Language embeddings can leak item and user identities in recommenders
Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems
Cryptography and SecurityArtificial Intelligence
Summary
Language embeddings are used by recommendation systems to understand items based on their text descriptions. This paper shows that these embeddings can unintentionally reveal the exact identity of items if someone compares them with known text information from other sources. Even when the descriptions are different but related in meaning, the risk remains. Furthermore, this information leak can help identify users based on their item ratings, posing privacy concerns. The authors also find that hiding some details in descriptions reduces leakage but affects recommendation quality.
What this means in practice
- •For recommendation engineers: Detect and mitigate privacy leaks from language embeddings that expose item or user identities in recommender systems.
- •For privacy compliance teams: Assess risks of sharing item content embeddings externally to prevent unintended disclosure of sensitive user or item information.
Authors
Linda Beková, Rodrigo Alves
Abstract
Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple cosine-similarity attack can recover item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets. Leakage is strongest when the adversary's partial information overlaps with the victim representation, but it also persists through semantic alignment between independently sourced descriptions. We further show that item leakage can propagate to user re-identification from sparse ratings. Finally, we evaluate obfuscated descriptions as a mitigation and find a clear leakage-utility tradeoff.