Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems

Linda Beková; Rodrigo Alves

cs.CROct 15, 2026

Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems

Authors: Linda Beková, Rodrigo Alves

Organizations: Czech Technical University in Prague, Prague, Czech Republic

Abstract

Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple cosine-similarity attack can recover item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets. Leakage is strongest when the adversary's partial information overlaps with the victim representation, but it also persists through semantic alignment between independently sourced descriptions. We further show that item leakage can propagate to user re-identification from sparse ratings. Finally, we evaluate obfuscated descriptions as a mitigation and find a clear leakage-utility tradeoff.

Figures & tables

				MiniLM-L6			MiniLM-L3			mMiniLM-L12			DistilRoBERTa			MPNet-QA			ALBERT-small
			A/V	$T+D$	$D$	$\tilde{D}$	$T+D$	$D$	$\tilde{D}$	$T+D$	$D$	$\tilde{D}$	$T+D$	$D$	$\tilde{D}$	$T+D$	$D$	$\tilde{D}$	$T+D$	$D$	$\tilde{D}$
MovieLens	Closed Set	1000	$\overline{T}$	1.00	0.91	0.15	0.97	0.78	0.12	0.95	0.79	0.14	1.00	0.92	0.17	0.98	0.89	0.12	0.96	0.78	0.12
		1000	$\overline{D}$	0.80	0.79	0.46	0.77	0.73	0.51	0.75	0.72	0.51	0.80	0.78	0.45	0.81	0.82	0.43	0.73	0.70	0.47
		3000	$\overline{T}$	0.99	0.88	0.10	0.95	0.72	0.08	0.92	0.74	0.09	0.99	0.89	0.11	0.96	0.85	0.08	0.95	0.73	0.08
		3000	$\overline{D}$	0.75	0.74	0.37	0.71	0.67	0.41	0.69	0.66	0.41	0.75	0.73	0.36	0.76	0.76	0.35	0.68	0.64	0.37
		5000	$\overline{T}$	0.99	0.86	0.08	0.94	0.69	0.06	0.91	0.71	0.08	0.99	0.88	0.09	0.95	0.83	0.06	0.93	0.71	0.06

Table 1: Item-identification MRR across datasets, candidate settings, embedding models, victim corpora, and adversarial corpora.

Figure 1: Leakage–utility tradeoff and user re-identification results on MovieLens. Left: obfuscation reduces item-identification MRR but degrades rating prediction and ranking agreement; right: sparse ratings enable user re-identification as

k

increases.

Recommender Systems

Recommender systems predict and rank items for people using interaction histories, content, context, and feedback.

See all 521 papers

Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders
Jul 26, 2026Ge Zhang, Jingru Cheng, Huiyuan ChenLearning to Rank Adversarial Attacks
Stanford University · Independent Researcher
Is Serving-Time Language-Model Inference Necessary for Recommendation? Evidence from Generative and Agentic Settings
Aug 2, 2026Xiang Chen, Zhongke He, Hongwei Zeng +4Sequential Recommendation Algorithmic Auditing
Tongji University · Dalian University of Technology · University of Chinese Academy of Sciences +3
Memory Layer: Train the In-Model Cache for Recommendation Models
Jul 27, 2026Liangyuan Na, Gufan Yin, Yixin Bao +19KV Caching Recommender Systems
Meta

Jul 26, 2026J/K move · Enter open · S save

Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders

Ge Zhang, Jingru Cheng, Huiyuan Chen

Stanford University · Independent Researcher

Learning to Rank Adversarial Attacks Adversarial Attacks on LLMs LLM Reranking Recommender Systems Position Bias

Open paper AskPDF arXiv

Large language models (LLMs) used as listwise rerankers in recommendation systems suffer from position bias when serializing candidate sets into prompts. We show this order sensitivity creates an exploitable attack surface: an attacker can promote a label-0 target into the top-

k

solely by reordering candidates, without changing item content, labels, or model parameters. We introduce

\mathrm{promo}@k

to quantify this vulnerability, measuring the fraction of label-0 targets that can be elevated into top-

k

rankings via permutation. Evaluating across three domains (MovieLens, Amazon Books, and Amazon Fashion),

\mathrm{promo}@5

reaches up to 0.57 at an attack budget of

R

= 50 orderings. Furthermore, ordinary permutation stability predicts vulnerability without running the attack. While a bidirectional T5 encoder scorer reduces exposure, permutation-consistency regularization and architectural invariance effectively mitigate it. Pointwise scoring avoids the bias issue but degrades ranking quality. These results demonstrate that input candidate order in listwise LLM reranking is a security-relevant attack vector. Code and data are available at https://github.com/geoz-lab/position_bias_attack.

Abstract

Recommender Systems

Explore similar work

Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders

Is Serving-Time Language-Model Inference Necessary for Recommendation? Evidence from Generative and Agentic Settings

Memory Layer: Train the In-Model Cache for Recommendation Models