Graph Neural Networks for Privacy-Preserving Recommendation with Secure Hardware

Local differential privacy (LDP) is widely used in graph neural networks (GNNs) for recommendation to protect users’ privacy. However, existing LDP-based GNNs usually introduce too much noise caused by the untrusted servers and result in poor model accuracy. The emergence of trusted execution environments such as intel SGX can guarantee code integrity and data confidentiality, and lead a new direction in differential privacy. In this paper, we propose a federated GNN recommendation system based on SGX and DP, which converts the LDP model into a central differential privacy (CDP) model without a trusted server. Specifically, in our scheme, the SGX runs differentially private computations on the data and reveals the results, which introduces less noise while achieving the same privacy protection level compared with LDP. And in order to address the privacy concerns caused by side channel attacks in SGX, we additionally use homomorphic encryption to encrypt the data before uploading, so that even if SGX is breached, the adversary could only access the ciphertext, not the plaintext. We prove that our algorithm satisfies (epsilon, delta) -CDP for data owners and conduct experiments on several real-world datasets. The result shows that our method is outperforming existing LDP-based GNN recommendation systems.