# Privacy in LLM-based Recommendation: Recent Advances and Future Directions

Sichun Luo1, Wei Shao1, Yuxuan Yao1, Jian Xu2, Mingyang Liu1, Qintong Li3,
Bowei He1, Maolin Wang1, Guanzhi Deng1, Hanxu Hou4, Xinyi Zhang5, Linqi Song1
1CityUHK 2Tsinghua University 3HKU 4Dongguan University of Technology 5CUEB
<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Nowadays, large language models (LLMs) have been integrated with conventional
recommendation models to improve recommendation performance. However, while
most of the existing works have focused on improving the model performance,
the privacy issue has only received comparatively less attention. In this
paper, we review recent advancements in privacy within LLM-based
recommendation, categorizing them into privacy attacks and protection
mechanisms. Additionally, we highlight several challenges and propose future
directions for the community to address these critical problems.

Privacy in LLM-based Recommendation: Recent Advances and Future Directions

Sichun Luo1, Wei Shao1, Yuxuan Yao1, Jian Xu2, Mingyang Liu1, Qintong Li3,
Bowei He1, Maolin Wang1, Guanzhi Deng1, Hanxu Hou4, Xinyi Zhang5, Linqi Song1
1CityUHK 2Tsinghua University 3HKU 4Dongguan University of Technology 5CUEB
<EMAIL_ADDRESS><EMAIL_ADDRESS>

##  1 Introduction

Recommender systems have been proposed to address the information overload
problem Luo et al. (2022a, b, 2023b, 2024b). Recently, large language models
(LLMs) have shown great ability in natural language understanding, generation,
and reasoning Zhao et al. (2023); Luo et al. (2024d); Wang et al. (2023); Yao
et al. (2024b). They have also been integrated into recommendation systems,
achieving significant progress and reshaping the paradigms of recommendation
Bao et al. (2023); Lin et al. (2023c); Zhao et al. (2024b).

Despite the extensive research on LLM-based recommendation systems, most
studies have centered on model accuracy, with less attention dedicated to
privacy issues. However, safeguarding privacy is paramount due to the critical
nature of private information. Thus privacy issues are not peripheral; they
are central to the ethical use of these technologies and warrant thorough
investigation.

Several surveys have explored LLM-based recommendation systems Lin et al.
(2023c); Li et al. (2023a); Zhao et al. (2024b), privacy issues in
recommendation systems Huang et al. (2019); Fan et al. (2022); Ogunseyi et al.
(2023), and privacy concerns specific to LLMs Pan et al. (2020); Neel and
Chang (2023); Yao et al. (2024a); Yan et al. (2024). Nevertheless, there has
been no comprehensive study that specifically focus on privacy in LLM-based
recommendation systems, leaving a significant gap in the literature.

In this paper, we aim to bridge this gap. We first provide an overview of LLM-
based recommendation systems and examine the privacy issues inherent to LLMs
and their applications in recommendations. Thereafter, we discuss various
privacy attacks and the corresponding privacy protection mechanisms.
Subsequently, we point out some challenges and future directions. Our
contributions are threefold:

  * •

To the best of our knowledge, we are the first to conduct an extensive review
of recent advances in privacy issues in LLM-based recommendation systems.

  * •

We systematically introduce privacy in LLM-based recommendations, including
privacy definition, attacks, and protection methods.

  * •

We highlight current challenges and promising research directions for
developing privacy-preserving LLM-based recommender systems.

##  2 Preliminary

###  2.1 LLM-based Recommendation

LLM-based recommendation can be classified into several categories. Some works
use LLMs as feature encoders Harte et al. (2023); Rajput et al. (2024),
feature engineering tools Wei et al. (2024); Luo et al. (2024c),
scoring/ranking functions Luo et al. (2023a); Lin et al. (2023b), and for
modeling user interaction Liu et al. (2023c); Leszczynski et al. (2023).
Noteworthy advancements have been made in utilizing LLMs as recommenders,
either through in context learning Luo et al. (2024a); Liu et al. (2023a) or
supervised fine-tuning Bao et al. (2023); Zhang et al. (2023). However, while
a significant emphasis is placed on model accuracy, the aspect of privacy
remains relatively under-explored, thereby presenting a substantial research
gap.

###  2.2 Privacy Issues

####  2.2.1 Privacy Issues in LLMs

Privacy concerns pervade the life cycle of LLMs, including pre-training, fine-
tuning, and inference stages. We briefly discuss them as follows.

##### Pre-training Stage

LLMs are trained on massive datasets, often sourced from publicly available
internet data, which can contain sensitive information such as addresses,
emails, and Social Security numbers. As model parameters increase, the risk of
memorizing and inadvertently outputting this private information also rises,
leading to potential privacy breaches.

##### Fine-tuning Stage

Fine-tuning (FT) adapts pre-trained LLMs to specific tasks using smaller,
domain-specific datasets from fields like healthcare, law, and finance. These
datasets can include sensitive information, such as patient privacy data or
corporate trade secrets. Despite regulations, LLMs may still memorize private
content, and attacks like Membership Inference and Model Inversion can exploit
this to reveal sensitive information.

##### Inference Stage

During inference, LLMs generate content based on user inputs, which may
contain sensitive or personally identifiable information, leading to privacy
leaks. Even with assurances from LLM service providers, complete protection of
user data is challenging. LLMs can infer user attributes and preferences from
interaction history, even without explicit private information, posing
significant privacy concerns.

####  2.2.2 Privacy in Recommendation

According to previous works Huang et al. (2019); Ge et al. (2022), the
definition of privacy shares similar ingredients. This includes sensitive user
attributes such as identity, gender, age, and address, which necessitate
stringent access restrictions. The concept of ownership dictates that only
authorized entities—whether individual users or the platform itself—are
permitted to access and control private information. However, these systems
face significant threats from malicious entities, both internal and external,
who seek to gain unauthorized access or manipulate this information. These
adversaries often exploit auxiliary public information to facilitate their
infiltration or attacks. Consequently, the primary goal of privacy protection
within recommender systems is to uphold the ownership of private information
and develop effective countermeasures against such threats. This ensures that
users’ sensitive data remains secure and their privacy intact, fostering trust
in the technology.

####  2.2.3 Privacy Issues in LLM-based Recommendation

Privacy in LLM-based recommendation is the intersection of privacy in LLM and
privacy in recommendation, since it may involve the incorporation of these two
kinds of models. For example, when utilizing LLMs as recommenders, privacy
concerns primarily center around the privacy of the LLM itself. Conversely,
when employing LLMs as feature augmentors in conjunction with conventional
recommender systems, privacy issues are more likely to arise within the
recommendation process.

##  3 Privacy Attack in LLM-based Recommendation

Privacy attacks on recommendation include several categories, such as
Membership Inference Attacks Zhang et al. (2021a) (i.e., identify whether the
target user is utilized to train the target recommendation model), Property
Inference Attacks Ganju et al. (2018) (i.e., infer global sensitive
information in the training set), Reconstruction Attacks Meng et al. (2019)
(i.e., using the user’s publicly available attributes and multiple queries to
reconstruct their sensitive information), and Model Extraction Attacks Yue et
al. (2021) (i.e., extract useful information from model).

There are several kinds of privacy attacks on LLM, such as Prompt Hacking Shen
et al. (2023); Liu et al. (2023b) (i.e. strategically designing and
manipulating input prompts so that they can influence LLMs’s output),
Adversarial Attack Zhang et al. (2021b); Nguyen et al. (2024) (i.e.
manipulating input data to cause the LLM to produce incorrect or unintended
outputs), Gradient Leakage Attack Deng et al. (2021); Balunovic et al. (2022)
(i.e. access or infer the gradients or the gradient information, which may
obtain access to the model or even compromise its privacy and safety).

Some pioneer works focus on privacy attacks in LLM-based recommendation Zhang
et al. (2024b, c). Zhang et al. (2024b) reveals that the LLM-based
recommendation introduces security vulnerabilities, allowing attackers to
subtly manipulate item recommendations without detection, and further propose
a stealthy attack via prompt injection. Moreover, Zhang et al. (2024c) propose
LoRec, a framework that effectively utilizes LLMs to detect and defend against
poisoning attacks in sequential recommender systems, significantly improving
their robustness.

##  4 Privacy Protection in LLM-based Recommendation

###  4.1 LLM-based Recommendation Unlearning

Machine unlearning Bourtoule et al. (2021) is a privacy-preserving technique
aiming at addressing the "right to be forgotten" challenge underscored by
various privacy regulations Mantelero (2013); Illman and Temple (2019). Its
primary objective is to facilitate the effective and efficient erasure or
exclusion of sensitive or unwanted information from the trained machine
learning model while maintaining the model performance Nguyen et al. (2022).

Recommendation unlearning, a subset of machine unlearning, is specifically
tailored for recommendation scenarios Chen et al. (2022); Li et al. (2023b,
2024). LLM-based recommendation unlearning focuses on the LLM-based
recommendation siutation. E2URec Wang et al. (2024) enhances unlearning
efficiency by updating select LoRA parameters and employs a teacher-student
framework to improve the unlearning process. Besides, APA Hu et al. (2024)
utilize unique adapters for segmented training data shards, retraining only
those adapters impacted by unusable data, and employing parameter-level
adapter aggregation with sample-adaptive attention for each test sample. These
methods enable effective and efficient unlearning while preserving
recommendation performance.

###  4.2 LLM-based Federated Recommendation

Recently, some pioneering studies have already equipped the LLM-based
recommendation with the paradigm of federated learning to leverage the
foundation models while preserving the users’ data privacy Zeng et al. (2024);
Zhang et al. (2024a); Zhao et al. (2024a). For example, Zhao et al. (2024a)
adopts a federated split learning manner to selectively retain certain
sensitive LLM layers on the client side while offloading non-sensitive layers
to the server to reduce the local training burden. Meanwhile, a dynamic
balance strategy is also proposed to ensure relatively balanced performance
across clients. Zeng et al. (2024) proposes a novel hybrid Retrieval Augmented
Generation (RAG) mechanism for extracting the ID-based user patterns and text-
based item features, which are then converted into text prompts and fed into
the ChatGPT for re-ranking. In this way, generalized features could be
extracted from the sparse and heterogeneous data, and the rich knowledge
within the pre-trained LLM could be exploited. Zhang et al. (2024a) proposes a
novel adapter-based foundation model customization for recommendation in a
federated setting, where each client trains its local adapter using the
private data and the local adapters are further clustered into multiple groups
in the server. Finally, the personalized adapter is obtained by combining both
the user-level and user-group-level adapters. Then, the pre-trained foundation
models equipped with personalized adapters can provide fine-grained
recommendation service efficiently.

###  4.3 Other Privacy Preserving Techniques

There are other privacy-preserving techniques have been employed within the
broader domain of recommender systems, including non-cryptography-based
techniques (e.g., anonymization Luo et al. (2013); Chang et al. (2010); Sakuma
and Osame (2017), randomization Polat and Du (2005); Li et al. (2006), and
differential privacy Berlioz et al. (2015); Shin et al. (2018); Saleem et al.
(2021)) and a myriad of cryptography-based techniques (e.g., homomorphic
encryption Erkin et al. (2012); Kim et al. (2018); Jumonji et al. (2021),
secure multiparty computation Shmueli and Tassa (2017); Kaur et al. (2019);
Shmueli and Tassa (2020), and secret sharing Chen et al. (2020, 2021); Lin et
al. (2022)). These methods have proven effective in their respective
applications, providing robust privacy safeguards. Specifically, RAH Shu et
al. (2023) consists of LLM-based agents and emphasizes user alignment, to
address challenges in recommender systems such as accuracy, biases, privacy,
and cold-start problems. Carranza et al. (2023) addresses differential privacy
in training deep retrieval systems by using DP language models to generate
private synthetic queries, improving retrieval quality while maintaining
privacy guarantees.

##  5 Challenges and Future Directions

We detail the existing works for privacy in LLM-based recommendation. However,
there are also some other potential directions to be explored. In this
section, we will illustrate some promising directions for further research on
this topic.

  * •

Challenge 1: Lack of Universally Applicability in Privacy-Preserving LLM-based
Recommendations. The application of LLM-based recommender systems spans a wide
array of scenarios, each with unique requirements and specificities. Current
research often targets narrow, specific use cases, limiting the broader
applicability and adaptability of these methods. This fragmentation hinders
the development of universally and comprehensively applicable solutions that
can seamlessly integrate across varying contexts and industries.

Future Directions: To address this challenge, there is a pressing need for a
unified, general, and comprehensive framework that can accommodate the diverse
requirements of different application scenarios while ensuring privacy
preservation. This necessitates the development of multi-task, multi-domain
solutions that are robust and versatile enough to handle the complexity and
variability inherent in real-world applications.

  * •

Challenge 2: Efficiency and Effectiveness in Privacy-Preserving LLM-based
Recommendations. The substantial size of LLMs poses significant challenges in
terms of computational efficiency. The sheer scale of these models can lead to
resource-intensive operations, making them impractical for many applications
where quick, reliable recommendations are crucial. Furthermore, privacy-
preserving techniques, such as encryption, often incur additional
computational costs. Besides, the trade-off between privacy and accuracy means
that some privacy-preserving methods may compromise the model’s effectiveness.
Consequently, preserving user privacy effectively and efficiently remains a
challenging task.

Future Directions: Innovative approaches are required to enhance the
efficiency and effectiveness of LLM-based recommendation systems. Research
should focus on optimizing model architectures, leveraging techniques like
model pruning Ma et al. (2023), quantization Lin et al. (2023a), and
distillation Hsieh et al. (2023) to reduce computational overhead without
compromising performance. Additionally, exploring methods to improve inference
speed and energy efficiency will be crucial for the practical deployment of
LLMs in recommender systems.

  * •

Challenge 3: Privacy-Preserving Cloud-Edge Collaboration for LLM-based
Recommendation. Due to the large size of LLM, applying cloud-edge
collaborative recommender systems could be a promising direction to relieve
the computation and storage burden for edge devices. However, it may not be
practical to fine-tune the cloud-side large models without the disclosure of
local sensitive data, thus reducing the recommendation performance. Moreover,
the tremendous volume of edge users also makes it infeasible to customize the
cloud-side model for each individual user. Besides, latency caused by
intermediate information transmission and extensive computation overhead
highly impacts the user experience.

Future Directions: Model compression techniques for LLMs could be a promising
direction for deploying recommendation models in the edge devices while
parameter-efficient fine-tuning methods Ding et al. (2023); Han et al. (2024),
such as adapter Hu et al. (2023) and LoRA Hu et al. (2021), could also be
applied for local model customization, thus avoiding uploading the local data.
Considering heterogeneous device capabilities, novel model architectures with
multiple exits could also offer a flexible trade-off between the performance
and efficiency during the model inference.

##  6 Conclusion

In this paper, we provide a comprehensive overview of recent advancements for
privacy in LLM-based recommendation. More specifically, we introduce the basic
concepts and taxonomy to facilitate a better understanding of this topic. We
also summarize the representative methods addressing privacy concerns in LLM-
based recommendation systems, covering both privacy attacks and privacy
protection. Finally, we analyze potential challenges and suggest possible
future research directions in the realm of privacy for LLM-based
recommendations.

## References

  * Balunovic et al. (2022) Mislav Balunovic, Dimitar Dimitrov, Nikola Jovanović, and Martin Vechev. 2022.  Lamp: Extracting text from gradients with language model priors.  _Advances in Neural Information Processing Systems_ , 35:7641–7654.
  * Bao et al. (2023) Keqin Bao, Jizhi Zhang, Yang Zhang, Wenjie Wang, Fuli Feng, and Xiangnan He. 2023.  Tallrec: An effective and efficient tuning framework to align large language model with recommendation.  In _Proceedings of the 17th ACM Conference on Recommender Systems_ , pages 1007–1014.
  * Berlioz et al. (2015) Arnaud Berlioz, Arik Friedman, Mohamed Ali Kaafar, Roksana Boreli, and Shlomo Berkovsky. 2015.  Applying differential privacy to matrix factorization.  In _Proceedings of the 9th ACM Conference on Recommender Systems_ , pages 107–114.
  * Bourtoule et al. (2021) Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021.  Machine unlearning.  In _2021 IEEE Symposium on Security and Privacy (SP)_ , pages 141–159. IEEE.
  * Carranza et al. (2023) Aldo Gael Carranza, Rezsa Farahani, Natalia Ponomareva, Alex Kurakin, Matthew Jagielski, and Milad Nasr. 2023.  Privacy-preserving recommender systems with synthetic query generation using differentially private large language models.  _arXiv preprint arXiv:2305.05973_.
  * Chang et al. (2010) Chih-Cheng Chang, Brian Thompson, Hui Wang, and Danfeng Yao. 2010.  Towards publishing recommendation data with predictive anonymization.  In _Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security_ , pages 24–35.
  * Chen et al. (2020) Chaochao Chen, Liang Li, Bingzhe Wu, Cheng Hong, Li Wang, and Jun Zhou. 2020.  Secure social recommendation based on secret sharing.  _arXiv preprint arXiv:2002.02088_.
  * Chen et al. (2022) Chong Chen, Fei Sun, Min Zhang, and Bolin Ding. 2022.  Recommendation unlearning.  In _Proceedings of the ACM Web Conference 2022_ , pages 2768–2777.
  * Chen et al. (2021) Jinrong Chen, Lin Liu, Rongmao Chen, Wei Peng, and Xinyi Huang. 2021.  Secrec: A privacy-preserving method for the context-aware recommendation system.  _IEEE Transactions on Dependable and Secure Computing_ , 19(5):3168–3182.
  * Deng et al. (2021) Jieren Deng, Yijue Wang, Ji Li, Chao Shang, Hang Liu, Sanguthevar Rajasekaran, and Caiwen Ding. 2021.  Tag: Gradient attack on transformer-based language models.  _arXiv preprint arXiv:2103.06819_.
  * Ding et al. (2023) Ning Ding, Yujia Qin, Guang Yang, Fuchao Wei, Zonghan Yang, Yusheng Su, Shengding Hu, Yulin Chen, Chi-Min Chan, Weize Chen, et al. 2023.  Parameter-efficient fine-tuning of large-scale pre-trained language models.  _Nature Machine Intelligence_ , 5(3):220–235.
  * Erkin et al. (2012) Zekeriya Erkin, Thijs Veugen, Tomas Toft, and Reginald L Lagendijk. 2012.  Generating private recommendations efficiently using homomorphic encryption and data packing.  _IEEE transactions on information forensics and security_ , 7(3):1053–1066.
  * Fan et al. (2022) Wenqi Fan, Xiangyu Zhao, Xiao Chen, Jingran Su, Jingtong Gao, Lin Wang, Qidong Liu, Yiqi Wang, Han Xu, Lei Chen, et al. 2022.  A comprehensive survey on trustworthy recommender systems.  _arXiv preprint arXiv:2209.10117_.
  * Ganju et al. (2018) Karan Ganju, Qi Wang, Wei Yang, Carl A Gunter, and Nikita Borisov. 2018.  Property inference attacks on fully connected neural networks using permutation invariant representations.  In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_ , pages 619–633.
  * Ge et al. (2022) Yingqiang Ge, Shuchang Liu, Zuohui Fu, Juntao Tan, Zelong Li, Shuyuan Xu, Yunqi Li, Yikun Xian, and Yongfeng Zhang. 2022.  A survey on trustworthy recommender systems.  _ACM Transactions on Recommender Systems_.
  * Han et al. (2024) Zeyu Han, Chao Gao, Jinyang Liu, Sai Qian Zhang, et al. 2024.  Parameter-efficient fine-tuning for large models: A comprehensive survey.  _arXiv preprint arXiv:2403.14608_.
  * Harte et al. (2023) Jesse Harte, Wouter Zorgdrager, Panos Louridas, Asterios Katsifodimos, Dietmar Jannach, and Marios Fragkoulis. 2023.  Leveraging large language models for sequential recommendation.  In _Proceedings of the 17th ACM Conference on Recommender Systems_ , pages 1096–1102.
  * Hsieh et al. (2023) Cheng-Yu Hsieh, Chun-Liang Li, CHIH-KUAN YEH, Hootan Nakhost, Yasuhisa Fujii, Alex Jason Ratner, Ranjay Krishna, Chen-Yu Lee, and Tomas Pfister. 2023.  Distilling step-by-step! outperforming larger language models with less training data and smaller model sizes.  In _The 61st Annual Meeting Of The Association For Computational Linguistics_.
  * Hu et al. (2021) Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2021.  Lora: Low-rank adaptation of large language models.  In _International Conference on Learning Representations_.
  * Hu et al. (2023) Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee-Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Ka-Wei Lee. 2023.  Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models.  In _The 2023 Conference on Empirical Methods in Natural Language Processing_.
  * Hu et al. (2024) Zhiyu Hu, Yang Zhang, Minghao Xiao, Wenjie Wang, Fuli Feng, and Xiangnan He. 2024.  Exact and efficient unlearning for large language model-based recommendation.  _arXiv preprint arXiv:2404.10327_.
  * Huang et al. (2019) Weiming Huang, Baisong Liu, and Hao Tang. 2019.  Privacy protection for recommendation system: a survey.  In _Journal of Physics: Conference Series_ , volume 1325, page 012087. IOP Publishing.
  * Illman and Temple (2019) Erin Illman and Paul Temple. 2019.  California consumer privacy act.  _The Business Lawyer_ , 75(1):1637–1646.
  * Jumonji et al. (2021) Seiya Jumonji, Kazuya Sakai, Min-Te Sun, and Wei-Shinn Ku. 2021.  Privacy-preserving collaborative filtering using fully homomorphic encryption.  _IEEE Transactions on Knowledge and Data Engineering_ , 35(3):2961–2974.
  * Kaur et al. (2019) Harmanjeet Kaur, Neeraj Kumar, and Mohammad S Obaidat. 2019.  Multi-party secure collaborative filtering for recommendation generation.  In _2019 IEEE Global Communications Conference (GLOBECOM)_ , pages 1–6. IEEE.
  * Kim et al. (2018) Jinsu Kim, Dongyoung Koo, Yuna Kim, Hyunsoo Yoon, Junbum Shin, and Sungwook Kim. 2018.  Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption.  _ACM Transactions on Privacy and Security (TOPS)_ , 21(4):1–30.
  * Leszczynski et al. (2023) Megan Leszczynski, Shu Zhang, Ravi Ganti, Krisztian Balog, Filip Radlinski, Fernando Pereira, and Arun Tejasvi Chaganty. 2023.  Talk the walk: Synthetic data generation for conversational music recommendation.  _arXiv preprint arXiv:2301.11489_.
  * Li et al. (2023a) Lei Li, Yongfeng Zhang, Dugang Liu, and Li Chen. 2023a.  Large language models for generative recommendation: A survey and visionary discussions.  _arXiv preprint arXiv:2309.01157_.
  * Li et al. (2006) Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian. 2006.  t-closeness: Privacy beyond k-anonymity and l-diversity.  In _2007 IEEE 23rd international conference on data engineering_ , pages 106–115. IEEE.
  * Li et al. (2024) Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Junlin Liu, and Jun Wang. 2024.  Making recommender systems forget: Learning and unlearning for erasable recommendation.  _Knowledge-Based Systems_ , 283:111124.
  * Li et al. (2023b) Yuyuan Li, Chaochao Chen, Xiaolin Zheng, Yizhao Zhang, Biao Gong, Jun Wang, and Linxun Chen. 2023b.  Selective and collaborative influence function for efficient recommendation unlearning.  _Expert Systems with Applications_ , 234:121025.
  * Lin et al. (2023a) Ji Lin, Jiaming Tang, Haotian Tang, Shang Yang, Xingyu Dang, and Song Han. 2023a.  Awq: Activation-aware weight quantization for llm compression and acceleration.  _arXiv preprint arXiv:2306.00978_.
  * Lin et al. (2023b) Jianghao Lin, Bo Chen, Hangyu Wang, Yunjia Xi, Yanru Qu, Xinyi Dai, Kangning Zhang, Ruiming Tang, Yong Yu, and Weinan Zhang. 2023b.  Clickprompt: Ctr models are strong prompt generators for adapting language models to ctr prediction.  _arXiv preprint arXiv:2310.09234_.
  * Lin et al. (2023c) Jianghao Lin, Xinyi Dai, Yunjia Xi, Weiwen Liu, Bo Chen, Xiangyang Li, Chenxu Zhu, Huifeng Guo, Yong Yu, Ruiming Tang, et al. 2023c.  How can recommender systems benefit from large language models: A survey.  _arXiv preprint arXiv:2306.05817_.
  * Lin et al. (2022) Zhaohao Lin, Weike Pan, Qiang Yang, and Zhong Ming. 2022.  A generic federated recommendation framework via fake marks and secret sharing.  _ACM Transactions on Information Systems_ , 41(2):1–37.
  * Liu et al. (2023a) Junling Liu, Chao Liu, Peilin Zhou, Renjie Lv, Kang Zhou, and Yan Zhang. 2023a.  Is chatgpt a good recommender? a preliminary study.  _arXiv preprint arXiv:2304.10149_.
  * Liu et al. (2023b) Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. 2023b.  Prompt injection attack against llm-integrated applications.  _arXiv preprint arXiv:2306.05499_.
  * Liu et al. (2023c) Yuanxing Liu, Wei-Nan Zhang, Yifan Chen, Yuchi Zhang, Haopeng Bai, Fan Feng, Hengbin Cui, Yongbin Li, and Wanxiang Che. 2023c.  Conversational recommender system and large language model are made for each other in e-commerce pre-sales dialogue.  _arXiv preprint arXiv:2310.14626_.
  * Luo et al. (2023a) Sichun Luo, Bowei He, Haohan Zhao, Yinya Huang, Aojun Zhou, Zongpeng Li, Yuanzhang Xiao, Mingjie Zhan, and Linqi Song. 2023a.  Recranker: Instruction tuning large language model as ranker for top-k recommendation.  _arXiv preprint arXiv:2312.16018_.
  * Luo et al. (2023b) Sichun Luo, Chen Ma, Yuanzhang Xiao, and Linqi Song. 2023b.  Improving long-tail item recommendation with graph augmentation.  In _Proceedings of the 32nd ACM International Conference on Information and Knowledge Management_ , pages 1707–1716.
  * Luo et al. (2024a) Sichun Luo, Jiansheng Wang, Aojun Zhou, Li Ma, and Linqi Song. 2024a.  Large language models augmented rating prediction in recommender system.  In _ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , pages 7960–7964. IEEE.
  * Luo et al. (2022a) Sichun Luo, Yuanzhang Xiao, and Linqi Song. 2022a.  Personalized federated recommendation via joint representation learning, user clustering, and model adaptation.  In _Proceedings of the 31st ACM international conference on information & knowledge management_, pages 4289–4293.
  * Luo et al. (2024b) Sichun Luo, Yuanzhang Xiao, Xinyi Zhang, Yang Liu, Wenbo Ding, and Linqi Song. 2024b.  Perfedrec++: Enhancing personalized federated recommendation with self-supervised pre-training.  _ACM Trans. Intell. Syst. Technol._ Just Accepted.
  * Luo et al. (2024c) Sichun Luo, Yuxuan Yao, Bowei He, Yinya Huang, Aojun Zhou, Xinyi Zhang, Yuanzhang Xiao, Mingjie Zhan, and Linqi Song. 2024c.  Integrating large language models into recommendation via mutual augmentation and adaptive aggregation.  _arXiv preprint arXiv:2401.13870_.
  * Luo et al. (2024d) Sichun Luo, Yuxuan Yao, Haohan Zhao, and Linqi Song. 2024d.  A language model-based fine-grained address resolution framework in uav delivery system.  _IEEE Journal of Selected Topics in Signal Processing_.
  * Luo et al. (2022b) Sichun Luo, Xinyi Zhang, Yuanzhang Xiao, and Linqi Song. 2022b.  Hysage: A hybrid static and adaptive graph embedding network for context-drifting recommendations.  In _Proceedings of the 31st ACM International Conference on Information & Knowledge Management_, pages 1389–1398.
  * Luo et al. (2013) Zhifeng Luo, Shuhong Chen, and Yutian Li. 2013.  A distributed anonymization scheme for privacy-preserving recommendation systems.  In _2013 IEEE 4th International Conference on Software Engineering and Service Science_ , pages 491–494. IEEE.
  * Ma et al. (2023) Xinyin Ma, Gongfan Fang, and Xinchao Wang. 2023.  Llm-pruner: On the structural pruning of large language models.  _Advances in neural information processing systems_ , 36:21702–21720.
  * Mantelero (2013) Alessandro Mantelero. 2013.  The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’.  _Computer Law & Security Review_, 29(3):229–235.
  * Meng et al. (2019) Xuying Meng, Suhang Wang, Kai Shu, Jundong Li, Bo Chen, Huan Liu, and Yujun Zhang. 2019.  Towards privacy preserving social recommendation under personalized privacy settings.  _World Wide Web_ , 22:2853–2881.
  * Neel and Chang (2023) Seth Neel and Peter Chang. 2023.  Privacy issues in large language models: A survey.  _arXiv preprint arXiv:2312.06717_.
  * Nguyen et al. (2022) Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022.  A survey of machine unlearning.  _arXiv preprint arXiv:2209.02299_.
  * Nguyen et al. (2024) Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H Pham, Khoa D Doan, and Kok-Seng Wong. 2024.  Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions.  _Engineering Applications of Artificial Intelligence_ , 127:107166.
  * Ogunseyi et al. (2023) Taiwo Blessing Ogunseyi, Cossi Blaise Avoussoukpo, and Yiqiang Jiang. 2023.  A systematic review of privacy techniques in recommendation systems.  _International Journal of Information Security_ , 22(6):1651–1664.
  * Pan et al. (2020) Xudong Pan, Mi Zhang, Shouling Ji, and Min Yang. 2020.  Privacy risks of general-purpose language models.  In _2020 IEEE Symposium on Security and Privacy (SP)_ , pages 1314–1331. IEEE.
  * Polat and Du (2005) Huseyin Polat and Wenliang Du. 2005.  Svd-based collaborative filtering with privacy.  In _Proceedings of the 2005 ACM symposium on Applied computing_ , pages 791–795.
  * Rajput et al. (2024) Shashank Rajput, Nikhil Mehta, Anima Singh, Raghunandan Hulikal Keshavan, Trung Vu, Lukasz Heldt, Lichan Hong, Yi Tay, Vinh Tran, Jonah Samost, et al. 2024.  Recommender systems with generative retrieval.  _Advances in Neural Information Processing Systems_ , 36.
  * Sakuma and Osame (2017) Jun Sakuma and Tatsuya Osame. 2017.  Recommendation with k-anonymized ratings.  _arXiv preprint arXiv:1707.03334_.
  * Saleem et al. (2021) Yasir Saleem, Mubashir Husain Rehmani, Noel Crespi, and Roberto Minerva. 2021.  Parking recommender system privacy preservation through anonymization and differential privacy.  _Engineering Reports_ , 3(2):e12297.
  * Shen et al. (2023) Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2023.  " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models.  _arXiv preprint arXiv:2308.03825_.
  * Shin et al. (2018) Hyejin Shin, Sungwook Kim, Junbum Shin, and Xiaokui Xiao. 2018.  Privacy enhanced matrix factorization for recommendation with local differential privacy.  _IEEE Transactions on Knowledge and Data Engineering_ , 30(9):1770–1782.
  * Shmueli and Tassa (2017) Erez Shmueli and Tamir Tassa. 2017.  Secure multi-party protocols for item-based collaborative filtering.  In _Proceedings of the eleventh ACM conference on recommender systems_ , pages 89–97.
  * Shmueli and Tassa (2020) Erez Shmueli and Tamir Tassa. 2020.  Mediated secure multi-party protocols for collaborative filtering.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ , 11(2):1–25.
  * Shu et al. (2023) Yubo Shu, Hansu Gu, Peng Zhang, Haonan Zhang, Tun Lu, Dongsheng Li, and Ning Gu. 2023.  Rah! recsys-assistant-human: A human-central recommendation framework with large language models.  _arXiv preprint arXiv:2308.09904_.
  * Wang et al. (2024) Hangyu Wang, Jianghao Lin, Bo Chen, Yang Yang, Ruiming Tang, Weinan Zhang, and Yong Yu. 2024.  Towards efficient and effective unlearning of large language models for recommendation.  _arXiv preprint arXiv:2403.03536_.
  * Wang et al. (2023) Ke Wang, Houxing Ren, Aojun Zhou, Zimu Lu, Sichun Luo, Weikang Shi, Renrui Zhang, Linqi Song, Mingjie Zhan, and Hongsheng Li. 2023.  Mathcoder: Seamless code integration in llms for enhanced mathematical reasoning.  In _The Twelfth International Conference on Learning Representations_.
  * Wei et al. (2024) Wei Wei, Xubin Ren, Jiabin Tang, Qinyong Wang, Lixin Su, Suqi Cheng, Junfeng Wang, Dawei Yin, and Chao Huang. 2024.  Llmrec: Large language models with graph augmentation for recommendation.  In _Proceedings of the 17th ACM International Conference on Web Search and Data Mining_ , pages 806–815.
  * Yan et al. (2024) Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzheng Cheng. 2024.  On protecting the data privacy of large language models (llms): A survey.  _arXiv preprint arXiv:2403.05156_.
  * Yao et al. (2024a) Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024a.  A survey on large language model (llm) security and privacy: The good, the bad, and the ugly.  _High-Confidence Computing_ , page 100211.
  * Yao et al. (2024b) Yuxuan Yao, Sichun Luo, Haohan Zhao, Guanzhi Deng, and Linqi Song. 2024b.  Can llm substitute human labeling? a case study of fine-grained chinese address entity recognition dataset for uav delivery.  In _Companion Proceedings of the ACM on Web Conference 2024_ , pages 1099–1102.
  * Yue et al. (2021) Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. 2021.  Black-box attacks on sequential recommenders via data-free model extraction.  In _Proceedings of the 15th ACM Conference on Recommender Systems_ , pages 44–54.
  * Zeng et al. (2024) Huimin Zeng, Zhenrui Yue, Qian Jiang, and Dong Wang. 2024.  Federated recommendation via hybrid retrieval augmented generation.
  * Zhang et al. (2024a) Chunxu Zhang, Guodong Long, Hongkuan Guo, Xiao Fang, Yang Song, Zhaojie Liu, Guorui Zhou, Zijian Zhang, Yang Liu, and Bo Yang. 2024a.  Federated adaptation for foundation model-based recommendations.
  * Zhang et al. (2024b) Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, and Liang Wang. 2024b.  Stealthy attack on large language model based recommendation.  _arXiv preprint arXiv:2402.14836_.
  * Zhang et al. (2023) Junjie Zhang, Ruobing Xie, Yupeng Hou, Wayne Xin Zhao, Leyu Lin, and Ji-Rong Wen. 2023.  Recommendation as instruction following: A large language model empowered recommendation approach.  _arXiv preprint arXiv:2305.07001_.
  * Zhang et al. (2024c) Kaike Zhang, Qi Cao, Yunfan Wu, Fei Sun, Huawei Shen, and Xueqi Cheng. 2024c.  Lorec: Large language model for robust sequential recommendation against poisoning attacks.  _arXiv preprint arXiv:2401.17723_.
  * Zhang et al. (2021a) Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021a.  Membership inference attacks against recommender systems.  In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ , pages 864–879.
  * Zhang et al. (2021b) Xinyang Zhang, Zheng Zhang, Shouling Ji, and Ting Wang. 2021b.  Trojaning language models for fun and profit.  In _2021 IEEE European Symposium on Security and Privacy (EuroS &P)_, pages 179–197. IEEE.
  * Zhao et al. (2024a) Jujia Zhao, Wenjie Wang, Chen Xu, Zhaochun Ren, See-Kiong Ng, and Tat-Seng Chua. 2024a.  Llm-based federated recommendation.
  * Zhao et al. (2023) Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et al. 2023.  A survey of large language models.  _arXiv preprint arXiv:2303.18223_.
  * Zhao et al. (2024b) Zihuai Zhao, Wenqi Fan, Jiatong Li, Yunqing Liu, Xiaowei Mei, Yiqi Wang, Zhen Wen, Fei Wang, Xiangyu Zhao, Jiliang Tang, et al. 2024b.  Recommender systems in the era of large language models (llms).  _IEEE Transactions on Knowledge and Data Engineering_.