VirusCascade achieves 38.4% mean targeted exposure in LLM recommender systems via joint semantic and structural poisoning

Auto-published from arXiv:2609.38270 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.78, flags: [possible-zero-day, no-prompt-excerpt])

Category

data-poisoning

Model

GPT-4o-mini (victim backbone); GPT-4o, LLaMA-3, Gemini-2.5 (auxiliary generators for semantic injection)

Surface

LLM-powered recommender agent harness (AgentCF, AgentRAG, AgentSEQ) over four Amazon review datasets

Setup

Black-box attack requiring only text-level item listing modification. Step 1 (semantic surface): Attacker extracts preference motifs from anchor items using an auxiliary LLM, then rewrites the target item description using two aligned generation prompts — a base GenPrompt(P_i*) and a motif-aware GenPrompt(P_i*, Z(i*)) — selecting the output that maximizes motif coverage, profile fidelity, and naturalness while avoiding moderation triggers. Step 2 (structural surface): Attacker constructs a multi-hop interaction trajectory routing through popular items toward the target via a dual-cost transition graph c(i,j) = α·d_sem(i,j) + (1−α)·d_beh(i→j), with default trajectory length L_max=6. Full prompt templates deferred to Appendix A-B3.

Reproduction anchor

benchmark: Amazon review datasets (CDs & Vinyl n=1.4M, Movies & TV n=3.4M, Automotive n=1.7M, Musical Instruments n=231K interactions); attack algorithm and evaluation protocol in Section 5; prompt templates in Appendix A-B3; no public code repository found

Observed behavior

Mean E@20 of 0.384 across all dataset/architecture combinations, surpassing the strongest baseline (DrunkAgent) by +0.185 absolute. On AgentRAG with CDs & Vinyl, exposure rate reaches 0.545. Human evaluators (n=20, 120 descriptions each) flagged VirusCascade-generated descriptions as manipulated only 21.9% of the time — statistically indistinguishable from original descriptions (19.3%) and well below DrunkAgent (28.7%), confirming stealth.

Expected behavior

Recommender systems should expose items proportional to genuine user preferences; adversarially rewritten item descriptions should not systematically elevate target item exposure or survive stealth detection by human evaluators.

Reproducibility

medium

Threat model

Sellers on LLM-powered e-commerce recommendation platforms can gain disproportionate product exposure by modifying only their own item listings — no platform access or user data required. The attack is black-box, stealthy to human reviewers, and effective across all evaluated LLM-ARS architectures, making it directly applicable to deployed commercial recommender systems.

Novelty

First attack to jointly optimize semantic (text rewriting) and structural (trajectory routing) surfaces for LLM recommender exploitation, achieving state-of-the-art targeted promotion by turning the collaborative reflection mechanism itself into a propagation channel.

Source

• arXiv: 2609.38270
• PDF: https://arxiv.org/pdf/2609.38270
• Categories: cs.CR, cs.LG, cs.MA
• Authors: Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 1
• triage reason: Identifies and demonstrates a novel vulnerability class (collaborative-reflection hijacking) in LLM-powered recommender agents, with concrete black-box attack (VirusCascade) and controlled vulnerability analysis. No vendor disclosure mentioned.

─────────────────────────────────────────────────────────────────────