FADM: protecting user privacy from attribute inference attacks in federated recommendation

In recent years, federated learning (FL) has gained widespread adoption to address increasing privacy concerns in personalized recommendation. However, recent studies have revealed that federated recommender systems (FedRecs) remain vulnerable to the attribute inference attack (AIA). Specifically, the local model parameters uploaded by clients encode significant information about their sensitive attributes, inadvertently creating an avenue for AIA adversaries. To better understand the threat severity and characteristics of AIA in FedRecs, we conduct systematic attack experiments on several representative recommenders. The results underscore the substantial vulnerability of FedRecs to AIA, and reveal the heterogeneous and dynamic nature of the information leakage level from model updates. Consequently, existing local differential privacy (LDP)-based defense methods relying on uniform or static noise allocation fail to achieve a well balance between utility and privacy. To address this challenge, we propose the flexible adaptive defense mechanism (FADM). FADM incorporates a dynamic, attack-aware noise control strategy tailored to the varying degrees of leakage throughout training, integrated with component-wise noise scaling against leakage heterogeneity across model components. In FADM, users adaptively tune privacy budgets based on real-time simulated attack evaluations, consistently ensuring sufficient yet non-excessive noise addition. Extensive experiments on benchmark datasets demonstrate that FADM provides robust resistance to AIAs while preserving high recommendation quality, achieving a superior trade-off compared to all defense baselines. For instance, the gender inference F1 score drops from 0.894 to 0.537 with only a 0.055 decrease in the Hit Ratio (HR@10), for the FedNCF model on the ML-1M dataset. Compared to the state-of-the-art (SOTA) defense adaptive privacy preserving mechanism, FADM achieves a 12% relative improvement in HR@10 and a 14% reduction in the F1 score. Furthermore, FADM remains robust against adversaries with substantial prior knowledge.