1. Author(s): Rahul Sami, 2009
License: Unless otherwise noted, this material is made available under the terms of the Creative Commons Attribution Noncommercial Share Alike 3.0 License:
We have reviewed this material in accordance with U.S. Copyright Law and have tried to maximize your ability to use, share, and adapt it. The citation key on the following slide provides information about how you may share and adapt this material.
Copyright holders of content included in this material should contact with any questions, corrections, or clarification regarding the use of content.
For more information about how to cite these materials visit 1 1 1 1

2. Citation Key for more information see: http://open. umich
Use + Share + Adapt
Make Your Own Assessment
Creative Commons – Attribution License
Creative Commons – Attribution Share Alike License
Creative Commons – Attribution Noncommercial License
Creative Commons – Attribution Noncommercial Share Alike License
GNU – Free Documentation License
Creative Commons – Zero Waiver
Public Domain – Ineligible: Works that are ineligible for copyright protection in the U.S. (USC 17 § 102(b)) *laws in your jurisdiction may differ
Public Domain – Expired: Works that are no longer protected due to an expired copyright term.
Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105)
Public Domain – Self Dedicated: Works that a copyright holder has dedicated to the public domain.
Fair Use: Use of works that is determined to be Fair consistent with the U.S. Copyright Act. (USC 17 § 107) *laws in your jurisdiction may differ
Our determination DOES NOT mean that all uses of this 3rd-party content are Fair Uses and we DO NOT guarantee that your use of the content is Fair.
To use this content you should do your own independent analysis to determine whether or not your use will be Fair.
{ Content the copyright holder, author, or law permits you to use, share and adapt. }
{ Content Open.Michigan believes can be used, shared, and adapted because it is ineligible for copyright. }
{ Content Open.Michigan has used under a Fair Use determination. } 2 2 2 2 2

3. Lecture 13: Manipulation; Privacy
SI583: Recommender Systems 3

4. The Influence Limiter: Key Ideas4
The Influence Limiter: Key Ideas
[Resnick and Sami, Proceedings of RecSys ‘07 conference]
Limit influence until rater demonstrates informativeness
Informative only if you’re the first to provide the information
This is main point of departure of our work from prior work. The high level idea we want to use is to limit the influence a rater has on recommendations until she has demonstrated informativeness, The main point of departure from prior work is that we explicitly use a dynamic measure of informativenss. You are considered informative only if you are the first to provide a piece of information. In particular, copying the ratings of another rater doesn’t earn you influence. 4

5. Results we cannot achieve5
Results we cannot achieve
Prevent any person J from manipulating the prediction on a single item X.
Cannot distinguish deliberate manipulation from different tastes on item X
“Fairness”, ie., two raters with identical information get exactly the same influence, regardless of rating order.
Cannot distinguish second rater with identical information from an informationless clone. 5

6. Predictions on an Item: A Dynamic View6
Predictions on an Item: A Dynamic View 1
predicted probability of HIGH
In words: Mention that we use not the raw distance, but a loss function to measure this contribution, because it has an information-theoretic basis and good incentive properties
Here’s what the dynamic view of our sysetm
Recommender algorithm
ratings 6

7. Predictions on an Item: A Dynamic View7
Predictions on an Item: A Dynamic View 1
predicted probability of HIGH
In words: Mention that we use not the raw distance, but a loss function to measure this contribution, because it has an information-theoretic basis and good incentive properties
Recommender algorithm
ratings 7

8. Predictions on an Item: A Dynamic View8
Predictions on an Item: A Dynamic View 1
predicted probability of HIGH
In words: Mention that we use not the raw distance, but a loss function to measure this contribution, because it has an information-theoretic basis and good incentive properties
Recommender algorithm
ratings 8

9. Predictions on an Item: A Dynamic View9
Predictions on an Item: A Dynamic View
eventual
label by target: HIGH 1
predicted probability of HIGH
In words: Mention that we use not the raw distance, but a loss function to measure this contribution, because it has an information-theoretic basis and good incentive properties
Recommender algorithm
ratings 9

10. Predictions on an Item: A Dynamic View10
Predictions on an Item: A Dynamic View
eventual
label by target: HIGH
contribution 1
predicted probability of HIGH
In words: Mention that we use not the raw distance, but a loss function to measure this contribution, because it has an information-theoretic basis and good incentive properties.
Mention that if your rating doesn’t *change* the predicted probability, you haven’t made a contribution. So just copying won’t make it look like you’ve made a contribution.
Recommender algorithm
ratings 10

11. Our approach Information-theoretic measure of contribution and damage11
Our approach
Information-theoretic measure of contribution and damage
Limit influence a rater can have had based on past contribution
This limits net damage an attacker can cause
eventual
label
contribution 1
predicted probability
Recommender algorithm
ratings 11

12. Our Model Binary rating system (HIGH/LOW)12
Our Model
Binary rating system (HIGH/LOW)
Recommendations for a single target person
Any recommender algorithm
Powerful attackers:
Can create up to n sybil identities
Can “clone” existing rating profiles
No assumptions on non-attackers:
Attacker’s sybils may form majority
Do not depend on honest raters countering attacks
When say can clone, remind them that the clones won’t have the same influence as the original, because they wouldn’t have moved the prediction the same way. 12

13. 13
Overview of Results
“Influence-limiter” algorithm can be overlaid on any recommender algorithm to satisfy (with caveats):
Limited damage: An attacker with up to n sybils can never cause net total damage greater than O(1) units of prediction error
Bounded information loss: In expectation, O(log n) units of information discarded from each genuine rater in total.
We present an “influence-limiter” algorithm that can be added to any recommender algorithm, and prove three properties:
The first is a worst-case bound: We show that an attacker with upto n sybils (fake identities) cannot do much damage 13

14. Influence Limiter: Architecture14
target
rating
Scoring ~ ~ q0 q1 ~ to
target qn
reputations Rj
Influence Limiter q0 q1 qn
Recommender algo
Here’s our solution. We add two components to the basic recommender system -- the influence limiter and scorer, and use reputations Rj to track j’s contribution. Initially, all reps set to a very small value e^-lam. Now, the influence limiter works as follows. At each point of time, keeps track of the current influence- limited prediction. Now, when j puts in a rating, teh recommender generates some q0. If rep > 1, qjtilde set equal to qj. If not, the influence-limited prediction qjtilde is a weighted average of the previous prediction and the new rediction, weights determined by j’s reputation.
Eventually, target rates, and reputations are updated, This is done in the scoring.. i’ve written it as if it was in the same componen here.
Score is based on loss of predictions, with a twist: Rj scored not on his influence-limited prediction, but as if he had moved it all the way to q_j.
But the score itself is scaled by j’s initial reputation beta_j (if less than 1). Fairly simple algorithm -- a little anticlimactic as it took us a year and many
more complicated alternatives to get to it. (lets call it elegant).
ratings 14

15. Influence Limiter Algorithm: Illustration15
Influence Limiter Algorithm: Illustration 1
limited prediction ~
qj-1
Influence Limiter 1
raw predictions
qj-1
Recommender algorithm
ratings 15

16. Influence Limiter Algorithm: Illustration16
Influence Limiter Algorithm: Illustration
A rater with R=0.25 puts in a rating 1 ~
limited prediction
qj-1
Influence Limiter 1
raw predictions
qj-1 qj
Recommender algorithm
ratings 16

17. Influence Limiter Algorithm: Illustration17
Influence Limiter Algorithm: Illustration
A rater with R=0.25 puts in a rating 1 ~ ~
limited prediction
qj-1 qj
Influence Limiter 1
raw predictions
qj-1 qj
Recommender algorithm
ratings 17

18. Manipulation: summary18
Manipulation: summary
Increasingly important problem
Range of techniques to defend:
Detecting and filtering attack profiles
Influence Limiter
Incentive schemes
Strong identity verificiation
Combinations of these methods

19. Privacy in Recommender Systems19
Privacy in Recommender Systems
Privacy: your right to control dissemination of personally identifiable information
Privacy hazards:
Monitoring behavior without user’s consent
Persistent storage of information in cookies
Data leaks
Data leaks from anonymized datasets

20. Privacy-preserving CF [Canny]20
Privacy-preserving CF [Canny]
High-level idea: distributed computing of recommendations
User-specific information not available outside the user’s computer
uses neat cryptographic protocols (“zero-knowledge” protocols) to compute an SVD

21. Review: Topics we have covered21
Review: Topics we have covered
Eliciting ratings
Using implicit ratings
Collaborative Filtering methods
Implementation/Architectures
Evaluation of Recommenders
Explanations; task-based evaluation
Manipulation
Privacy