Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm

2025/09/16 by Cuihong, Li, Xiaowen, Huang, Chuanhuan, Yin +1
Computer Science · #Advanced Graph Neural Networks #Artificial Intelligence (cs.AI) #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Information Retrieval (cs.IR) #Recommender Systems and Techniques

paper · doi:10.48550/arxiv.2511.14763

openalex publication_date 2025/09/16 · openalex created_date 2025/11/23 · openalex updated_date 2026/07/28

Abstract

Membership Inference Attack (MIA) aims to determine whether a specific data sample was included in the training dataset of a target model. Traditional MIA approaches rely on shadow models to mimic target model behavior, but their effectiveness diminishes for Large Language Model (LLM)-based recommendation systems due to the scale and complexity of training data. This paper introduces a novel knowledge distillation-based MIA paradigm tailored for LLM-based recommendation systems. Our method constructs a reference model via distillation, applying distinct strategies for member and non-member data to enhance discriminative capabilities. The paradigm extracts fused features (e.g., confidence, entropy, loss, and hidden layer vectors) from the reference model to train an attack model, overcoming limitations of individual features. Extensive experiments on extended datasets (Last.FM, MovieLens, Book-Crossing, Delicious) and diverse LLMs (T5, GPT-2, LLaMA3) demonstrate that our approach significantly outperforms shadow model-based MIAs and individual-feature baselines. The results show its practicality for privacy attacks in LLM-driven recommender systems.

Citations

• Membership Inference Attacks on Large-Scale Models: A Survey
• LLM Dataset Inference: Did you train on my dataset?
• Text-like Encoding of Collaborative Information in Large Language Models for Recommendation
• CoLLM: Integrating Collaborative Embeddings into Large Language Models for Recommendation
• CoLLM: Integrating Collaborative Embeddings Into Large Language Models for Recommendation
• Membership Inference Attacks against Language Models via Neighbourhood Comparison
• Dynamic Knowledge Distillation for Pre-trained Language Models
• Membership Inference Attack Susceptibility of Clinical Language Models
• Extracting Training Data from Large Language Models
• Online Knowledge Distillation with Diverse Peers
• Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer
• Membership Inference Attacks against Machine Learning Models
• Distilling the Knowledge in a Neural Network
• FitNets: Hints for Thin Deep Nets
• BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

Related

• Membership Inference Attacks on LLM-based Recommender Systems
• Membership Inference Attacks on Recommender System: A Survey
• Membership Inference Attacks on Large-Scale Models: A Survey
• Membership Inference Attacks Against Recommender Systems
• Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models