# LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems

arXiv: https://arxiv.org/abs/2505.13528 · HTML: https://mlsanity.com/paper/2505.13528/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 58 references that are in the map.
- First posted on arXiv 18 May 2025.

## Builds on (most cited first, 24 of 24)

- [Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks](https://mlsanity.com/paper/1511.06434/) (2015)
- [Recommender AI Agent: Integrating Large Language Models for Interactive Recommendations](https://mlsanity.com/paper/2308.16505/) (2023)
- [RecMind: Large Language Model Powered Agent For Recommendation](https://mlsanity.com/paper/2308.14296/) (2023)
- [AgentCF: Collaborative Learning with Autonomous Language Agents for Recommender Systems](https://mlsanity.com/paper/2310.09233/) (2023)
- [Leveraging Large Language Models in Conversational Recommender Systems](https://mlsanity.com/paper/2305.07961/) (2023)
- [MACRec: a Multi-Agent Collaboration Framework for Recommendation](https://mlsanity.com/paper/2402.15235/) (2024)
- [Let Me Do It For You: Towards LLM Empowered Recommendation via Tool Learning](https://mlsanity.com/paper/2405.15114/) (2024)
- [LLM-Powered User Simulator for Recommender System](https://mlsanity.com/paper/2412.16984/) (2024)
- [Revisiting Adversarially Learned Injection Attacks Against Recommender Systems](https://mlsanity.com/paper/2008.04876/) (2020)
- [Personalized Graph Signal Processing for Collaborative Filtering](https://mlsanity.com/paper/2302.02113/) (2023)
- [Neural Network Matrix Factorization](https://mlsanity.com/paper/1511.06443/) (2015)
- [Attacking Recommender Systems with Augmented User Profiles](https://mlsanity.com/paper/2005.08164/) (2020)
- [Prospect Personalized Recommendation on Large Language Model-based Agent Platform](https://mlsanity.com/paper/2402.18240/) (2024)
- [Shilling Black-box Recommender Systems by Learning to Generate Fake User Profiles](https://mlsanity.com/paper/2206.11433/) (2022)
- [AutoSeqRec: Autoencoder for Efficient Sequential Recommendation](https://mlsanity.com/paper/2308.06878/) (2023)
- [A LLM-based Controllable, Scalable, Human-Involved User Simulator Framework for Conversational Recommender Systems](https://mlsanity.com/paper/2405.08035/) (2024)
- [Triple Structural Information Modelling for Accurate, Explainable and Interactive Recommendation](https://mlsanity.com/paper/2304.11528/) (2023)
- [Shilling Black-box Review-based Recommender Systems through Fake Review Generation](https://mlsanity.com/paper/2306.16526/) (2023)
- [Modeling Recommender Ecosystems: Research Challenges at the Intersection of Mechanism Design, Reinforcement Learning and Generative Models](https://mlsanity.com/paper/2309.06375/) (2023)
- [Adversarial Recommendation: Attack of the Learned Fake Users](https://mlsanity.com/paper/1809.08336/) (2018)
- [Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systems](https://mlsanity.com/paper/2402.09023/) (2024)
- [Stop Playing the Guessing Game! Target-free User Simulation for Evaluating Conversational Recommender Systems](https://mlsanity.com/paper/2411.16160/) (2024)
- [Assessing the Impact of a User-Item Collaborative Attack on Class of Users](https://mlsanity.com/paper/1908.07968/) (2019)
- [Policy Design for Two-sided Platforms with Participation Dynamics](https://mlsanity.com/paper/2502.01792/) (2025)

## Built on by (most cited first, 3 of 3)

- [Scaling Towards the Information Boundary of Instruction Sets: The Infinity Instruct Subject Technical Report](https://mlsanity.com/paper/2507.06968/) (2025)
- [PersonaLedger: Generating Realistic Financial Transactions with Persona Conditioned LLMs and Rule Grounded Feedback](https://mlsanity.com/paper/2601.03149/) (2026)
- [PsyBer-Agent: A Psychology-Driven User Agent for Recommender Systems](https://mlsanity.com/paper/2610.13989/) (2026)

## Abstract (arXiv)

Recommender systems (RS) are increasingly vulnerable to shilling attacks, where adversaries inject fake user profiles to manipulate system outputs. Traditional attack strategies often rely on simplistic heuristics, require access to internal RS data, and overlook the manipulation potential of textual reviews. In this work, we introduce Agent4SR, a novel framework that leverages Large Language Model (LLM)-based agents to perform low-knowledge, high-impact shilling attacks through both rating and review generation. Agent4SR simulates realistic user behavior by orchestrating adversarial interactions, selecting items, assigning ratings, and crafting reviews, while maintaining behavioral plausibility. Our design includes targeted profile construction, hybrid memory retrieval, and a review attack strategy that propagates target item features across unrelated reviews to amplify manipulation. Extensive experiments on multiple datasets and RS architectures demonstrate that Agent4SR outperforms existing low-knowledge baselines in both effectiveness and stealth. Our findings reveal a new class of emergent threats posed by LLM-driven agents, underscoring the urgent need for enhanced defenses in modern recommender systems.