PGPO: Prototype-Guided Progressive Obfuscation for Privacy-Preserving LLM-Enhanced Recommendation

Overview (TL;DR)

LLM-enhanced recommenders can benefit from textual side information, but the resulting semantic representations may expose sensitive item attributes to inversion attacks. PGPO shifts the goal from preserving literal semantics to preserving relational fidelity: change what individual words reveal while retaining how items relate to one another.

The method combines a prototype-aware semantic graph, GRPO-based anchor exploration, and graph-guided progressive expansion. The released repository covers the whole pipeline from side-information construction and training to recommendation evaluation and two complementary privacy attacks.

Abstract

Why Relational Fidelity?

Protecting an item independently is not enough. Recommendation quality depends on relative structure in semantic space. A useful privacy transformation therefore needs to move exposed content away from the original while keeping the neighborhood geometry useful to the recommender.

How It Works

Theory Intuition

The paper also analyzes why path-dependent generation can make source recovery harder. The formal guarantees rely on the assumptions stated in the paper; this section summarizes the intuition rather than replacing the full derivation.

For final item representations, the paper further uses a data-processing argument: when collaborative signals contain limited residual information about the source text, reducing text-level leakage also reduces representation-level leakage.

Evaluation Setup

Recommendation backends: SASRec, LightGCN, FREEDOM, LightGT, TALLRec, and LLaRA.   Baselines: InferDPT, Text2Text, SanText+, and TextObfuscator (TOF).

Obfuscated Variant Quality

PGPO produces valid variants for nearly all words while achieving the highest local-topology Spearman correlation among the compared methods on both datasets.

Recommendation Performance

Across sequential, graph-based, multimodal, and LLM-based recommenders, PGPO remains close to the unprotected-description upper bound. The table highlights representative metrics from the latest manuscript.

Privacy Evaluation

The aligned-CosSim inversion evaluation shows that PGPO provides substantial protection without the recommendation degradation seen in token-level perturbation baselines. A stronger white-box Replay-MLE attacker is used in the ablation analysis below.

Representation Analysis

The two datasets are shown together for direct comparison rather than using one oversized row per figure.

Ablation: What Each Component Contributes

Appendix Insights: Parameter Sensitivity

Several analyses that are easy to miss in the paper's main body are useful for understanding how PGPO behaves in practice.

Cache size

Removing the cache nearly destroys local structural preservation (Spearman 0.0070). A moderate cache restores relational anchors; very large caches bring diminishing returns and increasingly favor low-similarity variants.

Prototype count

A small high-influence set is already enough to establish effective anchors. Expanding too far makes structural learning harder: Spearman falls from about 0.235 at 1.25k–2.5k prototypes to 0.131 at 10k.

Reward weights

The three rewards control different axes: dissimilarity strengthens semantic displacement, structural consistency raises neighborhood preservation, and the semantic constraint keeps outputs on a valid semantic manifold. Over-weighting the constraint makes variants too close to the source.

Scope & Limitations

The current implementation applies a unified obfuscation strategy rather than assigning stronger protection to especially sensitive or rare words. It also introduces extra LLM generation cost, and the current study focuses on textual side information. Sensitivity-aware privacy budgets, lightweight policy distillation, retrieval-based reuse, and multimodal relational fidelity are natural extensions.

Resources

• GitHub repository — full training and evaluation pipeline.
• Hugging Face models — released model weights for MovieLens-1M and Amazon-Book.
• Evaluation suite — recommendation, embedding inversion, and white-box source re-identification.
• arXiv preprint — coming soon.

Quick Start

git clone https://github.com/Shengxiang-Lin/PGPO.git
cd PGPO

conda create -n pgpo python=3.10 -y
conda activate pgpo
pip install -r requirements.txt

BibTeX

@inproceedings{lin2026pgpo,
  title={{PGPO}: Prototype-Guided Progressive Obfuscation for Privacy-Preserving LLM-Enhanced Recommendation},
  author={Lin, Shengxiang and Su, Jiajie and Zhou, Pengyang and Chen, Xiang and Zheng, Xiaolin and Tian, Feng and Chen, Chaochao},
  booktitle={Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing},
  year={2026},
  note={To appear}
}

Acknowledgments

This work was supported by the National Natural Science Foundation of China under Grant Nos. 72192823, 62177038, 62522217 and 624B2131.