Privacy-Preserving Recommendation

A recommender is only as good as the behaviour it has seen, and behaviour is intimate: what you watched at 2 a.m., which health products you bought, which jobs you looked at twice. Privacy-preserving recommendation is the set of techniques that keep the personalisation while cutting how much raw personal history any single party has to hold.

The mechanisms in use

Federated recommendation trains on the device: gradients or item-embedding updates travel to the server, interaction logs do not.
Differential privacy adds calibrated noise to gradients or counts, bounding how far any one user's data can move the model.
Local obfuscation has the client send a plausible mixture of real and decoy interactions.
Secure aggregation lets the server combine thousands of updates it cannot read individually.

What it costs
Each mechanism trades accuracy for protection, and the cost lands unevenly. Noise hurts sparse users most — the people with twenty interactions, not two thousand — so cold start gets worse exactly where it was already hardest. Federated setups also complicate the item side: a shared embedding table has to be synchronised without revealing which client touched which row.

Why it matters
Interaction logs are regulated data, and a trained factorisation model leaks more than it appears to: given the model, an attacker can often infer whether a particular user's history was in the training set. This is not a compliance veneer over an ordinary ranker — it changes what signal the model is permitted to see, so retrieval and ranking both have to be designed around it.

Privacy-preserving recommendation produces personalised rankings without centralising raw interaction histories. Federated training, differential privacy, local obfuscation and secure aggregation each limit what the server learns about an individual user. It matters because interaction logs are sensitive and regulated, and because a trained model can leak whether someone's history was used. The cost is accuracy, concentrated on sparse users, which makes cold start harder.

Think of a tailor who can cut a suit that fits you perfectly without ever writing down your measurements. That is the goal here.

Recommendations work because software watches what you do — what you play, buy, skip or linger on. That history is personal, and once it sits on a company's servers it can leak or be misused. Privacy-preserving recommendation is the set of methods that get you the suggestions without hoarding the diary: doing some of the learning on your own phone, sending back blurred summaries instead of exact records, or blending everyone's data so thoroughly that no single person's habits can be picked out again.