Trustworthy Personalized Federated Recommender System with Blockchain-Assisted Decentralized Reward Management

1  Introduction

Recommender systems (RS) have become a fundamental component of modern intelligent services, supporting personalized content delivery in domains such as e-commerce, media streaming, smart healthcare, and mobile applications [1,2]. These systems rely heavily on large-scale user interaction data to infer individual preferences and generate accurate recommendations. However, the centralized collection and processing of such data raise serious concerns regarding user privacy, regulatory compliance, and data ownership [3]. In response, federated learning (FL) has emerged as a promising paradigm that enables collaborative model training while keeping raw user data localized on client devices [4,5]. By design, FL aligns well with privacy-preserving requirements and distributed deployment environments. Despite its advantages, directly applying federated learning to recommender systems remains challenging [6]. Recommendation tasks are inherently personalized, data distributions across users are highly non-IID, and evaluation is dominated by ranking-oriented objectives rather than simple prediction accuracy. Existing FedRS often struggle to maintain personalization quality while ensuring stable convergence under heterogeneous client behavior [7,8]. More critically, most approaches implicitly assume honest participation, rendering them vulnerable to shilling attacks, model poisoning, and free-riding behavior, particularly in open or cross-organizational federated environments. Recent studies have shown that these vulnerabilities are exacerbated in recommendation scenarios, where malicious updates can subtly manipulate item rankings without significantly affecting global loss values [3,6,9,10]. Blockchain-assisted FL has therefore attracted increasing attention as a means to enhance trust, transparency, and incentive alignment [11–13]. Pang et al. [9] demonstrated that reputation-driven aggregation combined with blockchain-based accountability can effectively suppress adversarial behavior in generic federated learning tasks. However, such frameworks are primarily designed for classification or regression settings and do not consider the unique structural and evaluative characteristics of recommender systems.

Federated recommender systems introduce additional complexities that are not adequately addressed by existing blockchain-FL solutions [14,15]. First, contribution quality in RS is best measured through top-K ranking metrics such as NDCG or Hit Ratio, rather than loss reduction. Second, personalization requires careful separation between global collaborative knowledge and user-specific representations. Third, naive reputation assignment or uniform reward allocation may distort learning dynamics, leading to overfitting to dominant clients or marginalization of sparse-data participants. As highlighted by Cai et al. [10], effective trust mechanisms for federated recommendation must be explicitly ranking-aware and resistant to strategic manipulation.

Several recent studies have explored the integration of trust, privacy, and decentralization in RS through different architectural choices [6,14]. Existing decentralized and privacy-preserving approaches highlight the importance of secure aggregation, robustness, and identity management in distributed recommendation settings. However, most of these methods either depend on centralized trust assumptions or treat federated learning as a generic optimization process, without explicitly accounting for personalization, ranking-oriented objectives, and incentive alignment. As a result, a key gap remains in current FedRS research: the lack of a unified, domain-aware framework that jointly supports personalized modeling, ranking-aware contribution assessment, robustness against adversarial clients, and decentralized reward management. Addressing this gap requires redesigning both the learning and incentive layers of FedRS with recommendation-specific trust signals rather than relying on generic federated abstractions.

In this paper, we propose T-FedRS, a Trustworthy Personalized Federated Recommender System with Blockchain-Assisted Decentralized Reward Management. The proposed framework extends FedNCF [16] by integrating a ranking-aware reputation mechanism and a blockchain-backed incentive layer. Personalization is preserved through locally maintained user embeddings, while (global) item interaction parameters are learned collaboratively. Unlike conventional federated aggregation, client contributions are evaluated via peer-based ranking metrics on a public probe set, ensuring that reputation reflects true recommendation utility rather than raw update magnitude.

To enforce transparency and incentive alignment, T-FedRS employs a lightweight blockchain layer that records cryptographic commitments, reputation evidence, and reward allocations in a tamper-resistant manner. Reputation-weighted aggregation suppresses low-quality or malicious updates, while decentralized reward settlement incentivizes sustained honest participation. Importantly, only compact metadata are stored on-chain, ensuring scalability and avoiding excessive communication overhead. Collectively, our work brought the following key contributions:

•   We propose T-FedRS, a unified framework for trustworthy FedRS that extends federated neural collaborative filtering with a decentralized incentive mechanisms, enabling personalized recommendation under non-IID data while preserving data locality and scalability.

•   We introduce a ranking-aware decentralized reputation mechanism tailored to FedRS, where client contributions are evaluated via top-K ranking metrics, allowing reliable differentiation between high-quality and adversarial updates beyond loss- or gradient-based criteria.

•   We design a decentralized reward management scheme that binds contribution evidence, reputation evolution, and incentive allocation in a tamper-resistant manner, ensuring long-term incentive compatibility and discouraging shilling and model poisoning behaviors.

•   Through extensive experiments, we empirically demonstrate superior recommendation performance, maintains stable convergence with moderate communication overhead, and remains robust against a high fraction of malicious clients, while producing stable and meaningful reputation dynamics aligned with true contribution quality.

2  Related Work

This work intersects three primary research directions: federated recommender systems, trust and robustness in federated learning, and blockchain-assisted decentralized learning with incentives for RS and FedRS. We review these areas and highlight how the proposed T-FedRS advances beyond existing studies.

Federated Recommender Systems. Federated recommender systems extend federated learning to collaborative filtering by enabling decentralized model training while preserving user privacy. Early efforts focused on adapting matrix factorization and neural collaborative filtering to the federated setting, primarily by partitioning users across clients and aggregating shared item representations. Perifanis and Efraimidis [16] introduced Federated Neural Collaborative Filtering (FedNCF), demonstrating that separating user embeddings from globally shared item factors can preserve personalization under privacy constraints. However, most existing FedRSs assume benign clients and rely on uniform or data-volume-based aggregation. As a result, they are highly susceptible to shilling attacks and malicious model updates, particularly in open or cross-domain deployments [6,8]. Recent surveys have emphasized that robustness and trust remain largely underexplored in federated recommendation, especially when ranking-oriented objectives dominate evaluation [14,17].

Robust and Trust-Aware Federated Learning. Robust federated learning has been extensively studied in the context of classification and regression tasks. Techniques such as trimmed mean, median aggregation, and Byzantine-resilient optimization aim to mitigate the influence of adversarial updates without relying on explicit trust modeling [18–20]. While effective in certain settings, these methods operate purely at the parameter level and are agnostic to task semantics. Such generic defenses may fail to detect subtle attacks that preserve loss values while manipulating task-specific outputs, such as item rankings. In addition, several studies propose accuracy-based or loss-based contribution evaluation to guide aggregation [19,21]. Nevertheless, these approaches are ill-suited for RS, where small parameter changes can lead to large ranking shifts.

Blockchain-Assisted FL and Incentives. Blockchain-assisted FL has emerged as a promising direction for addressing trust, auditability, and incentive alignment in decentralized learning environments. Lo et al. [22] and Yang et al. [20] explored blockchain-based aggregation and secure logging of model updates, demonstrating improved transparency and resistance to tampering. Other works incorporated token-based incentives to encourage participation and discourage free-riding behavior [23]. Despite these advances, most blockchain-FL frameworks do not account for personalization, ranking-based evaluation, or the structural properties of recommender models. Furthermore, on-chain storage of model updates often incurs prohibitive overhead. In contrast, T-FedRS stores only compact cryptographic commitments and reputation evidence on-chain, while keeping all high-dimensional updates off-chain, achieving a practical balance between transparency and efficiency.

Compared with existing FedRS, T-FedRS is a unique framework to jointly integrate personalized FedNCF, ranking-aware decentralized reputation measurement, and blockchain-assisted reward management. Unlike robust aggregation methods that blindly integrate outliers, our reputation mechanism evaluates updates based on their observable impact on recommendation quality. Unlike prior general blockchain-FL approaches, our incentive design is explicitly aligned with ranking performance. This unified design enables T-FedRS to simultaneously preserve personalization, enhance robustness against adversarial behavior, and ensure fair, decentralized incentive allocation, addressing key limitations of prior work.

3  Methodology

This section presents the design of T-FedRS. We integrate FedNCF with decentralized reputation-driven aggregation and blockchain-based reward settlement to ensure personalization, robustness against adversarial behaviors, and verifiable contributor incentives.

3.1 Problem Statement

We consider a distributed recommendation environment with a set of clients 𝒦, each holding private implicit-feedback data Dk and collaboratively training a shared neural collaborative filtering model. The objective is to learn global item representations and interaction parameters while preserving personalization through user-specific embeddings, without exposing raw data. Traditional federated recommenders remain vulnerable to poisoned model updates, inconsistent contribution measurement, and unfair reward allocation. Our goal is to formulate a trustworthy federated recommender framework that (i) evaluates each client’s contribution via ranking-aware reputation, (ii) performs reputation-weighted aggregation to ensure robustness, and (iii) enforces decentralized, tamper-resistant reward distribution through a blockchain layer.

3.2 System Architecture

The proposed architecture operates over a set of clients 𝒦, each holding private implicit-feedback data and maintaining local user-specific parameters while collaboratively learning global item embeddings and interaction network parameters. As highlighted in Fig. 1, the architecture is structured into two tightly coupled phases: an off-chain FL phase responsible for local model updates, peer-based reputation evaluation, and reputation-weighted aggregation; and an on-chain settlement phase that records cryptographic commitments, final reputation scores, and reward allocations on a tamper-evident blockchain ledger.

Figure 1: System architecture of the proposed T-FedRS framework. Clients perform personalized federated training and submit compressed updates with cryptographic commitments. Ranking-aware decentralized reputation drives weighted aggregation of global model parameters, while a lightweight blockchain records reputations and reward allocations to ensure transparent and tamper-resistant incentive management.

During the off-chain phase, each client k performs local training on its dataset Dk to obtain a model update Δkt consisting of sparse item-embedding variations and dense neural parameter deltas. Clients optionally apply a compression operator with ratio sk, and may add calibrated differential-privacy noise before transmitting updates. A cryptographic commitment Ckt is produced for each update to ensure later verifiability. Contribution evaluation is performed collaboratively: peers verify the utility of Δkt by computing ranking-aware metrics on the public probe dataset P, producing local evaluations mj←kt. A robust aggregation mechanism generates a stable contribution estimate Mkt, which is mapped through a calibrated monotonic function to produce the per-round reputation score Rkt. Aggregation is then applied to produce the updated global item embeddings Vt+1 and interaction parameters Θt+1, treating embedding matrices and neural parameters under separate fusion rules to preserve latent-factor consistency.

In the on-chain phase, clients submit commitments together with succinct proofs of evaluation to a blockchain ledger ℬ. The blockchain records (Ckt,Rkt) and executes a decentralized reward allocation policy that distributes the per-round reward pool Wt proportionally to long-term smoothed reputations R~kt. The consensus mechanism incorporates reputation-aware difficulty adjustment, allowing high-reputation clients to receive preferential block inclusion probability. Only compact metadata and reputation evidence are stored on-chain, while all high-dimensional model updates remain off-chain to ensure scalability. Privacy and security are enforced through secure aggregation for model fusion, differential privacy for embedding deltas, signed peer evaluations, and optional zero-knowledge attestations for verifying evaluation correctness without exposing additional information.

3.3 Base Recommender FedNCF

To instantiate personalized recommendation within the proposed framework, we adopt a federated variant of neural collaborative filtering in which each client maintains local user embeddings while collaboratively learning global item representations and interaction parameters. The underlying model consists of three components: a user embedding matrix Uk stored locally at client k, a shared item-embedding matrix V, and an interaction network parameterized by Θ implementing a multi-layer perceptron that captures nonlinear user-item interactions. During each communication round, client k receives the current global parameters (Vt,Θt), performs several local optimization steps on its private data Dk, and produces an update Δkt that reflects changes in both the item embeddings and the neural network parameters.

In order to maintain consistency of latent factors and reduce interference among heterogeneous client updates, we adopt the decomposition strategy introduced in FedNCF [16], separating the aggregation of embedding matrices from that of neural parameters. Item-embedding updates are fused through a factor-aware rule that considers exposure frequencies and reputation weights, ensuring that shared item factors evolve coherently across clients. In contrast, the dense interaction parameters are aggregated through reputation-weighted federated averaging, which is more suitable for neural components with smooth loss landscapes. This decomposition avoids the instability that arises from mixing sparse embedding deltas with dense parameter updates and improves convergence behavior in federated settings.

3.4 Personalization Strategy

The federated recommendation setting requires preserving individual preference patterns while benefiting from shared collaborative signals [12,13,24]. Building on the decomposed FedNCF architecture, personalization is primarily achieved by retaining user-specific embeddings Uk locally at each client, allowing them to evolve exclusively under the influence of private interactions in Dk. These embeddings are never exchanged, ensuring both privacy protection and user-level adaptation. Beyond user embeddings, the system also supports lightweight item-specific adapters maintained by clients to correct global item factors for local consumption. To integrate global collaborative knowledge with such local adaptations, we adopt a meta-personalization mechanism in which each client maintains a personalization coefficient αk∈[0,1] that governs the contribution of the global model relative to its local variant. For a user i at client k and item j, the predicted relevance score is computed as:

y^kij=g(αkfglobal(ui,vj;Θ)+(1−αk)flocal(uk,i,vj;Θk)),(1)

where fglobal uses the shared parameters (V,Θ) and flocal uses client-specific parameters (Uk,Θk) with optional item-level adapters. This provides a smooth interpolation between global recommendations and purely local user-item interaction patterns. The gating parameter αk can be learned jointly with the model through gradient-based optimization or adjusted according to a scheduling rule that increases reliance on global parameters as the federation converges. The personalization strategy thus complements the reputation-weighted aggregation and decentralized incentive design by enabling heterogeneous clients to contribute meaningfully without compromising individual preference modeling. Through local fine-tuning, optional adapters, and meta-personalization gating, the system maintains a coherent global model while respecting user-specific heterogeneity inherent in federated recommender environments.

3.5 Decentralized Reputation Measurement

In FedRS, contribution quality must reflect ranking performance rather than predictive loss. Each client update Δkt is therefore evaluated using ranking metrics computed on a public probe set P. A subset of peers ℰkt applies Δkt and reports ranking scores mj←kt, yielding multiple independent assessments subject to potential noise or manipulation. Robust consolidation is performed as

Mkt=ℛ({mj←kt:j∈ℰkt}),(2)

where ℛ denotes a resilient estimator such as a trimmed mean or median. To improve resolution and stability, the aggregated score is mapped to a continuous reputation via

Rkt=ℳ(Mkt),(3)

where ℳ is a monotonic calibration mapping function. The resulting Rkt directly governs reputation-weighted aggregation and downstream incentive allocation.

3.6 Decentralized Reward Management

Reputation scores are coupled with a blockchain-based reward mechanism to ensure transparent and incentive-aligned collaboration. In each round t, a reward pool Wt is distributed based on a smoothed reputation signal

R~kt=γR~kt−1+(1−γ)Rkt,(4)

where γ controls temporal smoothing. Clients submit cryptographic commitments Ckt and reputation evidence on-chain, while full model updates remain off-chain. Rewards are allocated proportionally to R~kt, and reputation-aware prioritization is applied during consensus. Slashing rules penalize detected protocol violations, limiting reward monopolization and collusion.

3.7 Secure Aggregation

The decentralized federated recommendation setting requires strong privacy protection to prevent leakage of sensitive user preferences while preserving collaborative utility [11]. This risk is amplified in embedding-based models, where user and item representations may implicitly encode fine-grained behavioral signals. To address this, we adopt a secure aggregation strategy aligned with the decomposed structure of federated neural collaborative filtering. Specifically, aggregation is performed separately for item embeddings and neural interaction parameters, ensuring that only aggregated updates are revealed and no individual client updates can be inspected by the coordinator or colluding participants. Inspired from recent protection strategies [13,24] against inference attacks, differential privacy is incorporated into the update pipeline using an importance-aware noise mechanism. Let Δvk,jt denote the update to item embedding j from client k at round t. Noise is injected as:

Δv~k,jt=Δvk,jt+𝒩(0,σj2),(5)

where the noise variance σj2 is adapted based on item exposure frequency. Highly exposed items receive stronger noise to limit privacy leakage, while sparsely observed items are assigned tighter noise budgets to preserve learning signal. This design balances privacy and recommendation quality under skewed popularity distributions. To ensure the integrity of decentralized reputation computation, peer evaluation reports are digitally signed and validated using threshold-based acceptance rules. For stronger adversarial settings, secure multi-party computation can be applied to aggregate evaluation metrics without revealing individual reports. As highlighted in recent works [8,13,14], this integration ensures secure aggregation, adaptive differential privacy, and authenticated evaluation, which together guarantee that both model learning and reputation assessment remain private, verifiable, and robust.

Algorithm 1 jointly defines the off-chain learning and on-chain settlement workflow. Reputation-weighted aggregation suppresses low-utility updates, while blockchain-backed incentives enforce accountability with constant-size on-chain overhead.

3.8 Theoretical Analysis

We provide a high-level theoretical justification of the proposed framework focusing on three core properties: convergence under reputation-weighted federated optimization, bounded impact of malicious updates, and incentive compatibility of decentralized rewards (motivated through [1,25–27]). The analysis targets ranking-oriented learning objectives, which are more appropriate for recommender systems than pointwise prediction losses. Let ℒk(Θ,V;Dk) denote the local surrogate ranking loss at client k, and define the global objective as

ℒ(Θ,V)=∑k∈𝒦pkℒk(Θ,V;Dk),(6)

where pk reflects client importance. We assume standard smoothness and bounded-gradient conditions while allowing arbitrary non-IID data distributions across clients. Under reputation-weighted aggregation with weights wkt=Rkt/∑jRjt, and a diminishing learning rate schedule, the federated optimization converges to a stationary neighborhood of ℒ. In particular,

1T∑t=0T−1E[‖∇ℒ(Θt,Vt)‖2]≤𝒪(1T)+𝒪(δnon-IID),(7)

where δnon-IID captures the effect of data heterogeneity. Compared with uniform aggregation, reputation weighting attenuates the variance introduced by poorly generalizing updates, yielding more stable convergence for ranking-based objectives. The analysis follows standard federated optimization arguments adapted to the decomposed FedNCF structure. The reputation mechanism further bounds the influence of adversarial clients. Let 𝒜 denote malicious clients and εkt the deviation induced by client k on the probe-based ranking loss. Robust peer evaluation and monotonic reputation mapping ensure E[Rkt]≤R¯𝒜 for k∈𝒜, yielding

∑t=0T−1∑k∈𝒜wktεkt≤R¯𝒜R_∑t=0T−1∑j∈ℋwjtεjt,(8)

where ℋ denotes honest clients and R_ is a lower bound on honest reputations. This shows that the effect of poisoning or shilling attacks is constrained by observable ranking utility rather than attacker population size. Finally, incentive compatibility follows directly from reputation-based reward allocation. Since rewards are proportional to the smoothed reputation R~kt, the expected reward satisfies

∂E[Wkt]∂Mkt>0,(9)

implying that improving ranking performance on the public probe strictly increases long-term reward. This analysis is witnessed by three recent studies [14,23], and [28]. Further detailed proofs and extensions can be found in relevant studies.

4  Experimental Evaluation

In this section, we empirically evaluate the proposed T-FedRS model. The experiments are designed to assess effectiveness under personalization, robustness against adversarial behaviors, and the reliability of proposed decentralized mechanism in FedRS settings.

4.1 Experimental Setup

The evaluation is structured around three objectives. First, we evaluate whether T-FedRS can achieve competitive ranking performance while preserving client-level personalization under non-IID data distributions. Second, we assess the robustness of the proposed reputation-weighted aggregation when a fraction of clients behave maliciously. Third, we examine whether the ranking-aware reputation mechanism reliably reflects true contribution. Together, these goals validate the effectiveness, trustworthiness, and practical suitability of the proposed framework.

Dataset Description. We conduct experiments on 3 widely used benchmarks employed in diverse RS studies [29,30]. MovieLens 1M (ML-1M)1contains one million user–movie interactions and represents a moderately sparse recommendation scenario with rich collaborative signals. Amazon Appliances (Amazon)2is a domain-specific subset of the Amazon reviews dataset, characterized by extreme sparsity and highly skewed item popularity, posing significant challenges for federated recommenders. FilmTrust3is a smaller but denser dataset commonly used to evaluate trust-aware recommendation methods. Together, these datasets enable a systematic evaluation of T-FedRS under varying sparsity levels, popularity bias, and trust conditions that commonly arise in real-world federated settings. Statistics for the selected datasets are given in Table 1.

Evaluation Metrics. We adopt standard ranking-based metrics suitable for implicit-feedback recommendation. Hit Ratio at K(HR@K) measures whether the ground-truth item appears in the top-K list. Normalized Discounted Cumulative Gain at K(NDCG@K) accounts for the position of the relevant item, assigning higher weight to higher-ranked hits. Mean Average Precision (MAP) evaluates the average precision across users, reflecting overall ranking quality. In all experiments, K is set to 5 or 10 and we follow commonly adopted metrics calculation settings [1,8].

Baselines Studies: We compare T-FedRS against five representative baselines, selected to align with our evaluation goals.

•   Local NCF [31]: Standard neural collaborative filtering trained independently at each client, serving as a lower bound that highlights the benefit of collaborative learning.

•   Centralized NCF [31]: Aggregates all data into a single model and provides an upper bound on achievable accuracy without privacy or decentralization constraints.

•   FedNCF [16]: A state-of-the-art federated recommender baseline that supports personalized learning under non-IID data but does not incorporate trust, robustness, or incentive mechanisms.

•   Robust-FedAvg [7]: A blockchain-enabled federated learning framework designed for secure and privacy-preserving personalized recommendations. This baseline is included to assess the effectiveness of generic robustness and blockchain-based protection mechanisms that are not explicitly tailored to ranking-oriented recommender objectives.

•   T-BFL [20]: A representative trustworthy federated learning framework that integrates blockchain-based reputation and incentive management. We include this baseline to evaluate the advantage of designing trust and reward mechanisms specifically for federated recommender systems rather than general-purpose federated learning.

Implementation Details. All models are implemented in PyTorch and optimized using Adam. Experiments are conducted on a workstation equipped with NVIDIA RTX 3090 GPU and a multi-core CPU, which are used to simulate parallel client execution rather than representing actual client hardware. Federated training follows a standard cross-device simulation protocol, where clients hold disjoint user partitions and communicate with a central coordinator responsible for aggregation. Blockchain-assisted reputation and reward management is implemented via a lightweight ledger simulation module that records cryptographic commitments, reputation values, and reward allocations. Consensus latency and full smart-contract execution are abstracted, consistent with prior blockchain-assisted federated learning studies, allowing the evaluation to focus on learning dynamics, trust modeling, and incentive mechanisms. Communication cost is measured by the volume of transmitted model parameters per round, while computation cost is quantified by local training time and decentralized evaluation overhead.

4.2 Recommendation Performance

We evaluated the recommendation performance under standard federated settings and examine whether the proposed framework achieves effective personalization. We compare our method against Centralized NCF, which represents an accuracy upper bound without privacy constraints, and FedNCF with standard federated averaging, which serves as the strongest personalized federated baseline without trust or reputation mechanisms. Performance is evaluated on Ml-1M, Amazon, and FilmTrust using HR@10 and NDCG@10.

The outcomes in Table 2 demonstrate that T-FedRS consistently outperforms FedNCF across all datasets and, notably, achieves performance comparable to or exceeding centralized training. The improvement (highlighted as bold in Table 2) is particularly evident on sparse datasets such as Amazon Appliances and FilmTrust, where classical federated averaging struggles to preserve personalization under limited local interactions. These gains indicate that T-FedRS does not merely aggregate updates, but selectively emphasizes high-quality contributions through reputation-weighted learning.

Furthermore, the proposed decentralized reward management mechanism induces a clear structural separation between trustworthy and non-trustworthy contributors during federated optimization. As illustrated in Fig. 2, reputation-aware filtering produces well-separated clusters in the embedding space, where high-reputation clients dominate effective aggregation while low-reputation or biased clients are naturally isolated. We further visualize the embedding spaces of three randomly selected users, which remain well aligned with the trustworthy global representation, indicating that personalization is preserved rather than overridden by federation. This selective trust propagation explains the consistent ranking improvements and confirms the role of decentralized reward management in jointly enhancing robustness and personalization.

Figure 2: t-SNE visualizations of learned embedding spaces under the proposed T-FedRS framework.

4.3 Robustness against Adversarial Clients

This section evaluates robustness against targeted shilling attacks. As shown in Table 3, increasing the malicious client ratio from 10% to 40% causes severe degradation in FedNCF, with NDCG@10 dropping by 45%–55% across datasets. In contrast, the proposed T-FedRS remains stable on Ml-1M, and NDCG@10 decreases only from 0.447 to 0.429 even under 40% attacks. Consistent trends across K=5,10,20 confirm that the blockchain-assisted mechanism effectively preserves trustworthy personalized recommendation under adversarial settings. Additionally, robustness trends are further visualized in Fig. 3, which compares T-FedRS with standard FedNCF. As the fraction of malicious clients increases, FedNCF exhibits near-linear degradation, whereas T-FedRS maintains stable performance, retaining over 96% of its baseline utility even at a 40% attack ratio. This consistent behavior across heterogeneous datasets confirms that the decentralized reputation mechanism effectively isolates adversarial influence before it impacts the global model.

Figure 3: Robustness analysis against targeted shilling attacks. Comparison of NDCG@10 stability of T-FedRS against standard FedNCF across three datasets as the percentage of malicious clients increases.

Extensive empirical evaluations across three benchmark datasets confirm that T-FedRS consistently outperforms standard federated architectures in both recommendation accuracy and adversarial robustness. While the current framework achieves superior results within the neural collaborative filtering paradigm, future extensions could incorporate graph-based architectures to capture even more complex, high-order user-item interactions. Additionally, we aim to explore the integration of lightweight cryptographic primitives, such as zero-knowledge proofs, to further enhance the privacy of the reputation verification process in resource-constrained recommendation environments.

5  Conclusion

In this paper, we addressed the dual challenges of data poisoning and personalization in decentralized recommendation environment. We integrated FedNCF with a blockchain-assisted decentralized reward management mechanism, and the framework simultaneously preserves personalized recommendation quality and autonomously identifies and mitigates adversarial client influence. Extensive experiments on three benchmark datasets (MovieLens 1M, Amazon Appliances, and FilmTrust) demonstrate that T-FedRS consistently outperforms standard federated baselines, maintaining high NDCG@K and HR@K scores even when up to 40% of participants are malicious. These results confirm that blockchain-backed reputation serves as an effective proxy for model quality, bridging decentralized security and recommendation accuracy. While T-FedRS establishes a strong foundation for secure federated recommendation, several research directions remain. Future work will explore graph-based architectures to model higher-order user-item interactions and the integration of lightweight cryptographic primitives, such as zero-knowledge proofs, to further enhance privacy in resource-constrained environments. Overall, this work represents a step toward more resilient and user-centric intelligent systems in decentralized settings.

Acknowledgement: None.

Funding Statement: This work was supported by the Wenzhou-Kean University Internal Start-up Research Grant under Grant No. ISRG2024005.

Author Contributions: The authors confirm contribution to the paper as follows: Conceptualization, Waqar Ali, May Altulyan and Siyuan Li; methodology, Waqar Ali, Ghulam Farooque and Jie Shao; software, Waqar Ali, Ghulam Farooque and May Altulyan; validation, May Altulyan and Ghulam Farooque; formal analysis, Waqar Ali and Siyuan Li; resources, Waqar Ali and Jie Shao; writing—original draft preparation, Waqar Ali and Jie Shao; writing—review and editing, May Altulyan, Ghulam Farooque and Siyuan Li; funding acquisition, Waqar Ali. All authors reviewed and approved the final version of the manuscript.

Availability of Data and Materials: The data that support the findings of this study are openly available. Specifically, we used the MovieLens 1M (ML-1M) (https://grouplens.org/datasets/movielens/), Amazon Appliances (https://jmcauley.ucsd.edu/data/amazon/), and FilmTrust (https://guoguibing.github.io/librec/datasets.html) datasets for evaluation.

Ethics Approval: Not applicable.

Conflicts of Interest: The authors declare no conflicts of interest.

1https://grouplens.org/datasets/movielens/

2https://jmcauley.ucsd.edu/data/amazon/

3https://guoguibing.github.io/librec/datasets.html

References

1. Zhang H, Tian H, Chen C, Tian C, Dou W. A blockchain-assisted federated learning method for recommendation systems. In: IEEE International Symposium on Parallel and Distributed Processing with Applications, ISPA 2024; 2024 Oct 30–Nov 2; Kaifeng, China. p. 58–65. [Google Scholar]

2. Ali Z, Qi G, Ullah I, Mohammed AAQ, Kefalas P, Muhammad K. GLAMOR: graph-based language model embedding for citation recommendation. In: Proceedings of the 18th ACM Conference on Recommender Systems, RecSys 2024; 2024 Oct 14–18; Bari, Italy. p. 929–33. [Google Scholar]

3. Ali Z, Qi G, Muhammad K, Kefalas P, Khusro S. Global citation recommendation employing generative adversarial network. Expert Syst Appl. 2021;180:114888. doi:10.1016/j.eswa.2021.114888. [Google Scholar] [CrossRef]

4. Ali W, Kumar R, Deng Z, Wang Y, Shao J. A federated learning approach for privacy protection in context-aware recommender systems. Comput J. 2021;64(7):1016–27. doi:10.1093/comjnl/bxab025. [Google Scholar] [CrossRef]

5. Yuan W, Qu L, Cui L, Tong Y, Zhou X, Yin H. HeteFedRec: frecommender systems with model heterogeneity. In: 40th IEEE International Conference on Data Engineering, ICDE 2024; 2024 May 13–16; Utrecht, The Netherlands. p. 1324–37. [Google Scholar]

6. Ali W, Zhou X, Shao J. Privacy-preserved and responsible recommenders: from conventional defense to federated learning and blockchain. ACM Comput Surv. 2025;57(5):119:1–119:35. [Google Scholar]

7. Gupta BB, Gaurav A, Arya V. Secure and privacy-preserving decentralized federated learning for personalized recommendations in consumer electronics using blockchain and homomorphic encryption. IEEE Trans Consumer Electron. 2024;70(1):2546–56. doi:10.1109/tce.2023.3329480. [Google Scholar] [CrossRef]

8. Ali W, Kumar R, Zhou X, Shao J. Responsible recommendation services with blockchain empowered asynchronous federated learning. ACM Trans Intell Syst Technol. 2024;15(4):78:1–78:24. doi:10.1145/3633520. [Google Scholar] [CrossRef]

9. Pang S, Fan Z, Gui H, He X, Lu Z, Zhao S, et al. Reputation-based federated learning and blockchain for trustworthy service recommendations in edge computing. Clust Comput. 2025;28(11):687. [Google Scholar]

10. Cai Z, Tang T, Yu S, Xiao Y, Xia F. Marking the pace: a blockchain-enhanced privacy-traceable strategy for federated recommender systems. IEEE Internet Things J. 2024;11(6):10384–97. [Google Scholar]

11. Liu P, Jia L, Xiao Y. Participant selection for efficient and trusted federated learning in blockchain-assisted hierarchical federated learning architectures. Future Internet. 2025;17(2):75. doi:10.3390/fi17020075. [Google Scholar] [CrossRef]

12. Liu B, Tang Q. Secure data sharing in federated learning through blockchain-based aggregation. Future Internet. 2024;16(4):133. doi:10.3390/fi16040133. [Google Scholar] [CrossRef]

13. Rezaei H, Golmaryami M, Rezaei H, Palmieri F. A lightweight blockchain-based defense method for federated self-supervised learning. Future Gener Comput Syst. 2026;175(4):108092. doi:10.1016/j.future.2025.108092. [Google Scholar] [CrossRef]

14. Chen J, Wu Y, Rong D, Yu G, Jiang L, Liu Z, et al. Blockchain-based federated recommendation with incentive mechanism. In: First Conference on Blockchain and Web3.0 Technology Innovation and Application, BWTAC 2024. Singapore: Springer; 2024. p. 202–13. [Google Scholar]

15. Patni S, Lee J. EdgeGuard: decentralized medical resource orchestration via blockchain-secured federated learning in IoMT networks. Future Internet. 2024;17(1):2. doi:10.3390/fi17010002. [Google Scholar] [CrossRef]

16. Perifanis V, Efraimidis PS. Federated neural collaborative filtering. Knowl Based Syst. 2022;242(3):108441. doi:10.1016/j.knosys.2022.108441. [Google Scholar] [CrossRef]

17. Yuan W, Yang C, Qu L, Ye G, Nguyen QVH, Yin H. Robust federated contrastive recommender system against targeted model poisoning attack. Sci China Inf Sci. 2025;68(4):140103. doi:10.1007/s11432-024-4272-y. [Google Scholar] [CrossRef]

18. Tong Z, Wang J, Hou X, Chen J, Jiao Z, Liu J. Blockchain-based trustworthy and efficient hierarchical federated learning for UAV-enabled IoT networks. IEEE Internet Things J. 2024;11(21):34270–82. doi:10.1109/jiot.2024.3370964. [Google Scholar] [CrossRef]

19. Zhou S, Li K, Chen Y, Yang C, Liang W, Zomaya AY. TrustBCFL: mitigating data bias in IoT through blockchain-enabled federated learning. IEEE Internet Things J. 2024;11(15):25648–62. [Google Scholar]

20. Yang Z, Shi Y, Zhou Y, Wang Z, Yang K. Trustworthy federated learning via blockchain. IEEE Internet Things J. 2023;10(1):92–109. doi:10.1109/jiot.2022.3201117. [Google Scholar] [CrossRef]

21. Xiong R, Ren W, Zhao S, He J, Ren Y, Choo KR, et al. CoPiFL: a collusion-resistant and privacy-preserving federated learning crowdsourcing scheme using blockchain and homomorphic encryption. Future Gener Comput Syst. 2024;156:95–104. [Google Scholar]

22. Lo SK, Liu Y, Lu Q, Wang C, Xu X, Paik H, et al. Toward trustworthy AI: blockchain-based architecture design for accountability and fairness of federated learning systems. IEEE Internet Things J. 2023;10(4):3276–84. [Google Scholar]

23. Zhang F, Guo S, Qiu X, Xu S, Qi F, Wang Z. Federated learning meets blockchain: state channel-based distributed data-sharing trust supervision mechanism. IEEE Internet Things J. 2023;10(14):12066–76. [Google Scholar]

24. Zhang Y, Peng X, Xian H. pFedBASC: personalized federated learning with blockchain-assisted semi-centralized framework. Future Internet. 2024;16(5):164. doi:10.3390/fi16050164. [Google Scholar] [CrossRef]

25. Wang B, Tian Z, Liu X, Xia Y, She W, Liu W. A multi-center federated learning mechanism based on consortium blockchain for data secure sharing. Knowl Based Syst. 2025;310(23):112962. doi:10.1016/j.knosys.2025.112962. [Google Scholar] [CrossRef]

26. Wu B, Seneviratne O. Blockchain-based framework for scalable and incentivized federated learning. In: Companion Proceedings of the ACM on Web Conference 2025, WWW 2025; 2025 Apr 28–May 2; Sydney, NSW, Australia. p. 1761–7. [Google Scholar]

27. Qin Z, Yan X, Zhou M, Deng S. BlockDFL: a blockchain-based fully decentralized peer-to-peer federated learning framework. In: Proceedings of the ACM on Web Conference 2024, WWW 2024; 2024 May 13–17; Singapore. p. 2914–25. [Google Scholar]

28. Cheng Z, Liu Y, Wu C, Pan Y, Zhao L, Deng X, et al. Decentralized IoT data sharing: a blockchain-based federated learning approach with joint optimizations for efficiency and privacy. Future Gener Comput Syst. 2024;160:547–63. [Google Scholar]

29. Waqar A, Shao J, Aman KA, Saifullah T. Context-aware recommender systems: challenges and opportunities. J Univ Electron Sci Technol China. 2019;48(5):655–73. [Google Scholar]

30. Kefalas P, Symeonidis P, Manolopoulos Y. Recommendations based on a heterogeneous spatio-temporal social network. World Wide Web. 2018;21(2):345–71. doi:10.1007/s11280-017-0454-0. [Google Scholar] [CrossRef]

31. He X, Liao L, Zhang H, Nie L, Hu X, Chua T. Neural collaborative filtering. In: 26th International Conference on World Wide Web, WWW 2017; 2017 Apr 3–7; Perth, Australia. p. 173–82. [Google Scholar]