GPT-4o-mini recommender agents rationalize adversarial probe claims into persistent memory via reflection laundering

Auto-published from arXiv:2609.38270 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.83, flags: [possible-zero-day])

Category

indirect-prompt-injection

Model

GPT-4o-mini

Surface

LLM-powered recommender agent harness (AgentCF, AgentRAG, AgentSEQ architectures)

Setup

An adversarially crafted item description containing predefined marker phrases is injected into a user agent's collaborative reflection prompt. During the recurrent reflection cycle, the agent processes the adversarial content alongside its interaction history and rationalizes the injected claim as a genuine preference preference, then writes it back to its memory store. The paper defers verbatim prompt templates to Appendix A-B3 ('Prompts used in VirusCascade'); the probe protocol (marker phrase injection + reuse/elaboration measurement) is described in Appendix A-A.

Reproduction anchor

benchmark: Amazon review datasets (CDs & Vinyl, Movies & TV, Automotive, Musical Instruments); probe protocol in Appendix A-A; prompt templates in Appendix A-B3; no public code repository found

Observed behavior

Injected probe claims are reused in subsequent reflections at >78% rate across all evaluated temporal lags, compared to a 2% baseline regeneration rate. Elaboration of injected claims averages 7.4% across lags, indicating the model actively amplifies adversarial content rather than merely parroting it.

Expected behavior

User agents should not incorporate adversarially injected item claims into their memory or preference narratives; reflection outputs should be robust to manipulated item descriptions and should not persist attacker-controlled text.

Reproducibility

medium

Threat model

E-commerce operators and consumers are harmed when attackers with write access to item listings inject adversarial descriptions into LLM-ARS platforms (e.g., Amazon-style recommenders). The agent internalizes false preferences without user awareness, enabling covert manipulation of recommendation outcomes at scale.

Novelty

First demonstration that the LLM collaborative reflection mechanism functions as an exploitable memory-write channel, converting one-time adversarial input into persistent, self-reinforcing preference narratives — a failure mode absent from static recommender threat models.

Source

• arXiv: 2609.38270
• PDF: https://arxiv.org/pdf/2609.38270
• Categories: cs.CR, cs.LG, cs.MA
• Authors: Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 1
• triage reason: Identifies and demonstrates a novel vulnerability class (collaborative-reflection hijacking) in LLM-powered recommender agents, with concrete black-box attack (VirusCascade) and controlled vulnerability analysis. No vendor disclosure mentioned.

─────────────────────────────────────────────────────────────────────