mlsanityData to 7 Oct 2026

DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents

arXiv 2503.23804 ↗First posted 31 Mar 2025cs.CR cs.CL cs.IRcited by 12

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language model (LLM)-powered agents are increasingly used in recommender systems (RSs) to achieve personalized behavior modeling, where the memory mechanism plays a pivotal role in enabling the agents to autonomously explore, learn and self-evolve from real-world interactions. However, this very mechanism, serving as a contextual repository, inherently exposes an attack surface for potential adversarial manipulations. Despite its central role, the robustness of agentic RSs in the face of such threats remains largely underexplored. Previous works suffer from semantic mismatches or rely on static embeddings or pre-defined prompts, all of which are not designed for dynamic systems, especially for dynamic memory states of LLM agents. This challenge is exacerbated by the black-box nature of commercial recommenders. To tackle the above problems, in this paper, we present the first systematic investigation of memory-based vulnerabilities in LLM-powered recommender agents, revealing their security limitations and guiding efforts to strengthen system resilience and trustworthiness. Specifically, we propose a novel black-box attack framework named DrunkAgent. DrunkAgent crafts semantically meaningful adversarial textual triggers for target item promotions and introduces a series of strategies to maximize the trigger effect by corrupting the memory updates during the interactions. The triggers and strategies are optimized on a surrogate model, enabling DrunkAgent transferable and stealthy. Extensive experiments on real-world datasets across diverse agentic RSs, including collaborative filtering, retrieval augmentation and sequential recommendations, demonstrate the generalizability, transferability and stealthiness of DrunkAgent.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 43 of its 61 references that are in the map. First posted on arXiv 31 Mar 2025.

Builds on

43 of 61 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  2. 2024ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systems18 Sep

Other references · 41

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  5. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  6. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,134
  7. 2017Neural Collaborative Filteringcited by 1,108
  8. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  9. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  10. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
  11. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  12. 2022Recommendation as Language Processing (RLP): A Unified Pretrain, Personalized Prompt & Predict Paradigm (P5)cited by 396
29 more
  1. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  2. 2023TALLRec: An Effective and Efficient Tuning Framework to Align Large Language Model with Recommendationcited by 336
  3. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  4. 2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
  5. 2023Recommender Systems in the Era of Large Language Models (LLMs)cited by 188
  6. 2024Agent AI: Surveying the Horizons of Multimodal Interactioncited by 167
  7. 2023User Behavior Simulation with Large Language Model based Agentscited by 136
  8. 2023AgentCF: Collaborative Learning with Autonomous Language Agents for Recommender Systemscited by 116
  9. 2023CoLLM: Integrating Collaborative Embeddings into Large Language Models for Recommendationcited by 99
  10. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 78
  11. 2024CoRAL: Collaborative Retrieval-Augmented Large Language Models Improve Long-tail Recommendationcited by 44
  12. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
  13. 2024AI Safety in Generative AI Large Language Models: A Surveycited by 31
  14. 2020Revisiting Adversarially Learned Injection Attacks Against Recommender Systemscited by 30
  15. 2025Towards Agentic Recommender Systems in the Era of Multimodal Large Language Modelscited by 25
  16. 2020Attacking Recommender Systems with Augmented User Profilescited by 24
  17. 2024Stealthy Attack on Large Language Model based Recommendationcited by 19
  18. 2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
  19. 2020Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Startcited by 11
  20. 2020A Black-Box Attack Model for Visually-Aware Recommender Systemscited by 11
  21. 2024Poisoning Attacks against Recommender Systems: A Surveycited by 7
  22. 2024Foundation Models for Recommender Systems: A Survey and New Perspectivescited by 7
  23. 2021Understanding the Effectiveness of Reviews in E-commerce Top-N Recommendationcited by 4
  24. 2023Practical Cross-System Shilling Attacks with Limited Access to Datacited by 4
  25. 2024Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systemscited by 4
  26. 2020Densely Connected Residual Network for Attack Recognitioncited by 3
  27. 2020DualNet: Locate Then Detect Effective Payload with Deep Attention Networkcited by 3
  28. 2024Self-Distilled Disentangled Learning for Counterfactual Predictioncited by 3
  29. 2021Hunter in the Dark: Discover Anomalous Network Activity Using Deep Ensemble Networkcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 4; 2026: 8.

12 papers.

  1. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
  2. 2026GAM: Hierarchical Graph-based Agentic Memory for LLM Agentscited by 19
  3. 2026Self-Improvements in Modern Agentic Systems: A Surveycited by 17
  4. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 14
  5. 2025AI Meets Brain: Memory Systems from Cognitive Neuroscience to Autonomous Agentscited by 12
  6. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systemscited by 3
  7. 2025SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injectioncited by 0
  8. 2026In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducementcited by 0
  9. 2026Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivitycited by 0
  10. 2026An Efficient and Effective Agentic Group Shilling Attack on Recommender Systemscited by 0
  11. 2026From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agentscited by 0
  12. 2026VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent
  2. 2025LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems
  3. 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
  4. 2026How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation
  5. 2025Unveiling Privacy Risks in LLM Agent Memory
  6. 2026When Memory Takes Gradients: Collaborative Vector Memory for Agentic Recommender Systems
  7. 2026MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
  8. 2026Hidden in Memory: Sleeper Memory Poisoning in LLM Agents