TRAM-S: A Switch Transformer-Based Textual Recommendation Attack Model

The field of recommender systems is experiencing a fundamental paradigm shift, transitioning from the ID-based paradigm (IDRec) that relies on user/item identifiers to modality-based recommendation (MoRec) that integrate modality feature through pretrained encoders. This evolution addresses critical limitations of traditional IDRec, alleviating cold-start problem and enables the recommendation model to achieve cross-platform migration through pretraining. However, MoRec always contains more modality information which could cause more serious leakage of user historical data compared to IDRec. In this work, we aim to explore a question that would a stronger attack model could lead more security risk in textual field? Specifically, we propose a Switch Transformer-based Textual Recommendation Attack Model(TRAM-S) and study several subquestion: (i) how does the performance of TRAM-S in terms of attacks compare? Can it significantly increase the risk of privacy leakage compared to other attack model? (ii) how does the text encoder affect TRAM-S? What is the optimal attack parameter configuration for TRAM-S? (iii) how to balance the Pareto frontier between attack effectiveness and recommendation accuracy based on the differential privacy dynamic replacement algorithm? To answer these questions, we conduct rigorous experiments with textual modality. We provide the experiment on two public datasets, MIND and the EB-NeRD, demonstrating that TRAM-S leads to serious leakage of user historical behavior data compared with TRAM and IDRec under the same conditions. And we also demonstrate the significant role of Differential Privacy Dynamic Replacement in protecting user privacy.