Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity

arXiv 2608.03272 ↗First posted 4 Aug 2026cs.IR cs.CR cs.MAcited by 0

On the map: LLM agents and tool use → Agentic recommender systems

Abstract (arXiv)

Multi-agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item agents through natural-language interaction to refine preferences and generate recommendations. These systems inherit vulnerabilities from both their data-driven nature and their multi-agent interactions, which manifest in distinct ways. Understanding how connectivity modulates vulnerability in these systems could facilitate the development of more robust recommendation pipelines. In this work, we adapt attacks and defenses from the general multi-agent systems (MAS) literature to the agent-based CF setting, evaluating them under systematically varied connectivity in the AgentCF framework, where CF connectivity is characterized along two axes: (i) candidate count (the number of item candidates per turn per user, measuring user-side interaction density) and (ii) catalog concentration (the degree of item catalog overlap across users). Our contributions include: (1) Adaptation: we reproduce MAS-inspired attacks and defenses in the agentic CF domain, confirming partial transferability of original observations. (2) Characterization: we characterize how the two aspects of connectivity shape attack and defense outcomes, revealing role asymmetries between user and item agents, non-monotonic temporal dynamics in attack efficacy, and divergent patterns across dissemination and extraction attack goals. Additionally, as an exploratory extension, we assess the applicability of epidemic-inspired static metrics in ranking CF configurations by expected attack outcome, potentially enabling cost-efficient robustness assessment. Implementation is available at https://github.com/anjunhu/ConnACF

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agentic recommender systems, one of 16 directions in LLM agents and tool use. Builds on 53 of its 82 references that are in the map. First posted on arXiv 4 Aug 2026.

Builds on

53 of 82 references.

Closest ancestors · 14

Same direction, newest first

2 more

Other references · 39

2025Why Do Multi-Agent LLM Systems Fail?cited by 604
2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 369
2023User Behavior Simulation with Large Language Model based Agentscited by 140
2025OWL: Optimized Workforce Learning for General Multi-Agent Assistance in Real-World Task Automationcited by 131
2024PsySafe: A Comprehensive Framework for Psychological-based Attack, Defense, and Evaluation of Multi-agent System Safetycited by 80
2014Epidemic processes in complex networkscited by 58
2021Membership Inference Attacks Against Recommender Systemscited by 57
2025Multi-Agent Systems Execute Arbitrary Malicious Codecited by 53
2024Let Me Do It For You: Towards LLM Empowered Recommendation via Tool Learningcited by 51
2025Understanding the Information Propagation Effects of Communication Topologies in LLM-based Multi-Agent Systemscited by 43
2025BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attackscited by 38
2025GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modelingcited by 36

27 more

2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 34
2024Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applicationscited by 33
2025TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systemscited by 26
2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agentcited by 25
2024Large Language Models are Learnable Planners for Long-Term Recommendationcited by 24
2024RecAI: Leveraging Large Language Models for Next-Generation Recommender Systemscited by 20
2025The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaborationcited by 20
2024Stealthy Attack on Large Language Model based Recommendationcited by 19
2025Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAScited by 17
2022Shilling Black-box Recommender Systems by Learning to Generate Fake User Profilescited by 15
2024Beyond Utility: Evaluating LLM as Recommendercited by 15
2025DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agentscited by 12
2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
2025Topology Matters: Measuring Memory Leakage in Multi-Agent LLMscited by 11
2024ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systemscited by 10
2025Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detectioncited by 9
2025SentinelNet: Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detectioncited by 8
2025Exploring Backdoor Attack and Defense for LLM-empowered Recommendationscited by 6
2025MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures -- A Comprehensive Frameworkcited by 6
2025Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspectivecited by 6
2024Poisoning Attacks and Defenses in Recommender Systems: A Surveycited by 5
2025Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagationcited by 5
2023Attacking Pre-trained Recommendationcited by 3
2025Retrieval-Augmented Review Generation for Poisoning Recommender Systemscited by 3
2025SemanticShield: LLM-Powered Audits Expose Shilling Attacks in Recommender Systemscited by 2
2026With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systemscited by 2
2025IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotioncited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way