  Federated learning has emerged as a promising privacy-preserving solution for
machine learning domains that rely on user interactions, particularly
recommender systems and online learning to rank. While there has been
substantial research on the privacy of traditional federated learning, little
attention has been paid to the privacy properties of these interaction-based
settings. In this work, we show that users face an elevated risk of having
their private interactions reconstructed by the central server when the server
can control the training features of the items that users interact with. We
introduce RAIFLE, a novel optimization-based attack framework where the server
actively manipulates the features of the items presented to users to increase
the success rate of reconstruction. Our experiments with federated
recommendation and online learning-to-rank scenarios demonstrate that RAIFLE is
significantly more powerful than existing reconstruction attacks like gradient
inversion, achieving high performance consistently in most settings. We discuss
the pros and cons of several possible countermeasures to defend against RAIFLE
in the context of interaction-based federated learning. Our code is
open-sourced at https://github.com/dzungvpham/raifle.
