AlignPoison: Conditional Targeted Poisoning of Generative Recommenders via Decoding-Aligned Prefixes

• The study addresses an underexplored risk for autoregressive recommenders that decode structured item tokens rather than score a fixed candidate set.Source: §1 · pp. 1–2
• Simple trigger-conditioned injections substantially increase target exposure, demonstrating conditional targeted poisoning vulnerability in generative recommenders.Source: §1 · p. 2
• Across two Amazon product datasets and a multimodal micro-video dataset, AlignPoison outperforms poisoning baselines while preserving benign recommendation quality.The evaluation also compares against defenses and ablations.Source: §1 · p. 2
• AlignPoison discovers and samples short, context-aligned prefixes using API outputs, then injects synthetic histories to reinforce trigger-to-target associations.The framework is designed for black-box prefix discovery, optimization, and adaptive sampling.Source: §1 · p. 2
• Decoding alignment and prefix popularity are the two key properties identified for malicious prefixes, whose interaction is characterized as driving attack success.Source: §1 · p. 2

2.1 Generative Recommendation

• Generative recommendation spans semantic-ID retrieval, industrial and multimodal systems, and a parallel line of language-interface approaches.Source: §2.1 · p. 2

2.2 Data Poisoning Attacks in Recommendation and Autoregressive Models

• Prior poisoning work includes recommender, language-model, and language-based recommendation attacks; this study instead targets semantic-ID recommenders through interaction histories and top-K queries.With metadata, prompts, and tokenizer fixed, the setup precludes direct text manipulation and motivates decoding-aligned poisoning.Source: §2.2 · p. 3

3.1 Generative Recommendation Model

• Generative recommenders serialize user histories as semantic-ID token sequences and autoregressively decode the next item, with beam search producing top-K recommendations.Source: §3.1 · p. 3

3.2 Data Poisoning Attacks

• Poisoning injects synthetic histories into clean training data; the targeted objective is to increase the target’s top-K appearance after a trigger and benign history prefix.Source: §3.2 · p. 3, §3.3 · p. 3

3.3 Conditional Targeted Poisoning: Adversary Model

• The adversary can inject a limited fraction of histories, query a recommendation API, and inspect the catalog, but lacks model internals, tokenizer access, and real interaction sequences.The attack is restricted to interaction histories, uses small poisoning ratios, and defaults to popular triggers without assuming metadata or prompt modification.Source: §3.3 · p. 3

3.4.1 Motivation: From Global to Conditional Poisoning

• Conditional poisoning activates promotion in a trigger context, potentially capturing high-value traffic while leaving global metrics relatively undisturbed; the section asks whether recommenders are vulnerable.Source: §3.4.1 · p. 4

3.4.2 Warm-up Experiment

• +43.2 pp on Industrial: trigger-conditioned injection yields greater ASR@K lift than random poisoning at the 1% poisoning ratio.The lift measures target hit-rate difference between poisoned and clean models on identical triggered test histories.Source: Table 1 · p. 4, §3.4.2 · p. 4
• After establishing conditional promotion with random prefixes, the warm-up study asks whether optimizing the context before the trigger further improves steering.Source: §3.4.2 · p. 4

4 Method: Decoding-Aware Conditional Poisoning

• The method constructs poisoned histories as Q ◦ Ip ◦ T, first identifying and scoring candidate prefixes, then allocating the budget and sampling histories to inject.The pipeline has two phases.Source: §4 · p. 4

4.1 Poison-Budget Allocation

• The allocation objective weights each prefix’s conditional attack success by the natural probability of encountering its triggered context.The attack-success and context-probability quantities are not directly available through black-box access, motivating an observable surrogate.Source: §4.1 · p. 5

4.2 Observable Conditions for Effective Prefixes

• The observable signals represent complementary parts of triggered-context coverage: prefix occurrence and support for the subsequent trigger transition.The clean decoder’s trigger ranking provides the transition-support signal; API-level exposure serves as a proxy for prefix occurrence.Source: §4.2 · pp. 5–6
• AlignPoison scores prefixes by combining API exposure as a proxy for prefix occurrence with clean-model trigger rank as a proxy for transition support.A frequent prefix with weak trigger support, or a trigger-supporting prefix that rarely occurs, may have limited context coverage.Source: §4.2 · pp. 5–6
• The observable utility retains a multiplicative structure, with nonnegative weights controlling the influence of trigger support and API exposure.With both weights positive, weaker support from either factor lowers the score; a zero weight removes that factor.Source: §4.2 · p. 6

4.3.1 Phase 1: Prefix Utility Estimation

• The discovery process induces a candidate-prefix pool from API query outputs, then discards prefixes where the trigger is absent and scores the feasible remainder.Queries over catalog items produce observed items and API frequencies; queries with each candidate prefix provide its trigger rank and exposure.Source: §4.3.1 · p. 6

4.3.2 Phase 2: Entropy-Regularized Poison Budget Allocation

• AlignPoison distributes the poisoning budget by maximizing expected prefix utility plus an entropy term, yielding a Gibbs distribution over feasible prefixes.Smaller temperature concentrates budget on high-utility prefixes, while larger temperature produces a smoother allocation; sampled prefixes form histories Q ◦ Ip ◦ T.Source: §4.3.2 · pp. 6–7

5.1 Experimental Setup

• Evaluation spans two Amazon Review subsets and MicroLens-100K with an SID-tokenized autoregressive recommender; ASR@K lift compares poisoned and clean models on identical triggered histories.The study also compares adapted interaction-poisoning baselines.Source: §5.1 · p. 7

5.2 Main Results: Overall Performance

• On Industrial at r = 0.5%, AlignPoison achieves 36.7 pp ASR@10 lift, exceeding the strongest baseline by 14.0 pp.Table 2 reports ASR@K lift across three datasets and multiple cutoffs.Source: §5.2 · p. 7, Table 2 · p. 8
• At r = 1%, ASR@3 / ASR@50 exceeds 80% on Industrial and nearly 87% on MicroLens; clean-set utility stays stable on Office and Industrial, with a minor MicroLens drop.The ratio compares lift at K = 3 with lift at K = 50.Source: §5.2 · p. 8, Figure 3 · p. 8, Figure 4 · p. 8

5.3 Component Analysis and Practicality

• On Office, combined prefix scoring achieves 16.6 pp ASR lift@3, versus 4.8 pp for popularity-only and 11.2 pp for ranking-only scoring.The same ordering holds at K = 5.Source: §5.3 · p. 9, Figure 5 · p. 9
• On MicroLens at r = 0.5%, B = 100 yields ASR lift@3/10/50 of 17.1/22.5/23.7 pp, only 0.7/0.7/0.4 pp below the full candidate pool.After API outputs are collected, prefix scoring and the closed-form allocation use local computations.Source: §5.3 · p. 9, Table 3 · p. 9
• With Meta-Llama-3.2-1B-Instruct on MicroLens at r = 0.5%, AlignPoison achieves ASR lift@3/10/50 of 14.3/18.7/20.1 pp, exceeding the strongest baseline at each cutoff.At K = 10, the improvement over Random_prefix is 5.1 pp.Source: §5.3 · p. 9, Table 4 · p. 9

5.4 Detectability of the Proposed Attack

• At a 1% clean-user FPR, FAP detects 0.0%–1.2% of injected users across datasets, poisoning ratios, and graph constructions.The table reports TPRs on injected users; lower values indicate harder detection.Source: §5.4 · p. 10, Table 5 · p. 10
• Across all three datasets, AlignPoison has substantially lower Mahalanobis-detector AUROC than Bandwagon, indicating less distinguishable injected histories.The analysis measures separation in the model’s internal representations.Source: §5.4 · p. 10

6 Case Study

• At r = 0.5%, the target is absent from the clean model’s saved top-50 output and ranks first after poisoning in this single archived instance.The target is an evaluation label, not part of the prompt; the main experiments report aggregate effectiveness.Source: Figure 6 · p. 10, §6 · p. 10

• The paper demonstrates conditional poisoning vulnerabilities in black-box generative recommenders.Source: §7 · p. 11
• AlignPoison enables targeted promotion with small poisoning budgets and motivates defenses against suspicious patterns.Source: §7 · p. 11

• The attack assumes sufficient black-box API access for prefix discovery; relaxing this assumption requires further study.Source: Limitations · p. 11

Ethical Considerations

• Experiments use public benchmark datasets and simulated data-poisoning attacks, not a deployed service or real users.Source: Ethical Considerations · p. 11
• Generative AI tools were used to improve the manuscript’s clarity and readability.Source: Ethical Considerations · p. 11

A Additional Warm-up Results

• Trigger-conditioning consistently outperforms unconditioned injection across datasets and strategies at both poisoning ratios, often moving near-zero lift to double-digit lift.The comparison covers r ∈ {0.5%, 1%}; the trigger-conditioned variant inserts the trigger immediately before the target while retaining each strategy’s prefix construction.Source: A Additional Warm-up Results · p. 16, Table 6 · p. 16

B Prefix Utility and Budget Allocation

• Prefix utility combines context activation with API-exposure and clean-model trigger-rank proxies, while entropy regularization yields a unique optimal allocation.The activation identity requires no independence assumption; the context analysis fixes prefix length.Source: B Prefix Utility and Budget Allocation · p. 17

C Model Details

• The backbone autoregressively decodes semantic-ID sequences, while multimodal video representations combine visual and textual inputs compressed by a QFormer.Source: C Model Details · p. 18

D Dataset Details

• Evaluation uses two Amazon product datasets and the MicroLens-100K micro-video benchmark, modeled as time-ordered implicit-feedback interaction sequences.The Amazon datasets are filtered using iterative 5-core processing and split into train, validation, and test sets at an 8:1:1 ratio.Source: D Dataset Details · p. 18

E ASR Lift and Early-Cutoff Ratio

• ASR@K lift measures the poisoned-minus-clean target hit-rate difference on identical triggered histories, in percentage points.Positive lift does not establish that exposure increases exclusively on triggered histories; ASR@3 / ASR@50 compares lift at two cutoffs and is not a fraction of successful samples or a recall measure.Source: D Dataset Details · p. 19, E ASR Lift and Early-Cutoff Ratio · p. 19

F Implementation Details

• Evaluation pairs each long-tail target with a popular trigger and compares poisoned and clean models on the same trigger-ending history, while benign utility uses histories not ending in a trigger.Targets are selected from the bottom 20% of items by popularity and triggers from the top 20.Source: F Implementation Details · pp. 19–20
• AlignPoison queries the clean model with catalog-seeded prefixes of at most two items, scores feasible prefixes using trigger rank and API-level exposure, then samples histories Q ◦Ip ◦T at poisoning ratios of 0.5% or 1%.Training uses supervised fine-tuning followed by reinforcement learning.Source: F Implementation Details · p. 20
• Selected triggers already occur hundreds to thousands of times in clean data, while MicroLens targets occur approximately 1–5 times, so poisoning reinforces specific transitions rather than dominating trigger frequency.The global 0.5% or 1% poisoning budget is shared across target–trigger pairs.Source: F Implementation Details · p. 20

G Additional Benign Utility Results

• Table 7 reports benign HR@K for K ∈ {10, 20, 50} under different poisoning configurations.Source: G Additional Benign Utility Results · p. 20, Table 7 · p. 21

H.1 Effect of sampling sharpness α

• ASR lift peaks at α = 0.5; near-deterministic sampling at α = 0.1 and greater randomness at α ≥ 1.0 yield weaker performance.The authors use α = 0.5 as the default, balancing exploration and exploitation.Source: §H.1 · p. 21, Figure 7 · p. 21

H.3 Trigger–target pairing

• 14.9/20.1/21.5 ASR@3/10/50 for one-to-many pairing trails one-to-one pairing’s 17.8/23.2/24.1 by 2.9/3.1/2.6 percentage points on MicroLens at r = 0.5%.Source: §H.3 · p. 22

H.2 Prefix length analysis

• Increasing prefix length from one to two items substantially improves attack success across cutoffs, while length three adds only marginal gains.Table 8 reports ASR@K lift in percentage points on MicroLens at r = 0.5%.Source: §H.2 · p. 21, Table 8 · p. 22

FAP protocol

• The FAP protocol propagates suspiciousness for 100 iterations and calibrates its decision threshold on clean users to yield a 1% false-positive rate.Poison labels are used only to calculate metrics after scores are produced.Source: I Detectability Analysis · p. 22

Representation-space analysis

• Representation analysis embeds each history using the mean of its last-layer hidden states, then projects subsampled clean and injected histories to 2D with t-SNE.The reported subsample contains 10,000 clean and 100 injected histories.Source: I Detectability Analysis · p. 22
• Mahalanobis-detector AUROC is 0.67, 0.64, and 0.71 for AlignPoison versus 0.91, 0.88, and 0.94 for Bandwagon on Office, Industrial, and MicroLens, respectively.The authors report that AlignPoison preserves attack effectiveness while reducing representation-level detectability compared with Bandwagon.Source: I Detectability Analysis · p. 22
• Across datasets, AlignPoison’s injected interactions are less clustered and more mixed with clean interactions than Bandwagon’s.The t-SNE visualizations show this pattern for Office, Industrial, and MicroLens.Source: I Detectability Analysis · p. 22, Figure 8 · p. 23, Figure 9 · p. 23