Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems

Summary

This study examines whether language embeddings of item content in recommender systems leak item identities to an adversary holding auxiliary item text. A simple cosine-similarity attack recovers item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets, and leakage can extend to user re-identification from sparse ratings. The authors also test obfuscated descriptions as a mitigation and report a clear leakage-utility tradeoff.

Mitigation

Obfuscated descriptions were evaluated as a mitigation, and the source reports a clear leakage-utility tradeoff. No specific fix or configuration is given.

Related items

• InfoThe LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDKSimilar attack · AWS Security Bulletins
• InfoAgentCIScope: Grounded Contextual Integrity Evaluation for LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCost-Efficient Privacy Enforcement for Email-Generating LLM Agents under Strategic Information RequestsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCOMPASS: Membership Inference Attack Against Vision Large Language Models via Adaptive Noise CalibrationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)