The paper introduces VirusCascade, a black‑box attack that exploits the collaborative reflection mechanism in LLM‑powered recommender agents. By leveraging reflective persistence and cross‑agent propagation, the attack promotes a target item through semantic rationalisation and structural positioning, achieving state‑of‑the‑art targeted exposure on four real‑world datasets. The study demonstrates that existing static‑pipeline attacks cannot exploit this recurrent, multi‑agent amplification pathway.
By Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim
arXiv:2606. 02643v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG)-enhanced LLM systems, while powerful, introduce substantial inference costs due to the inclusion of an extra multi-stage pipeline that dynamically retrieves and synthesizes information from external knowledge sources.
By Chengliang Liu, Liangbo Ning, Yujuan Ding, Wenqi Fan
arXiv:2606. 11265v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate downstream model outputs through malicious knowledge injection.
By Xi Nie, Hongwei Li, Shenghao Wu, Mingxuan Li, Jiachen Li, Wenbo Jiang
arXiv:2512. 05518v2 Announce Type: replace-cross Abstract: Open-source Large Language Models (LLMs) play a critical role in the democratization of AI, yet their "open" nature introduces more avenues for malicious actors to misuse them for harmful purposes.
By Jason Vega, Gagandeep Singh
Multimodal Retrieval Augmented Generation (M-RAG) is increasingly vulnerable to adversarial attacks where malicious data are crafted to produce embeddings that align with benign entries in the vector...
Protein foundation models increasingly support the generation of novel biological sequences, yet their reliance on large public datasets creates opportunities for adversarial manipulation of the mater...
The paper reports two data‑only poisoning attacks on protein design systems. In the first, poisoned sequences were added to the pre‑training corpus of large autoregressive language models, causing the models to reliably generate sequences triggered by specific patterns after as few as 200 contaminated examples. The second attack inserted malicious records into a retrieval corpus, enabling a single query‑aware record to dominate retrieval results and, in many cases, alter the generated protein sequence or transfer a new domain via homology.
By Charalampos Koilakos, Kimon-Antonios Provatas, Michail Patsakis, Candace SY Chan, Georgios A. Pavlopoulos, Ilias Georgakopoulos-Soares
arXiv:2511.22707v2 Announce Type: replace-cross
Abstract: In web environments, user preferences are often refined progressively as users move from browsing broad categories to exploring specific item...
By Tianxin Wei, Xuying Ning, Xuxing Chen, Ruizhong Qiu, Yupeng Hou, Yan Xie, Shuang Yang, Zhigang Hua, Jingrui He
Unified autoregressive models (UAMs) generate both text and image tokens in a single pass, simplifying multimodal generation but introducing new vulnerabilities. The authors present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, which can be executed via data-based or model-based poisoning. ToBAC can manipulate both visual outputs and accompanying text, enabling subtle triggers such as the word "cool" to induce brand promotion or ideological influence in a majority of generations, with success rates up to 63.1% against JanusPro.
By Tobias Braun, Jonas Henry Grebe, Hossein Shakibania, Anna Rohrbach, Marcus Rohrbach
VerTox is a framework that turns corpus poisoning of neural ranking models into a verifiable reward‑guided reinforcement learning problem. By fine‑tuning compact large language models with reward shaping that couples ranking distortion and factual corruption, VerTox generates fluent, low‑perplexity adversarial documents that frequently outrank target items across multiple ranking architectures, including a commercial embedding model. Experiments show near‑perfect attack success and significant degradation of downstream retrieval‑augmented generation performance.
By Zhiqi Huang, Vivek Datla, Zhichao Xu, Puxuan Yu, Vivek Srikumar, Alfy Samuel
arXiv:2606. 11023v1 Announce Type: cross Abstract: Sequential recommendation aims to predict users' next interaction with items by analyzing their historical behavior.
By Yifan Li, Jiahong Liu, Xinni Zhang, Hao Chen, Yankai Chen, Wenhao Yu, Jianting Chen, Irwin King
arXiv:2511.14301v4 Announce Type: replace-cross
Abstract: Transformer-based models are highly susceptible to backdoor attacks via supervised fine-tuning (SFT). To red-team existing data-poisoning def...
By Eric Xue, Ruiyi Zhang, Pengtao Xie