{"id":"526fbb9d-0440-4db0-944c-2235b5542441","arxiv_id":"2508.03703","paper_version":2,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":4.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"An inversion attack on LLM-based recommenders reconstructs user prompts from output logits, recovering 65% of interacted items and inferring age and gender in 87% of cases.","lead":"This paper shows that LLM-powered recommender systems can leak private user information: attackers can recover much of a user's interaction history and demographics from the model's output scores. The work matters because it identifies a concrete attack surface in a class of AI systems that is being rapidly adopted.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reconstruction accuracy may reflect lexical leakage in LLM output logits, not genuine privacy compromise; needs trivial-baseline comparison before the 65%/87% claims are interpretable.","rationale":"The reader's weakest assumption correctly identifies that reconstruction fidelity may not equal privacy leakage. My read sharpens that concern: for LLM-based recommenders, output logits are over a text vocabulary that includes item titles, so the inversion attack could succeed by trivial lexical association rather than by extracting latent private information. This is the most load-bearing issue because the entire paper's contribution rests on the 65% and 87% empirical numbers; if those numbers are not compared against obvious baselines, the vulnerability claim is unsubstantiated. The abstract alone cannot settle this, so the reader's UNVERDICTED verdict remains appropriate. However, the concrete test I propose is the minimal evidence a full text must provide to convert the verdict toward ACCEPT or REJECT. I mark agreement as partial because the reader emphasized metric definition and dataset leakage, whereas my concern focuses on the specific mechanism of lexical leakage through the output vocabulary and the need for baseline controls.","tokens_in":749,"tokens_out":2926,"duration_ms":34429,"concrete_test":"Run the same inversion attack with a trivial-adversary baseline that (a) always returns the top-10 most frequent items in the training set and (b) always predicts the majority demographic class; compute the same item-recovery and attribute-inference metrics. If the proposed method's improvement over these baselines is small (e.g., within a few percent), then the 65%/87% numbers do not measure privacy leakage. Additionally, repeat the evaluation with a held-out set of prompts whose item titles are replaced by semantically equivalent but lexically distinct IDs; if recovery collapses, the attack is exploiting surface form rather than user-history semantics.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that output-logit inversion recovers user history and demographics. The load-bearing condition is that the measured recovery rate faithfully represents adversarial privacy leakage. The abstract does not state how items are counted, whether exact match is required, or whether the victim model's output distribution over the text vocabulary contains the item titles themselves. In an LLM-powered recommender, the model must emit item names or descriptive text as output tokens; the logits over those tokens can assign high probability to the exact strings that also appear in the user prompt. In that case, an inversion attack could largely reconstruct the prompt by exploiting surface lexical overlap rather than leaking private user data. Furthermore, without a baseline that predicts the most frequent items or the model's own recommended items, the 65% item-recovery figure may only show that the reconstructed prompt resembles the input prompt on easily guessable content. The 87% age/gender inference likewise needs comparison to demographic base rates in the dataset. If the attack does not substantially beat such baselines, the paper's headline vulnerability claim is not established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims to present the first systematic study of inversion attacks on LLM-empowered recommender systems, in which an adversary reconstructs the original textual user prompts (containing interaction histories and demographics) from the output logits of the recommendation model. The authors report that their proposed Similarity Guided Refinement method reproduces and improves upon the vec2text framework, recovering nearly 65 percent of user-interacted items and correctly inferring age and gender in 87 percent of cases across two domains and two LLM-based recommendation models. The abstract also states that leakage is insensitive to victim model performance but highly dependent on domain consistency and prompt complexity. This review is based solely on the abstract, as the full text was not available.","tokens_in":951,"tokens_out":1921,"duration_ms":21643,"significance":"If the reported results are correct and the evaluation is rigorous, this would be a practically meaningful privacy vulnerability in an emerging class of recommender systems, with implications for user data protection and system transparency. The paper would also introduce a concrete attack method (Similarity Guided Refinement) that improves on an existing inversion framework, which is a useful contribution. However, the abstract alone does not provide the definitions, baselines, or experimental controls needed to assess whether the claimed success rates represent genuine privacy leakage rather than lexical artifacts or base-rate predictability. The significance is therefore conditional on verification of the evaluation methodology, and the current abstract under-specifies the load-bearing empirical claims.","major_comments":[{"comment":"The headline success rates ('nearly 65 percent' item recovery and '87 percent' age/gender inference) are not defined. It is unspecified whether item recovery requires exact title match, fuzzy matching, or rank-based metrics, and no error bars or statistical significance tests are reported. The abstract should state the metric definitions, the number of test prompts, and the variance across runs before these numbers can be interpreted as evidence of a privacy leak.","section":"Abstract"},{"comment":"No baselines are reported. The 65 percent item-recovery figure needs comparison to trivial baselines such as predicting the most frequent items in the training set or the victim model's own recommended items. Similarly, the 87 percent demographic inference must be compared to demographic base rates in the datasets. Without such comparisons, the attack may only reflect that user histories and attributes are predictable, not that inversion recovers them from output logits.","section":"Abstract"},{"comment":"The central claim that the attack recovers private user information from output logits requires ruling out lexical leakage. In LLM-based recommenders, the model must emit item names or descriptive text as output tokens, so the logits over those tokens may assign high probability to the exact strings appearing in the user prompt. The abstract does not explain how the evaluation distinguishes reconstruction of private interaction history from reconstruction of the surface form of the generated recommendation text. This is a load-bearing interpretive issue that should be addressed with a controlled comparison, e.g., measuring recovery against prompts whose items are paraphrased or replaced with non-private placeholders.","section":"Abstract"},{"comment":"The claimed conclusion that 'privacy leakage is largely insensitive to the victim model's performance but highly dependent on domain consistency and prompt complexity' is not supported by the information given. The abstract reports only two domains and two models, and no results are shown that vary model performance, domain consistency, or prompt complexity. The dependent and independent variables are not defined, and no effect sizes are provided, so this claim currently reads as an assertion rather than an experimental finding.","section":"Abstract"}],"minor_comments":[{"comment":"The phrase 'reproduce the vec2text framework' should specify the exact version and configuration of vec2text used, and the incremental contribution of Similarity Guided Refinement over the reproduced baseline should be quantified.","section":"Abstract"},{"comment":"The abstract reports 'age and gender' as a joint 87 percent figure; it would be clearer to report accuracy for age and gender separately, since these may have different base rates and difficulty levels.","section":"Abstract"},{"comment":"The abstract should mention whether the attack is white-box (access to full logits) or black-box, and whether the adversary is assumed to know the prompt template; this is central to interpreting the threat model.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":"This review is based solely on the abstract because the full text was not provided. The abstract-level concerns about missing metric definitions and baselines are serious enough to require major revision, but they are fixable within the paper's scope. I would encourage the editor to send the full manuscript for review, since the central claim may well be defensible once the evaluation is properly specified. I also note that the paper does not appear to include a discussion of ethical or responsible-disclosure considerations for a demonstrated privacy attack; this would be worth adding if not already present in the full text."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague—quick read of arXiv:2508.03703, abstract only. The paper does something real: it takes the existing vec2text inversion framework and applies it, with a refinement heuristic, to LLM-powered recommenders, and reports concrete empirical numbers (65% item recovery, 87% demographic inference). If those numbers hold up, that is a useful, timely finding for the recommender-systems and privacy communities. The 'first systematic study' framing is a bit strong—this is a new application of a known attack rather than a new attack class—but that alone is not a flaw.\n\nThe soft spots are in the evidence, not the idea. The abstract gives no metric definitions: what counts as an 'item recovered'? Exact match? Rank-based? What are the datasets, the split, the victim models' output spaces? There are no error bars, no baselines, no comparisons to frequency priors or to the model's own outputs. That last one matters: an LLM-powered recommender has to emit item names or descriptive text, so the output logits may assign high probability to the exact strings that appear in the user's prompt. If so, a logit-inversion attack could be reconstructing surface lexical content rather than leaking genuinely private data. The stress-test note is right that without a trivial baseline—always predicting the most common items, or predicting the model's own top recommendations—the 65% figure is hard to interpret. The 87% demographic inference also needs comparison to base rates in the dataset. I would not call this a load-bearing flaw yet, because we have not seen the full evaluation; but it is exactly what a referee should push on.\n\nOn balance, the paper deserves a serious referee. The central claim is checkable, the domain is relevant, and the authors are reusing a known framework rather than inventing something unverifiable. The risk is that the evaluation inflates the attack's strength, not that the paper is trivial or incoherent.\n\nBring it to a reading group? Maybe, if someone wants to review the evaluation methodology. Would I cite it? Not in my own work right now. My recommendation: send to peer review with a request for baselines and metric definitions.","headline":"Abstract-only review: a timely and concrete attack study, but the headline numbers are uninterpretable without baselines and metric definitions; worth a rigorous referee, not a desk reject.","tokens_in":1426,"tokens_out":1611,"would_cite":false,"duration_ms":16771,"reading_group":"maybe","serious_thinker":"unclear","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Output logits leak 65% of user history in LLM recommenders, the paper claims.","keywords":["privacy leakage","inversion attack","LLM recommender systems","prompt reconstruction","output logits","Similarity Guided Refinement","demographic inference"],"falsifier":"Re-run the reconstruction evaluation using only items the victim model never saw during training and with prompts in raw, unnormalized form; if item recovery drops to near zero, the 65 percent figure depends on the shared vocabulary rather than on genuine logit leakage.","tokens_in":579,"feed_emoji":"🔓","tokens_out":4338,"duration_ms":38692,"temperature":0.7,"pith_summary":"This paper tries to establish that LLM-empowered recommender systems leak private user information through their output logits. An adversary who can observe the model's output probabilities can reconstruct the original textual prompt, which contains interaction histories and demographic attributes. The authors' method, Similarity Guided Refinement, recovers nearly 65 percent of user-interacted items and infers age and gender in 87 percent of cases across movie and book recommender models. This matters because these systems are promoted for handling cold-start users, and the attack shows that their textual interface is also a privacy side channel.","feed_headline":"Logits leak 65% of user history in LLM recommenders","feed_subtitle":"An inversion attack rebuilds the user prompt from model outputs, inferring age and gender in 87% of cases.","key_machinery":"The central mechanism is the inversion pipeline built from a text-inversion model that is fine-tuned to convert a recommendation model's output logits back into a token sequence. The paper's contribution, Similarity Guided Refinement, iteratively improves the reconstructed prompt by measuring the similarity between the embedding of the current reconstruction and the embedding implied by the logits. This refinement step is what pushes the reconstruction fidelity to the reported levels.","core_discovery":"The paper's central claim is that the logits produced by LLM-empowered recommender systems carry enough information to reconstruct the user prompt itself, not merely to rank items. Using a text-inversion model optimized by Similarity Guided Refinement, the attack maps output logits back to the original prompt tokens, achieving high-fidelity reconstruction. The reported recovery rate of nearly 65 percent for interacted items and 87 percent for age and gender holds across two representative LLM-based recommendation models in the movie and book domains. The experiments also show that leakage is largely independent of the victim model's performance and is instead driven by domain consistency and prompt complexity.","pith_inferences":["The threat model presumes the adversary can observe output logits; in many real deployments logits are not exposed to end users, so the practical risk depends on API design and may be smaller than the headline numbers suggest.","The same inversion approach likely transfers to other prompt-based personalization systems, such as conversational shopping assistants or personalized search, where user attributes are also baked into a textual prompt.","Because the fidelity metric compares against the original prompt, defenses that paraphrase or reorder the prompt could lower the reported success rate without actually removing the semantic information, so attack evaluations should include semantic equivalence measures as well."],"forward_implications":["A user-facing API that exposes logits gives adversaries a practical path to recovering a user's interaction history without access to the model's training data.","Privacy leakage cannot be reliably reduced by making the recommender less accurate, since the attack succeeds almost regardless of the victim model's performance.","The attack works best when the recommendation domain is consistent and the prompt is simple, so more complex or cross-domain prompts offer a natural defensive surface.","Practitioners who deploy LLM-based recommenders should treat output logits as a privacy-sensitive signal and consider restricting or perturbing them."],"supporting_citations":[],"fun_headline_variants":["LLM recommenders silently leak user history via inversion attack","Logits betray users: 65% of items, 87% of age/gender in LLM recommenders","Reconstructing user prompts from LLM recommender logits","Inversion attack on LLM recommenders recovers 65% of user interactions","LLM recommender leakage: 65% item recovery, 87% age/gender inference"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported success rates assume that matching the reconstructed prompt to the original prompt is a valid measure of privacy leakage; if normalization or a shared item vocabulary inflates the match, the real-world risk would be lower.","fun_headline_variants_meta":{"raw":{"variants":["LLM recommenders silently leak user history via inversion attack","Logits betray users: 65% of items, 87% of age/gender in LLM recommenders","Reconstructing user prompts from LLM recommender logits","Inversion attack on LLM recommenders recovers 65% of user interactions","LLM recommender leakage: 65% item recovery, 87% age/gender inference"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00065,"raw_usage":{"total_tokens":2958,"prompt_tokens":897,"completion_tokens":2061,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":513,"completion_tokens_details":{"reasoning_tokens":1954}},"tokens_in":513,"tokens_out":2061,"duration_ms":15118,"temperature":1.0,"reasoning_tokens":1954,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T15:45:30.091767+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the reconstruction evaluation using only items the victim model never saw during training and with prompts in raw, unnormalized form; if item recovery drops to near zero, the 65 percent figure depends on the shared vocabulary rather than on genuine logit leakage.","supporting_citations":[],"review_version":1}