mlsanityData to 14 Oct 2026

Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systems

arXiv 2505.05196 ↗First posted 8 May 2025cs.IRcited by 8

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

We present a systematic study of provider-side data poisoning in retrieval-augmented recommender systems (RAG-based). By modifying only a small fraction of tokens within item descriptions -- for instance, adding emotional keywords or borrowing phrases from semantically related items -- an attacker can significantly promote or demote targeted items. We formalize these attacks under token-edit and semantic-similarity constraints, and we examine their effectiveness in both promotion (long-tail items) and demotion (short-head items) scenarios. Our experiments on MovieLens, using two large language model (LLM) retrieval modules, show that even subtle attacks shift final rankings and item exposures while eluding naive detection. The results underscore the vulnerability of RAG-based pipelines to small-scale metadata rewrites and emphasize the need for robust textual consistency checks and provenance tracking to thwart stealthy provider-side poisoning.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 8 of its 14 references that are in the map. First posted on arXiv 8 May 2025.

Builds on

8 of 14 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems20 Jan

Other references · 7

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  4. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  5. 2024A Review of Modern Recommender Systems Using Generative Models (Gen-RecSys)cited by 58
  6. 2024Recommendation with Generative Modelscited by 13
  7. 2025Toward Holistic Evaluation of Recommender Systems Powered by Generative Modelscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 4.

8 papers.

  1. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generationcited by 11
  2. 2026Autonomous Information Seeking: A Roadmap for Agentic Recommender Systemscited by 4
  3. 2025RAG-VisualRec: An Open Resource for Vision- and Text-Enhanced Retrieval-Augmented Generation in Recommendationcited by 3
  4. 2025FuncPoison: Poisoning Function Library to Hijack Multi-agent Autonomous Driving Systemscited by 2
  5. 2025Data Security in Large Language Models: Risks, Defense, and Directionscited by 0
  6. 2026Position: Generative Engine Optimization Creates Underexamined Risks, Governance Must Target Concentration, Disclosure, and Academic Blind Spotscited by 0
  7. 2026One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenderscited by 0
  8. 2026VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks
  2. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systems
  3. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  4. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  5. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis
  6. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  7. 2025MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attacks
  8. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation