Pith. sign in

REVIEW 4 major objections 7 minor 1 cited by

Preserving Privacy and Utility in LLM-Based Product Recommendations

T0 review · 4 major / 7 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper tries to establish that a hybrid split-processing scheme lets cloud-based LLM recommenders produce near-baseline recommendations while sensitive purchases never leave the user's device.

desk verdict A clean system paper with a real engineering contribution, but the privacy claim is unanchored until the sensitivity labels get external validation. read the letter →

arxiv 2505.00951 v1 pith:NBUCXTIU submitted 2025-05-02 cs.IR cs.CRcs.LG

Tina Khezresmaeilzadeh , Jiang Zhang , Dimitrios Andreadis , Konstantinos Psounis This is my paper · ORCID
classification cs.IRcs.CRcs.LG
keywords LLM-basedrecommendationprivacypreservationobfuscationdeobfuscationBERTclassifierlocalinferencehitratecategorydistribution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a hybrid privacy-preserving framework for LLM-based product recommendation. A fine-tuned BERT classifier separates a user's purchase history into sensitive and nonsensitive products, only the nonsensitive part is sent to a large server-side LLM, and a small local Llama model generates the sensitive recommendations on-device. Experiments on real e-commerce data report that this merged list recovers most of the utility lost by filtering: Categorical HR@10 drops only from 0.6263 (full-data baseline) to 0.6061, while Semantic HR@10 rises slightly from 0.3045 to 0.3117. The remaining privacy leakage of 22.28% is attributed to BERT misclassifications. If the results hold, users of cloud recommenders could obtain near-baseline personalization while keeping health-related purchase history off the server.

What carries the argument

The load-bearing mechanism is the obfuscator-deobfuscator pair. The obfuscator is a BERT-based binary classifier, fine-tuned with focal loss, class weighting, and a lowered decision threshold of 0.3, that labels each product in a purchase history as sensitive or nonsensitive. Nonsensitive products go to a server-side ChatGPT-4o recommender whose prompt requests category proportions matching the nonsensitive history, while sensitive products go to a locally running Llama 3.2 1B deobfuscator. The two recommendation lists are merged in proportion to the sizes of the two subsets. The evaluation apparatus includes ChromaDB vector retrieval to map generated text to real products, a sentence-transformer embedding model for semantic similarity, and binary and semantic privacy-leakage metrics.

What would settle it

Re-annotate a sample of the products with human raters from diverse backgrounds, then rerun the BERT classifier and the PL_b and PL_s computations against those human labels; if the measured leakage rises well above 22.28% or the classifier's F1 score drops materially, the reported privacy guarantee does not transfer to real users.

Watch

Extended reading notes

Core claim

The central claim is that obfuscating sensitive products before a cloud call costs little recommendation utility when a local deobfuscator restores the sensitive side of the recommendation list. For the best configuration, BERT Obfuscation plus local Deobfuscation (R''), the paper reports Categorical HR@10 of 0.6061 and Semantic HR@10 of 0.3117, closely approaching the no-privacy baseline of 0.6263 and 0.3045, while binary privacy leakage stays at 22.2833% because the BERT classifier fails to flag some sensitive items. The paper also reports that deobfuscation reduces category-distribution distances to the baseline and that the whole pipeline can run on a consumer-grade laptop with roughly 3.8 seconds of added latency.

Load-bearing premise

The privacy account rests on ChatGPT-4o-generated sensitivity labels being a trustworthy ground truth; if users' actual privacy judgments diverge from that model's, both the classifier's error rate and the measured leakage could be very different.

Editorial extensions

If this is right

  • Cloud LLM recommender services could offer a privacy mode that requires no server-side changes and delivers near-baseline recommendation quality.
  • The utility gap between the privacy-preserving system and the full-data baseline is tied to classifier accuracy, so better sensitivity classification would simultaneously reduce leakage and further close that gap.
  • The local deobfuscator restores sensitive-category diversity that obfuscation-only schemes lose, as measured by the reported L1 and L2 category-distribution distances.
  • The measured hardware overhead suggests the approach is deployable on consumer devices: the paper reports about 3.8 seconds of added end-to-end latency on a laptop with an 8-bit quantized local model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The privacy guarantee is only as strong as ChatGPT-4o's notion of sensitivity, because the same model family generates both the classifier's training labels and the leakage scores; an independent human-annotated benchmark could shift the reported 22.28% leakage substantially.
  • The paper's sensitivity definition is health-centric; extending the classifier to income, relationship status, or other private attributes is described as straightforward but untested, and cumulative purchase-history inference remains a leakage channel the paper itself acknowledges.
  • A testable extension: replacing the local Llama 3.2 1B deobfuscator with a stronger local ranker should push Semantic HR@10 further above the full-data baseline, since the paper already reports that the semantic metric slightly exceeds the baseline in its best configuration.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper proposes a hybrid privacy-preserving framework for LLM-based product recommendation. A fine-tuned BERT classifier (trained with focal loss on ChatGPT-4o-labeled products) serves as an obfuscator that removes sensitive products from a user's purchase history; the remaining nonsensitive products are sent to a cloud ChatGPT-4o recommender, while a local Llama 3.2 1B model generates recommendations for the withheld sensitive products; the two lists are merged. Using the Amazon Reviews 2023 dataset, the authors evaluate HR@10 (categorical and semantic), category-distribution L1/L2 distances relative to a full-history baseline, and two privacy-leakage metrics. The central empirical claim is that BERT Obf + Deobf (R'') nearly matches baseline utility (Categorical HR@10 0.6061 vs 0.6263; Semantic HR@10 0.3117 vs 0.3045) while incurring 22.28% binary privacy leakage, and that the approach runs on consumer hardware.

Significance. If the central numbers are accepted, the paper demonstrates a practical design point for LLM recommendation with on-device filtering: rather than encrypting or perturbing all prompts, the system withholds only sensitive products and uses a small local model to recover the lost sensitive recommendation channel. The hardware measurements (Table 7, Section 7.2) and the explicit prompt appendices are useful engineering contributions, as is the frank Limitations section. However, the privacy guarantee is currently not externally anchored: the labels and sensitivity scores used to measure leakage are generated by ChatGPT-4o, the same model family used as the cloud recommender. Because the central privacy claim depends on this unvalidated ground truth, and because the utility numbers are single-run stochastic outputs with small differences, the paper's headline conclusion is not yet established to the standard of a journal publication.

major comments (4)
  1. [Section 3.2.2, Section 5.3, Table 4] The privacy metrics PL_b and PL_s are computed against ground-truth sensitivity labels (Section 5.3) and sensitivity scores (Section 3.2.2) that are both generated by ChatGPT-4o via few-shot prompts (Appendices A.3 and A.4); since the cloud recommender is also ChatGPT-4o (Section 4.2.1), the 22.2833% binary leakage in Table 4 measures the BERT classifier's disagreement with ChatGPT-4o's sensitivity judgments rather than leakage relative to an independent standard. Please validate the labels and scores against human annotation or an established medical/privacy taxonomy on at least a held-out sample, and report inter-annotator agreement; without this, the privacy-utility trade-off claim is ungrounded.
  2. [Section 4.1.3 vs Section 5.3] The inference rule in Section 4.1.3 states that products with sensitivity scores > 0.5 are classified as sensitive and scores <= 0.5 as nonsensitive, but Section 5.3 states that the decision threshold for the sensitive class was lowered to 0.3 to increase recall; the paper does not say which threshold produced the Table 4 results. This ambiguity affects both the reported 22.28% leakage and the HR@10 numbers, so reproducibility requires stating the operational threshold and reporting sensitivity of the main results to threshold choice.
  3. [Section 5.2 and Table 4] Table 4 includes an 'Only Local' configuration with Categorical HR@10 0.4667 and Semantic HR@10 0.2398, but Section 5.2 defines only Baseline, Only Obfuscator, and Obfuscator + Deobfuscator; the 'Only Local' input, prompt, and merge procedure are never specified. Please define this baseline precisely or remove it, since the text uses it to argue that server-side nonsensitive data contributes to utility.
  4. [Section 6.1, Table 4] The utility results in Table 4 appear to be single runs of stochastic LLMs with no repetition, seeds, or error bars; the headline utility differences are small (Categorical HR@10 0.6061 vs 0.5960 for BERT Obf Only, and Semantic HR@10 0.3117 vs 0.3045 for the no-privacy Baseline), so without confidence intervals or significance tests the claim that BERT Obf + Deobf 'closely approaches' the baseline is not statistically grounded. Please report multiple runs (at least five) with mean and variance, or bootstrap confidence intervals, for both HR@10 and the distance metrics.
minor comments (7)
  1. [Abstract] The phrase 'to a large extend' should be 'to a large extent'.
  2. [Table 4] The row labeled 'Categorical Obf Only (R)' uses R instead of R-prime; the notation in Section 5.2 reserves R-prime for obfuscation-only setups.
  3. [Section 6.4] The recovery percentage is computed as 41.52% in footnote 1 but reported as 41.42% in Table 6 for the same numbers; please reconcile the arithmetic.
  4. [Section 6] The text before Section 6.2 contains a garbled passage ('Analysis of Average Category Distribution Distances ies...') that appears to be an editing artifact; please fix the sentence.
  5. [Section 3.2.1] The word 'noticable' appears in Section 3.2.1 and Section 6.3; it should be 'noticeable'.
  6. [Section 7.2] Inference times are reported as bare numbers (0.1808, 6.3816, 2.7428, 3.8196) without units; please state that these are seconds and clarify whether the deobfuscation time refers to the 8-bit quantized model described in that section.
  7. [References] Reference [3] contains a typo ('ccessed' instead of 'Accessed').

Circularity Check

1 steps flagged · score 5.0 of 10

Privacy leakage is measured against the same ChatGPT-4o labels used to train the obfuscator, so the reported 22.28% leakage is a self-consistency score rather than an externally grounded privacy guarantee.

  1. fitted input called prediction [Section 5.3 (Labeling); Section 3.2.2 (Privacy metrics); Table 4 (PL_b=22.28%, PL_s=10.99%)]
    ""ChatGPT-4o was used to assign these labels based on the classification criteria." (Sec. 5.3) ... "To measure sensitivity scores, we use few-shot prompting with ChatGPT-4-o [43] to assign a sensitivity score between 0 and 1 to each product based on its perceived sensitivity." (Sec. 3.2.2) ... "We employed ChatGPT-4-o [43] via its API for its state-of-the-art performance" (Sec. 4.2.1)."

    The BERT obfuscator is fitted to ChatGPT-4o sensitivity labels, and the privacy-leakage metrics PL_b and PL_s are computed against "ground-truth" labels and sensitivity scores that ChatGPT-4o also produces (Section 3.2.2, Appendices A.3/A.4). The server-side recommender is the same model family, ChatGPT-4o. Consequently, the reported 22.28% binary leakage is the rate at which the BERT classifier, trained to imitate ChatGPT-4o's sensitivity judgments, fails to filter products that ChatGPT-4o itself labels sensitive. This is a held-out agreement rate between the obfuscator and its own labeler, not an externally validated privacy guarantee.

full rationale

The utility half of the evaluation is independent: HR@10 and semantic HR@10 are computed against actual held-out products from the Amazon Reviews 2023 dataset, using embeddings from a Sentence Transformer, so the claim that BERT Obf + Deobf (R'') nearly matches baseline utility (Categorical HR@10 0.6061 vs 0.6263; Semantic 0.3117 vs 0.3045) is not circular. No load-bearing self-citation was found: prior work by the same authors (Harpo/De-Harpo, voice-assistant profiling) is cited only as related work. The circularity is confined to the privacy guarantee. The BERT obfuscator is trained on ChatGPT-4o sensitivity labels, and both PL_b and PL_s are evaluated against ChatGPT-4o-generated "ground-truth" labels and sensitivity scores; the server is also ChatGPT-4o. The reported 22.28% binary leakage is therefore the rate at which the fitted BERT model disagrees with its own labeler, not a privacy guarantee anchored to an external standard. The paper's Limitations section concedes sensitivity is subjective, but no independent human validation is provided. Because the central utility claim stands on independent ground truth, the overall circularity is partial, not total.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical or mathematical entities, but it relies on several modeling choices: a hand-set classification threshold, a synthetic sensitivity ground truth from ChatGPT-4o, and a proportional allocation rule that shapes the category distribution results. The number of hand-tuned experimental parameters is modest, but the sensitivity labels are self-referential, which limits the independence of the privacy evaluation.

free parameters (4)
  • Sensitivity classification threshold = 0.3 (training) vs 0.5 (inference description)
    The threshold for classifying products as sensitive is lowered to 0.3 during training to increase recall (Section 5.3), but Section 4.1.3 states scores > 0.5 are classified sensitive; the inconsistency matters because it changes the measured privacy leakage.
  • Focal loss gamma = 2
    Focusing parameter in Eq. 9 set to 2, a standard choice for imbalanced classification (Section 5.3).
  • Number of recommendations = 10
    n = 10 used for HR@10 and for allocation formulas in Eqs. 6-7; a conventional evaluation choice (Section 4.2.2).
  • Purchase history length and engagement filter = last 20 purchases, >=30 total
    Section 5.1 restricts users to >=30 purchases and takes the last 20; this affects the balance of sensitive/nonsensitive items and the difficulty of the recommendation task.
assumptions (5)
  • domain assumption The server is semi-honest and cannot access external data or cross-site tracking; it only sees the prompt.
    Section 2.3 defines the threat model; if the server can enrich prompts with external data, the privacy guarantee weakens.
  • domain assumption The user's device is trusted and free of malware.
    Section 2.3 assumes the local obfuscator/deobfuscator runs on an uncompromised device.
  • ad hoc to paper ChatGPT-4o few-shot labeling provides a correct ground truth for product sensitivity.
    Section 5.3 uses ChatGPT-4o to label training data for BERT and Section 3.2.2 uses it to assign sensitivity scores for the leakage metric; no human-verified ground truth is provided.
  • domain assumption LLM-generated text recommendations can be mapped to real products through ChromaDB semantic retrieval for evaluation.
    Section 3.1 states recommendations are compared to an indexed product database via vector similarity; errors in this mapping would bias HR@10 and distance metrics.
  • domain assumption Enforcing proportional category representation via the prompt preserves meaningful diversity.
    Appendix A.1 instructs the model to match category proportions from the purchase history, and Eqs. 6-7 set list sizes proportional to the sensitive/nonsensitive split; this makes category alignment partly a design property rather than a learned recommendation skill.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Preserving Privacy and Utility in LLM-Based Product Recommendations." pith.science (2026). https://pith.science/paper/NBUCXTIU

@misc{pith2026250500951,
  author       = {Pith},
  title        = {Pith review of: Preserving Privacy and Utility in LLM-Based Product Recommendations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NBUCXTIU}},
  note         = {Machine review of arXiv:2505.00951}
}
read the original abstract

Large Language Model (LLM)-based recommendation systems leverage powerful language models to generate personalized suggestions by processing user interactions and preferences. Unlike traditional recommendation systems that rely on structured data and collaborative filtering, LLM-based models process textual and contextual information, often using cloud-based infrastructure. This raises privacy concerns, as user data is transmitted to remote servers, increasing the risk of exposure and reducing control over personal information. To address this, we propose a hybrid privacy-preserving recommendation framework which separates sensitive from nonsensitive data and only shares the latter with the cloud to harness LLM-powered recommendations. To restore lost recommendations related to obfuscated sensitive data, we design a de-obfuscation module that reconstructs sensitive recommendations locally. Experiments on real-world e-commerce datasets show that our framework achieves almost the same recommendation utility with a system which shares all data with an LLM, while preserving privacy to a large extend. Compared to obfuscation-only techniques, our approach improves HR@10 scores and category distribution alignment, offering a better balance between privacy and recommendation quality. Furthermore, our method runs efficiently on consumer-grade hardware, making privacy-aware LLM-based recommendation systems practical for real-world use.

Figures

Figures reproduced from arXiv: 2505.00951 by the authors.

Figure 1
Figure 1. High-level overview of the system. The rest of the paper is structured as follows: Section 2 defines concepts, goals, and assumptions. Section 3 presents our method￾ology, including the proposed approach and performance metrics. Section 4 details the system design, covering the obfuscator, server￾based recommendation, deobfuscator, and combined recommenda￾tion list. Section 5 describes the experimental setup, follow… view at source ↗
Figure 2
Figure 2. Overview of different components of privacy-preserving recommendation system. The user query ( [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Multi-Level Modeling of Large Language Model Inference Latency and Energy via Hybrid Analytical--Machine-Learning Predictors

    cs.LG 2026-08 conditional novelty 6.0 of 10

    A hybrid analytical-ML framework predicts LLM inference latency and energy from architectural parameters, with MAPE below 5 percent on selected models and about 10 percent on a broad set.

Reference graph

Works this paper leans on

69 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [1]

    Armin Abdollahi, Mehdi Kamal, and Massoud Pedram. 2025. RocketPPA: Ultra- Fast LLM-Based PPA Estimator at Code-Level Abstraction. arXiv preprint arXiv:2503.21971 (2025)

    arXiv 2025

  2. [2]

    Meta AI. 2024. Llama 3.2 Model Card. https://github.com/meta-llama/llama- models/blob/main/models/llama3_2/MODEL_CARD.md. Accessed: 2025-02-01

    work page 2024

  3. [3]

    Meta AI. 2025. Llama 3.2: Revolutionizing edge AI and vision with open, cus- tomizable models. https://ai.meta.com/blog/llama-3-2-connect-2024-vision- edge-mobile-devices/ ccessed: 2025-02-08

    work page 2025

  4. [4]

    Amazon. 2025. Amazon.com Privacy Notice. https://www.amazon.com/gp/help/ customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ. Accessed: 2025-01-25

    work page 2025

  5. [5]

    Amazon. 2025. Amazon.com. Spend less. Smile more. https://www.amazon.com/ Accessed: 2025-01-25

    work page 2025

  6. [6]

    Anthropic. 2025. Claude: Anthropic’s AI Assistant. https://www.anthropic.com/ claude Accessed: 2025-02-08

    work page 2025

  7. [7]

    Seyedarmin Azizi, Mohammad Erfan Sadeghi, Mehdi Kamal, and Massoud Pe- dram. 2024. Efficient Noise Mitigation for Enhancing Inference Accuracy in DNNs on Mixed-Signal Accelerators. arXiv preprint arXiv:2409.18553 (2024)

    work page Pith review arXiv 2024

  8. [8]

    Ghazaleh Beigi, Ruocheng Guo, Alexander Nou, Yanchao Zhang, and Huan Liu

Show all 69 references
  1. [9]

    Aldo Gael Carranza, Rezsa Farahani, Natalia Ponomareva, Alex Kurakin, Matthew Jagielski, and Milad Nasr. 2023. Synthetic Query Generation for Privacy- Preserving Deep Retrieval Systems using Differentially Private Language Models. arXiv preprint arXiv:2305.05973 (2023)

    2023 arXiv

  2. [10]

    Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. 2022. The-x: Privacy-preserving trans- former inference with homomorphic encryption. arXiv preprint arXiv:2206.00216 (2022)

    2022 arXiv

  3. [11]

    Yu Chen, Tingxin Li, Huiming Liu, and Yang Yu. 2023. Hide and seek (has): A light- weight framework for prompt privacy protection. arXiv preprint arXiv:2309.03057 (2023)

    2023 arXiv

  4. [12]

    Paul Covington, Jay Adams, and Emre Sargin. 2016. Deep Neural Networks for YouTube Recommendations. In Proceedings of the 10th ACM Conference on Recommender Systems (Boston, Massachusetts, USA) (RecSys ’16). Association for Computing Machinery, New York, NY, USA, 191–198. http...

    2016

  5. [13]

    Sunhao Dai, Ninglu Shao, Haiyuan Zhao, Weijie Yu, Zihua Si, Chen Xu, Zhongx- iang Sun, Xiao Zhang, and Jun Xu. 2023. Uncovering chatgpt’s capabilities in recommender systems. In Proceedings of the 17th ACM Conference on Recom- mender Systems. 1126–1132

    2023

  6. [14]

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey. Comput. Surveys (2024)

    2024

  7. [15]

    Google DeepMind. 2025. Gemini: Google’s Multimodal AI Model. https: //deepmind.google/technologies/gemini Accessed: 2025-02-08

    2025

  8. [16]

    Chroma Developers. 2025. Chroma: The AI-native open-source embedding database. https://github.com/chroma-core/chroma. Accessed: 2025-02-23

    2025

  9. [17]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human...

    2019 doi

  10. [18]

    Angela Di Fazio. 2024. Enhancing Privacy in Recommender Systems through Dif- ferential Privacy Techniques. InProceedings of the 18th ACM Conference on Recom- mender Systems (Bari, Italy) (RecSys ’24). Association for Computing Machinery, New York, NY, USA, 1348–1352. https://d...

    2024

  11. [19]

    Dario Di Palma, Giovanni Maria Biancofiore, Vito Walter Anelli, Fedelucio Nar- ducci, Tommaso Di Noia, and Eugenio Di Sciascio. 2023. Evaluating chatgpt as a recommender system: A rigorous approach. arXiv preprint arXiv:2309.03613 (2023)

    2023 arXiv

  12. [20]

    Cynthia Dwork. 2006. Differential Privacy. In International Colloquium on Au- tomata, Languages and Programming . https://api.semanticscholar.org/CorpusID: 2565493

    2006

  13. [21]

    Hugging Face. 2025. meta-llama/Llama-3.2-1B. https://huggingface.co/meta- llama/Llama-3.2-1B Accessed: 2025-01-03

    2025

  14. [22]

    Hugging Face. 2025. sentence-transformers/all-MiniLM-L6-v2. https:// huggingface.co/sentence-transformers/all-MiniLM-L6-v2 Accessed: 2025-01-03

    2025

  15. [23]

    Arya Fayyazi, Mehdi Kamal, and Massoud Pedram. 2025. FACTER: Fairness- Aware Conformal Thresholding and Prompt Engineering for Enabling Fair LLM- Based Recommender Systems. arXiv preprint arXiv:2502.02966 (2025)

    2025 arXiv

  16. [24]

    Yue Feng, Shuchang Liu, Zhenghai Xue, Qingpeng Cai, Lantao Hu, Peng Jiang, Kun Gai, and Fei Sun. 2023. A large language model enhanced conversational recommender system. arXiv preprint arXiv:2308.06212 (2023)

    2023 arXiv

  17. [25]

    Luke Friedman, Sameer Ahuja, David Allen, Zhenning Tan, Hakim Sidahmed, Changbo Long, Jun Xie, Gabriel Schubiner, Ajay Patel, Harsh Lara, et al. 2023. Leveraging large language models in conversational recommender systems.arXiv preprint arXiv:2305.07961 (2023)

    2023 arXiv

  18. [26]

    Yunfan Gao, Tao Sheng, Youlin Xiang, Yun Xiong, Haofen Wang, and Jiawei Zhang. 2023. Chat-rec: Towards interactive and explainable llms-augmented recommender system. arXiv preprint arXiv:2303.14524 (2023)

    2023 arXiv

  19. [27]

    Google Shopping - Shop Online, Compare Prices &amp; Where to Buy. 2025. google-shopping. https://shopping.google.com/ Accessed: 2025-01-25

    2025

  20. [28]

    Xiangnan He, Lizi Liao, Hanwang Zhang, Liqiang Nie, Xia Hu, and Tat-Seng Chua. 2017. Neural collaborative filtering. In Proceedings of the 26th international conference on world wide web . 173–182

    2017

  21. [29]

    Yunlong He, Lingtao Wei, Fei Chen, Hanlin Zhang, Jia Yu, and Haiyang Wang

  22. [30]

    Zhankui He, Zhouhang Xie, Rahul Jha, Harald Steck, Dawen Liang, Yesu Feng, Bodhisattwa Prasad Majumder, Nathan Kallus, and Julian McAuley. 2023. Large language models as zero-shot conversational recommenders. InProceedings of the 32nd ACM international conference on informatio...

    2023

  23. [31]

    Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen jie Lu, Cheng Hong, and Kui Ren. 2023. CipherGPT: Secure Two-Party GPT Inference. Cryptology ePrint Archive, Paper 2023/1147. https://eprint.iacr.org/2023/1147

    2023

  24. [32]

    Yupeng Hou, Jiacheng Li, Zhankui He, An Yan, Xiusi Chen, and Julian McAuley

  25. [33]

    Howe and Helen Nissenbaum

    Daniel C. Howe and Helen Nissenbaum. 2017. Engineering Privacy and Protest: A Case Study of AdNauseam. In IWPE@SP. https://api.semanticscholar.org/ CorpusID:26168377

    2017

  26. [34]

    Zhigang Kan, Linbo Qiao, Hao Yu, Liwen Peng, Yifu Gao, and Dongsheng Li. 2023. Protecting user privacy in remote conversational systems: A privacy-preserving framework based on text sanitization. arXiv preprint arXiv:2306.08223 (2023)

    2023 arXiv

  27. [35]

    Omnia Kelany, Sherin Aly, and Mohamed A. Ismail. 2020. Deep Learning Model for Financial Time Series Prediction. In 2020 14th International Conference on Innovations in Information Technology (IIT) . 120–125. https://doi.org/10.1109/ IIT50501.2020.9299063

    2020

  28. [36]

    Tina Khezresmaeilzadeh, Elaine Zhu, Kiersten Grieco, Daniel J Dubois, Kon- stantinos Psounis, and David Choffnes. 2024. Echoes of Privacy: Uncovering the Profiling Practices of Voice Assistants. arXiv preprint arXiv:2409.07444 (2024)

    2024 arXiv

  29. [37]

    and Weinan Zhang

    Jianghao Lin, Xinyi Dai, Yunjia Xi, Weiwen Liu, Bo Chen, Hao Zhang, Yong Liu, Chuhan Wu, Xiangyang Li, Chenxu Zhu, Huifeng Guo, Yong Yu, Ruiming Tang, 13 () Khezresmaeilzadeh et al. and Weinan Zhang. 2025. How Can Recommender Systems Benefit from Large Language Models: A Surve...

    2025 doi

  30. [38]

    Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. 2017. Focal loss for dense object detection. In Proceedings of the IEEE international conference on computer vision . 2980–2988

    2017

  31. [39]

    Sichun Luo, Wei Shao, Yuxuan Yao, Jian Xu, Mingyang Liu, Qintong Li, Bowei He, Maolin Wang, Guanzhi Deng, Hanxu Hou, et al . 2024. Privacy in LLM- based Recommendation: Recent Advances and Future Directions. arXiv preprint arXiv:2406.01363 (2024)

    2024 arXiv

  32. [40]

    Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. 2023. Split-and- denoise: Protect large language model inference with local differential privacy. arXiv preprint arXiv:2310.09130 (2023)

    2023 arXiv

  33. [41]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

    2017

  34. [42]

    Peter Müllner, Elisabeth Lex, Markus Schedl, and Dominik Kowald. 2024. The impact of differential privacy on recommendation accuracy and popularity bias. In European Conference on Information Retrieval . Springer, 466–482

    2024

  35. [43]

    OpenAI. 2025. ChatGPT-4o. Large Language Model developed by OpenAI. Available at https://openai.com/

    2025

  36. [44]

    OpenAI. 2025. ChatGPT: OpenAI’s Conversational AI Model. https://openai. com/chatgpt Accessed: 2025-02-08

    2025

  37. [45]

    Parsa Razmara, Tina Khezresmaeilzadeh, and B Keith Jenkins. 2024. Fever detec- tion with infrared thermography: Enhancing accuracy through machine learning techniques. arXiv preprint arXiv:2407.15302 (2024)

    2024 arXiv

  38. [46]

    Amazon Web Services. 2024. Selecting the Right Metadata to Build High- Performing Recommendation Models with Amazon Personalize. https: //aws.amazon.com/blogs/machine-learning/selecting-the-right-metadata-to- build-high-performing-recommendation-models-with-amazon-personalize/...

    2024

  39. [47]

    Erez Shmueli and Tamir Tassa. 2020. Mediated Secure Multi-Party Protocols for Collaborative Filtering. ACM Trans. Intell. Syst. Technol. 11, 2, Article 15 (Feb. 2020), 25 pages. https://doi.org/10.1145/3375402

    2020 doi

  40. [48]

    Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298 (2023)

    2023 arXiv

  41. [49]

    Harald Steck, Chaitanya Ekanadham, and Nathan Kallus. 2024. Is Cosine- Similarity of Embeddings Really About Similarity?. In Companion Proceed- ings of the ACM Web Conference 2024 (Singapore, Singapore) (WWW ’24). As- sociation for Computing Machinery, New York, NY, USA, 887–8...

    2024

  42. [50]

    Chi Sun, Xipeng Qiu, Yige Xu, and Xuanjing Huang. 2019. How to fine-tune bert for text classification?. In Chinese computational linguistics: 18th China na- tional conference, CCL 2019, Kunming, China, October 18–20, 2019, proceedings 18 . Springer, 194–206

    2019

  43. [51]

    Latanya Sweeney. 2002. k-anonymity: A model for protecting privacy. Interna- tional journal of uncertainty, fuzziness and knowledge-based systems 10, 05 (2002), 557–570

    2002

  44. [52]

    Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2023. InferDPT: Privacy-preserving inference for black-box large language model. arXiv preprint arXiv:2310.12214 (2023)

    2023

  45. [53]

    Department of Health & Human Services

    U.S. Department of Health & Human Services. 1996. Health Insurance Portability and Accountability Act (HIPAA). https://www.hhs.gov/hipaa Accessed: February 9, 2025

    1996

  46. [54]

    Shang Wang, Tianqing Zhu, Bo Liu, Ming Ding, Xu Guo, Dayong Ye, Wanlei Zhou, and Philip S Yu. 2024. Unique security and privacy threats of large language model: A comprehensive survey. arXiv preprint arXiv:2406.07973 (2024)

    2024

  47. [55]

    Likang Wu, Zhi Zheng, Zhaopeng Qiu, Hao Wang, Hongchao Gu, Tingjia Shen, Chuan Qin, Chen Zhu, Hengshu Zhu, Qi Liu, et al . 2024. A survey on large language models for recommendation. World Wide Web 27, 5 (2024), 60

    2024

  48. [56]

    Lanling Xu, Junjie Zhang, Bingqian Li, Jinpeng Wang, Sheng Chen, Wayne Xin Zhao, and Ji-Rong Wen. 2025. Tapping the Potential of Large Language Models as Recommender Systems: A Comprehensive Framework and Empirical Analysis. arXiv:2401.04997 [cs.IR] https://arxiv.org/abs/2401.04997

    2025 arXiv

  49. [57]

    Huimin Zeng, Zhenrui Yue, Qian Jiang, and Dong Wang. 2024. Federated recom- mendation via hybrid retrieval augmented generation. In 2024 IEEE International Conference on Big Data (BigData) . IEEE, 8078–8087

    2024

  50. [58]

    Chunxu Zhang, Guodong Long, Hongkuan Guo, Xiao Fang, Yang Song, Zhao- jie Liu, Guorui Zhou, Zijian Zhang, Yang Liu, and Bo Yang. 2024. Feder- ated adaptation for foundation model-based recommendations. arXiv preprint arXiv:2405.04840 (2024)

    2024 arXiv

  51. [59]

    Jiang Zhang, Hadi Askari, Konstantinos Psounis, and Zubair Shafiq. 2022. A Utility-Preserving Obfuscation Approach for YouTube Recommendations. arXiv preprint arXiv:2210.08136 (2022)

    2022 arXiv

  52. [60]

    Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, and Liang Wang

  53. [61]

    Jiang Zhang, Konstantinos Psounis, Muhammad Haroon, and Zubair Shafiq

  54. [62]

    Jujia Zhao, Wenjie Wang, Chen Xu, Zhaochun Ren, See-Kiong Ng, and Tat- Seng Chua. 2024. Llm-based federated recommendation. arXiv preprint arXiv:2402.09959 (2024)

    2024 arXiv

  55. [63]

    Yandong Zheng, Hui Zhu, Rongxing Lu, Songnian Zhang, Fengwei Wang, Jun Shao, and Hui Li. 2025. Efficient and Privacy-Preserving Weighted Range Set Sampling in Cloud. IEEE Transactions on Dependable and Secure Computing 22, 1 (2025), 534–548. https://doi.org/10.1109/TDSC.2024.3408816

    2025

  56. [64]

    arXiv preprint arXiv:2402.14836 (2024)

    Stealthy attack on large language model based recommendation. arXiv preprint arXiv:2402.14836 (2024)

    2024 arXiv

  57. [69]

    nonsensitive

    Erion Çano and Maurizio Morisio. 2017. Hybrid recommender systems: A sys- tematic literature review. Intelligent Data Analysis 21, 6 (Nov. 2017), 1487–1524. https://doi.org/10.3233/ida-163209 A Prompts A.1 Prompt for Server-Based Recommendation System Task: Based on the user’s...

    2017 doi

  58. [2019]

    In Proceedings of the twelfth ACM international conference on web search and data mining

    Protecting user privacy: An approach for untraceable web browsing history and unambiguous user profiles. In Proceedings of the twelfth ACM international conference on web search and data mining . 213–221

  59. [2021]

    arXiv preprint arXiv:2111.05792 (2021)

    Harpo: Learning to subvert online behavioral advertising. arXiv preprint arXiv:2111.05792 (2021)

    2021 arXiv

  60. [2024]

    arXiv preprint arXiv:2403.03952 (2024)

    Bridging language and items for retrieval and recommendation. arXiv preprint arXiv:2403.03952 (2024)

    2024 arXiv

  61. [2025]

    Expert Syst

    Fedai: Federated recommendation system with anonymized interactions. Expert Syst. Appl. 271 (2025), 126564. https://api.semanticscholar.org/CorpusID: 275768413

    2025

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.