Adversarial Attacks on Differentially Private Factorization Machines in Recommendation Systems

Recommendation systems powered by Factorization Machines (FM) play a crucial role in personalizing user experiences across various domains, including e-Commerce, social networks, and streaming services. However, these models often rely on large amounts of user data, raising significant privacy concerns. Differential Privacy (DP) has emerged as a viable solution that provides privacy guarantees by introducing controlled noise into the model computations. Despite these protections, differentially private FM models remain vulnerable to adversarial attacks. This work explores the susceptibility of DP-enhanced FM recommendation systems to adversarial perturbations, particularly through the use of Wasserstein Generative Adversarial Networks (WGAN) and Wasserstein loss functions. Recommendation systems powered by Factorization Machines (FM) play a crucial role in personalizing user experiences across various domains, including e-Commerce, social networks, and streaming services. However, these models often rely on large amounts of user data, raising significant privacy concerns. Differential Privacy (DP) has emerged as a viable solution that provides privacy guarantees by introducing controlled noise into the model computations. Despite these protections, differentially private FM models remain vulnerable to adversarial attacks. This work explores the susceptibility of DP-enhanced FM recommendation systems to adversarial perturbations, particularly through the use of Wasserstein Generative Adversarial Networks (WGAN) and Wasserstein loss functions. The study aims to highlight how adversarial techniques can exploit the inherent privacy-utility tradeoff in DP mechanisms, potentially compromising both privacy and model robustness. While DP guarantees protection against the disclosure of individual participation, it does not preclude the inference of correlated or population-level attributes, leaving residual privacy risks. In addition, we discuss the limitations of existing defenses and propose potential strategies to enhance the security of DP-FM systems.The study aims to highlight how adversarial techniques can exploit the inherent privacyutility trade-off in DP mechanisms, potentially compromising both privacy and model robustness. In addition, we discuss the limitations of existing defenses and propose potential strategies to enhance the security of DP-FM systems.