Interaction-level Membership Inference Attack Against Federated Recommender Systems

Abstract: The marriage of federated learning and recommender system (FedRec) has been widely used to address the growing data privacy concerns in personalized recommendation services. In FedRecs, users' attribute information and behavior data (i.e., user-item interaction data) are kept locally on their personal devices, therefore, it is considered a fairly secure approach to protect user privacy. As a result, the privacy issue of FedRecs is rarely explored. Unfortunately, several recent studies reveal that FedRecs are vulnerable to user attribute inference attacks, highlighting the privacy concerns of FedRecs. In this paper, we further investigate the privacy problem of user behavior data (i.e., user-item interactions) in FedRecs. Specifically, we perform the first systematic study on interaction-level membership inference attacks on FedRecs. An interaction-level membership inference attacker is first designed, and then the classical privacy protection mechanism, Local Differential Privacy (LDP), is adopted to defend against the membership inference attack. Unfortunately, the empirical analysis shows that LDP is not effective against such new attacks unless the recommendation performance is largely compromised. To mitigate the interaction-level membership attack threats, we design a simple yet effective defense method to significantly reduce the attacker's inference accuracy without losing recommendation performance. Extensive experiments are conducted with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on three real-world recommendation datasets (MovieLens-100K, Steam-200K, and Amazon Cell Phone), and the experimental results show the effectiveness of our solutions.

\section{Introduction}\label{sec:introduction}
In the age of the information explosion, recommender systems have become an essential means to alleviate information overload~\cite{gomez2015netflix,yin2017spatial}, and many recommendation techniques have been proposed, including matrix factorization~\cite{mnih2007probabilistic}, deep learning based methods~\cite{he2017neural,he2020lightgcn}, etc.
These traditional recommender systems have already achieved good performance in diverse scenarios~\cite{zhang2019deep}.
However, most of these traditional recommender systems work in a centralized way, i.e., they require collecting and storing users' historical interaction data  to train a powerful recommender model in a central server~\cite{lam2006you}.
As the increasing concerns of user privacy and the relevant privacy protection regulations such as the General Data Protection Regulation (GDPR)~\cite{voigt2017eu} in European Union and the California Consumer Privacy Act (CCPA)~\cite{harding2019understanding} in the United States, centrally collecting users' personal data is harder and even becomes infeasible in many cases~\cite{liang2021fedrec++}.

To address the privacy issue, federated learning (FL)~\cite{mcmahan2017communication} has been recently adopted in recommender systems.
In federated recommender systems (FedRecs), users can collaboratively train the recommender model but do not need to share their private data with either central servers or other users (clients).
Therefore, FedRecs are  considered a natural solution to protect users' sensitive information.
Generally, FedRecs can be further divided into FedRecs with explicit feedback~\cite{liang2021fedrec++} and FedRecs with implicit feedback, according to their training datasets and optimization objectives.
In this paper, we focus on FedRecs with implicit feedback\footnote{To make the presentation concise, we directly use FedRec refer to FedRec with implicit feedback by default in the remaining part of this paper.}.
Since Ammad et al.~\cite{ammad2019federated} proposed the first FedRec with collaborative filtering, many studies followed and extended their basic FedRec framework.
For example, FedFast~\cite{muhammad2020fedfast} aims to accelerate the convergence of FedRec training.
Imran et al.~\cite{imran2022refrs} and Wang et al.~\cite{wang2022fast} focused on the efficiency of FedRecs.

With the remarkable attainment achieved in a short time~\cite{yang2020federated}, a few recent studies have started to verify whether FedRecs are ``safe'' enough.
\cite{zhang2022comprehensive} is the first work to analyze the privacy issue of FedRecs.
However, it only discussed sensitive attribute information leakage~\cite{zhang2021graph} and developed an effective attribute information protection approach.
Although \cite{lin2020fedrec,liang2021fedrec++,lin2021fr,lin2022generic} studied the leakage and protection of user rating information in FedRecs, they all focused on explicit feedback data,  which are much different from this work targeting FedRecs with implicit feedback.

Inferring a user's interaction data in FedRecs is one type of membership inference attack (MIA).  Although MIA has been widely investigated in federated classification tasks~\cite{nasr2019comprehensive,zhang2020gan,geiping2020inverting,lyu2020threats,zhao2021user,suri2022subject}, their proposed attack and defense approaches cannot apply to  FedRecs due to the following major differences between federated recommendation  and federated classification.  (1) From the perspective of attack objective,  MIA in federated classification aims to infer or predict whether a sample has been used in the federated training process and which client has used it for the local training.
However, in FedRecs, the associated item set of each client can be easily inferred  by simply checking which items' embeddings are updated by the client.  Furthermore, knowing such an item set is meaningless in FedRecs, since it consists of both positive and negative samples/items, and only positive samples (i.e., interacted items) can leak user privacy.
Hence, the membership inference attack on FedRecs aims to infer the user's interacted items (i.e., positive samples), and we name such MIA as Interaction-level Membership Inference Attack (IMIA).
(2) From the attack implementation perspective, MIA in federated classification needs to acquire extra i.i.d. data, which is however infeasible in FedRecs. In addition, the federated recommender architecture is significantly different from the federated classification model architecture. A client in FedRecs can have its private parameters (i.e., user embedding), while all model parameters in the federated classification models are shared.

In this paper, we first design a novel IMIA attacker to reveal the risk of leaking user interaction data in FedRecs and then  propose an efficient and effective defender. The attack is launched by a central server that is honest but curious.
The central server aims to identify a user's interacted items (i.e., positive samples) from its associated items (including both positive and negative samples) by analyzing the user's uploaded parameters without breaking the federated learning protocol.
To be specific, given a target client, the attacker iteratively identifies its interacted items by repeating the following procedure.  The attacker first randomly assigns ratings (0 or 1) to the client's associated items to construct a shadow training set, based on which a shadow recommender model is trained.  Then, the attacker compares the relevance between the client's uploaded item embeddings and the item embeddings in the shadow recommender model to find the correctly guessed items. We implement the IMIA attacker on
two representative FedRecs (Fed-NCF~\cite{ammad2019federated} and Fed-LightGCN~\cite{he2020lightgcn}), and evaluate its inference accuracy on
  three real-world recommendation datasets (MovieLens-100K~\cite{harper2015movielens}, Steam-200K~\cite{cheuque2019recommender}, and Amazon Cell Phone~\cite{he2016ups}).
The experimental results show the high inference accuracy of this new IMIA attacker, highlighting the risk of user interaction data leakage in FedRecs.

Recently, to improve the privacy-preserving ability of federated learning, Local Differential Privacy (LDP) has been employed in FedRecs and quickly becomes a gold standard for privacy preservation because of its effectiveness~\cite{wang2019collecting,yang2020local,liu2022federated}.
Therefore, we also evaluate the performance of the IMIA attacker in the above-mentioned FedRecs equipped with LDPs.
It is found that LDP is not effective against such new attacks unless the recommendation performance is largely compromised, highlighting the timely demand for a new defense mechanism against the new IMIA.

In light of this, we propose a novel defense mechanism - IMIA defender. As there are both public and private parameters in FedRecs and only the public parameters can leak user privacy information, we impose a regularization term in the loss function of FedRecs to restrict the update and learning ability of the public parameters and enforce the private parameters to learn more useful patterns and account more for the recommendation performance.
In this way, less sensitive information is transmitted to the server via the shared parameters. As shown in our experiments, our proposed defender can significantly decrease the inference accuracy of the IMIA attacker to the level of random guess with negligible influence on the recommendation performance.

In conclusion, the main contributions of this paper are summarized as follows:
\begin{itemize}
  \item To the best of our knowledge, we are the first to perform a comprehensive privacy analysis of federated recommender systems under interaction-level membership inference attack (IMIA). Our study discloses the privacy risk of user interaction data in FedRecs.
  \item We find that the commonly used privacy-preserving approach, LDP, cannot effectively defend against the new IMIA attack. Then, we propose  a simple yet effective defense mechanism to constrain the update of public parameters, which can significantly degenerate the IMIA attacker's performance to the level of random guesses without hurting the recommendation performance.
  \item Extensive experiments are conducted with two widely used federated recommender systems (Fed-NCF and Fed-LightGCN) on three real-world recommendation datasets, showing the effectiveness of our attack and defense approaches.
\end{itemize}
\section{Preliminaries}
In this section, we first revisit the fundamental settings of FedRecs, and then formally define interaction-level membership inference attack and defense.
Note that the bold lowercase (e.g. $\mathbf{a}$) represents vectors, bold uppercase (e.g. $\mathbf{A}$) denotes matrices, and squiggle uppercase (e.g. $\mathcal{A}$) signifies sets.

\begin{figure}[!htbp]
  \centering
  \includegraphics[width=0.48\textwidth]{fed_arch.pdf}
  \caption{A typical federated recommender system with IMIA attacker and defender.}\label{fig_fed_learning}
\end{figure}

\subsection{Federated Recommender System}
Let $\mathcal{U}$ and $\mathcal{V}$ denote the sets of users (clients) and items, respectively.
In FedRec, each user/client $u_{i}$ has a local training dataset $\mathcal{D}_{i}$, which consists of user-item interactions $(u_{i}, v_{j}, r_{ij})$.
$r_{ij}=1$ means that user $u_{i}$ has interacted with item $v_{j}$; otherwise, $r_{ij}=0$, that is $v_{j}$ is a negative sample.
We use $\mathcal{V}_{i}^{+}$ and $\mathcal{V}_{i}^{-}$ to denote the interacted item set and negative sample set of user $u_{i}$.
The FedRec is trained to predict $\hat{r}_{ij}$ between $u_{i}$ and non-interacted items.
Finally, FedRec will recommend top-$K$ ranked items with the highest predicted ratings to each user $u_i$.

In FedRec, a central server coordinates a large number of clients.
The federated training process mainly contains four steps.
First, the central server randomly selects a batch of users/clients as participants and dispenses the global parameters to these clients.
Second, after receiving global parameters, each client combines these public parameters with their private parameters to form a local recommendation model and optimize this model on their local datasets regarding a certain objective function (e.g., BPRLoss~\cite{rendle2012bpr}).
Third, after local training, each client sends the updated public parameters back to the central server.
Finally, the central server aggregates received public parameters with a certain aggregation strategy (e.g., FedAvg~\cite{mcmahan2017communication}).
The above steps form a global training epoch in FedRec and will be repeated many times until the model convergence or meet some pre-defined requirement.

\subsection{Interaction-level Membership Inference Attack and Defense}
\textbf{Adversary's Goal.}
In this paper, we assume the central server is honest-but-curious, i.e., the server is curious about user private data, but it will not break FedRec's learning protocol.
The goal of the curious server is to infer the set of interacted items on each client $u_{i}$ based on its uploaded public parameters:
\begin{equation}
  \hat{\mathcal{V}}_{i}^{+} \leftarrow IMIA(\mathbf{V}_{i}^{t})
\end{equation}
where $\hat{\mathcal{V}}_{i}^{+}$ is the inferred set of $u_i$'s interacted items, and $\mathbf{V}_{i}^{t}$ represents public or shared parameters that user $u_{i}$ sends to the server at epoch $t$.
Without loss of generality, the public parameters mainly refer to item embeddings in this paper.
The central curious server aims to accurately infer each client's interacted items, and meanwhile, it does not expect its inference attack to affect FedRec's normal learning process and recommendation performance.

\textbf{Adversary's Knowledge.}
To be more realistic, we assume that the server has the following prior knowledge:  (1) the target user $u_{i}$'s uploaded public parameters (or gradients), which is consistent with the FedRec protocol;  and
(2) a few basic learning hyper-parameters, such as learning rate $lr$ and the ratio of negative sampling $\eta$.  In FedRecs, these hyper-parameters are pre-defined by the central server and broadcast to each participant client, therefore, this assumption of prior knowledge is reasonable.

\textbf{Defense.}
The defense is launched locally by each client to defend against the curious server's inference attack.
The client anticipates the defense method can significantly reduce the server's inference accuracy  to protect their interaction data
without much recommendation performance loss and  extra computation footprint.

\section{Method}
In this section, we will first describe the base federated recommenders used in this paper and then present the details of the IMIA attacker and defender. Fig.~\ref{fig_fed_learning} shows the framework of FedRec with IMIA attack and defense and the whole procedure is also described in Alg.~\ref{alg_fedrec}.

\subsection{Base Federated Recommender}
Generally, a federated learning framework can be applied to most deep learning-based recommendation models.
Among these recommenders, neural collaborative filtering (NCF)~\cite{he2017neural} and graph neural network (GNN)~\cite{scarselli2008graph} are the two most widely used techniques. Hence, we extend an NCF-based centralized model and a LightGCN-based~\cite{he2020lightgcn} centralized model to Fed-NCF and Fed-LightGCN respectively, which will be then used as our base FedRecs to show the effectiveness of our attacker and defender.

\textbf{Neural Collaborative Filtering.} NCF extends collaborative filtering (CF) by leveraging an $L$-layer feedforward network (FFN) to capture the complex patterns of user-item interactions as follows:
\begin{equation}\label{eq_predict}
  \hat{r}_{ij} = \sigma (\mathbf{h}^\top FFN([\mathbf{u}_{i}, \mathbf{v}_{j}]))
\end{equation}
where $\mathbf{u}_{i}$ and $\mathbf{v}_{j}$ are user $u_{i}$'s and item $v_{j}$'s embedding; $\mathbf{h}$ denotes a learnable weight vector; $[\cdot]$ is concatenation operation, and $\hat{r}_{ij}$ is the predicted preference score of user $u_i$ on item $v_{j}$.

\textbf{LightGCN.} In graph-based recommenders, the user-item interactions can be constructed as a bipartite graph. Then, LightGCN treats all users and items as distinct nodes.
After that, user and item embeddings are learned by propagating their neighbor nodes' embeddings:
\begin{equation}
  \label{eq_lightgcn}
    \mathbf{u}_{i}^{l} = \sum\limits_{j\in \mathcal{N}_{u_{i}}}\frac{1}{\sqrt{\left| \mathcal{N}_{u_{i}} \right|} \sqrt{\left| \mathcal{N}_{v_{j}} \right|}}\mathbf{v}_{j}^{l-1},\quad
    \mathbf{v}_{j}^{l} = \sum\limits_{i\in \mathcal{N}_{v_{j}}}\frac{1}{\sqrt{\left| \mathcal{N}_{v_{j}} \right|} \sqrt{\left| \mathcal{N}_{u_{i}} \right|}}\mathbf{u}_{i}^{l-1}
\end{equation}
where $\mathcal{N}_{u_{i}}$ and $\mathcal{N}_{v_{j}}$ denote the sets of $u_i$'s and $v_j$'s neighbors.  $l$ is the propagation layer.
Note that under the federated learning setting, each user/client can only access its own data, thus they can only perform the above calculation on their local bipartite graphs.

After $L$ layers propagation, we aggregate all layers' embedding together as the final user and item embeddings:
\begin{equation}
    \mathbf{u}_{i} = \sum\limits_{l=0}^{L} \mathbf{u}_{i}^{l}, \quad \mathbf{v}_{j} = \sum\limits_{l=0}^{L} \mathbf{v}_{j}^{l}
\end{equation}
Then, as done in NCF,  E.q.~\ref{eq_predict} is adopted to compute the predicted preference scores.

\textbf{FedRec Learning Protocol.}
In FedRec, the parameters can be divided into private and public parameters.
Each client initializes its private parameters, i.e., user embedding $\mathbf{u}_{i}$, and the public parameters $\mathbf{V}$ are initialized by a central server $s$.
At the beginning of a global training epoch $t$, the server $s$ randomly selects a group of clients as participants $\mathcal{U}_{t}$ and sends $\mathbf{V}_{t}$ to each participant.
The participant combines $\mathbf{V}_{t}$ with its private parameters to form a local recommender and trains the recommender on its local dataset $\mathcal{D}_{i}$ with the following loss function:
\begin{equation}\label{eq_ori_loss}
  \mathcal{L}^{rec} = -\sum\nolimits_{(u_{i}, v_{j}, r_{ij})\in \mathcal{D}_{i}} r_{ij}\log \hat{r}_{ij} + (1-r_{ij})\log (1-\hat{r}_{ij})
\end{equation}
After the local training, the client $u_{i}$ locally updates its private user embedding $\mathbf{u}_{i}$ and uploads the updated public parameters $\mathbf{V}_{i}^{t}$ to the central server $s$.
Then, the server utilizes FedAvg~\cite{mcmahan2017communication} to update the global parameters:
\begin{equation}
  \mathbf{V}_{t+1} = \sum\limits_{u_{i} \in \mathcal{U}_{t}} \mathbf{V}_{i}^{t}
\end{equation}
The above steps iterate until the system converges or meets certain requirements.

\textbf{Local Differential Privacy.}
As one of the most popular ways to protect users' sensitive data, LDP has been integrated into many FedRecs~\cite{wu2021personalized}.
In this paper, we perform the analysis of IMIA attacks on not only the vanilla FedRecs but also  FedRecs with the LDP mechanism.
Following~\cite{wei2020federated}, before uploading public parameters to server $s$, the client adds some noises to $\mathbf{V}_{i}^{t}$:
\begin{equation}\label{eq_ldp}
  \mathbf{V}_{i}^{t} \leftarrow \mathbf{V}_{i}^{t} + \mathcal{N}(\mathbf{0}, \lambda^{2}\mathbf{I})
\end{equation}
where $\mathcal{N}$ is the normal distribution and $\lambda$ controls the scale of noise.

\subsection{Interaction-level Membership Inference Attacker}\label{sec_imia_attack}
In this work, the curious-but-honest central server is the IMIA attacker, who attempts to infer target user $u_{i}$'s interacted item set $\mathcal{V}_{i}^{+}$.
Basically, if the server has more prior information, such a membership attack is easier to implement with high accuracy.
For example, if the server $s$ can access $u_{i}$'s private user embedding or a part of $u_{i}$'s interaction data, it can simply train a shadow recommender to infer its other interacted items.
However, these strong prior knowledge assumptions are unrealistic in real-world FedRecs.
 Therefore, we assume that the malicious server can only access the public parameters $\mathbf{V}_{i}^{t}$ uploaded by each client  and some training hyper-parameters including the learning rate $lr$ and the negative sampling ratio $\eta$.

Based on the public parameters $\mathbf{V}_{i}^{t}$ updated by $u_i$, the  server can easily infer which items are involved during the local training according to their embedding updates. That is, for item $v_j$, if its embedding is updated by the client $u_i$, $v_j$ participates in $u_i$'s local training. But such simple inference is not useful since $v_{j}$ can also be a negative sample.
The malicious server would like to further infer whether $v_{j}$ is positive or not for user $u_{i}$  (i.e., the value of $r_{ij}$).
Once the $r_{ij}$ is accurately predicted, $u_i$'s private interaction dataset $\mathcal{D}_{i}$ is exposed to the server.
Thus, the membership inference attack problem transforms to predict $r_{ij}$ for item $v_{j}$ in $\mathcal{V}_{i}$.

Our attacker design is inspired  by the following interesting empirical observation.
Assume there is a local model $\mathbf{M}_{i}$ trained on its local dataset $\mathcal{D}_{i}$.
$\mathbf{M}_{i}^{'}$ is also trained on $\mathcal{D}_{i}$ but its private parameters (i.e., user embedding)  have different initial values.
$\mathcal{D}_{i}^{j}$ represents a dataset in which  $v_{j}$'s rating $r_{ij}$ is reversed, and all the other ratings are the same as in $\mathcal{D}_{i}$.
For example, if $r_{ij}=1$ in $\mathcal{D}_{i}$, $r_{ij}$ will be reversed to $0$ in $\mathcal{D}_{i}^{j}$.
$\mathbf{M}_{i}^{''}$ is trained on $\mathcal{D}_{i}^{j}$ with a different private parameter initial point.
Before training, these three models' public parameters are the same.
After training, we obtain the following interesting observation: $dist(\mathbf{v}_{j}, \mathbf{v}_{j}^{'}) < dist(\mathbf{v}_{j}, \mathbf{v}_{j}^{''})$. $dist(\cdot)$ denotes a distance function and the Euclidean metric is adopted in our paper.
$\mathbf{v}_{j}$, $\mathbf{v}_{j}^{'}$, and $\mathbf{v}_{j}^{''}$ are $v_{j}$'s embeddings from model $\mathbf{M}_{i}$, $\mathbf{M}_{i}^{'}$, and $\mathbf{M}_{i}^{''}$, respectively.
It is worth noting that $u_i$'s embeddings in $\mathbf{M}_{i}$, $\mathbf{M}_{i}^{'}$, and $\mathbf{M}_{i}^{''}$  have different initial values.
Table~\ref{tb_fix_acc} provides a proof-of-concept.
For each user, we randomly select one item from its local dataset and reverse the item's rating  to construct the dataset $\mathcal{D}_{i}^{j}$.
Once  $\mathbf{M}_{i}$, $\mathbf{M}_{i}^{'}$, $\mathbf{M}_{i}^{''}$ are trained,  we can infer the rating $r_{ij}$ in $\mathcal{D}_{i}$
 only based on the item's rating in $\mathcal{D}_{i}^{j}$ and the  distance of the item's embeddings in these three models.
 As shown in Table~\ref{tb_fix_acc},  the inference accuracy is higher than 90\% in most cases, showing the effectiveness of this inference attack method.  Based on this observation, if all other item ratings in $\mathcal{D}_{i}$ are known, we can infer $v_{j}$'s rating $r_{ij}$ by training $\mathbf{M}_{i}^{'}$ and $\mathbf{M}_{i}^{''}$ and then comparing their $v_{j}$'s item embedding distance with the uploaded parameters $\mathbf{V}^{t}_{i}$.

\begin{table}[!htbp]
  \setlength\tabcolsep{2.1pt}
  \caption{Accuracy of inferring randomly select items' ratings  for all users based on comparing Euclidean distances  $dist(\mathbf{v}_{j}, \mathbf{v}_{j}^{'})$ and $dist(\mathbf{v}_{j}, \mathbf{v}_{j}^{''})$.}\label{tb_fix_acc}
  \begin{tabular}{lccc}
  \hline
  \textbf{Models} & \multicolumn{1}{l}{\textbf{MovieLens-100K}} & \multicolumn{1}{l}{\textbf{Steam-200K}} & \multicolumn{1}{l}{\textbf{Amazon}} \\ \hline
  Fed-NCF          & 93.9\%                                      & 97.6\%                                  & 99.9\%                                         \\
  Fed-LightGCN     & 79.7\%                                      & 90.5\%                                  & 91.15\%                                        \\ \hline
  \end{tabular}
  \end{table}

However, the IMIA attacker does not know any item rating in $\mathcal{D}_{i}$, so the above  method cannot be directly used as the attack approach for FedRecs.
To implement IMIA attacks, we relax the requirement and generalize the observation: if most samples are the same on two datasets $\mathcal{D}$ and $\mathcal{D}^{'}$, and we train two models $\mathbf{M}$ and $\mathbf{M}^{'}$ on them respectively, the embeddings of counterpart items will be close if their ratings are the same.
Based on this assumption, when the server is curious about user $u_{i}$'s interaction data at epoch $t$, the server first randomly assigns ratings (i.e., 0 and 1) for each item in $\mathcal{V}_{i}$ according to the negative sampling ratio $\eta$.
For example, if $\eta$ is $1:4$, the server will randomly choose $25\%$ items as positive items and the remaining items as negative ones, thus constructing a fake dataset $\mathcal{D}_{i}^{fake}$.
Since the negative samples are empirically several times more than the positive items, $\mathcal{D}_{i}^{fake}$ and $\mathcal{D}_{i}$ still have a portion of common ratings. Still taking $\eta = 1:4$  as an example, although in the worst case  all positive items are wrongly assigned with rating 0, $\mathcal{D}_{i}^{fake}$ and $\mathcal{D}_{i}$ still have 50\% the same item ratings.
Then, the server trains a shadow model $\mathbf{M}_{i}^{fake}$ based on $\mathcal{D}_{i}^{fake}$.
After that, the malicious server calculates the  distance between item embeddings from $\mathbf{M}_{i}^{fake}$ and the uploaded item embeddings $V_{i}^{t}$, and it chooses $\gamma*\left|\mathcal{V}_{i}\right|$ items with the smallest distance as ``correct guess''.
The ratings of ``correct guess'' items  will be fixed in the next iteration.
Repeat the above steps several times until the server finishes inferring the positive item set $\hat{\mathcal{V}}_{i}^{+}$ for user $u_{i}$.
Since the whole inference attack process happens on the malicious server side by using uploaded public parameters, the client is unaware of the IMIA attack.
In addition, the malicious server can also store the target user's uploaded parameters and asynchronously execute the inference attack process without interrupting the normal training of FedRecs. Lines 23-32 in Alg.~\ref{alg_fedrec} describe the process of the proposed IMIA attack with pseudo-code.

\begin{algorithm}[!ht]
  \renewcommand{\algorithmicrequire}{\textbf{Input:}}
  \renewcommand{\algorithmicensure}{\textbf{Output:}}
  \caption{FedRec with IMIA attacker and defender.} \label{alg_fedrec}
  \begin{algorithmic}[1]
    \Require global epoch $T$; local epoch $L$; learning rate $lr$, negative sampling rate $\eta$, \dots;
    \Ensure global parameter $\mathbf{V}$, local client embedding $\mathbf{u}_{i}|_{i \in \mathcal{U}}$;
    \State Initializing global parameter $\mathbf{V}_{0}$;
    \For {each round t = 0, 1, ..., $T$}
        \State sampling a fraction of clients $\mathcal{U}_{t}$;
        \For{$u_{i}\in \mathcal{U}_{t}$}
          \State $\mathbf{V}_{i}^{t} \leftarrow$ \Call{ClientTrain}{$u_{i},\mathbf{V}_{t}, L$};
          \If {curious about $u_{i}$'s data}
            \State $\hat{\mathcal{V}}_{i}^{+}\leftarrow$\Call{Attacker}{$\mathbf{V}_{i}^{t}$,$\eta$, $\gamma$};
          \EndIf
        \EndFor
        \State $\mathbf{V}_{t+1} = \sum\limits_{u_{i} \in \mathcal{U}_{t}} \mathbf{V}_{i}^{t}$;
    \EndFor
    \Function{ClientTrain} {$u_{i},\mathbf{V}_{t}, L$}
      \State downloading $\mathbf{V}_{t}$ from the server;
      \State sampling negative items $\mathcal{V}_{i}^{neg}$;
      \If {use IMIA defender}
        \State $\mathbf{u}_{i}^{t+1}, \mathbf{V}_{i}^{t} \leftarrow$ training $L$ epochs with E.q.~\ref{eq_loss_with_defend};
      \Else
        \State $\mathbf{u}_{i}^{t+1}, \mathbf{V}_{i}^{t} \leftarrow$ training $L$ epochs with E.q.~\ref{eq_ori_loss};
      \EndIf
      \State if use LDP, add noise with E.q.~\ref{eq_ldp};
      \State \Return $\mathbf{V}_{i}^{t}$
    \EndFunction
    \Function{Attacker}{$\mathbf{V}_{i}^{t}$, $\eta$, $\gamma$}
      \State $\hat{\mathcal{V}}_{i}^{+}=\{\}$
      \State $\mathcal{V}_{i}\leftarrow$ select updated items according to $\mathbf{V}_{i}^{t}$ and $\mathbf{V}_{t}$;
      \While {$\left|\hat{\mathcal{V}}_{i}^{+}\right| <\eta\left|\mathcal{V}_{i}\right|$}
        \State randomly assign ratings to $v_{j} \in \mathcal{V}_{i} \setminus \hat{\mathcal{V}}_{i}^{+}$;
        \State train fake model $\mathbf{M}_{i}^{fake}$ on constructed dataset;
        \State $\hat{\mathcal{V}}_{i}^{+}, \hat{\mathcal{V}}_{i}^{-}\leftarrow$ select $\gamma*\left|\mathcal{V}_{i}\right|$ items using $dist(\mathbf{V}_{i}^{t}, \mathbf{V}_{i}^{fake})$;
      \EndWhile
      \State \Return $\hat{\mathcal{V}}_{i}^{+}$
    \EndFunction
    \end{algorithmic}
\end{algorithm}

\subsection{Interaction-level Membership Inference Defender}~\label{sec_imia_def}
In Section~\ref{sec_vanilla} and \ref{sec_ldp_against}, the experimental results demonstrate that both vanilla FedRecs and FedRecs with LDP are  vulnerable to the new attack IMIA, highlighting the need for
 a new defense mechanism.  The experimental results in Table~\ref{tb_vanilla_atk} and~\ref{tb_ldp_imia} show that  Fed-LightGCN is more resistant to IMIA.  This may be because the private user embeddings in Fed-LightGCN learn more useful information and patterns than in Fed-NCF.
  Since the private user embeddings in Fed-LightGCN capture more user-item interaction patterns,  it is harder for the curious server to infer interactions only from public parameters.

To further validate our hypothesis, we compare the deviation of user/item embeddings in the training process from their initial values using L2 loss (i.e., $dist^{2}(v^{t}_{i}-v^{0}_{i})$).   Fig.~\ref{fig_deviation} illustrates the trend of the average deviation over training time.
In Fig.~\ref{fig_deviation}, the deviation of item embeddings is much larger than user embeddings' deviation.
In other words, on average, user embeddings do not  change as much as item embeddings during the whole training process, therefore user embeddings learn less information and patterns.
Further, by comparing Fig.~\ref{fig_ncf_deviation} and Fig.~\ref{fig_lightgcn_deviation}, we can see that user embeddings in Fed-NCF vary
 much less than in Fed-LightGCN, which supports our hypothesis.
Note that for the sake of visualization, we log the L2 loss value in Fig.~\ref{fig_ncf_deviation} because of the large difference between user and item embedding deviation.
\begin{figure}[!htbp]
  \centering
  \subfloat[Deviation trend in Fed-NCF.]{\includegraphics[width=1.67in]{ncf_embedding_diff.pdf}\label{fig_ncf_deviation}}
  \subfloat[Deviation trend in Fed-LightGCN.]{\includegraphics[width=1.67in]{lightgcn_embedding_diff.pdf}\label{fig_lightgcn_deviation}}
  \caption{Trend of embedding deviation over time until convergence in Fed-NCF and Fed-LightGCN on MovieLens-100K.}\label{fig_deviation}

\end{figure}

Motivated by the above observation, we propose a novel IMIA defender.
 The basic idea of LDP is to add noise to the shared parameters to distort the sensitive information behind the shared parameters, leading to catastrophic performance dropping.
Unlike LPD, the key idea of our defender is to restrict the learning ability of public parameters so that they will convey less information to the curious central server. To implement that, we add a constraint term in the original FedRec loss function E.q.~\ref{eq_ori_loss}, as follows:
\begin{equation}\label{eq_loss_with_defend}
  \mathcal{L} = \mathcal{L}^{rec} + \mu\left\| \mathbf{V}_{i}^{t}-\mathbf{V}_{t} \right\|
\end{equation}
The constraint term limits the update of the public parameters $\mathbf{V}_{t}$ on each local client/device.  Consequently, to optimize $\mathcal{L}^{rec}$, the recommender model would enforce the private embeddings to learn more information and patterns.
Fig.~\ref{fig_deviation} shows the embedding deviation trend after applying our defender to Fed-NCF and Fed-LightGCN.
User embedding deviation becomes larger than vanilla FedRecs, while item embedding deviation significantly drops.
More details of embedding deviation are in Appendix~\ref{app_deviation}.

\section{Experiments}
\subsection{Datasets}
We use three real-world datasets (MovieLens-100K~\cite{harper2015movielens}, Steam-200K~\cite{cheuque2019recommender}, and Amazon Cell Phone~\cite{he2016ups})  from various domains (movie recommendation, game recommendation, and cell phone recommendation) to evaluate the performance of our IMIA attacker and defender.
The statistics of these datasets are shown in Table~\ref{tb_dataset}.
MovieLens-100K contains $100,000$ interactions between $943$ users and $1,682$ items.
There are  $3,753$ users, $5,134$ items, and $114,713$ interactions in Steam-200K.
Amazon Cell Phone consists of  $13,174$ users,  $5,970$ cell phone related items, and $103,593$ interactions.
Note that the densities of these three datasets are different.
MovieLens-100K is the densest dataset, while Amazon Cell Phone is the most sparse one.
Following~\cite{zhang2022pipattack}, we binarize the user feedback, where all ratings are transformed to $r_{ij}=1$ and negative instances are sampled with $1:4$ ratio.
Besides, we utilize the leave-one-out method to split the training, validation, and test sets.

\begin{table}[!ht]
  \centering
  \setlength\tabcolsep{2.pt}
  \caption{Statistics of recommendation datasets}\label{tb_dataset}

  \begin{tabular}{lccccc}
  \hline
  \textbf{Dataset}  & \multicolumn{1}{l}{\textbf{\#users}} & \multicolumn{1}{l}{\textbf{\#items}} & \multicolumn{1}{l}{\textbf{\#interactions}} & \multicolumn{1}{l}{\textbf{Avg.}} & \multicolumn{1}{l}{\textbf{Density}} \\ \hline
  MovieLens-100K    & 943                                  & 1,682                                 & 100,000                                     & 106                                      & 6.30\%                               \\
  Steam-200K        & 3,753                                 & 5,134                                 & 114,713                                     & 31                                       & 0.59\%                               \\
  Amazon  & 13,174                               & 5,970                                & 103,593                                     & 8                                        & 0.13\%                               \\ \hline
  \end{tabular}
  \end{table}

\subsection{Evaluation Metrics}
To measure the effectiveness of IMIA attackers, we employ the widely used classification metric F1 score to evaluate inference performance.
To evaluate the recommendation performance, we adopt the widely used hit ratio at rank $10$ (Hit@10), which measures the ratio of ground truth items that appear in the top-10 recommendation list.
\subsection{Baselines}
Since none of the prior works conducts interaction-level membership attacks on FedRecs,  we design two baselines.

\textbf{Random Attack.} For each client $u_{i}$, the server randomly selects a group of items from $\mathcal{V}_{i}$ as the positive items based on the negative sampling ratio $\eta$.
Comparing with Random Attack can reveal whether a privacy issue of user interaction data exists.

\textbf{K-means Attack.} Since we do not have any labels of user-item interaction samples, IMIA can naturally be treated as a clustering problem.
We adopt K-means~\cite{hartigan1979algorithm} algorithm to divide items into two clusters based on the client's uploaded public parameters $\mathbf{V}_{i}^{t}$. Positive items are chosen from the cluster with lower SSE (the sum of squared errors).
The intuition of K-means Attack is that for a user, the positive items are more similar to each other than diverse negative items due to the coherence principle of personal interests, therefore, their embeddings will also be more coherent.

\subsection{Parameter Settings}
For both Fed-NCF and Fed-LightGCN, the dimension of user and item embeddings is $64$, and $3$ neural layers with dimensions $128, 64, 32$ are used to process the concatenated user and item embedding.
The negative sampling ratio $\eta$ is set to $1:4$, as this ratio can well balance the training effectiveness and efficiency for most pair-wise loss functions and has been widely used.
The local training batch size and local epoch size are $64$ and $20$, respectively.
Adam~\cite{kingma2014adam} optimizer with $0.001$ learning rate is employed to optimize local models.
To ensure the model convergence, the maximum global epoch is set to $200$. $\gamma$ is set to $20\%$.
 We also perform the sensitivity  analysis of key hyper-parameters in the experiment.

\subsection{Performance of IMIA Attackers}\label{sec_vanilla}
Table~\ref{tb_vanilla_atk} presents three attackers' performances on two FedRecs and three datasets.
The results are average F1 scores that reflect the inference effectiveness of the IMIA attacker. The results in Table~\ref{tb_vanilla_atk} highlight that \textbf{vanilla FedRecs have a high risk of user interaction data leakage}, since the performance of our IMIA attacker is much better than Random Attack.
Besides, comparing K-means and our attacker, we can see that the naive clustering method cannot effectively infer user interaction information.
Furthermore, by comparing our IMIA attacker's performances crossing datasets, we can find that FedRecs trained on Steam-200K and Amazon Cell Phone are more vulnerable to IMIA than the ones trained on MovieLens-100K.
With the statistics of datasets in Table~\ref{tb_dataset}, we believe that this phenomenon is related to the number of user interactions  because the average number of user interactions on MovieLens-100K is much higher than that on the other two datasets.
To further investigate this phenomenon on MovieLens-100K, we cluster users into 20 groups  according to their interaction numbers and report their average F1 score in Fig.~\ref{fig_user_interaction}.
The results show that \textbf{users with fewer interactions have a higher risk of interaction data leakage}.
Appendix~\ref{app_interaction} analyzes this phenomenon on all datasets.

\begin{table}[!htbp]
  \centering
  \setlength\tabcolsep{2.1pt}
  \caption{The performance (F1 scores) of attackers on vanilla FedRecs. ML-100K is short for MovieLens-100K, Amazon is short for Amazon Cell Phone.}~\label{tb_vanilla_atk}
  \begin{tabular}{l|l|lll}
  \hline
  \textbf{Model}                         & \textbf{Attack} & \textbf{ML-100K} & \textbf{Steam-200K} & \textbf{Amazon} \\ \hline
                                         & \textbf{Random} & {\ul 0.2079}            & {\ul 0.2019}        & {\ul 0.1998}    \\ \hline
  \multirow{2}{*}{\textbf{Fed-NCF}}      & \textbf{K-means} & 0.3183                  & 0.2477              & 0.2458          \\
                                         & \textbf{Ours}   & \textbf{0.5928}         & \textbf{0.6707}     & \textbf{0.6516} \\ \hline
  \multirow{2}{*}{\textbf{Fed-LightGCN}} & \textbf{K-means} & 0.1460                  & 0.2573              & 0.2697          \\
                                         & \textbf{Ours}   & \textbf{0.3900}         & \textbf{0.6007}     & \textbf{0.4328} \\ \hline
  \end{tabular}
  \end{table}

\begin{figure}[!ht]
    \centering
    \includegraphics[width=0.4\textwidth]{user_interaction_ml_ncf.pdf}
    \caption{IMIA attacker performance for users with different number of interactions on MovieLens-100K.}\label{fig_user_interaction}
  \end{figure}

  \begin{table*}[!htbp]
    \centering
    \caption{The result of Local Differential Privacy (LDP) against our IMIA attacker. F1 is the attacker's performance, and the lower scores ($\downarrow$) are better. Hit@10 ($\uparrow$) measures recommendation performance, and the higher scores are better.}\label{tb_ldp_imia}
    \begin{tabular}{ll|cccccccc}
    \hline
    \textbf{Model}                         & \textbf{Dataset}    & \multicolumn{8}{c}{\textbf{Noise Scale}}                                                                                \\ \hline
                                           &                     & \multicolumn{2}{c}{$\lambda=$\textbf{0.0}}                                      & \multicolumn{2}{c}{$\lambda=$\textbf{0.001}}                                    & \multicolumn{2}{c}{$\lambda=$\textbf{0.01}}                                     & \multicolumn{2}{c}{$\lambda=$\textbf{0.1}}                                      \\ \cline{3-10}
                                           &                     & \multicolumn{1}{c}{\textbf{F1}$\downarrow$} & \multicolumn{1}{c}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{c}{\textbf{F1}$\downarrow$} & \multicolumn{1}{c}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{c}{\textbf{F1$\downarrow$}} & \multicolumn{1}{c}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{c}{\textbf{F1}$\downarrow$} & \multicolumn{1}{c}{\textbf{Hit@10}$\uparrow$} \\ \hline
    \multirow{3}{*}{\textbf{Fed-NCF}}       & \textbf{ML-100K}    & {\ul 0.5928}                          & \textbf{0.3690}                     & 0.5474                          & 0.3308                              & 0.3954                          & 0.2958                              & \textbf{0.2520}                 & 0.1696                              \\
                                           & \textbf{Steam-200K} & {\ul 0.6707}                          & \textbf{0.6645}                     & 0.6012                          & 0.5901                              & 0.3334                          & 0.4524                              & \textbf{0.2199}                 & 0.2224                              \\
                                           & \textbf{Amazon}     & {\ul 0.6516}                          & \textbf{0.2176}                     & 0.6260                          & 0.1984                              & 0.2933                          & 0.1505                              & \textbf{0.2126}                 & 0.1217                              \\ \hline
    \multirow{3}{*}{\textbf{Fed-LightGCN}} & \textbf{ML-100K}    & {\ul 0.3900}                          & \textbf{0.4072}                     & 0.3786                          & 0.3923                              & 0.2816                          & 0.3658                              & \textbf{0.2357}                 & 0.3138                              \\
                                           & \textbf{Steam-200K} & {\ul 0.6007}                          & \textbf{0.6943}                     & 0.5690                          & 0.6957                              & 0.3392                          & 0.6890                              & \textbf{0.2188}                 & 0.5123                              \\
                                           & \textbf{Amazon}     & {\ul 0.4328}                          & \textbf{0.1796}                     & 0.3483                          & 0.1717                              & 0.2642                          & 0.1720                              & \textbf{0.2209}                 & 0.1562                              \\ \hline
    \end{tabular}
    \end{table*}
    \begin{table*}[!htbp]
      \caption{The result of our defender against IMIA. The best results on each dataset are bold.}\label{tb_our_defend}
      \resizebox{\textwidth}{!}{
      \begin{tabular}{ll|cccccccccc}
      \hline
      \textbf{Model}                         & \textbf{Dataset}    & \multicolumn{10}{c}{\textbf{Constraint Scale}}                                                                                \\ \hline
                                             &                     & \multicolumn{2}{c}{$\mu=$\textbf{0.0}}                                      & \multicolumn{2}{c}{$\mu=$\textbf{0.1}}                                      & \multicolumn{2}{c}{$\mu=$\textbf{0.4}}                                      & \multicolumn{2}{c}{$\mu=$\textbf{0.7}}                                      & \multicolumn{2}{c}{$\mu=$\textbf{1.0}}                                               \\ \cline{3-12}
                                             &                     & \multicolumn{1}{c}{\textbf{F1}$\downarrow$} & \multicolumn{1}{c}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{c}{\textbf{F1}$\downarrow$} & \multicolumn{1}{l}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{l}{\textbf{F1}$\downarrow$} & \multicolumn{1}{l}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{l}{\textbf{F1}$\downarrow$} & \multicolumn{1}{l}{\textbf{Hit@10}$\uparrow$} & \multicolumn{1}{l}{\textbf{F1}$\downarrow$} & \multicolumn{1}{l}{\textbf{Hit@10}$\uparrow$} \\ \hline
      \multirow{3}{*}{\textbf{Fed-NCF}}       & \textbf{ML-100K}    & {\ul 0.5928}                    & 0.3690                              & 0.2638                          & 0.3605                              & \textbf{0.2140}                 & \textbf{0.3743}                     & 0.2166                          & 0.3563                              & 0.2145                          & 0.3531                              \\
                                             & \textbf{Steam-200K} & {\ul 0.6707}                    & \textbf{0.6645}                     & 0.3888                          & 0.6005                              & 0.2667                          & 0.6011                              & 0.2213                          & 0.5960                              & \textbf{0.2058}                 & 0.5960                              \\
                                             & \textbf{Amazon}     & {\ul 0.6516}                    & \textbf{0.2176}                     & 0.4761                          & 0.2142                              & 0.3368                          & 0.2129                              & \textbf{0.3079}                 & 0.2126                              & 0.3240                          & 0.2121                              \\ \hline
      \multirow{3}{*}{\textbf{Fed-LightGCN}} & \textbf{ML-100K}    & {\ul 0.3900}                    & 0.4072                              & 0.2130                          & \textbf{0.4082}                     & 0.1892                          & 0.3891                              & 0.1811                          & 0.3796                              & \textbf{0.1741}                 & 0.3870                              \\
                                             & \textbf{Steam-200K} & {\ul 0.6007}                    & \textbf{0.6943}                     & 0.4730                          & 0.6584                              & 0.4620                          & 0.5830                              & 0.4205                          & 0.5582                              & \textbf{0.2246}                 & 0.5472                              \\
                                             & \textbf{Amazon}     & {\ul 0.4328}                    & 0.1796                              & \textbf{0.2281}                 & \textbf{0.1920}                     & 0.2847                          & 0.1821                              & 0.3231                          & 0.1704                              & 0.3308                          & 0.1615                              \\ \hline
      \end{tabular}}
      \end{table*}

    \begin{table}[!htbp]
      \setlength\tabcolsep{1.8pt}
      \centering
      \caption{Comparison of $\frac{\left|\Delta F1\right|}{\left|\Delta Hit@10\right|}$ for LDP and our defender. Higher scores represent the more cost-effective defense. NCF and LightGCN are short for ``Fed-NCF'' and ``Fed-LightGCN''.}\label{tb_delta}
      \begin{tabular}{l|cccccc}
      \hline
      \textbf{Defense} & \multicolumn{2}{c}{\textbf{ML-100K}}                                             & \multicolumn{2}{c}{\textbf{Steam-200K}}                                          & \multicolumn{2}{c}{\textbf{Amazon}}                                              \\ \hline
                        & \multicolumn{1}{l}{\textbf{NCF}} & \multicolumn{1}{l}{\textbf{LightGCN}} & \multicolumn{1}{l}{\textbf{NCF}} & \multicolumn{1}{l}{\textbf{LightGCN}} & \multicolumn{1}{l}{\textbf{NCF}} & \multicolumn{1}{l}{\textbf{LightGCN}} \\ \hline
      \textbf{LDP}     & 1.70                                 & 1.65                                      & 1.01                                 & 2.09                             & 4.57                                 & 9.05                                      \\
      \textbf{ours}    & \textbf{71.47}                       & \textbf{10.68}                            & \textbf{6.78}                        & \textbf{2.55}                                      & \textbf{68.74}                       & \textbf{16.50}                            \\ \hline
      \end{tabular}
      \end{table}

Finally, the comparison of IMIA attackers' performances on Fed-NCF and Fed-LightGCN shows that \textbf{Fed-LightGCN is more resistant to IMIA than Fed-NCF}.
This may be because that \textbf{private parameters (i.e., user embeddings) in Fed-LightGCN  learn more useful information than in Fed-NCF}, since user embeddings in Fed-LightGCN aggregate information from  item embedding via convolution operation.
As a result, only using public parameters to infer user interaction records  becomes harder.
In Appendix~\ref{app_deviation}, we further show the embeddings' deviation from their initial values.
The results support our explanation.
The above observation motivates us to design our effective IMIA defender (see Section~\ref{sec_imia_def}), which attempts to limit the learning ability of public parameters and enforce private parameters to learn more patterns.

\subsection{Effectiveness of LDP Against IMIA}\label{sec_ldp_against}
As the most classical and widely used privacy-preserving approach,
LDP can effectively prevent attribute inference attacks on FedRecs~\cite{zhang2022comprehensive}.
Here, we conduct this experiment to study whether LDP can defend against the new inference attack IMIA.
Table~\ref{tb_ldp_imia} presents the results of LDP with different noise scales against IMIA attacks.
$\lambda=0.0$ means FedRecs without LDP.
The results indicate that with subtle noise (e.g. $\lambda=0.001$), LDP cannot well protect user interaction data.
Adding more noises (e.g. $\lambda=0.1$) can defend against our IMIA attacker, however, stronger noises severely degenerate the recommendation performance of FedRecs.

To measure how much recommendation performance LDP needs to sacrifice to effectively defend the attacker, we calculate $\frac{\left|\Delta F1\right|}{\left|\Delta Hit@10\right|}$ for the LDP which degenerates the IMIA attacker's performance to the level of Random Attack.
Intuitively, $\frac{\left|\Delta F1\right|}{\left|\Delta Hit@10\right|}$ measures the change ratio of the attacker's performance and recommendation performance.
Lower scores represent that the defender has to sacrifice more recommendation performance to reduce the attacker's threat.
Table~\ref{tb_delta} shows that LDP would sacrifice too much recommendation performance to alleviate IMIA threats.
As a result, \textbf{LDP is not cost-effective to defend against IMIA}.

\subsection{Effectiveness of IMIA Defender}
Since LDP cannot effectively mitigate IMIA threats, we propose a novel defense mechanism against the IMIA attack.
The results of our defender against IMIA are shown in Table~\ref{tb_our_defend} where we vary the values of the hyper-parameter $\mu$ from 0.0 to 1.0, and $\mu=0.0$ represents the vanilla FedRecs.
With our defense method, the attacker's performance is reduced to the level of random guesses in all cases.
Meanwhile, the recommender's performance is even improved in some cases (e.g., Fed-NCF on ML-100K, Fed-LightGCN on ML-100K, and Amazon Cell Phone) due to the regularization effect of the constraint term in the loss function, which indicates that \textbf{when restricting the updates of public parameters, the recommendation models can still  achieve good recommendation performance by enforcing private parameters to learn more patterns}.

Table~\ref{tb_delta} shows the comparison  between LDP and our defender.
The higher scores represent that the defender invalids the IMIA attacker with less performance loss.
As we can see, in all cases, our defender is more cost-effective than LDP.
Specifically, our defender's $\frac{\left|\Delta F1\right|}{\left|\Delta Hit@10\right|}$ scores for Fed-NCF on MovieLens-100K and Amazon Cell Phone are nearly $40$ times and $15$ times higher than LDP.
In conclusion, our defender provides a more cost-effective solution against IMIA than LDP.

\subsection{Attack with More Prior Knowledge}
As mentioned in Section~\ref{sec_imia_attack}, to make the threat more realistic, we strictly restrict the curious server's prior knowledge with only uploaded parameters and some hyper-parameters such as learning rate and sampling ratio.
In this section, we explore one possible prior knowledge that the server may have chances to access: the popularity information of items. Although the popularity information is not always accessible, it is still available in many scenarios. In this part, we assume that the server knows the top 10\% popular items. Based on the popularity information, instead of randomly assigning ratings to items at the initial phase, the server assigns positive ratings to popular items with a higher probability.
 Fig.~\ref{fig_popularity} shows that with the item popularity information, the IMIA attacker's performance is improved in most cases.
\begin{figure}[!ht]
  \centering
  \includegraphics[width=0.35\textwidth]{popular.pdf}
  \caption{IMIA with popularity information. NCF and LightGCN are short for ``IMIA for Fed-NCF'' and ``IMIA for Fed-LightGCN''. ``pop'' means popularity information.}\label{fig_popularity}
\end{figure}

\section{Related Work}
In this section, we mainly introduce the related works of attacks against federated learning and attacks against federated recommender systems.
The recent progress of recommender systems, federated recommender systems, federated learning, and local differential privacy can be referred to~\citep{zhang2019deep,yang2020federated,lyu2020threats,trung2020adaptive,wang2020next}.

\subsection{Attack against Federated Learning}
Recently, varieties of attacks were proposed to access privacy risks in federated learning (FL)~\cite{lyu2020threats,rodriguez2022survey}.
These attacks include threats such as model inversion~\cite{zhang2020secret}, attribute inference~\cite{ganju2018property}, and membership inference.
In this paper, we mainly discuss membership inference attacks.
Nasr et al.~\cite{nasr2019comprehensive} took the first comprehensive study of class-level membership inference attack in FL under both white-box and black-box settings.
Then, many works took further steps to study more fine-grained membership inference attacks, e.g.~\cite{nguyen2017argument,wang2019beyond,zhao2021user,hu2021source,suri2022subject}.
However, existing membership inference attacks cannot be used in FedRec because of the major differences mentioned in Section~\ref{sec:introduction}.

\subsection{Attack against Federated Recommendation}
Zhang et al.~\cite{zhang2022comprehensive} conducted the first analysis of FedRec's privacy-preserving, however, their work only reveals attribute-level leakage risks.
Some research discussed the user rating privacy issue of FedRec with explicit feedback~\cite{lin2020fedrec,liang2021fedrec++,lin2021fr,lin2022generic}, but the interaction privacy issue of FedRec with implicit feedback is another pair of shoes.
Other attack methods~\cite{zhang2022pipattack} aim to promote/demote item's rank, which cannot reveal the privacy issue of FedRecs.
As a result, the privacy issue of FedRecs is still under explored.
Besides, the defense method for improving federated recommendation's privacy protection is also under explored~\cite{yuan2022federated}.

\section{Conclusion}
In this paper, we perform the first study of interaction-level membership inference attacks (IMIA) in federated recommender systems (FedRecs) to reveal the privacy issue of user-item interactions.
We first design an attacker from the curious-but-honest server side.
The attacker infers the target user's private interaction based on its uploaded public parameters by iteratively training shadow models on shadow datasets.
We implement IMIA attack with two commonly used FedRecs on three real-world datasets.
The experimental results validate the threats of IMIA for FedRecs.
Furthermore, we find that the classical privacy-preserving method, LDP, cannot effectively defend against our attack.
In light of this, we propose a novel defender to mitigate IMIA threats with imperceptible influence on the recommendation performance.

\begin{acks}
  This work is supported by Australian Research Council Future Fellowship (Grant No. FT210100624), Discovery Project (Grant No. DP190101985), and Discovery Early Career Research Award (Grant No. DE200101465).
\end{acks}

\bibliographystyle{ACM-Reference-Format}
\balance


Search for the rare decays $J/ψ\to D^{0} e^{+}e^{-} +c.c.$ and $ψ(3686) \to D^{0} e^{+}e^{-} +c.c.$

Abstract: Using the data samples of $(1310.6\pm7.2 )\times 10^{6}$ $J/\psi$ events and $(448.1\pm2.9)\times 10^{6}$ $\psi(3686)$ events collected with the BESIII detector, we search for the rare decays $J/\psi \to D^{0} e^{+}e^{-} +c.c.$ and $\psi(3686) \to D^{0} e^{+}e^{-} +c.c.$. No significant signals are observed and the corresponding upper limits on the branching fractions at the $90\%$ confidence level are determined to be $Br(J/\psi \to D^{0} e^{+}e^{-} +c.c.)< 8.5\times 10^{-8}$ and $Br (\psi(3686) \to D^{0} e^{+}e^{-} +c.c.)<1.4\times 10^{-7}$, respectively. Our limit on $Br(J/\psi \to D^{0} e^{+}e^{-} +c.c.)$ is more stringent by two orders of magnitude than the previous results, and the $Br(\psi(3686) \to D^{0} e^{+}e^{-} +c.c.)$ is measured for the first time.

\section{ACKNOWLEDGMENTS}
The BESIII collaboration thanks the staff of BEPCII, the IHEP computing center and the Supercomputing center of USTC for their strong support. This work is supported in part by National Key Basic Research Program of China under Contract No. 2015CB856700; National Natural Science Foundation of China (NSFC) under Contracts Nos. 11235011, 11322544, 11335008, 11425524, 11322544, 11375170, 11275189, 11475169, 11475164, 11575133, 11625523, 11635010; the Chinese Academy of Sciences (CAS) Large-Scale Scientific Facility Program; the CAS Center for Excellence in Particle Physics (CCEPP); the Collaborative Innovation Center for Particles and Interactions (CICPI); Joint Large-Scale Scientific Facility Funds of the NSFC and CAS under Contracts Nos. 11179007, U1332201, U1532257, U1532258; CAS under Contracts Nos. KJCX2-YW-N29, KJCX2-YW-N45, QYZDJ-SSW-SLH003; 100 Talents Program of CAS; National 1000 Talents Program of China; INPAC and Shanghai Key Laboratory for Particle Physics and Cosmology; German Research Foundation DFG under Contracts Nos. Collaborative Research Center CRC 1044, FOR 2359; Istituto Nazionale di Fisica Nucleare, Italy; Koninklijke Nederlandse Akademie van Wetenschappen (KNAW) under Contract No. 530-4CDP03; Ministry of Development of Turkey under Contract No. DPT2006K-120470; National Natural Science Foundation of China (NSFC) under Contracts Nos. 11505034, 11575077; National Science and Technology fund; The Swedish Research Council; U. S. Department of Energy under Contracts Nos. DE-FG02-05ER41374, DE-SC-0010118, DE-SC-0010504, DE-SC-0012069; University of Groningen (RuG) and the Helmholtzzentrum fuer Schwerionenforschung GmbH (GSI), Darmstadt; WCU Program of National Research Foundation of Korea under Contract No. R32-2008-000-10155-0

High Energy Physics - Experiment (hep-ex)


Single photon wavefront-splitting interference: An illustration of the light quantum in action

Abstract: We present a new realization of the textbook experiment consisting in single-photon interference based on the pulsed, optically excited photoluminescence of a single colour centre in a diamond nanocrystal. Interferences are created by wavefront-splitting with a Fresnel's biprism and observed by registering the "single-photon clicks" with an intensified CCD camera. This imaging detector provides also a real-time movie of the build-up of the single-photon fringes. We perform a second experiment with two detectors sensitive to photons that follow either one or the other interference path. Evidence for single photon behaviour is then obtained from the absence of time coincidence between detections in these two paths.

\section{Introduction}
\label{intro}
Many textbooks on Quantum Mechanics, like Feynman's lectures \cite{Feynman}, describe a thought-experiment based on the Young's double-slit interference setup, and realised with independent particles sent one at a time through the interferometer. The striking feature is that the image we have for interference is a wave passing simultaneously through both slits, incompatible with the image of a particle, which goes through either one or the other slit but not both. While the last statement comes naturally for objects primarily known as particles like electrons \cite{Tonomura}, neutrons \cite{Neutrons}, atoms \cite{Carnal} and molecules  \cite{Arndt}, it can be questioned in the case of the ''LichtQuanten" introduced by Einstein \cite{Einstein} in 1905, since light is primarily described as a wave.

\begin{figure}
\includegraphics[width=8.5cm]{fig1.pdf}
 \caption{Wavefront-splitting setup based on a Fresnel's biprism (FB). APDs are avalanche silicon photodiodes operating in photon counting regime. An intensified CCD camera (dash line) records interference fringes in the overlapping region of the two deviated wavefronts. When the CCD is removed, it is then possible to demonstrate the single photon behaviour by recording the time coincidences events between the two output channels of the interferometer.}
 \label{general}
 \end{figure}

One century later, we present a realization of this textbook experiment consisting in single-photon interference. Our experiment, depicted on Fig.\ref{general}, has several new striking features compared to previous works \cite{Grangier,Zeilinger,Benson,Jelezko}: (i) we use a clock-triggered single-photon source from a single emitting dipole, which is both conceptually and practically simple \cite{Kun,Brouri}, (ii) we use a wavefront-splitting interferometer based on a Fresnel's biprism, very close to the basic Young's double-slit scheme, (iii) we register the ''single-photon clicks'' in the interference plane using an intensified CCD camera which provides a real-time movie of the build-up of the single-photon fringes.

In early experiments \cite{Taylor}, the so-called single-photon regime was reached by attenuating light. But Poissonian photon number statistics in faint light pulses leads to the unwanted feature that more than one photon may be present between the source and the interference fringes observation plane. To demonstrate the single-photon behaviour, we also perform the experiment with two detectors sensitive to photons that follow either one or the other interference path. Evidence for single photon behaviour can then be obtained from the absence of time coincidence between detections in these two paths \cite{Grangier,Gerry}. Such a measurement also provides a ''which-path'' information complementary to the interference observation.

The paper is organized as follows. In section $2$, we describe the triggered single-photon source used for the experiment. Section 3 is dedicated to the demonstration of the particle-like behaviour. Finally, single photon interferences are presented in section 4.

\section{Triggered single-photon source using the photoluminescence of a single N-V
colour centre in a diamond nanocrystal }
\label{sec:1}

A lot of efforts have been put in the realization of single-photon-source (SPS) over the recent years. Since first proposal \cite{Imamoglu}, a wide variety of schemes have been worked out, based on the fluorescence from different kinds of emitters, such as molecules, atoms, colour centres and semiconductor structures \cite{General SPS}.
The clock-triggered single-photon source at the heart of our experiment, previously developed for quantum key distribution \cite{Brouri,Alleaume}, is based on the pulsed, optically excited photoluminescence of a single N-V colour centre in a diamond nanocrystal. This system, which consists in a substitionnal nitrogen atom (N) associated to a vacancy (V) in an adjacent lattice site of the diamond crystalline matrix (Fig.2-(a)), has shown an unsurpassed efficiency and photostability at room temperature \cite{Gruber,Kurtsiefer}.

In bulk diamond, the high index of refraction of the material
($n=2.4$) makes difficult to extract N-V colour centre fluorescence efficiently. One way to circumvent this problem is to use diamond nanocrystals, with a size much smaller than the radiated light wavelength, deposited on a microscope glass coverplate~\cite{Beveratos}.  For such sub-wavelength size, refraction becomes irrelevant and the colour centre can
simply be assimilated to a point source radiating at the air-glass
interface. Samples were prepared by a procedure described in Ref.\cite{Beveratos}. N-V colour centre are created by irradiation of type Ib diamond powder with high-energy electrons followed by annealing at $800^{\circ}$C. Under well controlled irradiation dose, the N-V colour centre density
is small enough to allow independent
addressing of a single emitter using standard confocal microscopy, as depicted on Fig.\ref{confoc}-(b).

 \begin{figure}[h!]
  \centerline{\includegraphics[width=8.8cm]{fig2.pdf}}
  \caption{(a)-The N-V  colour centre  consists in a substitionnal nitrogen atom (N), associated to a
 vacancy (V)  in an adjacent lattice site of the diamond crystalline matrix.
(b)-Confocal microscopy setup: pulsed excitation laser
beam at $\lambda =  532$ nm is tightly focused on the
diamond nanocrystals with a high numerical aperture (NA=$0.95$) microscope
objective. Fluorescence light emitted by the N-V colour centre
is collected by the same objective and then spectrally filtered from the
remaining pump light. Following  standard
confocal detection scheme, collected light is focused onto a $100$
microns diameter pinhole.
The reflected part from a $50$/$50$ beamsplitter (BS) goes then into an imaging spectrograph,
while the transmitted part is detected by a silicon avalanche photodiode in photon counting regime and used for fluorescence raster scan as shown in (c). The central peak corresponds to the
photoluminescence of the single N-V colour centre used in the single-photon interference experiment. (d)-Fluorescence spectrum of this single N-V colour centre recorded with a  back-illuminated cooled CCD matrix (2 minutes integration duration)  placed in the image plane of the spectrograph. The peak fluorescence wavelength is at
670~nm. The two sharp lines (1) and (2) are respectively the two-phonon Raman
scattering line of the diamond matrix associated to the excitation wavelength
and the N-V centre zero phonon line at 637~nm which characterizes the negatively charged N-V colour centre photoluminescence.}
\label{confoc}
\end{figure}

Under pulsed excitation with a pulse duration shorter than the
radiative lifetime, a single dipole emits photons one by one \cite{Brouri_PRA00,De Martini}. As described in Ref.\cite{Kun}, we use a home-built pulsed laser at a wavelength of 532~nm with a 800~ps pulse duration to excite a single N-V colour centre. The 50~pJ energy per pulse is high enough to ensure efficient pumping of the defect centre in its excited level. The
repetition rate, synchronized on a stable external clock, can be adjusted
between 2 to 6 MHz so that successive fluorescent decays are well
separated in time from each other. Single photons are thus emitted by
the N-V colour centre at predetermined times within the accuracy of
its excited state lifetime, which is about 45~ns (See Fig.\ref{fig_biprisme_HBT}) for the centre used in
the experiment.

As a proof of the robustness of this single-photon source, note that all the following experiments have been realised with the same emitting N-V colour centre.

 \section{"Which-path" experiment : particle-like behaviour}
Single photons emitted by the N-V  colour centre are now sent at normal incidence onto a
Fresnel's biprism. Evidence for a particle-like behaviour can be obtained using the arrangement of Fig.\ref{general}. If light is really made of quanta, a single photon should either be deviated upwards or downwards, but should not be split by the biprism. In that case, no coincidences corresponding to joint photodetections on the two output beams should be observed. On the opposite, for a semi-classical model that describes light as a classical wave, the input wavefront will be split in two equal parts, leading to a non-zero probability of joint detection on the two photodetectors. Observation of zero coincidences, corresponding to an anticorrelation effect, would thus give evidence for a particle-like behaviour.

For a realistic experiment aimed at evidencing this property, we need to establish a criterion which enables us to discriminate between a particle-like behaviour and another one compatible with the semi-classical model for light. For that, we faithfully follow the approach introduced in Ref.\cite{Grangier} for interpreting single photon anticorrelation effect on the two output channels of a beamsplitter.  We consider a run corresponding to $N_{T}$ trigger pulses applied to the emitter, with $N_{1}$ (resp. $N_{2}$) counts detected in path 1 (resp. 2) of the interferometer, and $N_{C}$ detected coincidences. It is straightforward to show that any semi-classical theory of light, in which light is treated as a wave and photodetectors are quantized, predicts that these numbers of counts should obey the inequality

\begin{equation}
\alpha = \frac{N_{C}N_{T}}{N_{1}N_{2}} \geq 1.
\end{equation}

Violation of this inequality thus gives a criterion which characterizes nonclassical behaviour. For a single photon wavepacket, perfect anticorrelation is predicted since the photon can only be detected once, leading to $\alpha=0$ in agreement with the intuitive image that a single photon cannot be detected simultaneously in the two paths of the interferometer. On the other hand, inequality (1) cannot be violated even with faint laser pulses. Indeed, in this case the number of photons in the pulse follows a Poisson law predicting $\alpha=1$. This value indicates that coincidences will then be observed preventing the particle-like behaviour to be evidenced. We measured the $\alpha$ correlation parameter for triggered single-photon pulses and for faint laser pulses. To establish a valid comparison between these two cases, all data have been taken for an identical mean number of detected photons per pulse, below $10^{-2}$.

\begin{figure}[t]
 \centerline{\includegraphics[width=9cm]{fig3.pdf}}
 \caption{Histogram of time intervals between consecutive photodetection events in the two paths of the wavefront-splitting interferometer.  The pulsed excitation laser repetition period is 444~ns, and the total counting time was 148.15~s . Lines are exponential fits for each peak, corresponding to a radiative lifetime of  $44.6\pm 0.8$~ns. Values written above each peak correspond to their respective  area normalized to the corresponding value for poissonian photon number statistics. The strong reduction of coincidences around zero delay gives evidence for single-photon emission by the excited N-V colour centre and for   its particle-like behaviour as the wavefront  is split in two parts by the Fresnel's  biprism.}
 \label{fig_biprisme_HBT}
\end{figure}

\begin{table}
\caption{Measurements of the correlation parameter $\alpha$ associated to ten independant sets of $10^5$ photodetections (lasting about 5~s) registered for ({\it a})  faint laser pulses with a mean number of photons per pulse below $10^{-2}$ and ({\it b}) single-photon pulses emitted by the N-V colour centre.
As the laser emits coherent states of light, the number of photons in each pulse is given by Poissonian statistics, leading to a correlation parameter $\alpha = 1.00 \pm 0.06$, the precision being inferred from simple statistical analysis with a 95\% confidence interval. On the other hand, an anticorrelation effect, corresponding to $\alpha = 0.13 \pm 0.01<1$, is clearly observed for single-photon pulses propagating through the Fresnel's biprism.}
\label{tab:1}

\begin{center}
({\it a}) {\it Faint laser pulses}\\
\vspace{0.15cm}
\begin{tabular}{lllll}
\hline\noalign{\smallskip}
Counting time (s)
    & $N_{1}$
      &  $N_{2}$
          &   $N_{C}$
             &   $\alpha$\\
             \noalign{\smallskip}\hline\noalign{\smallskip}
4.780 & 49448 & 50552 & 269 & 1.180\\
          4.891 & 49451 & 50449 & 212 & 0.937\\
        4.823 & 49204 & 50796 & 211 & 0.934\\
          4.869 & 49489 & 50511 & 196 & 0.875\\
          4.799 & 49377 & 50623 & 223 & 0.981\\
          4.846 & 49211 & 50789 & 221 & 0.982\\
          4.797 & 49042 & 50958 & 232 & 1.021\\
          4.735 & 49492 & 50508 & 248 & 1.077\\
          4.790 & 49505 & 50495 & 248 & 1.090\\
          4.826 & 49229 & 50771 & 219 & 0.970\\

\noalign{\smallskip}\hline
\end{tabular}
\end{center}

\vspace{0.35cm}
\begin{center}
({\it b}) {\it Single-photon pulses}\\
\vspace{0.15cm}
\begin{tabular}{lllll}
\hline\noalign{\smallskip}
Counting time (s)
    & $N_{1}$
      &  $N_{2}$
          &   $N_{C}$
             &   $\alpha$\\
             \noalign{\smallskip}\hline\noalign{\smallskip}

         5.138 & 49135 & 50865 & 28 &  0.132\\
          5.190 & 49041 & 50959 & 23 & 0.109\\
        5.166 & 49097 & 50903 & 23 & 0.109\\
          5.173 & 49007 & 50996 & 28 & 0.133\\
          5.166 & 48783 & 51217 & 29 & 0.137\\
          5.167 & 48951 & 51049 & 31 & 0.147\\
          5.169 & 49156 & 50844 & 30 & 0.142\\
          5.204 & 49149 & 50851 & 32 & 0.152\\
          5.179 & 49023 & 50977 & 26 & 0.124\\
          5.170 & 48783 & 51217 & 26 & 0.123\\
\hline
\end{tabular}
\end{center}
\end{table}

Since the single-photon source emits light pulses triggered by a stable external clock and
well separated in time,  the value of $\alpha$ can be directly inferred from the record of all photon arrival times. Every photodetection event produced by the two avalanche photodiodes  is time-stamped using a time-interval-analyser (TIA) computer board
(GT653, GuideTech).  Straightforward processing of these timestamps over a discrete time base allows us to reconstruct the number of detection events on each output channel of the biprism interferometer, and thus gives an access to the "which-path" information. Furthermore,  time intervals between two successive photodetections are directly inferred from the timestamps ensemble,  so as to estimate if  a coincidence has occurred or not for each registered photodetection. However  the notion of coincidence is meaningful only accordingly to a temporal gate: there will be a coincidence if two detections happen within the same gate. As the radiative lifetime of the emitting N-V colour centre
used for the experiment is approximately equal to 45~ns (see Fig.\ref{fig_biprisme_HBT}),   we set the   gate duration to 100~ns. Such a value is  much smaller than the 436~ns time interval between two successive excitation pulses. It  also ensures that about  90\% of the detected photons are considered for data analysis.

Using the results given on Table~1
 and simple statistical analysis associated to a 95\% confidence interval, we infer
$\alpha = 1.00 \pm 0.06$  for faint laser pulses and
$\alpha = 0.13 \pm 0.01$ for single-photon pulses.

As expected, light pulses emitted by the single-photon source lead  to a  strong violation of the inequality $\alpha \geq 1$ valid for any semi-classical theory of light. The non-ideal value  $\alpha \not= 0 $ is due to remaining background fluorescence of the sample and to the two-phonon Raman scattering line, which induces a non-vanishing probability of having more than one photon in the emitted light pulse.  Table~1 also shows that the number of coincidences observed with faint laser pulses, within a given integration time, is much higher than in the experiment with single-photon pulses, and corresponds to $\alpha$ equal to unity within one standard deviation. This result  is a clear confirmation that it is not possible to demonstrate the particle-like behaviour with attenuated pulses from a classical light source, involving many emitters simultaneously and independently excited.

From the set of photodetection timestamps, one can also build the histogram of delays between two consecutive detections on the two paths of the wavefront-splitting  interferometer.  In the limit of low collection efficiency and short timescale, the recorded histogram coincides with a measurement of the second-order  autocorrelation function $g^{(2)}$ \cite{Reynaud}.
As shown in Fig.\ref{fig_biprisme_HBT}, strong reduction of coincidences around zero delay gives again clear evidence for single-photon behaviour \cite{Brunel}. Note that the area of the zero-delay peak, normalized to its value for coherent pulses with poissonian statistics, is strictly equivalent to the $\alpha$ correlation parameter previously defined.

\section{Single-photon interference setup and data analysis}
\label{sec:3}

\subsection{Experimental setup and observations}
\label{sec:2.1}
 Using the same N-V colour centre, we now observe the interference fringes in the
intersection volume of the two separated wavefronts, as shown in Fig.\ref{general}.

Interference patterns are detected in a single-photon recording mode,
using an intensified CCD camera (\emph{iStar} from
Andor Technologies, Ireland) cooled at $-25^\circ{\rm C}$. An eye-piece, equivalent
to a short focal length achromatic lens ($f=22$~mm)  is inserted between the biprism and the camera,
in order to obtain a fringe spacing much larger than the $25~\mu$m  pixel size of the camera.
Image acquisition parameter are optimized by adjusting the camera gain and the detection threshold, so that more than $\approx 88\%$ of the bright pixels correspond to detections of single photons.

 \begin{figure}[ht]
  \centerline{\includegraphics[width=9cm]{fig4.pdf}}
 \caption{Observation of the interference pattern expanded by the eyepiece and recorded by the intensified CCD camera. Image (a) (resp. (b) and (c)) is made of 272 photocounts (resp. 2240 and 19773)  corresponding to an exposure duration of 20~s (resp. 200~s  and 2000~s). Graph (d) displays the resulting interference fringes obtained by binning columns of CCD image (c) and fit of this interference pattern using coherent beam propagation in the Fresnel diffraction regime, and taking into account the finite temporal coherence due to the broad spectral emission of the NV colour centre. A visibility of 94\% can be associated to the central fringe.}
\label{interf_setup}
\end{figure}

Snapshots with exposure duration of 1~s are acquired one after each
other, with a mean number of eight photons detected on the CCD
array per snapshot. Accumulated images show how
the interference pattern builds up (Fig.\ref{interf_setup}). Less than 200 accumulated snapshots are required to clearly see the fringes pattern, and the final image contains about $2\times 10^4$ single photodetection events. This is a demonstration of the wave-like behaviour of light, even in the single-photon regime. To display fringe pattern gradual build-up, we generated a movie from the 2000 snapshots (available as Supplementary File). The movie frame rate is set to a value of  30 images per second resulting in a build-up 30 times faster than in real time.

\subsection{Fit of the interference pattern}
\label{sec:2.2}
The interference pattern obtained with a monochromatic plane wave incident on Fresnel's biprism would result in sinusoidal fringes with a visibility equal to unity. In our experiment,  the finite spatial extension of the single-photon wavefront yields more complicated interference patterns. In order to fit the fringes shown on Fig.\ref{interf_setup}-(c), we performed a computer simulation of the beam propagation through the Fresnel's biprism using free space propagation theory from classical optics.
Starting at the input of the Fresnel's biprism with a TEM$_{00}$ wavefront associated to a measured 1.25~mm FWHM gaussian intensity distribution, the output field amplitude is calculated in a virtual observation plane located at a given distance $z$ behind the biprism input plane~\cite{Note}. The expected pattern in the CCD plane simply results
from the expansion by the eye-piece of this calculated intensity pattern.

In order to fit more accurately the fringes minima, we also take into account temporal coherence effects due to the N-V colour centre broadband incoherent emission (see Fig.\ref{confoc}-(d)).  Finally the calculated intensity pattern is normalized to the total recorded intensity so that the only remaining fitting parameter is the observation distance $z$.
The quality of the fit is illustrated by Fig.\ref{interf_setup}-(d), recorded approximately in the middle of the interference field. All over the interference pattern, the visibility of the fringes is very well described by the beam propagation simulation with the addition of finite temporal coherence of the source.

  \begin{figure} [t]
  \centerline{\includegraphics[width=8.8cm]{fig5.pdf}}
  \caption{Examples of interference patterns observed in the overlapping region of the two transmitted beams through the Fresnel's biprism, for (a) $z = 11 $ mm and (b) $z = 98$ mm.  Overlayed blue curves are fits evaluated from a model taking   into account Fresnel diffraction and temporal coherence effects.}
 \label{fresnel}
 \end{figure}

Validity of the model is furthermore confirmed by fits of interference patterns
observed for two others $z$ positions, as shown in Fig.\ref{fresnel}.
The good agreement between the fit and the experimental data is an illustration of the well-known result from Quantum Optics that phenomena like interference, diffraction, propagation, can be computed with the classical theory of light even in the single-photon regime \cite{Gerry}.

\section{Conclusion}
  \label{sec:conc}

Summarizing, we have carried out the two complementary experiments of "interference observation vs. which-path detection" in the single-photon regime. While our results may not appear as a big surprise, it is interesting to note that one century after Einstein's paper the intriguing properties of the photon still give rise to sometimes confused debates \cite{Afshar}. We hope that our experiment can contribute not only to clarify such discussions, but also to arouse the interest and astonishment of those who will discover the photon during the century to come.