Similarity based recommendation systems can be stealthily poisoned by multi stage attacker chains
The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
Online agents use recommendation systems to show users content they might like. The authors find a way to trick these systems by creating chains of fake posts that appear real and gather likes over time. This fake popularity causes the system to keep showing bad or harmful posts to the agents, even when those posts don't closely match user interests. The attack hides from easy detection by using the system's own liking rules against it.
What this means in practice
- •For social media platform engineers: Detect and mitigate subtle multi-stage poisoning attacks exploiting like-score feedback loops in recommendation algorithms.
- •For online security teams: Develop monitoring tools that identify chains of realistic poisoned posts aiming to manipulate user agent feeds.
Authors
Yue Xing, Pengfei He, Zitao Li
Abstract
With recent advancements in large language models (LLMs) and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms (e.g., for managing a user's personal account) remains underexplored. Existing studies on agent poisoning typically assume that the adversary can expose poisoned content to the agent. Although such an attack is direct and effective, it is more easily detected and mitigated. In the context of social media platforms, this leaves open whether the recommendation system itself would surface such content to the agent in a more subtle manner. Through theoretical analysis, we show that the like-score mechanism used in OASIS can be exploited, and we characterize the conditions under which a multi-stage chain of poisoned posts can steer the agent's feed. Based on these insights, we further develop an algorithm that crafts realistic poisoned posts. Experiments support our theoretical findings and demonstrate the effectiveness of the proposed algorithm. Notably, by exploiting the like-score feedback loop, the attack causes the recommendation system to select poisoned posts even when their user-post similarity falls below the retrieval threshold.