mlsanityData to 14 Oct 2026

IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion

arXiv 2511.05845 ↗First posted 8 Nov 2025cs.CRcited by 1

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Recommender systems play a central role in digital platforms by providing personalized content. They often use methods such as collaborative filtering and machine learning to accurately predict user preferences. Although these systems offer substantial benefits, they are vulnerable to security and privacy threats, especially data poisoning attacks. By inserting misleading data, attackers can manipulate recommendations for purposes ranging from boosting product visibility to shaping public opinion. Despite these risks, concerns are often downplayed because such attacks typically require controlling at least 1% of the platform's user base, a difficult task on large platforms. We tackle this issue by introducing the IndirectAD attack, inspired by Trojan attacks on machine learning. IndirectAD reduces the need for a high poisoning ratio through a trigger item that is easier to recommend to the target users. Rather than directly promoting a target item that does not match a user's interests, IndirectAD first promotes the trigger item, then transfers that advantage to the target item by creating co-occurrence data between them. This indirect strategy delivers a stronger promotion effect while using fewer controlled user accounts. Our extensive experiments on multiple datasets and recommender systems show that IndirectAD can cause noticeable impact with only 0.05% of the platform's user base. On public benchmark datasets, IndirectAD remains effective under very low poisoning ratios, suggesting that recommender-system poisoning may be more practical than previously assumed.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 71 references that are in the map. First posted on arXiv 8 Nov 2025.

Builds on

32 of 71 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Membership Inference Attacks Against Recommender Systems16 Sep
  2. 2021Data Poisoning Attacks to Deep Learning Based Recommender Systems7 Jan

Other references · 30

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  2. 2018Self-Attentive Sequential Recommendationcited by 1,184
  3. 2017Neural Collaborative Filteringcited by 1,111
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  6. 2019BERT4Rec: Sequential Recommendation with Bidirectional Encoder Representations from Transformercited by 964
  7. 2016Ups and Downs: Modeling the Visual Evolution of Fashion Trends with One-Class Collaborative Filteringcited by 520
  8. 2018Personalized Top-N Sequential Recommendation via Convolutional Sequence Embeddingcited by 476
  9. 2016SeqGAN: Sequence Generative Adversarial Nets with Policy Gradientcited by 376
  10. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  11. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  12. 2018Variational Autoencoders for Collaborative Filteringcited by 310
18 more
  1. 2020Blind Backdoors in Deep Learning Modelscited by 182
  2. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  3. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  4. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 83
  5. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 63
  6. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 56
  7. 2020GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detectioncited by 54
  8. 2018Adversarial Personalized Ranking for Recommendationcited by 49
  9. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 37
  10. 2020Revisiting Adversarially Learned Injection Attacks Against Recommender Systemscited by 32
  11. 2018Adversarial Training Towards Robust Multimedia Recommender Systemcited by 28
  12. 2020Attacking Recommender Systems with Augmented User Profilescited by 26
  13. 2022Knowledge-enhanced Black-box Attacks for Recommendationscited by 26
  14. 2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 20
  15. 2018Hardware Trojan Attacks on Neural Networkscited by 12
  16. 2023Manipulating Federated Recommender Systems: Poisoning with Synthetic Users and Its Countermeasurescited by 6
  17. 2013Recommending with an Agenda: Active Learning of Private Attributes using Matrix Factorizationcited by 3
  18. 2020On Detecting Data Pollution Attacks On Recommender Systems Using Sequential GANscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attacks
  2. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systems
  3. 2025Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systems
  4. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems
  5. 2022Targeted Data Poisoning Attack on News Recommendation System by Content Perturbation
  6. 2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion
  7. 2024Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systems
  8. 2024Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought