mlsanityData to 7 Oct 2026

ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systems

arXiv 2409.11690 ↗First posted 18 Sep 2024cs.IRcited by 9

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Recent advances in ID-free recommender systems have attracted significant attention for effectively addressing the cold start problem. However, their vulnerability to malicious attacks remains largely unexplored. In this paper, we unveil a critical yet overlooked risk: LLM-powered agents can be strategically deployed to attack ID-free recommenders, stealthily promoting low-quality items in black-box settings. This attack exploits a novel rewriting-based deception strategy, where malicious agents synthesize deceptive textual descriptions by simulating the characteristics of popular items. To achieve this, the attack mechanism integrates two primary components: (1) a popularity extraction component that captures essential characteristics of popular items and (2) a multi-agent collaboration mechanism that enables iterative refinement of promotional textual descriptions through independent thinking and team discussion. To counter this risk, we further introduce a detection method to identify suspicious text generated by our discovered attack. By unveiling this risk, our work aims to underscore the urgent need to enhance the security of ID-free recommender systems.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 29 of its 46 references that are in the map. First posted on arXiv 18 Sep 2024.

Builds on

29 of 46 references.

References · 29

  1. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  2. 2018Self-Attentive Sequential Recommendationcited by 1,169
  3. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,134
  4. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  5. 2023AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviorscited by 580
  6. 2024Scaling Synthetic Data Creation with 1,000,000,000 Personascited by 397
  7. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
  8. 2021Are Graph Augmentations Necessary? Simple Graph Contrastive Learning for Recommendationcited by 173
  9. 2019Text Classification Algorithms: A Surveycited by 163
  10. 2023Text Is All You Need: Learning Language Representations for Sequential Recommendationcited by 149
  11. 2023Recommender AI Agent: Integrating Large Language Models for Interactive Recommendationscited by 130
  12. 2023DNA-GPT: Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Textcited by 127
17 more
  1. 2023Where to Go Next for Recommender Systems? ID- vs. Modality-based Recommender Models Revisitedcited by 124
  2. 2022Towards Universal Sequence Representation Learning for Recommender Systemscited by 120
  3. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  4. 2021Contrastive Learning for Cold-Start Recommendationcited by 77
  5. 2021Zero-Shot Recommender Systemscited by 45
  6. 2023Multi-Modal Self-Supervised Learning for Recommendationcited by 44
  7. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 25
  8. 2022Efficient Bi-Level Optimization for Recommendation Denoisingcited by 20
  9. 2024Stealthy Attack on Large Language Model based Recommendationcited by 19
  10. 2021PETGEN: Personalized Text Generation Attack on Deep Sequence Embedding-based Classification Modelscited by 17
  11. 2023Unveiling Vulnerabilities of Contrastive Recommender Systems to Poisoning Attackscited by 10
  12. 2023Shilling Black-box Review-based Recommender Systems through Fake Review Generationcited by 8
  13. 2023Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasurescited by 5
  14. 2023Adversarial Item Promotion on Visually-Aware Recommender Systems by Guided Diffusioncited by 5
  15. 2024Poisoning Decentralized Collaborative Recommender System and Its Countermeasurescited by 5
  16. 2024Poisoning Attacks and Defenses in Recommender Systems: A Surveycited by 5
  17. 2023Single-User Injection for Invisible Shilling Attack against Recommender Systemscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 6.

9 papers.

  1. 2025DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agentscited by 12
  2. 2025Prompt-Induced Linguistic Fingerprints for LLM-Generated Fake News Detectioncited by 3
  3. 2026PAMAS: Self-Adaptive Multi-Agent System with Perspective Aggregation for Misinformation Detectioncited by 2
  4. 2025Relational Database Distillation: From Structured Tables to Condensed Graph Datacited by 1
  5. 2026Self-Distilled Reinforcement Learning for Co-Evolving Agentic Recommender Systemscited by 1
  6. 2026Evolutionary Router Feature Generation for Zero-Shot Graph Anomaly Detection with Mixture-of-Expertscited by 0
  7. 2026DisenReason: Behavior Disentanglement and Latent Reasoning for Shared-Account Sequential Recommendationcited by 0
  8. 2026Sharpness-Aware Poisoning: Enhancing Transferability of Injective Attacks on Recommender Systemscited by 0
  9. 2026Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems
  2. 2026An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems
  3. 2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent
  4. 2026How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation
  5. 2026VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents
  6. 2025Web Fraud Attacks Against LLM-Driven Multi-Agent Systems
  7. 2025Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systems
  8. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks