Membership inference attacks utilizing autonomous users
Techniques for conducting membership inference attacks are disclosed. In an example, a plurality of target interactions of a target user with an item providing platform are monitored. A plurality of target recommendations for the target user is received from a recommendation system of the item providing platform. Using an attack classifier and based on (i) the plurality of target interactions and (ii) the plurality of target recommendations, an inference is made as to whether at least a subset of the plurality of target interactions and/or at least a subset of the plurality of target recommendations were used to train the recommendation system. The attack classifier is trained using training data associated with a plurality of autonomous users (such as autonomous sock puppets) interacting with the item providing platform. In an example, the item providing platform is one of a video providing platform, an audio providing platform, or a shopping platform.
1 . A non-transitory computer-readable medium including instructions that when executed by one or more processors, cause a system including the one or more processors to perform operations including:
monitoring a plurality of target interactions of a target user with an item providing platform;
receiving a plurality of target recommendations for the target user from a recommendation system of the item providing platform;
inferring, using an attack classifier and based at least in part on (i) the plurality of target interactions and (ii) the plurality of target recommendations, whether at least a subset of the plurality of target interactions and/or at least a subset of the plurality of target recommendations were used to train the recommendation system;
interacting, by each of a plurality of autonomous users, with the item providing platform;
receiving, by each of the plurality of autonomous users, a corresponding plurality of recommendations from the item providing platform, based at least in part on interaction of the corresponding autonomous user with the item providing platform;
generating, for a first autonomous user of the plurality of autonomous users, (i) a center interaction vector, based at least in part on one or more items with which the first autonomous user interacted with the item providing platform, (ii) a center recommendation vector, based at least in part on one or more recommendations received by the first autonomous user from the item providing platform, and (iii) a difference vector, based at least in part on the center interaction vector and the center recommendation vector;
generating training data, based at least in part on the difference vector; and
training the attack classifier using the training data.
2 . The non-transitory computer-readable medium of claim 1 , wherein the operations further include:
classifying each of the plurality of autonomous users as either a member or a nonmember,
wherein an autonomous user of the plurality of autonomous users is classified as a nonmember in response to the autonomous user having less than a threshold number of interactions or less than a threshold time period of interactions with the item providing platform, and
wherein another autonomous user of the plurality of autonomous users is classified as a member in response to the other autonomous user having at least the threshold number of interactions or at least the threshold time period of interactions with the item providing platform.
3 . The non-transitory computer-readable medium of claim 2 , wherein the first autonomous user of the plurality of autonomous users is classified as a nonmember, wherein the center interaction vector is a center nonmember interaction vector, the center recommendation vector is a center nonmember recommendation vector, and the difference vector is a nonmember difference vector, and wherein the operations further include:
generating, for the first autonomous user, (i) a list of nonmember items including the one or more items with which the first autonomous user interacted, (ii) a plurality of nonmember interaction vectors, wherein each nonmember interaction vector of the plurality of nonmember interaction vectors includes attributes associated with a corresponding item included within the list of nonmember items, (iii) a list of nonmember recommendations including the one or more recommendations received by the first autonomous user from the item providing platform, (iv) a plurality of nonmember recommendation vectors, wherein each nonmember recommendation vector of the plurality of nonmember recommendation vectors includes attributes associated with a corresponding recommendation included within the list of nonmember recommendations,
wherein the center nonmember interaction vector is generated based at least in part on the plurality of nonmember interaction vectors,
wherein the center nonmember recommendation vector is generated based at least in part on the plurality of nonmember recommendation vectors, and
wherein the nonmember difference vector is generated based at least in part on a difference between the center nonmember interaction vector and the center nonmember recommendation vector.
4 . The non-transitory computer-readable medium of claim 3 , wherein a second autonomous user of the plurality of autonomous users is classified as a member, and wherein the operations further include:
generating, for the second autonomous user, (i) a list of member items including one or more items with which the second autonomous user interacted, (ii) a plurality of member interaction vectors, wherein each member interaction vector of the plurality of member interaction vectors includes attributes associated with a corresponding item included within the list of member items, (iii) a list of member recommendations including one or more recommendations received by the second autonomous user from the item providing platform, (iv) a plurality of member recommendation vectors, wherein each member recommendation vector of the plurality of member recommendation vectors includes attributes associated with a corresponding recommendation included within the list of member recommendations, (v) a center member interaction vector generated based at least in part on the plurality of member interaction vectors, (vi) a center member recommendation vector generated based at least in part on the plurality of member recommendation vectors, and (vii) a member difference vector generated based at least in part on a difference between the center member interaction vector and the center member recommendation vector.
5 . The non-transitory computer-readable medium of claim 4 , wherein the training data comprises (i) the nonmember difference vector, along with a label of nonmember associated with the nonmember difference vector, and (ii) the member difference vector, along with a label of member associated with the member difference vector.
6 . The non-transitory computer-readable medium of claim 1 , wherein the attack classifier comprises a binary classifier.
7 . The non-transitory computer-readable medium of claim 1 , wherein the operations further include:
accessing (i) a plurality of interactions between a plurality of users and the item providing platform, and (ii) a plurality of recommendations received by the plurality of users from the item providing platform;
clustering the plurality of interactions and the plurality of recommendation into a plurality of clusters;
training each of a plurality of classifiers using data from a corresponding cluster of the plurality of clusters; and
operating each autonomous user of the plurality of autonomous users in conjunction with a corresponding classifier of the plurality of classifiers.
8 . The non-transitory computer-readable medium of claim 7 , wherein operating each autonomous user comprises:
operating the first autonomous user of the plurality of autonomous users in conjunction with a first classifier of the plurality of classifiers, such that when the first autonomous user is to interact with an item, the first classifier dictates an action to be undertaken by the first autonomous user while interacting with the item.
9 . The non-transitory computer-readable medium of claim 1 , wherein each of the plurality of autonomous users comprises a plurality of sock puppets.
10 . The non-transitory computer-readable medium of claim 1 , wherein the item providing platform is one of a video providing platform, an audio providing platform, or a shopping platform.
11 . A computer implemented method comprising:
monitoring a plurality of target interactions of a target user with an item providing platform;
receiving a plurality of target recommendations for the target user from a recommendation system of the item providing platform; and
inferring, using an attack classifier and based on (i) the plurality of target interactions and (ii) the plurality of target recommendations, whether at least a subset of the plurality of target interactions and/or at least a subset of the plurality of target recommendations were used to train the recommendation system;
interacting, by each of a plurality of autonomous users, with the item providing platform;
receiving, by each of the plurality of autonomous users, a corresponding plurality of recommendations from the item providing platform, based on interaction of the corresponding autonomous user with the item providing platform;
generating, for a first autonomous user of the plurality of autonomous users, (i) a center interaction vector, based at least in part on one or more items with which the first autonomous user interacted with the item providing platform, (ii) a center recommendation vector, based at least in part on one or more recommendations received by the first autonomous user from the item providing platform, and (iii) a difference vector, based at least in part on the center interaction vector and the center recommendation vector;
generating training data, based at least in part on the difference vector; and
training the attack classifier using the training data.
12 . The method of claim 11 , wherein the attack classifier comprises a binary classifier.
13 . The method of claim 11 , further comprising:
accessing (i) a plurality of interactions between a plurality of users and the item providing platform, and (ii) a plurality of recommendations received by the plurality of users from the item providing platform;
clustering the plurality of interactions and the plurality of recommendation into a plurality of clusters;
training each of a plurality of classifiers using data from a corresponding cluster of the plurality of clusters; and
operating each autonomous user of the plurality of autonomous users in conjunction with a corresponding classifier of the plurality of classifiers.
14 . The method of claim 13 , wherein operating each autonomous user comprises:
operating the first autonomous user of the plurality of autonomous users in conjunction with a first classifier of the plurality of classifiers, such that when the first autonomous user is to interact with an item, the first classifier dictates an action to be undertaken by the first autonomous user while interacting with the item.
15 . The method of claim 11 , wherein the item providing platform is one of a video providing platform, an audio providing platform, or a shopping platform.
16 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of actions including:
monitoring a plurality of target interactions of a target user with an item providing platform;
receiving a plurality of target recommendations for the target user from a recommendation system of the item providing platform; and
inferring, using an attack classifier and based on (i) the plurality of target interactions and (ii) the plurality of target recommendations, whether at least a subset of the plurality of target interactions and/or at least a subset of the plurality of target recommendations were used to train the recommendation system;
interacting, by each of a plurality of autonomous users, with the item providing platform;
receiving, by each of the plurality of autonomous users, a corresponding plurality of recommendations from the item providing platform, based on interaction of the corresponding autonomous user with the item providing platform;
generating, for a first autonomous user of the plurality of autonomous users, (i) a center interaction vector, based at least in part on one or more items with which the first autonomous user interacted with the item providing platform, (ii) a center recommendation vector, based at least in part on one or more recommendations received by the first autonomous user from the item providing platform, and (iii) a difference vector, based at least in part on the center interaction vector and the center recommendation vector;
generating training data, based at least in part on the difference vector; and
training the attack classifier using the training data.
17 . The system of claim 16 , wherein the item providing platform is one of a video providing platform, an audio providing platform, or a shopping platform.
18 . The system of claim 16 , wherein each of the plurality of autonomous users comprises a plurality of sock puppets.
19 . The system of claim 16 , wherein the attack classifier comprises a binary classifier.
20 . The system of claim 19 , wherein the set of actions further include:
classifying each of the plurality of autonomous users as either a member or a nonmember,
wherein an autonomous user of the plurality of autonomous users is classified as a nonmember in response to the autonomous user having less than a threshold number of interactions or less than a threshold time period of interactions with the item providing platform, and
wherein another autonomous user of the plurality of autonomous users is classified as a member in response to the other autonomous user having at least the threshold number of interactions or at least the threshold time period of interactions with the item providing platform.