledge Management (Association for Computing Machinery, New York), 1419–1428.Google Scholar
• Lin G, Liang F, Pan W, Ming Z (2020) FedRec: Federated recommendation with explicit feedback. IEEE Intelligent Systems 36(5):21–30.Crossref, Google Scholar
• Liu Y, Fang EX, Lu J (2023) Lagrangian inference for ranking problems. Oper. Res. 71(1):202–223.Link, Google Scholar
• Liu Q, Zeng Y, Mokhosi R, Zhang H (2018) STAMP: Short-term attention/memory priority model for session-based recommendation. KDD’18: Proc. 24th ACM SIGKDD Internat. Conf. Knowledge Discovery Data Mining (Association for Computing Machinery, New York), 1831–1839.Google Scholar
• Long J, Chen T, Ye G, Zheng K, Hung NQV, Yin H (2024) Physical trajectory inference attack and defense in decentralized POI recommendation. Proc. ACM Web Conf. 2024 (ACM, New York), 3379–3387.Google Scholar
• Narayanan A, Shmatikov V (2008) Robust de-anonymization of large sparse data sets. 2008 IEEE Sympos. Security Privacy (SP 2008) (IEEE, Piscataway, NJ), 111–125.Google Scholar
• Nunamaker JF Jr, Briggs RO, Derrick DC, Schwabe G (2015) The last research mile: Achieving both rigor and relevance in information systems research. J. Management Inform. Systems 32(3):10–47.Crossref, Google Scholar
• Pavlou PA (2011) State of the information privacy literature: Where are we now and where should we go? MIS Quart. 35(4):977–988.Crossref, Google Scholar
• Pedregosa F, Triantafillou E (2023) Announcing the first machine unlearning challenge. Accessed January 12, 2025, https://research.google/blog/announcing-the-first-machine-unlearning-challenge/.Google Scholar
• Polat H, Du W (2003) Privacy-preserving collaborative filtering using randomized perturbation techniques. Third IEEE Internat. Conf. Data Mining (IEEE, Piscataway, NJ), 625–628.Google Scholar
• Prawesh S, Padmanabhan B (2014) The “most popular news” recommender: Count amplification and manipulation resistance. Inform. Systems Res. 25(3):569–589.Link, Google Scholar
• Rittenberg LE, Purdy CR (1978) The internal auditor’s role in mis developments. MIS Quart. 2(4):47–57.Crossref, Google Scholar
• Sablayrolles A, Douze M, Schmid C, Ollivier Y, Jégou H (2019) White-box vs black-box: Bayes optimal strategies for membership inference. Proc. 36th Internat. Conf. Machine Learn. (ICML, Long Beach, CA), 5558–5567.Google Scholar
• Salem A, Zhang Y, Humbert M, Berrang P, Fritz M, Backes M (2019) ML-leaks: Model and data independent membership inference attacks and defenses on machine learning models. Proc. 26th Annual Network Distributed System Security Sympos. (NDSS) (Internet Society, San Diego, CA), 1–15.Google Scholar
• Salzberg SL (1997) On comparing classifiers: Pitfalls to avoid and a recommended approach. Data Mining Knowledge Discovery 1(3):317–328.Crossref, Google Scholar
• Shejwalkar V, Inan HA, Houmansadr A, Sim R (2021) Membership inference attacks against NLP classification models. Proc. 35th Conf. Neural Inform. Processing System (NeurIPS, Sydney, Australia), 1–13.Google Scholar
• Shokri R, Strobel M, Zick Y (2021) On the privacy risks of model explanations. AIES’21: Proc. 2021 AAAI/ACM Conf. AI Ethics Soc. (Association for Computing Machinery, New York), 231–241.Google Scholar
• Shokri R, Stronati M, Song C, Shmatikov V (2017) Membership inference attacks against machine learning models. 2017 IEEE Sympos. Security Privacy (SP) (IEEE, Piscataway, NJ), 3–18.Google Scholar
• Smith HJ, Dinev T, Xu H (2011) Information privacy research: An interdisciplinary review. MIS Quart. 35(4):989–1015.Crossref, Google Scholar
• Smith HJ, Milberg SJ, Burke SJ (1996) Information privacy: Measuring individuals’ concerns about organizational practices. MIS Quart. 20(2):167–196.Crossref, Google Scholar
• Song Y, Sahoo N, Ofek E (2019) When and how to diversify—A multicategory utility model for personalized content recommendation. Management Sci. 65(8):3737–3757.Link, Google Scholar
• Stempel J (2023) NY Times sues OpenAI, Microsoft for infringing copyrighted works. Reuters (May 27), https://www.reuters.com/legal/transactional/ny-times-sues-openai-microsoft-infringing-copyrighted-work-2023-12-27/.Google Scholar
• Sun F, Liu J, Wu J, Pei C, Lin X, Ou W, Jiang P (2019) BERT4Rec: Sequential recommendation with bidirectional encoder representations from transformer. CIKM’19: Proc. 28th ACM Internat. Conf. Inform. Knowledge Management (Association for Computing Machinery, New York), 1441–1450.Google Scholar
• Thudi A, Deza G, Chandrasekaran V, Papernot N (2022) Unrolling SGD: Understanding factors influencing machine unlearning. 2022 IEEE 7th Eur. Sympos. Security Privacy (EuroS&P) (IEEE, Piscataway, NJ), 303–319.Google Scholar
• Tulabandhula T, Sinha D, Karra SR, Patidar P (2023) Multi-purchase behavior: Modeling, estimation, and optimization. Manufacturing Service Oper. Management 25(6):2298–2313.Abstract, Google Scholar
• Wang M, Jiang Z, Zhang Y, Yang H (2018) T-closeness slicing: A new privacy-preserving approach for transactional data publishing. INFORMS J. Comput. 30(3):438–453.Link, Google Scholar
• Watson L, Guo C, Cormode G, Sablayrolles A (2022) On the importance of difficulty calibration in membership inference attacks. Proc. 10th Internat. Conf. Learn. Representations (ICLR, Appleton, WI), 1–16.Google Scholar
• Wei Q, Mu Y, Guo X, Jiang W, Chen G (2024) Dynamic Bayesian network–based product recommendation considering consumers’ multistage shopping journeys: A marketing funnel perspective. Inform. Systems Res. 35(3):1382–1402.Link, Google Scholar
• Xin X, Yang L, Zhao Z, Ren P, Chen Z, Ma J, Ren Z (2024) On the effectiveness of unlearning in session-based recommendation. WSDM’24: Proc. 17th ACM Internat. Conf. Web Search Data Mining (Association for Computing Machinery, New York), 855–863.Google Scholar
• Xin X, Yang J, Wang H, Ma J, Ren P, Luo H, Shi X, Chen Z, Ren Z (2023) On the user behavior leakage from recommender system exposure. ACM Trans. Inform. Systems 41(3):1–25.Crossref, Google Scholar
• Yang L, Tan B, Zheng VW, Chen K, Yang Q (2020) Federated recommendation systems. Yang Q, Fan L, Yu H, eds. Federated Learning, Lecture Notes in Computer Science, vol. 12500 (Springer, Cham, Switzerland), 225–239.Crossref, Google Scholar
• Yang Y, Han X, Chai Y, Ebrahimi R, Behnia R, Padmanabhan B (2024) From machine learning to machine unlearning: Complying with GDPR’s right to be forgotten while maintaining business value of predictive models. Preprint, submitted November 26, https://arxiv.org/abs/2411.17126.Google Scholar
• Yeom S, Giacomelli I, Fredrikson M, Jha S (2018) Privacy risk in machine learning: Analyzing the connection to overfitting. 2018 IEEE 31st Comput. Security Foundations Sympos. (CSF) (IEEE, Piscataway, NJ), 268–282.Google Scholar
• Yesilada M, Lewandowsky S (2022) Systematic review: YouTube recommendations and problematic content. Internet Policy Rev. 11(1):1652.Crossref, Google Scholar
• Zhao XW, Guo Y, He Y, Jiang H, Wu Y, Li X (2014) We know what you want to buy: A demographic-based system for product recommendation on microblogs. KDD’14: Proc. 20th ACM SIGKDD Internat. Conf. Knowledge Discovery Data Mining (Association for Computing Machinery, New York), 1935–1944.Google Scholar
• Zhang S, Yin H, Chen T, Huang Z, Cui L, Zhang X (2021b) Graph embedding for recommendation against attribute inference attacks. Leskovec J, Grobelnik M, Najork M, Tang J, Zia L, eds. Proc. Web Conf. 2021 (Association for Computing Machinery, New York), 3002–3014.Google Scholar
• Zhang Y, Feng F, Wang C, He X, Wang M, Li Y, Zhang Y (2020) How to retrain recommender system? A sequential meta-learning method. SIGIR’20: Proc. 43rd Internat. ACM SIGIR Conf. Res. Development Inform. Retrieval (Association for Computing Machinery, New York), 1479–1488.Google Scholar
• Zhang M, Ren Z, Wang Z, Ren P, Chen Z, Hu P, Zhang Y (2021a) Membership inference attacks against recommender systems. CCS’21: Proc. 2021 ACM SIGSAC Conf. Comput. Comm. Security (Association for Computing Machinery, New York), 864–879.Google Scholar
• Zhou M, Zhang J, Adomavicius G (2024) Longitudinal impact of preference biases on recommender systems’ performance. Inform. Systems Res. 35(4):1634–1656.Link, Google Scholar
• Zhou J, Li H, Liao X, Zhang B, He W, Li Z, Zhou L, Gao X (2023) A unified method to revoke the private data of patients in intelligent healthcare with audit to forget. Nature Comm. 14(1):6255.Crossref, Google Scholar
• Zhou G, Mou N, Fan Y, Pi Q, Bian W, Zhou C, Zhu X, Gai K (2019) Deep interest evolution network for click-through rate prediction. Proc. AAAI Conf. Artificial Intelligence 33(1):5941–5948.Crossref, Google Scholar
• Zhou G, Zhu X, Song C, Fan Y, Zhu H, Ma X, Yan Y, Jin J, Li H, Gai K (2018) Deep interest network for click-through rate prediction. KDD’18: Proc. 24th ACM SIGKDD Internat. Conf. Knowledge Discovery Data Mining (Association for Computing Machinery, New York), 1059–1068.Google Scholar
• Zhu Z, Wu C, Fan R, Lian D, Chen E (2023) Membership inference attacks against sequential recommender systems. WWW’23: Proc. ACM Web Conf. 2023 (Association for Computing Machinery, New York), 1208–1219.Google Scholar