{'fraction_non_alphanumeric': 0.03440930205035652, 'fraction_numerical': 0.008728068877777448, 'mean_word_length': 4.2936570086139385, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Towards a More Reliable Privacy-preserving Recommender System

This paper proposes a privacy-preserving distributed recommendation framework, Secure Distributed Collaborative Filtering (SDCF), to preserve the privacy of value, model and existence altogether. That says, not only the ratings from the users to the items, but also the existence of the ratings as well as the learned recommendation model are kept private in our framework. Our solution relies on a distributed client-server architecture and a two-stage Randomized Response algorithm, along with an implementation on the popular recommendation model, Matrix Factorization (MF). We further prove SDCF to meet the guarantee of Differential Privacy so that clients are allowed to specify arbitrary privacy levels. Experiments conducted on numerical rating prediction and one-class rating action prediction exhibit that SDCF does not sacrifice too much accuracy for privacy.


Introduction
Collaborative filtering (CF) is one of the most popular models for recommending items [1]. Its basic idea is to make recommendation based on the similarity between users or between items. CF-based models are trained on users' feedbacks of items, which can be divided into two categories: numerical and one-class. Numerical feedback consists of numeric value (e.g., ratings between 1 and 5). One-class feedback is a record for a specific action (e.g., purchase or not). As CF-based models are trained from large data, service providers must collect numerous feedbacks. However, if the servers are untrusted or contain vulnerabilities, the collection of user feedbacks can be a privacy liability due to the data leakage. Even if the servers are curious-but-honest, which means the services are functioning normally, feedback data leakage can still cause private attributes and even real identity of users, to be inferred by hackers [2,3].
Data leakage in CF-based recommender can be divided into three categories.
The first is Value Leakage: exposure of values of feedbacks, such as the rating scores. The second is Existence Leakage: exposure of the existence of feedbacks, such as whether a user rates an item. For example, if the attackers know that user u rates a book i, they can be quite certain that u has read i. The third is Model Leakage: exposure of the trained model. Models are important since given the CF model, attackers can estimate the ratings from any user to any item.
In this paper, we propose a client-server framework, Secure Distributed Collaborative Filtering (SDCF), to preserve user privacy in CF-based recommender.
We elaborate the idea of SDCF in Fig. 1

that uses Matrix Factorization (MF)
as an example. First, we separate the model into two disjoint parts: personal elements and public elements. Personal elements are user-specific while public elements are those common to every user, such as the items' information.
We propose to store only public elements on the server, while users keep both their personal ratings and personal elements at client side, to avoid value and model leakage. Apparently not all CF-based models meet this requirement. As will be described later, MF satisfies such condition. The next challenge is how to train a model on such structure since both parts of elements need to be updated frequently while training. We propose that during the training, users download public elements, based on which each user can locally update personal elements, and then send required information to the server to update public elements. Such distributed mechanism naturally prevents both value and model leakages, because users do not send the ratings to the server, and with only public elements, the server cannot perform recommendation solely. To further prevent the existence leakage, we propose a two-stage Randomized Response algorithm in SDCF. A strength of SDCF is the guarantee of Differential Privacy (DP) [3,4], which is a privacy quantification used in various domains. With DP, SDCF allows users to adjust their privacy levels based on their privacy budgets.
Previous studies of privacy-preserving recommender systems use various approaches. For example, one of the earliest work [5] proposes a peer-to-peer network that allows personalized recommendation to be generated by other members without disclosing individual user data. [6] first applied DP to CF and is followed by many works including [7,8,9,10,11,12]. Among these studies, [8,9,12,6] require servers to be trusted in some training stages, and [7,13,11,5,10,14] consider the scenario of completely untrusted servers as our work does. Nevertheless, most of them rely on certain conditions or resources.
For instance, [11] requires the category information of items, [10] relies on a small group of users to be public, and [13,5] need laborious computation for cryptography algorithms. [7] is probably the most similar to our solution. It assumes nothing other than the ratings, and preserves the privacy of value and model by a distributed gradient-transmission architecture. Still, it requires a third-party, i.e., an additional server between clients and the server of the service provider, as its noise sampling method is vulnerable to difference attack defined by [7]. The concern of a third-party is two-fold. First, the third-party may also be compromised, and second the employment of an additional third-party can increase the cost in both building and maintenance. Table 1 summarizes the features of different solutions. To the best of our knowledge, SDCF is the first to preserve value, model, and existence privacies and possess the guarantee of DP. More importantly, all feedback data are kept only at client side, i.e., it will not have any chance to be released or transmitted to the untrusted server or any other malicious client.
We choose MF [15] to realize SDCF, and develop Secure Distributed Matrix Factorization (SDMF), for the following reasons. First, in MF, it is natural to divide the model into personal (user) U and public (item) V parts (matrices).
Second, if we use gradient descent-based optimization to train the MF model, the updating of personal elements for different users can be done independently and locally at each client, meaning that no personal information will be transmitted to other clients or to the server. Third, the updating of the public element can be done by aggregating the gradients contributed from clients, meaning that only gradients of the model are transmitted from clients to the server.
The attackers cannot recover the original ratings nor personal elements even the gradients are intercepted during transmission. In this paper, we adopt MF with Stochastic Gradient Langevin Dynamics (SGLD) [12]. As will be discussed later, SGLD (instead of the popular Stochastic Gradient Descent) enjoys the advantage of preventing user latent vectors (i.e., personal elements) from being deciphered. The experiments show that our model can yield reasonably good recommendation results while guaranteeing decent level of privacy. In Section 5, we will further discuss how to use SDCF in Factorization Machine-based model [16]. Differential privacy provides a mathematical definition to quantify the privacy preserved by an algorithm [3,4]. Here we explain the meaning of DP in recommender systems. If users aim to preserve the value privacy, a privacypreserving algorithm is supposed to lower the server's confidence in identifying the actual value of each rating. Definition 1 (differential privacy). A randomized algorithm A with domain R n is -differentially private, if and only if any two datasets X, X ∈ R n contain at most one different record (i.e., the hamming distance d(X, X ) = 1), and for possible anonymized output O ⊆ Range(A): where the probability P r is taken over the randomness of algorithm A, and is positive. Lower values of indicates higher degree of privacy guaranteed.
With Definition 1, we can measure the difference between the outcomes with and without the presence of an element determined by . However, there is a trade-off between user privacy and the utility of an algorithm. Our model is designed to be a good privacy-preserving algorithm that can maintain the performance while increasing the degree of privacy.

Matrix Factorization (MF)
Let U and V be a user set and an item set, and each r ij indicates an observed score that a user i rated an item j in the rating matrix R ∈ R |U |×|V| . MF aims to make U V T ≈ R, where U ∈ R |U |×K and V ∈ R |V|×K for a given dimension number K. The objective is to find U and V such that the loss function L(U, V ) can be minimized: where λ is a given regularization factor to prevent overfitting. Stochastic Gradient Descent (SGD) is a popular technique to minimize the objective function of MF. It aims to iteratively learn u i and v j according to the following updating where e ij = r ij − u i v j T is the error of the prediction and η is the learning rate. These updating rules allow the gradients of u i and v j to be computed independently, and thus enables the deployment in a distributed environment.
However, applying SGD in a distributed manner may expose u i (i.e., model leakage) during gradients transmission. To remedy this problem, we introduce SGLD below.

Stochastic Gradient Langevin Dynamics (SGLD)
SGLD [17] is an optimization method, which combines SGD and Langevin Dynamics that samples from the posterior distribution to prevent overfitting.
Specifically, based on the Bayesian view of MF, we can convert the objective into a maximization of posterior distribution of U and V given the observed ratings and parameters: where λ r is the global regularization term, Λ u and Λ v are diagonal matrices generated by Gamma distribution for the regularization of u i and v j . Since a hypothesis of normal distribution N can be adopted in Eq. 3, the log-likelihood can be derived from: where C is a constant. To maximize the log-likelihood and also follow normal distribution to add noises into gradients to avoid overfitting, the updating rules of SGLD in the t-th iteration become: where η 0 is the initial learning rate, γ is the decay factor, and I is the identical matrix of size K. As Liu et al. [12] has proved that introducing noises to SGLD can guarantee the differential privacy. As will be shown later on, our model using SGLD can avoid the exposure of model.

Framework Overview
The overview of the SDMF framework is exhibited in Fig. 2  is to divide the model into the private (user) parts and a public (item) part, and transmit only gradients to avoid leakage. Since MF learns two matrices, items' and users' latent factors, by iteratively performing updates, we consider items' latent factors as the public elements in SDCF, thereby being the only information stored in the server, as illustrated in Fig. 1. In addition, users' latent factors are treated as personal elements and thus are stored with their ratings at client side only. With SGD to optimize MF's objective (Eq. 1), we define the gradients (denoted by grad(v j ) for the latent factors of item i as: The updating rule in Eq. 2 can be rewritten as: The gradients are the only things transmitted from clients to the server. Specifically, in each iteration, each client needs to download the newest V from the server, then calculates the gradients for u i and v j . The gradients of u i are directly used to update u i stored at the client side while grad(v j ) is sent to the server, which then updates v j . However, we further look into the formation of grad(v j ) and find that Since v j , η, and λ are public, the server can obtain e ij u j . When u j converges, the server will be able to approximate each u j given several e ij u j for different items within a few iterations, because u j is the greatest common divisor (GCD) of the values of e ij u j .
To avoid the exposure of u i , we propose to use SGLD instead of SGD to protect the gradients by adding Gaussian noises. The gradients of items can be re-written as: Aside from DP proved by [12], the noises introduced make it hard to recover u i from grad(v j ) by GCD. In addition, since the noises in each iteration are sampled with different values, we are immune to the difference attack mentioned in [7]. Even if the gradients are exposed, the privacy of model and value can still be preserved.

Randomized Response (RR) Algorithm
The existence is still exposed due to the action that user i sends grad(v j ) of item j to the server in SGLD. Thus, instead of sending gradients of all rated items, our idea is to send the gradients of some unrated items to the server so that exact items that are rated are unknown. We implement such idea with the technique of randomized response. A straightforward solution consists of two steps. First, we create a binary matrix to represent the existence of ratings, as illustrate in the left part of Fig. 3, in which each user i maintains a binary vector B i whose element B ij indicates whether user i rates item j. Second, in t-th iteration, the client does not send the gradients of all rated items, but the gradients of a perturbed item set determined by a bit array S t i . This naive algorithm is shown in the upper right of Fig. 3. Specifically, the bit array S t i of user i is used to protect the user's existence by randomizing the rated and unrated items. If S t ij = 1, item j's gradient will be sent to the server, otherwise not. We generate the bit array S t i of item i based on its binary vector B i , given by: where p and q are two given probabilities to determine the number of perturbed unrated and rated items in S t i . Higher p leads to larger disturbance in the randomization while higher q preserves the actual rating behavior. Note that in each iteration t, the bit array S t i of item i is re-generated. Unfortunately, such simple randomization is vulnerable to the average attack.
Specifically, untrusted server may collect the gradients for a sufficient number of iterations T and obtain the rating actions by averaging the derived bit array of user i with the following formula: To address this, we propose to realize the idea of randomized response, which is originally presented by RAPPOR [18], to construct a secured and distributed recommender system. Note that we are the first that implements the concept of randomized response in distributed recommendation. The proposed two-stage RR algorithm aims to strengthen the perturbation of rated and unrated items via the binary vector B i and the bit array S ij . The Permanent Randomized Response (PRR) stage prevents rating exposure caused by the average attack over multiple iterations while the Instantaneous Randomized Response (IRR) stage preserves privacy in every single iteration. Note that PRR will be executed only once during initialization and IRR will be executed in the beginning of every iteration.

Permanent Randomized Response (PRR)
We propose to generate a perturbed binary vector B i to permanently replace the original B i so that we can apply the RR mechanism based on not only the actual rating actions but also some fake "1"s and "0"s. With this strategy, the average attacker will not be able to derive B i since all information sent to server are generated from both fake and actual rating actions. To implement such idea, when initializing the optimization process, we sample the perturbed binary vector B i for each user i by where the parameter f is a probability specified by the client to control the strength of perturbation, and thus determines the percentage of actual rating actions in B i . With a higher f , it will be more private with more perturbation but provide less information for the prediction model. Then B i is fixed and become the input to IRR in every iteration. Note that instead of letting the client to provide the probability parameter f , the value of f is automatically determined by the differential privacy parameter I , which will be introduced and discussed in Sec. 3.4.

Instantaneous Randomized Response (IRR)
With the perturbed binary vector B i derived from PRR, IRR is to implement the naive approach by generating the bit array S t i . In detail, for each iteration t, we sample a bit array S t i for every user i based on two probabilities p and q using Eq. 6, in which the original binary vector B i is replaced by the perturbed version B i . Then the client sends gradients of user i to every item j if S t ij = 1. Note that, since the bit array S t i is generated by the perturbed binary vector B i in Eq. 8, average attack at the server can at most recover the perturbed version B i . We discuss the properties of DP for both PRR and IRR in Sec. 3.4.

Number of Gradients Sent to the Server
Given we can determine the degree of privacy by adjusting the probability parameters f , p and q, in this subsection, we aim to discuss how these parameters affect the number of gradients sent to the server which influences the transmission cost of a distributed recommender system. Recall in Eq. 6 that the probabilities p and q determine the perturbed rated and unrated items via the bit array. We can estimate the number of gradients sent by first calculating the probabilities of sending the gradients of unrated and rated items, denoted by p and q , respectively. Lemma 1. The probability of sending gradients of unrated item j to the server is: The probability of sending gradients of rated item j to the server is: Let the number of items rated by user i be h i , the expected number of gradients sent to the server is It is obvious that the fewer gradients to send, the smaller the transmission cost will be, but the server will get less information to update the model. Therefore, we can allow users to adjust these parameters according to their needs. In our experiments, for each user i, we set z to be |R| |U | , which is the average number that each user has rated, so that the total amount of gradients that the server receives is the same as the original MF and we can make a fair comparison.
Note that with z and Theorem 2, which allows users to specify a privacy budget I , we can obtain p and q .

The Gradients of Unrated Items
Now we have only one remaining issue: what to transmit to the server for an item not rated by the user? For a rated item j, the user i can simply send where e ij is the difference between the predicted and the observed value, r ij − u i v T j , as mentioned in Eq. 2. However, if item j is unrated, we cannot get e ij because r ij does not exist. Therefore, we propose to sample "fake" e ij from the distribution of observed e ij of user i. As pointed out in the Bayesian view of SGLD (Eq. 3), the probabilities of U and V given the observed ratings are assumed to be in normal distributions. Consequently, we can shift N (R|U V T , λ −1 r ) in Eq. 4 to be zero mean to obtain the distribution of e ij , which is also a normal distribution.
Step 1. Calculate distribution of on rated items of user i Step 2. Sample of a unrated item Step 3. Derive with Therefore, our sampling method for unrated item consists of three steps, as illustrated in Fig. 4. First, given a certain user i, we can count the sample mean µ and standard deviation σ from the rated items so the distribution of e i can be derived. Second, we sample e ij for each unrated item j from N (µ, σ) within a given range [−α, α]. Third, the gradients grad(v j ) with sampled e ij can be derived.
Since e ij is sampled from the distribution of the rated items, the attacker cannot distinguish "fake" gradients from actual ones. Besides, the bound in α can constrain the range of e ij to avoid imposing serious noise on the recommendation model. Furthermore, we will discuss how α can be set to control the privacy level in Section 3.4.

Differential Privacy in Our Framework
An important feature in our framework is that the level of privacy is controllable based on the parameter f in PRR, the probabilities p, and q in IRR, as well as the range factor α in computing gradients of unrated items. In this section, we aim to provide theoretical analysis on how the Differential Privacy (DP) is related to these parameters so that one can determine the correspondent parameters for arbitrary privacy levels. Although the total privacy budget scales up with the number of iterations, here we focus on privacy level of each single iteration since the number of iterations that SGLD requires to converge to a certain performance is varied between different datasets. Therefore, we keep it a decision that should be made by the service providers according to their particular goals.
DP of Two-stage Randomized Response Algorithm. To control the privacy level of the proposed two-stage RR algorithm, we will set a few privacy budgets to control the difficulty for the server to identify the rated items according to the number of times the gradients of items are sent from the user. In the following, we prove the DP in PRR and IRR with the privacy budgets P and I , respectively, and derive the relation between these privacy budgets and the probabilities f , p, and q.
Then for any pair of B 1 and B 2 in any possible B i , we can derive the ratio in differential privacy (Definition 1) as below: where p and q follow Lemma 1.
Proof. Assume O S derived from Equation 6 in IRR, for s ∈ O S (for simplicity, we let s be any possible S t i ), given B i = b , the probability of B i being changed into some S t i = s is Then for any pair of B 1 and B 2 in any possible B i , we can derive the ratio in differential privacy ( Definition 1. ) as below: Practically, I is smaller than P because P is the privacy guarantee of the worst case of suffering from average attack over several iterations. In our implementation, we set P = 2 I and find f by P . Consequently, given I specified by the client, we can obtain p and q by solving Eq. 9, 10,11, and 12.
DP of Computation of Gradients to Unrated Items. Here we explain how to use the range factor α to control the difficulty for the attacker to distinguish fake gradients of unrated items from gradients of rated items at the server side according to the numerical values of gradients. Note that this privacy level is different from the DP of Randomized Response algorithm, which is the difficulty of detecting rated items according to discrete results of being sampled or not.
Theorem 3. With a privacy budget g , gradients for unrated items are gdifferentially private, if g = ln where α is the range factor, and erf () is the Gauss Error Function: Proof. Based on Section 3.3, we have the normal distribution of the observed e ij : where µ and σ are mean and standard deviation of the observed e ij . Assume e is any possible e ij , then for any possible item pair of j 1 and j 2 , we derive the ratio in differential privacy ( Definition 1. ) as below: Since it is difficult to directly solve Eq. 13, in our implementation, we set so that [−α, α] can cover more than 95% of the ratings in the distribution. Then we do binary search in (0, α M ax ) to find an α that where δ is a very small number (e.g. 10 −6 in our experiments) so that

Implementation Details of SDMF
We further explain the procedure on the client-side and server-side during the training process of SDMF.

Client-side
As step-by-step actions of each iteration t shown in Algorithm 1. A client first initializes its latent factors, decide the two probabilities used in IRR, p and q, and conduct PRR as Equation 8 when t = 0. In every iteration t, it downloads the item latent factors and calculates the prediction error e ij of the rated item.
After generating the mean and standard deviation of e ij , the client can find a suitable α. Later, the client will conduct IRR as Equation to generate S t i of this iteration t. For every item j that S t i = 1, if it is a rated item, the client sends the server j and grad(v j ) as in general SGLD; if it is an unrated item, sample e ij in N (µ, σ) (and re-sample if it is not within a bound of [−α, α]), sending grad(v j ) calculated with this sampled e ij and j to the server. After the client finishes the sending of gradients to the server, it sends a "finish" signal to the server and updates its user latent factors with the average updates calculated before.  Find α with µ, σ and g

18:
for j ∈ V do 19: if S i (t) j = 1 and B ij = 1 then 20: Send (j, grad(v j )) to Server

29:
Send "finish" to Server 30: whatever grad(v j ) it receives. In this process, nothing but the items' latent factors has to be stored, thereby privacy is preserved. Besides, we can make all clients compute gradients of all their ratings at the same time for each iteration.
With this parallelization, the time that the server has to wait for all gradients will be largely reduced, comparing to a centralized training of MF.

Algorithm 2 Server
Require: U, V InitializeV with all zero 8: Initialize Count = 0 9: for i ∈ U do 10: Call Client i to run Client(i, t) 11: while True do 12: Wait until receiving a (j, grad(v j )) 13:V j ←V j + grad(v j )

Evaluation
We conduct experiments to evaluate the utility of SDMF. Specifically, the experiments aim to examine the trade-off between privacy and performance of How does the privacy budgets I and g in the proposed two-stage RR method affect accuracy? (3) How does SDMF perform on both numerical and one-class rating prediction tasks? Note that the experiments here focus on the effect of using DP to preserve existence privacy, so we do not compare with other DP methods such as [7,11] since their DP algorithms aim to preserve value privacy, which SDMF can completely preserve with the architecture.

Datasets & Evaluation Settings
We use three popular public rating datasets for the experiments: two Movie-Lens datasets 1 (ML-100K and ML-1M) and Netflix data [19]. Note that we subsample Netflix data to a subset with 10,000 users and 5,000 items, all with more than 10 ratings to avoid cold-start users, who will contribute little due to the RR algorithm. The statistics of MovieLens-100K, MovieLens-1M and the subsampled Netflix dataset are shown in Table 2.
Task 1: Numerical Rating Prediction. We randomly split both rating datasets into 80% as the training set and 20% as the test set. This random splitting is repeated for 30 times to obtain the average Root-Mean-Square Error (RMSE). In order to examine how different privacy levels affect the performance, we vary the controllable parameters, i.e., the privacy budgets g and I in SDMF.
As data quality (or noise introduced) is determined by -differential privacy, higher values of g and I lead to weaker privacy protection, but maintain the accuracy of the recommendation model. Hence, we choose to have a wide range of privacy budgets so that the trade-off between performance and privacy can be observed. The privacy budgets g and I are chosen from {4, 1, 0.25, 0.0625}, resulting in 16 combinations of privacy budgets in total. Note that we set P = 2 I so that we do not show the results of different P . The settings of parameters are: K = 50, γ = 0.6, and , (Λ u , Λ v ) ∼ Gamma (1, 100). The learning rate η 0 is 5 × 10 −6 for MovieLens-100K, 5 × 10 −7 for MovieLens-1M, and 5 × 10 −7 for Netflix, which are tuned to have better performance based on a validation set made by randomly splitting the training set into 80%-20%, which are tuned to have better performance based on a validation set made by randomly splitting the training set into 80%-20%. Besides, SDMF will be compared to the baselines and competitive methods as listed in the following.
• Non-private MF: Performing recommendation using the original MF with SGLD. We compare this non-private version with SDMF to understand how the noises introduced for preserving privacy affect performance.
• Input Perturbation SGLD (ISGLD): We make a comparison to a naïve strategy of simply adding noises to ratings. Note that this solution can only preserve value, not model nor existence privacies. We add Laplacian noises to ratings and train MF using SGLD on these perturbed ratings to derive ISGLD. The -differential privacy of adding Laplacian noises to ratings has been proved in [8]. We compare SDMF with ISGLD with privacy budget set to 4 and 2, while the former is the largest number we set for privacy budgets in SDMF and the latter is what reported to have comparable performance as item average baseline by [8].
• SDMF α = ∞: This is an SDMF given no constraint on the sampled fake gradient. Hence, it would lead to the highest privacy level for given fixed g and I in SDMF.  [20] in ML-100K, ML-1M, and the subsampled Netflix dataset. That says, BPRMF is considered MF technique in our SDMF. The split of training and testing is set by the leave-one-out strategy, which is the same as BPRMF [20]. Specifically, we first randomly select one rating action of each user to be added into the for unrated items, where x ijj = u i v T j − u i v T j denotes the distance between the predicted ranking scores of a rated item j and an unrated item j .
The updating rules of using BPRMF in SDMF, termed SD-BPRMF, is shown in Lemma 2. Since the optimization of BPRMF computes gradients for unrated items, SD-BPRMF does not need the "fake" errors, and the privacy budget g is not applied here.
Lemma 2. For a rated item j rated by user i, SD-BPRMF randomly samples an unrated item j and updates its latent factors with We

Experimental Results
Since  Fig. 5a and 5b, the ones on ML-1M are in Fig. 6a and 6b, and the ones on Netflix are in Fig. 7a and 7b.
It can be seen that the distance between ISGLD ( = 4) and ISGLD ( = 2) is much greater than the ranges that the same curves in SDMF spread. Such results reflect that the performance of SDMF is less sensitive to the privacy budget than ISGLD. This result also shows that SDMF has the advantage to maintain the accuracy while still enjoying the additional protection on existence and model privacy. While comparing two privacy budgets, in Fig. 5a, 6a, and 7a, we can see g has a negative relation to RMSE, which means more privacy yields lower accuracy on prediction. Although SDMF of α = ∞ can already provide comparable performance with ISGLD ( = 4), controlling α enjoys arbitrary adjustment of the balance between privacy and accuracy to handle different circumstances. On the other hand, in Fig. 5b, 6b,     Netflix are shown in Fig. 8a, 8b, and 8c, respectively. Comparing to the nonprivate baseline, the loss values in AUC on the three datasets are 0.03, 0.07, and 0.05. Similar to Task 1, I has little influence on the performance. However, the gap between private version and non-private version is greater than that in Task 1. In our opinion, this is caused by the loss of information due to PRR (Section 3.2.1). In one-class rating action prediction, what PRR does is equivalent to deleting some rating actions from the training set, and thus generates more performance damage than in numerical rating prediction. Nevertheless, as we are the first to exploit differential privacy in one-class recommendation task, such loss is acceptable because the accuracy is still high enough to be with certain utility.

Discussion
Here we discuss how to apply SDCF to Factorization Machines (FM) [16], which is another widely-used and robust model for recommendation systems.
We choose FM not only because it can be optimized with gradient descent but also because many of CF-based methods such as MF, SVD++, and K-Nearest Neighbors (KNN) can actually be expressed as Factorization Machines with different settings of parameters [16]. The basic idea of FM is to learn the interactions between variables. To simply explain FM, let us assume the input data of the prediction task is a matrix X ∈ R n×m , where x ∈ R m describes a sample with m variables. To model the interactions of d-order, for the c-th column of total m columns in X, FM will learn a bias weight w c and d latent vectors v l c ∈ R k l , where k l is the number of dimensions for the l-th latent vector. Therefore, the predicted target (e.g., the predicting scores), denoted byŷ(x), is defined aŝ For recommendation systems, each rating will be formulated as an x such that the information about the user and the item can be represented in a format of dummy code as shown in below: x = (0, · · · , 0, 1, 0, · · · , 0 |U | , 0, · · · , 0, 1, 0, · · · , 0 |V| , x |U |+|V|+1 , · · · , x m other variables ), where other variables describe information such as time, age of user, categories of item, or other attributes about the rating. To incorporate SDCF with FM, we can consider v l c and w c for all c ≤ |U | as personal elements while other bias weights and latent vectors are treated as public elements. In this way, users can download public elements, update their own v l c and w c , and then send gradients for other bias weights and latent vectors to the server.

Conclusions and Future Work
This paper proposed a framework, SDCF, to preserve privacy of value, model, and existence. The differential privacy of two-stage Randomized Response algorithm and the method we use to compute gradients for unrated items are theoretically justified. Experimental results demonstrate the ability of SDCF to be applied to both prediction tasks of numerical ratings and one-class rating actions without sacrificing too much accuracy. To improve the feasibility of SDCF for practical usage, in the future we plan to work on the scenario of active learning to lower down the transmission overhead and the scenario of online learning to renew the model without re-training from scratch. Besides, we plan to extend this framework to content-based models and other models that also use gradient descent to learn latent representations (e.g., deep learning framework) so the applications will not be limited to only recommender systems.