  Learned recommender systems may inadvertently leak information about their
training data, leading to privacy violations. We investigate privacy threats
faced by recommender systems through the lens of membership inference. In such
attacks, an adversary aims to infer whether a user's data is used to train the
target recommender. To achieve this, previous work has used a shadow
recommender to derive training data for the attack model, and then predicts the
membership by calculating difference vectors between users' historical
interactions and recommended items. State-of-the-art methods face two
challenging problems: (1) training data for the attack model is biased due to
the gap between shadow and target recommenders, and (2) hidden states in
recommenders are not observational, resulting in inaccurate estimations of
difference vectors. To address the above limitations, we propose a Debiasing
Learning for Membership Inference Attacks against recommender systems (DL-MIA)
framework that has four main components: (1) a difference vector generator, (2)
a disentangled encoder, (3) a weight estimator, and (4) an attack model. To
mitigate the gap between recommenders, a variational auto-encoder (VAE) based
disentangled encoder is devised to identify recommender invariant and specific
features. To reduce the estimation bias, we design a weight estimator,
assigning a truth-level score for each difference vector to indicate estimation
accuracy. We evaluate DL-MIA against both general recommenders and sequential
recommenders on three real-world datasets. Experimental results show that
DL-MIA effectively alleviates training and estimation biases simultaneously,
and achieves state-of-the-art attack performance.
