Privacy-Utility-Bias Trade-offs for Privacy-Preserving Recommender Systems

TL;DR

This paper evaluates how differential privacy mechanisms affect the accuracy and fairness of various recommender systems, revealing that privacy-utility-bias trade-offs vary significantly across models and privacy settings.

Contribution

It provides a comprehensive cross-model analysis of DP mechanisms in recommender systems, highlighting their distinct impacts on utility and bias.

Findings

Stronger privacy reduces recommendation utility variably across models.

Neural Collaborative Filtering under DPSGD maintains accuracy with minimal loss.

VAE is highly sensitive to privacy, especially for sparse data groups.

Abstract

Recommender systems (RSs) output ranked lists of items, such as movies or restaurants, that users may find interesting, based on the user's past ratings and ratings from other users. RSs increasingly incorporate differential privacy (DP) to protect user data, raising questions about how privacy mechanisms affect both recommendation accuracy and fairness. We conduct a comprehensive, cross-model evaluation of two DP mechanisms, differentially private stochastic gradient descent (DPSGD) and local differential privacy (LDP), applied to four recommender systems (Neural Collaborative Filtering (NCF), Bayesian Personalized Ranking (BPR), Singular Value Decomposition (SVD), and Variational Autoencoder (VAE)) on the MovieLens-1M and Yelp datasets. We find that stronger privacy consistently reduces utility, but not uniformly. NCF under DPSGD shows the smallest accuracy loss (under 10 percent at epsilon approximately 1), whereas SVD and BPR experience larger drops, especially for users with niche preferences. VAE is the most sensitive to privacy, with sharp declines for sparsely represented groups. The impact on bias metrics is similarly heterogeneous. DPSGD generally reduces the gap between recommendations of popular and less popular items, whereas LDP preserves existing patterns more closely. These results highlight that no single DP mechanism is uniformly superior; instead, each provides trade-offs under different privacy regimes and data conditions.