# With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems

arXiv: https://arxiv.org/abs/2603.28476 · HTML: https://mlsanity.com/paper/2603.28476/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 27 of its 68 references that are in the map.
- First posted on arXiv 30 Mar 2026.

## Builds on (most cited first, 27 of 27)

- [KuaiRand: An Unbiased Sequential Recommendation Dataset with Randomly Exposed Videos](https://mlsanity.com/paper/2208.08696/) (2022)
- [Controlling Fairness and Bias in Dynamic Learning-to-Rank](https://mlsanity.com/paper/2005.14713/) (2020)
- [Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction](https://mlsanity.com/paper/2109.01165/) (2021)
- [Detecting Harmful Content On Online Platforms: What Platforms Need Vs. Where Research Efforts Go](https://mlsanity.com/paper/2103.00153/) (2021)
- [Measuring the Business Value of Recommender Systems](https://mlsanity.com/paper/1908.08328/) (2019)
- [A Comprehensive Survey on Trustworthy Recommender Systems](https://mlsanity.com/paper/2209.10117/) (2022)
- [Algorithmic Collective Action in Machine Learning](https://mlsanity.com/paper/2302.04262/) (2023)
- [Trustworthy Recommender Systems](https://mlsanity.com/paper/2208.06265/) (2022)
- [Personalizing Content Moderation on Social Media: User Perspectives on Moderation Choices, Interface Design, and Labor](https://mlsanity.com/paper/2305.10374/) (2023)
- [Robust Yet Efficient Conformal Prediction Sets](https://mlsanity.com/paper/2407.09165/) (2024)
- [A Comprehensive Survey on Retrieval Methods in Recommender Systems](https://mlsanity.com/paper/2407.21022/) (2024)
- [Tournesol: A quest for a large, secure and trustworthy database of reliable human judgments](https://mlsanity.com/paper/2107.07334/) (2021)
- [Characterizing and modeling harms from interactions with design patterns in AI interfaces](https://mlsanity.com/paper/2404.11370/) (2024)
- [An engine not a camera: Measuring performative power of online search](https://mlsanity.com/paper/2405.19073/) (2024)
- [A Framework for Assurance Audits of Algorithmic Systems](https://mlsanity.com/paper/2401.14908/) (2024)
- [End User Authoring of Personalized Content Classifiers: Comparing Example Labeling, Rule Writing, and LLM Prompting](https://mlsanity.com/paper/2409.03247/) (2024)
- [Decline Now: A Combinatorial Model for Algorithmic Collective Action](https://mlsanity.com/paper/2410.12633/) (2024)
- [Robust Recommender System: A Survey and Future Directions](https://mlsanity.com/paper/2309.02057/) (2023)
- [Algorithmic Collective Action in Recommender Systems: Promoting Songs by Reordering Playlists](https://mlsanity.com/paper/2404.04269/) (2024)
- [Algorithmic Collective Action with Two Collectives](https://mlsanity.com/paper/2505.00195/) (2025)
- [Harm Mitigation in Recommender Systems under User Preference Dynamics](https://mlsanity.com/paper/2406.09882/) (2024)
- [Are We All in a Truman Show? Spotting Instagram Crowdturfing through Self-Training](https://mlsanity.com/paper/2206.12904/) (2022)
- [Measuring Strategization in Recommendation: Users Adapt Their Behavior to Shape Future Content](https://mlsanity.com/paper/2405.05596/) (2024)
- [You Don't Bring Me Flowers: Mitigating Unwanted Recommendations Through Conformal Risk Control](https://mlsanity.com/paper/2507.16829/) (2025)
- [#TulsaFlop: A Case Study of Algorithmically-Influenced Collective Action on TikTok](https://mlsanity.com/paper/2012.07716/) (2020)
- [How to Train Your YouTube Recommender to Avoid Unwanted Videos](https://mlsanity.com/paper/2307.14551/) (2023)
- [Sync or Sink: Bounds on Algorithmic Collective Action with Noise and Multiple Groups](https://mlsanity.com/paper/2510.18933/) (2025)

## Built on by (most cited first, 2 of 2)

- [Gaming the Metric, Not the Harm: Certifying Safety Audits against Strategic Platform Manipulation](https://mlsanity.com/paper/2605.06324/) (2026)
- [Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity](https://mlsanity.com/paper/2608.03272/) (2026)

## Abstract (arXiv)

Recommendation systems have become central gatekeepers of online information, shaping user behaviour across a wide range of activities. In response, users increasingly organize and coordinate to steer algorithmic outcomes toward diverse goals, such as promoting relevant content or limiting harmful material, relying on platform affordances -- such as likes, reviews, or ratings. While these mechanisms can serve beneficial purposes, they can also be leveraged for adversarial manipulation, particularly in systems where such feedback directly informs safety guarantees. In this paper, we study this vulnerability in recently proposed risk-controlling recommender systems, which use binary user feedback (e.g., "Not Interested") to provably limit exposure to unwanted content via conformal risk control. We empirically demonstrate that their reliance on aggregate feedback signals makes them inherently susceptible to coordinated adversarial user behaviour. Using data from a large-scale online video-sharing platform, we show that a small coordinated group (comprising only 1% of the user population) can induce up to a 20% degradation in nDCG for non-adversarial users by exploiting the affordances provided by risk-controlling recommender systems. We evaluate simple, realistic attack strategies that require little to no knowledge of the underlying recommendation algorithm and find that, while coordinated users can significantly harm overall recommendation quality, they cannot selectively suppress specific content groups through reporting alone. Finally, we propose a mitigation strategy that shifts guarantees from the group level to the user level, showing empirically how it can reduce the impact of adversarial coordinated behaviour while ensuring personalized safety for individuals.