Source-linked AI summary
An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems
Quoc Viet Nguyen, Trinh Pham, Viet Huynh, Hongzhi Yin, Quoc Viet Hung Nguyen, Bay Vo, Thanh Tam Nguyen
TL;DR
Recommender systems are vulnerable to fake-profile shilling, while prior attacks often require costly preparation or use static patterns. AGAS coordinates role-switching agents through feedback-driven campaign control, achieving stronger promotion, preserved benign quality, and greater efficiency under matched evaluations.
Problem
Prior shilling attacks require costly preparation, rely on static profile patterns, or lack coordinated adaptation, while coordinated agentic group attacks have not been explicitly studied in recommender systems.
Method
AGAS uses a Coordinator to manage role-switching worker agents, adapt attack strategies from feedback, and promote a target without offline fine-tuning.
Results
Across datasets and victim models, AGAS consistently outperforms conventional and agentic baselines while preserving benign recommendation quality, weakening representative detectors, and improving efficiency.
Takeaways & Limitations
AGAS provides a practical black-box threat model and reusable benchmark for stress-testing recommender systems against adaptive group shilling campaigns.
Abstract
from arXiv · showhide
Recommender systems have become core infrastructure for modern online platforms, personalizing content at scale and strongly influencing what users see, click on, and purchase. However, this dependence on user interaction also exposes them to shilling attacks, where malicious actors can inject fake profiles to distort item rankings and control visibility. Existing attacks often rely on target-specific fine-tuning or fixed profile templates, making them either difficult to adapt to different victims or easier to detect. To overcome these limitations, we propose the Agentic Group Attack System (AGAS), a coordinated shilling framework where a central Coordinator directs a group of role-switching worker agents to adaptively promote a target item across different victim families. The Coordinator dynamically adjusts the strategy when progress stalls or suppression signals increase, while workers pursue a shared objective and switch between active and inactive roles to avoid repetitive patterns. Under the same attack budgets and evaluation protocols, AGAS consistently surpasses strong baselines in target promotion while better preserving benign recommendation quality, weakening representative detectors, and achieving higher efficiency than prior attacks. These findings also emphasize that defending recommender systems may require mechanisms that can handle adaptive shilling campaigns, not just isolated fake-profile injections. Our code is available at https://github.com/phkhanhtrinh23/AGAS.
I. INTRODUCTION
AGAS frames shilling as a coordinated, adaptive campaign against collaborative-filtering recommenders, addressing preparation costs, static attacker behavior, and fixed strategies. It uses a Coordinator and role-switching workers to improve promotion, stealth, efficiency, and transfer across victim families.
- Motivation: Collaborative-filtering recommenders learn from interaction signals but are vulnerable to fake profiles that promote selected target items.Prior attacks span heuristics, profile generation, optimization, and reinforcement learning.
- Limitations of prior attacks: Previous methods incur costly preparation, produce static behavioral patterns, or lack mechanisms to redirect underperforming campaigns.Learning-based methods require training, while fixed templates and repeated strategies can leave detectable fingerprints.
- AGAS: A Coordinator uses feedback and safety signals to assign worker roles, regulate attack intensity, and switch strategies without offline fine-tuning.Workers can act as Profilers, Snipers, Camouflageurs, or Inactive agents across rounds.
- AGAS: AGAS formulates coordinated group shilling as an adaptive campaign in which multiple fake users jointly maximize target exposure while maintaining stealth.The framework explicitly treats the attack as coordinated rather than as independent profile injections.
- Evaluation and significance: Across datasets and victim models, AGAS outperforms conventional and agentic baselines while preserving benign recommendation quality and weakening representative detectors.The framework is also presented as an efficient benchmark for stress-testing recommender systems without costly fine-tuning or repeated surrogate retraining.
- Evaluation and significance: AGAS operates in a black-box setting and adapts from observable victim feedback rather than relying on victim-family-specific access or assumptions.This contrasts with white-box and surrogate-dependent attacks whose applicability depends on privileged information or surrogate quality.
III. FORMULATION
The paper models implicit-feedback collaborative filtering through user–item interactions and a learned scoring function, then connects this formulation to common matrix-factorization and graph-based backbones. The formulation supplies the recommender foundation used by the attack.
- A. Collaborative Filtering with Implicit Feedback: The user set U and item set I index the entities in the implicit-feedback recommendation problem.Users and items are represented as finite indexed sets.
- A. Collaborative Filtering with Implicit Feedback: The binary interaction matrix R records whether user u interacted with item i.An entry Rui equals 1 for an interaction and 0 otherwise.
- A. Collaborative Filtering with Implicit Feedback: Collaborative filtering learns a scoring function ŷui = fΘ(u, i) from each user’s positive item set.The positive set contains items for which the corresponding interaction entry is one.
- A. Collaborative Filtering with Implicit Feedback: The formulation covers matrix-factorization, graph-convolutional, and graph-contrastive recommender backbones.These model families share the interaction-based formulation while differing in how representations are learned.
- A. Collaborative Filtering with Implicit Feedback: BPR supplies the training objective for learning from positive interactions and unobserved or negative comparison items.The objective is defined over user, positive-item, and comparison-item tuples.
- A. Collaborative Filtering with Implicit Feedback: At inference, the recommender produces item scores that determine users’ ranked recommendation lists.These rankings provide the basis for evaluating whether a target item reaches a top-K position.
B. Targeted Shilling Attack
The targeted attack injects fake-user interactions into a clean implicit-feedback matrix to promote a chosen item in benign users’ top-K recommendations. AGAS optimizes exposure under a stealth constraint using only attacker-accessible feedback and coordinated multi-round control.
- Targeted objective: The attacker selects a target item itar and seeks to place it in the top-K recommendations of benign test users.Success is evaluated by whether the target appears in those users’ recommendation lists.
- Attack construction: Fake users are introduced as new accounts, with their interaction vectors stacked into a poisoned matrix alongside the clean data.The injected matrix contains Mf fake users and N item dimensions.
- Attack objective: AGAS maximizes target exposure while requiring injected profiles to remain within a specified stealth tolerance.The objective compares target visibility under the recommender trained on the poisoned matrix against profile anomaly constraints.
- Attack objective: The stealth tolerance is operationalized through worker and environment signals that determine whether to continue, slow down, pause, or switch strategy.These decisions regulate campaign intensity in response to observed conditions.
- Attack construction: AGAS constructs the poisoned matrix over T rounds using feedback from recommendations returned to its own fake accounts, not hidden benign-user metrics.The reported evaluation uses the full poisoning history accumulated across all rounds.
- Coordinated control: A Coordinator manages fake-user workers across rounds, tracking progress, worker safety, and campaign state while adjusting roles and attack strategy without training latency.The worker pool includes Profiler, Camouflageur, Sniper, and Inactive roles.
A. Coordinator
The Coordinator observes worker and environment signals, updates memory, and selects adaptive campaign controls across iterative attack rounds. These controls incorporate worker trust, risk, suspicion, rank feedback, acceptance, and alerts.
- Coordinator: Worker trust, risk, and validator scores summarize individual effectiveness and profile-level suspicion.Validator score ϕt,w combines extreme ratings, target positivity, and overlap with other fake users.
- Coordinator: AGAS initializes worker and environment signals, then iteratively builds observations, updates memory, assigns roles, aggregates actions, and forms the poisoned matrix.The procedure runs for T rounds unless a stopping condition is met.
- Coordinator: Rank feedback and acceptance rate reveal whether promotion is working and whether injected actions are being filtered, discounted, or suppressed.A weak rank change can trigger strategy adjustment, while a sudden acceptance drop may indicate silent defense.
- Coordinator: The suppression signal combines dropped actions, discounting, weak target movement, suppression streaks, and group overlap into a round-level suspicion score.Equal weighting is used for the five components.
- Coordinator: Alerts identify abnormal target spikes, unusually high worker overlap, or sharp acceptance declines and encourage slowing, pausing, or switching strategies.Initial worker and environment signals are neutral before the campaign begins.
B. Workers
Workers switch among exploration, stealth, payload, and inactivity roles while retaining individual action histories under Coordinator-level coordination. Each role balances promotion, realism, feedback collection, or risk reduction differently.
- Workers: Each worker keeps its own memory for item-level decisions while the Coordinator preserves group-level coordination.Worker histories determine what item each worker rates next.
- Workers: Profiler workers explore safe filler or bridge items to test acceptance and discover paths toward receptive users.Bridge items are especially relevant when feedback suggests a graph-style victim.
- Workers: Camouflageur workers rate filler items passively to make histories appear normal, rebuild trust, and keep the pool active during slowdowns.This role reduces coordinated-looking promotion rather than directly pushing the target.
- Workers: Sniper workers deliver the strongest payload and are assigned to high-trust, low-risk workers despite greater detection pressure.They directly promote targets for embedding victims and use bridge-item paths for graph victims.
- Workers: Inactive workers take no actions, allowing suspicious profiles to disappear completely instead of continuing weak benign behavior.The role provides a full pause for risky workers.
C. Strategy
AGAS organizes campaigns through probing, warm-up, coordinated payloads, and adaptive responses to suppression or risk. The Coordinator changes roles and replaces exposed workers as victim feedback evolves.
- Strategy: The Coordinator selects one campaign strategy and one role for each worker in every round.Role assignment is the basic mechanism for group-level adaptation.
- Strategy: Early victim probing uses rank responses to distinguish more likely embedding-based from graph-based victims.Direct target-related improvements favor the embedding-based interpretation; otherwise the victim is treated as more likely graph-based.
- Strategy: For graph-based victims, Profiler workers build a bridge-item pool that Snipers later use to form stronger two-hop paths to the target.Items are selected from favorable rank feedback and real-user connections around the target.
- Strategy: AGAS warms up with limited exploration and camouflage before launching a coordinated payload with a small number of Snipers and at least one Camouflageur.This sequence gathers feedback and trust before stronger promotion.
- Strategy: When acceptance falls, risk rises, or alerts appear, the Coordinator slows down, cleans profiles, freezes suspicious Snipers, or shifts workers toward safer roles.Safe replacement substitutes lower-risk rested workers while keeping the number of Snipers unchanged.
- Strategy: When suspicion is low and the target remains outside top-K, the Coordinator assigns the best available high-trust, low-risk worker to Sniper.The push continues until top-K is reached or stronger defense signals appear.
D. Complexity Analysis
AGAS has per-round complexity combining Coordinator work, worker calls and actions, and victim queries. Its heavy LLM cost remains linear in rounds, unlike AgentAttack’s additional candidate-generation and surrogate-retraining overhead.
- Complexity Analysis: O(T(cC + |Uf|(cW + L) + V)) captures Coordinator calls, worker calls and actions, and victim-query cost across T rounds.Here, |Uf| is the fake-user pool, L is the per-user action budget, and V is the victim-query cost.
- Complexity Analysis: For embedding-based victims, V = O(|Uf|d), while graph-based victims use V = O((|R| + |R̃(≤t)|)dK).d denotes embedding dimension and K denotes graph propagation layers.
- Complexity Analysis: Table I reports unpopular-target promotion separately for embedding-based and graph-based victims using mean±95% CI over five runs.Values are scaled by ×10^3 and identify best and second-best results.
- Complexity Analysis: AGAS keeps heavy LLM cost linear in T, with O(T|Uf|) short worker calls, whereas AgentAttack adds O(|Uf|C) candidate generation and surrogate retraining.The additional candidate count C contributes to AgentAttack’s token and runtime overhead.
V. EXPERIMENTS
Experiments evaluate AGAS across diverse datasets, victim families, popularity regimes, detectors, ablations, and efficiency settings under matched attack budgets and retraining protocols.
- Research questions: The study tests performance, stealthiness, detector resistance, component contributions, and efficiency across victim models and popularity regimes.These objectives correspond to five research questions, including scalability as a benchmarking and stress-testing tool.
- Experimental setup: The evaluation covers matrix-factorization, graph-convolution, and graph-contrastive victim families using HR@K, NDCG@K, and benign Rec@K.Victims include MF, NeuMF, GMF, NGCF, LightGCN, SimGCL, and XSimGCL, among others.
- Experimental setup: All methods use the same fake-user budget, target-item set, injected-action limit, and retraining protocol for each dataset–victim pair.Agentic methods are matched by imposing the same upper limit on injected actions across fake users.
- Experimental setup: AGAS observes rank movement through probe workers during offline transfer and never queries evaluated victims using test users.Victims are trained from scratch on both clean and poisoned matrices after attack generation.
B. Performance
AGAS achieves stronger target promotion across popularity regimes and victim families, while adapting attack intensity instead of attacking aggressively in every round.
- Tail regime: AGAS achieves the best result in every Tail-regime setting, with sizable gains over the strongest baseline across three victim families.The reported families are matrix factorization, graph convolution, and graph contrastive recommenders.
- Head/Mid regime: On Head/Mid regimes, AGAS dominates every axis across GMF, LightGCN, and XSimGCL, consistently exceeding AgentAttack and AgentSA.The performance gap remains across victim types and popularity regimes, rather than being tied to one family or target regime.
- Adaptive control: AGAS can probe early, slow down as suppression signals increase, or pause when the campaign becomes risky.The paper attributes more reliable long-term target movement to temporarily reducing intensity, preserving workers, and avoiding unstable promotion patterns.
C. Stealthiness
AGAS promotes targets while preserving users’ original preference structure and producing more diffuse fake-user embeddings than competing methods.
- Preference preservation: AGAS is the only method that keeps both target and ground-truth distances small in the per-user preference view.This indicates target promotion without pulling users away from their ground-truth items.
- Distributional camouflage: AGAS spreads fake histories more diffusely within the benign embedding cloud, whereas other methods form more concentrated fake clusters.In the t-SNE view, more scattered fake histories indicate better stealth.
- Adaptive stealth: Round-level adaptation and role-switching prevent fake users from collapsing into repetitive attack patterns.These mechanisms support both preference preservation and global distributional camouflage.
D. Detector
AGAS weakens both profile-level and group-level detection signals while preserving benign Top-10 recommendation quality. These results suggest that adaptive agentic campaigns challenge detectors designed for static or synchronized shilling patterns.
- Five representative detectors evaluate Accuracy, Recall, Precision, and F1, with lower values indicating attacks that are harder to detect.
- Role-specific behaviors weaken both per-profile outliers and cross-user overlap signatures used by non-group and group detectors.Benign-looking context, cleaner-worker promotion, and inactive workers reduce synchronized or repetitive activity.
- AGAS stays closest to the NoneAttack Rec@10 ceiling across victims, preserving benign Top-10 quality while promoting the target.
- The combined results suggest that current detectors struggle with adaptive agentic campaigns.