VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents

Yurong Hao; Wen Zhou; Guowei Guan; Tiantong Wu; Fuyao Zhang; Wei Yang Bryan Lim

cs.CRSep 29, 2026

VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents

Authors: Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim

Organizations: College of Computing and Data Science, Nanyang Technological University

Abstract

Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous agents, whose semantic states are dynamically refined through a recurrent process known as collaborative reflection. While this mechanism improves recommendation quality, it simultaneously introduces a systemic vulnerability: adversarial evidence injected into a single agent can be rationalised into a legitimate preference narrative, written back into memory, and propagated to other agents through interaction contexts. We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking. Existing attacks on recommender systems, whether based on interaction-level data poisoning or text-level adversarial perturbations, assume static pipelines and thus cannot exploit this recurrent, multi-agent amplification pathway. To bridge this gap, we first conduct a controlled vulnerability analysis that establishes two exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation. Then building on these findings, we propose VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces: the former ensures the target item is naturally rationalised as satisfying broad user preferences, the latter positions it for system-wide propagation. Extensive experiments on four real-world datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves state-of-the-art targeted exposure under evaluated stealth constraints, reaching a mean E@20 of 0.384 and surpassing the strongest baseline by an absolute margin of +0.185.

Figures & tables

Fig. 1: RS vs. LLM-ARS. Traditional RS (Left) optimises fixed user–item representations through gradient-based learning, whereas LLM-ARS instantiate users and items as memory-equipped agents that update their semantic states through autonomous interaction and collaborative reflection.

Metric	Lag 1	Lag 2	Lag 3	Lag 4
Reuse Rate	78.0%	81.7%	79.3%	81.6%
Elaboration Rate	0 3.3%	0 3.4%	16.7%	0 6.3%
Avg. n (admitted users)	30	29	18	2
Baseline regeneration rate (no-probe control): 2.0%

TABLE I: Reflective persistence among admitted users (AgentCF, CDs & Vinyl), averaged over 10 runs. Each column reports a lag relative to the user’s individual admission round.

Fig. 2: Cumulative fraction of benign users measured across interaction-reflection rounds. Dark bars: newly admitted in each round; light bars: admitted in prior rounds and still retained. Dashed red line: no-probe baseline regeneration rate (2%).

Users	$n$	Setting	Rec. Drift $\uparrow$	Claim Adoption $\uparrow$
Hop-1	12	Sem.-null	0.003 [0.001, 0.005]	0.0% [0.0, 0.0]
Hop-1	12	Sem.-probe	0.397 [0.371, 0.423]	33.6% [28.9, 38.3]
Hop-2	25	Sem.-null	0.002 [0.001, 0.003]	0.0% [0.0, 0.0]
Hop-2	25	Sem.-probe	0.245 [0.221, 0.269]	25.8% [22.7, 28.9]
Hop $>2$	63	Sem.-null	0.003 [0.002, 0.004]	0.0% [0.0, 0.0]
Hop $>2$	63	Sem.-probe	0.123 [0.112, 0.134]	6.7% [5.1, 8.3]

TABLE II: Cross-agent propagation under the semantic probe and topology-matched semantic-null control. Values report the mean and 95%

t

-confidence interval across 10 paired runs;

n

denotes the number of benign users in each hop group.

Fig. 3: Overview of VirusCascade . The adversary extracts preference motifs from anchor items and designs the target profile to make

i^{*}

easier to rationalise during reflection. It then constructs smooth, propagation-oriented behaviour trajectories from anchor items to

i^{*}

. The victim system’s collaborative reflection may subsequently admit and propagate the injected evidence.

Dataset	#Users	#Items	#Inter.	Sparsity
CDs & Vinyl	112,395	73,713	1,443,755	99.98%
Movies & TV	297,529	60,110	3,404,812	99.98%
Automotive	193,651	79,317	1,709,025	99.99%
Musical Instruments	27,530	10,611	231,312	99.92%

TABLE III: Statistics of the datasets used in our experiments.

Victim RS	AgentCF
Attack	CDs & Vinyl						Movies & TV
Attack	H@10	N@10	E@10	H@20	N@20	E@20	H@10	N@10	E@10	H@20	N@20	E@20
NoAttack	0.130	0.050	(-)	0.260	0.082	(-)	0.220	0.125	(-)	0.310	0.148	(-)
RandAttack	0.090	0.053	0.010	0.210	0.084	0.071	0.170	0.110	0.050	0.280	0.138	0.120
PopAttack	0.115	0.053	0.000	0.235	0.077	0.010	0.170	0.114	0.050	0.290	0.133	0.150
ExpPromot	0.140	0.054	0.000	0.290	0.091	0.051	0.185	0.117	0.030	0.270	0.134	0.110

TABLE IV: Attack performance across three victim architectures on CDs & Vinyl and Movies & TV datasets. We report H@K and N@K for recommendation utility and E@K for targeted promotion effectiveness. NoAttack denotes the same victim configuration and benign protocol without any adversarial manipulation, and we report its E@K as (-).

Dataset	NoAttack		DrunkAgent	Ours
Dataset	Range	Mean	DrunkAgent	Ours
CDs & Vinyl	[10.31, 90.02]	28.78	49.93	32.22
Movies & TV	[12.91, 374.28]	72.85	50.65	39.35

TABLE V: Attack imperceptibility in terms of perplexity.

Attacks	CDs & Vinyl			Movies & TV
Attacks	@1	@2	@L	@1	@2	@L
TextFooler	0.200	0.000	0.200	0.251	0.000	0.121
DrunkAgent	0.294	0.000	0.100	0.175	0.000	0.087
VirusCascade	0.321	0.109	0.268	0.294	0.090	0.157

TABLE VI: Attack imperceptibility in terms of ROUGE.

Attacks	Flagged as Manipulated $\downarrow$	Factual Consistency $\uparrow$
Original	19.3%	$4.31\pm 0.47$
DrunkAgent	28.7%	$4.02\pm 0.95$
VirusCascade	21.9%	$4.16\pm 0.62$

TABLE VII: Attack imperceptibility in terms of human evaluation (20 participants, 120 descriptions each).

Victim RS	AgentCF
Variant	CDs & Vinyl						Movies & TV
Variant	H@10	N@10	E@10	H@20	N@20	E@20	H@10	N@10	E@10	H@20	N@20	E@20
NoAttack	0.130	0.050	(-)	0.260	0.082	(-)	0.220	0.125	(-)	0.310	0.148	(-)
w.o SemInj	0.110	0.058	0.010	0.250	0.094	0.071	0.200	0.135	0.020	0.320	0.164	0.170
w.o StruInj	0.100	0.046	0.020	0.260	0.086	0.131	0.160	0.101	0.000	0.300	0.135	0.080
VirusCascade	0.120	0.057	0.111	0.250	0.083	0.374	0.205	0.123	0.070	0.305	0.138	0.240

TABLE VIII: Ablation study: effect of removing semantic injection (w.o SemInj) or structural injection (w.o StruInj).

Fig. 4: Effect of malicious user fraction $m$ .

Fig. 5: Effect of the coefficient

\alpha

Dataset	Victim RS	LLaMA-3			GPT-4o			Gemini-2.5
Dataset	Victim RS	H@20	N@20	E@20	H@20	N@20	E@20	H@20	N@20	E@20
CDs & Vinyl	AgentCF	0.320	0.107	0.151	0.250	0.083	0.374	0.340	0.119	0.333
	AgentSEQ	0.410	0.129	0.160	0.240	0.087	0.465	0.330	0.112	0.283
	AgentRAG	0.320	0.096	0.170	0.230	0.105	0.545	0.350	0.115	0.364
Movies & TV	AgentCF	0.250	0.102	0.140	0.290	0.134	0.240	0.340	0.161	0.140
	AgentSEQ	0.330	0.144	0.150	0.300	0.142	0.300	0.340	0.165	0.210

TABLE IX: Attack transferability with different auxiliary models

\mathcal{M}_{\mathrm{aux}}

Dataset	$\mathcal{M}_{\mathrm{aux}}$	PPL		ROUGE
Dataset	$\mathcal{M}_{\mathrm{aux}}$	NoAttack	Ours	@1	@2	@L
CDs & Vinyl	LLaMA-3	[21.64, 107.62]	56.28	0.267	0.103	0.267
	GPT-4o	[10.31, 90.02]	32.22	0.321	0.109	0.268
	Gemini-2.5	[11.78, 113.24]	31.82	0.341	0.125	0.268
Movies & TV	LLaMA-3	[13.75, 409.59]	76.20	0.412	0.091	0.206
	GPT-4o	[12.91, 374.28]	39.35	0.294	0.090	0.157

TABLE X: Attack imperceptibility with different auxiliary models

\mathcal{M}_{\mathrm{aux}}

. NoAttack PPL is reported as [min, max].

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Marker	No-Probe Regen.	Lag-1	Lag-2	Lag-3	Lag-4
Rare	2.0%	78.0%	81.7%	79.3%	81.6%
Common	15.0%	72.0%	73.4%	68.7%	76.4%

Appendix

TABLE XI: Reflective persistence under rare and common-frequency diagnostic markers. Lag columns report reuse rate.

Victim RS	AgentCF (user-only)
Attack	CDs & Vinyl						Movies & TV
Attack	H@10	N@10	E@10	H@20	N@20	E@20	H@10	N@10	E@10	H@20	N@20	E@20
NoAttack	0.170	0.074	(-)	0.350	0.119	(-)	0.190	0.124	(-)	0.320	0.157	(-)
TextBugger	0.120	0.057	0.010	0.370	0.119	0.061	0.220	0.133	0.020	0.320	0.158	0.130
TextFooler	0.150	0.063	0.040	0.340	0.111	0.051	0.210	0.115	0.010	0.330	0.145	0.110
DrunkAgent	0.140	0.069	0.000	0.270	0.102	0.030	0.220	0.129	0.020	0.340	0.160	0.100

Appendix

TABLE XII: Attack transferability under user-only agent architectures (no item-side memory updates).

Victim RS	AgentCF
Attack	Automotive						Musical Instruments
Attack	H@10	N@10	E@10	H@20	N@20	E@20	H@10	N@10	E@10	H@20	N@20	E@20
NoAttack	0.150	0.075	(-)	0.230	0.094	(-)	0.110	0.042	(-)	0.280	0.085	(-)
RandAttack	0.080	0.043	0.000	0.180	0.068	0.170	0.060	0.023	0.010	0.160	0.049	0.141
PopAttack	0.070	0.038	0.050	0.230	0.078	0.170	0.090	0.043	0.030	0.220	0.075	0.091
ExpPromot	0.100	0.043	0.030	0.230	0.076	0.180	0.030	0.011	0.051	0.150	0.040	0.152

Appendix

TABLE XIII: Attack performance on Automotive and Musical Instruments. H@K and N@K measure recommendation utility, while E@K measures targeted promotion effectiveness.

Fig. 6: Population-scale evaluation on CDs & Vinyl under a fixed attacker budget of five users. Bars report VirusCascade as the active population increases from 100 to 500 users. Star markers denote DrunkAgent under the corresponding population setting.

Fig. 7: Attack performance over an extended 20-round interaction on AgentCF with CDs & Vinyl. Top: recommendation utility (H@20); bottom: targeted exposure (E@20).

Defence	Attack	AgentCF			AgentSEQ			AgentRAG
Defence	Attack	H@20	N@20	E@20	H@20	N@20	E@20	H@20	N@20	E@20
ONION (T)	NoAttack	0.410	0.141	(-)	0.410	0.161	(-)	0.410	0.168	(-)
	DrunkAgent	0.310	0.107	0.030	0.380	0.135	0.030	0.400	0.131	0.040
	VirusCascade	0.340	0.128	0.256	0.370	0.130	0.202	0.350	0.140	0.202
Fraudar (B)	NoAttack	0.270	0.088	(-)	0.380	0.124	(-)	0.340	0.114	(-)
	DrunkAgent	0.290	0.109	0.061	0.390	0.145	0.081	0.380	0.138	0.061

Appendix

TABLE XIV: Attack performance under text- (T), behaviour- (B), and memory-level (M) defences on the CDs & Vinyl dataset. Comparisons are made within each defence block, as defences alter the inference pipeline.

Explore similar work

Aug 4, 2026cs.IR

Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity

Multi-agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item agents through natural-language interaction to refine preferences and generate recommendations. These systems inherit vulnerabilities from both their data-driven nature and their multi-agent interactions, which manifest in distinct ways. Understanding how connectivity modulates vulnerability in these systems could facilitate the development of more robust recommendation pipelines. In this work, we adapt attacks and defenses from the general multi-agent systems (MAS) literature to the agent-based CF setting, evaluating them under systematically varied connectivity in the AgentCF framework, where CF connectivity is characterized along two axes: (i) candidate count (the number of item candidates per turn per user, measuring user-side interaction density) and (ii) catalog concentration (the degree of item catalog overlap across users). Our contributions include: (1) Adaptation: we reproduce MAS-inspired attacks and defenses in the agentic CF domain, confirming partial transferability of original observations. (2) Characterization: we characterize how the two aspects of connectivity shape attack and defense outcomes, revealing role asymmetries between user and item agents, non-monotonic temporal dynamics in attack efficacy, and divergent patterns across dissemination and extraction attack goals. Additionally, as an exploratory extension, we assess the applicability of epidemic-inspired static metrics in ranking CF configurations by expected attack outcome, potentially enabling cost-efficient robustness assessment. Implementation is available at https://github.com/anjunhu/ConnACF

Anjun Hu, Hanting Xie, Saranya Govindan +2

University of Oxford · Amazon

Collaborative Filtering Diverse Attacks Epidemiological Models

Ask PDF

Sep 22, 2026cs.CR

The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems

With recent advancements in large language models (LLMs) and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms (e.g., for managing a user's personal account) remains underexplored. Existing studies on agent poisoning typically assume that the adversary can expose poisoned content to the agent. Although such an attack is direct and effective, it is more easily detected and mitigated. In the context of social media platforms, this leaves open whether the recommendation system itself would surface such content to the agent in a more subtle manner. Through theoretical analysis, we show that the like-score mechanism used in OASIS can be exploited, and we characterize the conditions under which a multi-stage chain of poisoned posts can steer the agent's feed. Based on these insights, we further develop an algorithm that crafts realistic poisoned posts. Experiments support our theoretical findings and demonstrate the effectiveness of the proposed algorithm. Notably, by exploiting the like-score feedback loop, the attack causes the recommendation system to select poisoned posts even when their user-post similarity falls below the retrieval threshold.

Yue Xing, Pengfei He, Zitao Li

Michigan State University

Poisoning Social Media Recommendation Similarity and Metrics

Ask PDF

Jul 26, 2026cs.IR

Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders

Large language models (LLMs) used as listwise rerankers in recommendation systems suffer from position bias when serializing candidate sets into prompts. We show this order sensitivity creates an exploitable attack surface: an attacker can promote a label-0 target into the top-

k

solely by reordering candidates, without changing item content, labels, or model parameters. We introduce

\mathrm{promo}@k

to quantify this vulnerability, measuring the fraction of label-0 targets that can be elevated into top-

k

rankings via permutation. Evaluating across three domains (MovieLens, Amazon Books, and Amazon Fashion),

\mathrm{promo}@5

reaches up to 0.57 at an attack budget of

R

= 50 orderings. Furthermore, ordinary permutation stability predicts vulnerability without running the attack. While a bidirectional T5 encoder scorer reduces exposure, permutation-consistency regularization and architectural invariance effectively mitigate it. Pointwise scoring avoids the bias issue but degrades ranking quality. These results demonstrate that input candidate order in listwise LLM reranking is a security-relevant attack vector. Code and data are available at https://github.com/geoz-lab/position_bias_attack.

Ge Zhang, Jingru Cheng, Huiyuan Chen

Stanford University · Independent Researcher

Large Language Model Reranking Order Matters Cross-Encoder Cyberattacks Position Stationary Point

Ask PDF