DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents

1 Introduction

• Memory retains interaction histories so agents can adapt to changing preferences, but this same mechanism creates an overlooked attack surface.The paper focuses its investigation on stealthy memory-corruption attacks.Source: §1 · p. 2
• Persistent attacks can contaminate evolving memories and drift preferences, with sequential and retrieval models exposing perturbed traces in later recommendations.Temporal dependencies can bias belief states, while future retrieval extends the impact of small-scale attacks.Source: §1 · p. 2
• Prior attacks target static embeddings or predefined prompts, while agentic recommender studies largely omit security analysis and commercial systems are black-box.The paper also identifies item promotion as a practical threat that prior attack types overlook.Source: §1 · p. 2
• DrunkAgent crafts semantically meaningful triggers and interaction strategies to corrupt target-item memory updates, optimizing both on a surrogate model.The surrogate is intended to improve transferability and stealthiness while avoiding frequent queries to victim models.Source: §1 · p. 2
• DrunkAgent outperforms state-of-the-art black-box attacks across agentic recommenders and stealthiness evaluations, and resists existing advanced defenses.The reported evaluation uses real-world datasets and covers collaborative filtering, retrieval augmentation, and sequential recommendations.Source: §1 · p. 3

2.1 Victim LLM-powered Agentic RSs

• The interaction matrix Y records user-item interactions, while V_u denotes the items in user u’s profile.Source: §2.1 · p. 3
• Recommendation prompts combine behavior sequences or user and item features with personalized templates, with agent-based systems also using user or item memories.Source: §2.1 · p. 3

2.2 Threat Model

• The threat model assumes adversaries cannot access victim parameters, agent memories, or underlying LLM architectures, motivating black-box evaluation.Source: §2.2.1 · p. 3, §2.2.3 · p. 3

2.2.1 Attacker’s Knowledge

• The attacker’s available information includes publicly accessible recommendation data such as item titles and user reviews.Source: §2.2.1 · p. 3
• The attack seeks broad target-item exposure, with transferability across black-box systems and stealthiness as objectives.Source: §2.2.2 · p. 3

2.2.3 Attacker’s Capabilities

• The attacker can modify a target item’s description to induce memory corruption, including by updating descriptions or using multiple descriptions for the same item.Source: §2.2.3 · p. 3

3.1 Surrogate Module

• The surrogate simulates a target recommender with memory-augmented user, item, and recommendation agents, enabling attack optimization with limited access and fewer suspicious queries.Source: §3.1 · p. 3

3.2 Generation Module

• The generation module creates adversarial description triggers to promote target items, while its optimization context combines user memories, popular-item features, and target-item metadata.Source: §3.2 · p. 3, §3.2.1 · p. 5

3 DrunkAgent

• DrunkAgent has generation, strategy, and surrogate modules; the surrogate optimizes triggers and strategies for black-box attack transferability and stealthiness.Source: §3 · p. 3, Figure 2 · p. 4

3.2.1 Recommendation Context Construction.

• General user descriptions approximate user-agent memories, while publicly available popular items serve as candidates and their descriptions are LLM-refined into concise, informative features.Source: §3.2.1 · p. 4

3.2.2 Greedy Search Algorithm.

• Greedy search scores candidate triggers by negative log-likelihood of an output ranking the target first, then selects, recombines, and polishes candidates across epochs.Randomly exchanging text slices fuses candidate features; LLM polishing improves fluency and concealment.Source: §3.2.2 · p. 5

3.3 Strategy Module

• The strategy module aims to impede target-item agents’ memory updates during interactions, retaining the crafted trigger so the target item can be promoted.Source: §3.3 · p. 6

3.3.1 Perturbation Strategy Definition.

• Five perturbations fabricate task completion, switch context, add segmentation cues, inject malicious tasks, and use newline and exclamation marks to signal new urgent instructions.Source: §3.3.1 · p. 6

3.3.2 Adversarial Strategy Optimization.

• Strategy optimization seeks an ordering that maximizes the probability of a malicious action, defined as preventing the item agent from fulfilling roles or learning from interactions.The design may inform memory-aware defenses and efforts to strengthen agentic recommender robustness.Source: §3.3.2 · p. 6

4.1 Experimental Setup

• Experiments use CDs & Vinyl, Office Products, and Musical Instruments, randomly sampled target items, and six description-perturbation baselines optimized with the same surrogate.Yelp is included in the appendix to demonstrate cross-domain generalizability.Source: §4.1.1 · p. 6, Since we are the first work to gain… · p. 6

4.1.3 Targeted Recommender Systems.

• The evaluation tests AgentCF, retrieval-augmented AgentRAG, and sequential AgentSEQ under a strict black-box setting using HR@K, NDCG@K, and sentence perplexity.The ranking metrics use K values of 1, 2, and 3; lower perplexity indicates greater stealthiness.Source: §4.1.3 · p. 6, §4.1.4 · p. 6

4.1.5 Configuration of DrunkAgent.

• The surrogate uses Meta-Llama-3-8B-Instruct, with E = 20, |f M𝑐| = 10, and n = 5; victim LLM temperature is set to 0.Evaluation random seeds are set to 2024, and other parameters retain their defaults.Source: §4.1.5 · p. 7

4.2.1 Overall Transferability.

• DrunkAgent achieves higher HRs and NDCGs than state-of-the-art attack baselines across victim models and real-world datasets, though baselines can underperform benign status on Musical Instruments with AgentCF.The authors suggest improper descriptions can disrupt memory optimization and compromise attack performance.Source: §4.2.2 · p. 7, Table 1 · p. 7

4.3 Attack Universality

• HR@1 (equivalent to NDCG@1) across models, datasets, and randomly sampled target items indicates that DrunkAgent transfers across different items.The authors attribute this universality to triggers that capture general item characteristics and attack objectives.Source: Figure 3 · p. 7, §4.3 · p. 8

4.4 Attack Stealthiness

• Using HR@3, DrunkAgent does not induce drastic overall recommendation-performance changes before versus after attack, supporting the authors’ assessment that it is stealthy.The reported distribution covers all victim models and real-world datasets.Source: §4.4.1 · p. 8, Figure 4 · p. 8

4.4.1 Overall Stealthiness.

• DrunkAgent’s perturbed text has lower GPT-Neo perplexity than other attacks, which the authors interpret as greater imperceptibility.They describe the generated descriptions as coherent, fluent, and semantically meaningful.Source: §4.4.2 · p. 8, Figure 5 · p. 8

4.5 Defense Strategies to Attacks

• DrunkAgent remains transferable under paraphrasing and performs better than baselines after defenses are introduced.On Office Products, DrunkAgent with paraphrasing is more effective than without it; the authors suggest substitutions may improve semantic meaningfulness.Source: §4.5 · p. 8, Figure 6 · p. 8

5.1 Data Poisoning Attacks on Traditional Recommender Systems

• Traditional shilling attacks inject fake profiles with numerical ratings, but their training-time focus and textual semantic gap limit applicability to LLM-powered recommenders.These systems may use in-context learning or fine-tuning with little data rather than retraining, motivating text attacks at inference time.Source: §5.1 · p. 8

5.2 Adversarial Attacks on LLM-based Recommender Systems

• Existing LLM-based attacks either assume impractical access to prompt templates or target overall recommendation performance, while title edits can be noticeable and transferability is limited.The cited item-text attack alters titles; CheatAgent assumes prompt changes and is untargeted.Source: §5.2 · p. 9
• Dynamic agentic recommenders continuously adapt internal memories to user behavior and context, creating vulnerabilities such as memory corruption absent from static models.Robustness analysis therefore needs to account for evolving agent memory states.Source: §5.2 · p. 9
• DrunkAgent instead promotes target items through stealthy memory corruption using adversarial item descriptions and optimization tailored to dynamic victim architectures and attack goals.Descriptions offer more length and contextual information than titles for concealing perturbations.Source: §5.2 · p. 9

• Experiments on real-world datasets show DrunkAgent achieves state-of-the-art transferability and stealthiness under black-box settings.The framework promotes target items by perturbing agent memories.Source: §6 · p. 9
• The findings identify an unknown safety vulnerability: real-world inputs can influence agent memory, informing work toward more robust and trustworthy recommendation agents.The paper presents the attack as a lens for understanding agent vulnerabilities.Source: §6 · p. 9

• 100 users, 800 interactions, and 777 items; 99 users, 693 interactions, and 619 items; and 98 users, 588 interactions, and 483 items are sampled from the three datasets, respectively.The leave-one-out evaluation uses a 9:1 training-to-test split; scaling to larger datasets is future work.Source: §A.1.1 · p. 10

• Baselines perturb target-item descriptions at character, word, or sentence level using typos, punctuation, word substitutions, positive-word insertion, or GPT rewriting.The methods include DeepwordBug, PuncAttack, TextFooler, BertAttack, TrivialInsertion, and ChatGPTAttack.Source: §A.1.2 · p. 10
• DrunkAgent-generated description changes are presented as feasible because item providers can modify product representations through APIs; its E=20 yields the lowest attack costs among compared baselines.The passage contrasts this with the baselines’ query counts.Source: §A.1.2 · p. 10
• Agentic recommender architectures include user-side agents and AgentCF’s two-sided user-item modeling, with memories updated through interactions and optimization.AgentRAG and AgentSEQ add retrieval augmentation and task-specific prompts for diverse tasks.Source: §A.1.3 · p. 12

A.1.3 Victim LLM-powered Agentic Recommender Systems.

• The evaluation uses Chain-of-Thought prompting and ranks a randomly selected target item against nine randomly selected non-interactive items per user.The prompt design follows the original agents' autonomous-interaction and collaborative-optimization setup.Source: §A.1.3 · p. 12
• AgentCF ranks candidates using user-agent short memory, target-item features and memory, and candidate-item features.User and item agents are collaboratively optimized to model two-sided relations.Source: §A.1.3 · p. 12
• AgentRAG augments short-term user preference with specialized preferences retrieved from long-term memory using candidate-item memories as queries.The similarity calculation uses all-MiniLM-L6-v2.Source: §A.1.3 · p. 12
• AgentSEQ incorporates a user's historical interactions into recommendation prompts when interaction records are sparse and preference propagation is limited.The historical interactions correspond to item features associated with that user.Source: §A.1.3 · p. 12

A.2.1 Ablation Studies.

• Masking the strategy module causes a large attack-performance decrease, while removing greedy optimization causes a moderate decrease.The ablation results are built on AgentCF, with similar tendencies reported for AgentRAG and AgentSEQ; removing the surrogate was not tested because it would make the setting white-box.Source: §A.2.1 · pp. 12–13

A.2.2 Parameter Sensitivity.

• The success rate for getting target agents drunk remains 100% across tested optimization-iteration counts, and DrunkAgent is reported as insensitive to other attack parameters.The default iteration count is 2, as suggested in [42].Source: §A.2.2 · p. 13

A.2.3 Attack Generalizability across Domains.

• DrunkAgent consistently promotes target items on black-box recommender agents in Yelp, a local-services domain distinct from e-commerce.The evaluated Yelp subset contains 772 interactions from 61 users and 552 items, with 97.71% sparsity; Figure 7 reports HRs and NDCGs for benign and attack conditions.Source: §A.2.3 · p. 13, Figure 7 · p. 13

A.2.4 Attack Interpretability.

• Transferability is attributed to surrogate-based optimization of update-masking strategies and generalizable attack objectives, while stealthiness is attributed to coherent, meaningful text that conceals manipulative intent.Source: §A.2.4 · p. 13