AlignPoison: Conditional Targeted Poisoning of Generative Recommenders via Decoding-Aligned Prefixes

Key points

• In this work, we ask: how susceptible are generative recommenders to conditional targeted poisoning?1
• Under a realistic setting where an adversary can inject limited malicious interactions and query a recommendation API as a black box, our empirical study shows that generative recommenders are vulnerable: injecting fewer than 1% synthetic interactions significantly increases the likelihood of promoting malicious targets under the trigger.1
• Motivated by this analysis, we develop AlignPoison, a black-box framework that discovers and samples context-aligned prefixes from API outputs.1
• Results show that these prefixes outperform competitive baselines, improving ASR lift by up to 16.3 percentage points and highlighting a decoding-dependent, context-sensitive poisoning vulnerability in generative recommendation models.1

Sources (1)

• [1]AlignPoison: Conditional Targeted Poisoning of Generative Recommenders via Decoding-Aligned Prefixes
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 10, 02:36 AM

  Generative recommendation models based on autoregressive decoding have been adopted as alternatives to classical ranking-based systems.

  In this work, we ask: how susceptible are generative recommenders to conditional targeted poisoning?

Extractive summary: sentences quoted from the sources.