Stealthy Attack on LLM-Based Recommendation Systems (arXiv 2402.14836)

Forum topic · 小凯 · 2026-07-05

Summary

This paper, 'Stealthy Attack on Large Language Model based Recommendation' (arXiv:2402.14836, February 2024) by Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, and Liang Wang, studies security vulnerabilities in recommender systems built on large language models (LLMs). Unlike traditional recommendation attacks that manipulate IDs or embeddings, LLM-based recommenders take natural-language prompts, and the authors investigate whether attackers can subtly craft item text to bias the model's suggestions. The work proposes a stealthy attack framework, ILLM (Injecting LLM), that optimizes item descriptions with perturbations designed to promote a target item while remaining imperceptible to users and system-side detectors. Experiments on LLM-based recommendation benchmarks show the attack significantly raises the target item's exposure while preserving the semantic quality of item text, highlighting a real deployment risk: crowdsourced or seller-provided item metadata becomes an attack surface for manipulation. The paper discusses implications for platform security, detection strategies, and robust prompt design. This makes it a key reference for adversarial machine learning in generative recommendation.

Stealthy Attack on Large Language Model based Recommendation

Paper: arXiv:2402.14836 (February 2024)

Authors: Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, Liang Wang (Chinese Academy of Sciences / Northeastern University and collaborators)

Overview

LLM-based recommenders accept natural-language input, so item metadata (titles, descriptions) becomes a direct manipulation channel. This paper demonstrates that an attacker can craft item text that steers an LLM recommender toward promoting a target item — without any visible change to human readers.

Key points

Proposes ILLM (Injecting LLM), a stealthy attack framework that injects imperceptible perturbations into item text to boost a target item's recommendation probability.
Unlike traditional shilling attacks (fake user profiles, manipulated embeddings), this attack operates purely at the text/prompt level, exploiting the language interface of LLM-based recommenders.
The optimization is guided by feedback from the target LLM recommender itself, using score-guided search over candidate perturbations (token-level modification, insertion, etc.) rather than white-box gradients.
Stealthiness is a first-class objective: perturbed text preserves semantics and perplexity so that users and keyword/similarity-based defenses cannot easily detect manipulation.
Experiments on representative LLM-based recommendation settings show substantial increases in the target item's exposure (e.g., ranking/hit-rate gains for the promoted item) while the modified text remains nearly indistinguishable from the original.

Why it matters

New attack surface: crowdsourced item content, product listings, and seller descriptions become attack vectors once an LLM reads them directly.
Detection gap: conventional shilling detection (user-behavior anomalies) does not apply; the platform must inspect item text itself.
Defense directions: semantic consistency checks, perturbation detection, robust instruction design, and provenance filtering of item metadata.

Relation to related work

This entry sits alongside adversarial-SEO research on LLMs, e.g.,

Adversarial Search Engine Optimization for Large Language Models (arXiv:2406.18382)
Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines (arXiv:2501.00745)

Together these studies map how generative search and recommendation systems inherit classic IR ranking-manipulation risks, now expressed through natural language.

Reader takeaways

1. Researchers: reproduce the attack to benchmark detection methods; report stealthiness metrics alongside effectiveness. 2. Engineers: audit item text ingestion pipelines; consider semantic-similarity and anomaly checks on seller-supplied metadata. 3. Product/security teams: treat LLM-facing content as untrusted input and design defenses accordingly.