Recommendation · matrix factorisation · MovieLens-1M

A recommender learned new ratings every day. And held back every fake account.

A matrix-factorisation recommender on MovieLens-1M learned each day's new ratings, with CA3 deciding what it learned, while fake accounts tried to push their films. The original model stays as released.

Illustration: a ratings matrix, with the fake accounts' rows held back

Future ratings82%of what fine-tuning gains

Earlier ratings0.875error kept; original 0.875

Fake accounts' ratings100%held back; 0.6% of real ones

Erased user1.08×the noise floor; 5.0× before

Learns

Each day's new ratings.

The error on ratings that had not happened yet fell from 0.952 to 0.921 with CA3. Ordinary fine-tuning with replay reached 0.914: CA3 kept 82% of that gain.

0.952 → 0.921error on future ratings (lower is better)

0.914ordinary fine-tuning with replay

Keeps

What it had already learned.

The error on the ratings it had learned before stayed where it was.

0.875with CA3

0.875the original model

0.868fine-tuning with replay

Blocks

Fake accounts push their films.

1,208 fake accounts, a fifth of all accounts, rated their films up. CA3 held back all of their ratings and almost none of the real ones.

100%of the fake accounts' ratings held back

0.6%of real ratings held back too

The attack did not take hold even without CA3, so this shows the filter, not a rescue.

Forgets

A user asks to be forgotten.

After the erasure, the model differs from one that never saw that user no more than two such models differ from each other.

5.0×the noise floor, before the erasure

1.08×after (limit 1.5)

Undonethe day the training engine failed, and no other

Test it on your model.

A pilot on your own recommender: you choose what it must never forget and what it should learn, and you measure the result on your own ratings.

Contact All twelve use cases

Model and data

Matrix factorisation on MovieLens-1M (GroupLens).
Fake accounts: 1,208, a fifth of all accounts, rating their films up.

Sources

Harper FM, Konstan JA. The MovieLens datasets: history and context. ACM TiiS 2015.

Limits

Three runs (seeds 3 to 5), pre-registered, about 40 seconds each.
The attack did not take hold in ordinary fine-tuning either; the hold-back is shown by the filter alone.
A public dataset, not a live service.

Results from recorded, pre-registered tests. The mechanism is not shown. Model and dataset names are for identification only. Not produced or endorsed by GroupLens. CA3 is developed by Alberto Acedo, PhD, at Biome Makers Inc.