arXiv AI

Fairness Attacks on Recommender Systems

arXiv:2606. 29064v1 Announce Type: cross Abstract: The unfairness of recommender systems has become a topic of concern due to its significant social and ethical implications.

arXiv Machine Learning
Jun 9

The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection

arXiv:2606. 09204v1 Announce Type: new Abstract: We present a reproducible failure mode of safety training in RAG-based LLM recommendation -- the Injection Paradox -- in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injection-free baseline.

By Hyunseok Paeng
arXiv Computation and Language
Sep 2

VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models

VerTox is a framework that turns corpus poisoning of neural ranking models into a verifiable reward‑guided reinforcement learning problem. By fine‑tuning compact large language models with reward shaping that couples ranking distortion and factual corruption, VerTox generates fluent, low‑perplexity adversarial documents that frequently outrank target items across multiple ranking architectures, including a commercial embedding model. Experiments show near‑perfect attack success and significant degradation of downstream retrieval‑augmented generation performance.

By Zhiqi Huang, Vivek Datla, Zhichao Xu, Puxuan Yu, Vivek Srikumar, Alfy Samuel
arXiv AI
Aug 25

One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders

The paper introduces FORGE, a benchmark that rewrites real product pages into fake ones to test how often search‑augmented large language models (LLMs) recommend these polluted items. Across 12 commercial and open‑weight LLMs, a single polluted page can lead to up to 27% of recommendations being fake, rising to 73.8% when the top‑3 replacements are used. The study finds that reasoning does not help and existing defenses—skepticism prompts, consensus filters, and credibility re‑ranking—are largely ineffective.

By Minghao Luo, Liang Chen