  Modern recommender systems are trained to predict users potential future
interactions from users historical behavior data. During the interaction
process, despite the data coming from the user side recommender systems also
generate exposure data to provide users with personalized recommendation
slates. Compared with the sparse user behavior data, the system exposure data
is much larger in volume since only very few exposed items would be clicked by
the user. Besides, the users historical behavior data is privacy sensitive and
is commonly protected with careful access authorization. However, the large
volume of recommender exposure data usually receives less attention and could
be accessed within a relatively larger scope of various information seekers. In
this paper, we investigate the problem of user behavior leakage in recommender
systems. We show that the privacy sensitive user past behavior data can be
inferred through the modeling of system exposure. Besides, one can infer which
items the user have clicked just from the observation of current system
exposure for this user. Given the fact that system exposure data could be
widely accessed from a relatively larger scope, we believe that the user past
behavior privacy has a high risk of leakage in recommender systems. More
precisely, we conduct an attack model whose input is the current recommended
item slate (i.e., system exposure) for the user while the output is the user's
historical behavior. Experimental results on two real-world datasets indicate a
great danger of user behavior leakage. To address the risk, we propose a
two-stage privacy-protection mechanism which firstly selects a subset of items
from the exposure slate and then replaces the selected items with uniform or
popularity-based exposure. Experimental evaluation reveals a trade-off effect
between the recommendation accuracy and the privacy disclosure risk.
