Differentially Private Recommendation Systems

The fundamental mechanism for training recommendation models under differential privacy. During stochastic gradient descent, per-user gradient vectors are clipped to a fixed L2 norm threshold to bound sensitivity, then Gaussian noise is added before the model update is applied.

• Clipping threshold directly controls the privacy-utility trade-off
• Noise calibrated to the sensitivity of individual user contribution vectors
• Prevents the latent factors from encoding a single user's exact rating pattern
• Typically implemented via DP-SGD applied to the user embedding matrix

Recommendation systems require user-level differential privacy, protecting all ratings and interactions belonging to a single individual. This is stronger than item-level privacy, as a user may contribute hundreds of ratings.

• The presence or absence of a user's entire rating vector must be indistinguishable
• Requires grouping gradients by user before clipping, not by individual rating
• Privacy budget is consumed per user, not per interaction
• Critical for compliance with regulations like GDPR's right to erasure

New users with few ratings present a unique challenge. Privacy amplification by subsampling provides stronger guarantees when users are randomly sampled into training batches, but cold-start users with sparse data may receive weaker effective privacy.

• Sparse user vectors have higher relative sensitivity per rating
• Synthetic data generation can bootstrap new user profiles privately
• Federated settings allow local model personalization before global aggregation
• Trade-off between recommendation quality and privacy for low-activity users

Combining federated learning with differential privacy enables training on decentralized user data. Each client computes local model updates on-device, clips and noises the gradient, then transmits only the privatized update to the aggregation server.

• Local differential privacy model: server never sees raw ratings
• Secure aggregation protocols can further hide individual updates
• Communication efficiency requires compressing noisy gradients
• Protects against gradient leakage attacks that reconstruct training data

Recommendation systems continuously update as new ratings arrive. Composition theorems track cumulative privacy loss across sequential model retraining, requiring careful budget allocation.

• Moments Accountant provides tighter bounds than basic composition
• Rényi DP enables more efficient tracking across many training iterations
• Budget must be allocated between model updates and public statistics release
• Once budget is exhausted, further training on that data must halt or use only public data

Once a differentially private model is trained, post-processing immunity guarantees that any computation on the model's outputs cannot weaken the privacy guarantee. This enables flexible deployment.

• Public recommendation APIs can serve predictions without consuming additional budget
• Model outputs can be cached, ranked, and filtered arbitrarily
• Enables A/B testing of recommendation interfaces on private models
• The trained embeddings themselves carry the privacy guarantee forward indefinitely

The adaptation of memory-based and model-based collaborative filtering to satisfy differential privacy. User-user and item-item similarity computations are made private by adding Laplace or Gaussian noise to the similarity matrices. Matrix factorization techniques, such as Private Stochastic Gradient Descent, clip per-user gradient contributions and inject calibrated noise during the iterative optimization of latent user and item embeddings. This prevents the model from memorizing the specific rating vector of any single user while preserving the ability to capture broad preference patterns.

A critical design constraint in recommendation pipelines where a finite epsilon budget must be distributed across model training, hyperparameter tuning, and periodic retraining cycles. The composition theorem dictates that the total privacy loss accumulates additively. Strategies include allocating a larger budget to the initial training phase for model utility and reserving a smaller budget for online updates, or using zero-concentrated differential privacy (zCDP) for tighter composition analysis. Exhausting the budget requires freezing the model or discarding the data.

Unlike event-level privacy which protects a single click or rating, user-level differential privacy hides the entire contribution of an individual—all their ratings, views, and dwell times—from the trained model. This is achieved by bounding the L2 sensitivity of the aggregated gradient over all of a user's interactions via group privacy properties or by defining the neighboring dataset as one differing by a single user's complete history. This is the de facto standard for preventing the reconstruction of a user's full preference profile.

An alternative to DP-SGD for matrix factorization that iteratively fixes one set of latent factors (user or item) and solves for the other using a regularized least squares objective. To satisfy differential privacy, noise is injected into the sufficient statistics (e.g., the Gram matrix) computed during each alternating update step. This approach often converges faster than DP-SGD on implicit feedback datasets and allows for tighter control over the sensitivity of the analytical solution, making it a popular choice for large-scale private collaborative filtering.

A decentralized architecture where the recommendation model is trained across user devices without centralizing raw interaction data. Each device computes a local model update using on-device behavioral data and transmits a differentially private gradient to a central server for secure aggregation. This combines federated learning with local differential privacy or a distributed DP protocol to protect against a curious aggregator. The central server never sees individual ratings, only noisy, aggregated model updates, ensuring end-to-end privacy.

The fundamental tension between recommendation accuracy (e.g., Precision@k, Recall@k, NDCG) and the strength of the privacy guarantee (epsilon). A low epsilon (e.g., ε < 1) provides strong deniability but often degrades the model's ability to capture niche, long-tail preferences, leading to a popularity bias. Mitigation strategies include leveraging public auxiliary data for pre-training, using privacy amplification by subsampling, and designing custom noise schedules that inject less noise into dense item embeddings while protecting sparse user vectors.