Pith. sign in

REVIEW 4 major objections 3 minor 85 references

Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity

T0 review · 4 major / 3 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that connectivity—candidate count and catalog overlap—shapes attack and defense outcomes in multi-agent collaborative filtering, with user and item agents responding differently and fast early attacks not predicting final

desk verdict First connectivity map of agentic CF vulnerability, honestly scoped, but single-run curves and acknowledged confounds mean the specific F3 ordering claims need replication before they carry weight. read the letter →

arxiv 2608.03272 v1 pith:OBZWMDDT submitted 2026-08-04 cs.IR cs.CRcs.MAcs.SI

Anjun Hu , Hanting Xie , Saranya Govindan , Jas Kandola , Kurt Cutajar This is my paper
classification cs.IRcs.CRcs.MAcs.SI
keywords responsibleAImulti-agentsystemscollaborativefilteringconnectivityattacksuccessrateLLMagentsrecommendersystemsecurityadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that in LLM-powered multi-agent collaborative filtering systems, connectivity is a primary driver of how attacks spread and how defenses hold. It adapts six attacks and four defenses from general multi-agent-systems research into the AgentCF recommender, then sweeps two connectivity axes: how many item candidates each user sees per turn ($k$) and how concentrated the item catalog is across users ($\rho$). Its central empirical finding is that attack success is role-asymmetric and temporally non-monotonic: user agents and item agents respond differently, and a fast early contamination spike does not predict the eventual plateau. The authors argue this makes a single scalar attack-success-rate metric insufficient, and they propose per-partition, per-regime reporting plus an epidemic-style static predictor as a cheap way to rank configurations. A sympathetic reader would care because it tells recommender-system builders which wiring choices amplify or dampen security risks before deployment.

What carries the argument

The central instrument is a two-axis connectivity sweep on the bipartite AgentCF architecture: candidate count $k\in\{1,2,3\}$ and catalog concentration $\rho=n_U/n_I\in\{0.5,1,2\}$, realized by resampling MovieLens-100K. Outcomes are per-turn, per-partition Attack Success Rates (ASR) from an LLM judge, split into transient slope and steady-state mean. A secondary mechanism is the recovery-aware first-order connectivity predictor, a closed-form SIS mean-field formula $R_U, R_I$ that ranks configurations from $k$, $\rho$, attacker fractions, and fitted recovery parameters without running full simulations.

What would settle it

Run the same attack suite with $k$ varied while the response format is held constant (always binary like/dislike or always a ranking), and with $\rho$ varied while item degree distributions are held fixed by constrained resampling; if the reported orderings across $k$ and $\rho$ vanish or invert, the connectivity claim is confounded. Separately, have human annotators label a sample of agent memories and compare with the LLM judge's contamination labels; a materially high false-positive or false-negative rate would invalidate the ASR measurements.

Watch

Extended reading notes

Core claim

The authors claim that the connectivity of a multi-agent CF system—candidate count $k$ and catalog concentration $\rho$—systematically shapes vulnerability, with three reproducible patterns. F1: contamination and leakage grow fast and saturate, like epidemic spread. F2: user and item partitions respond differently to both axes, an asymmetry with no analogue in role-homogeneous MAS. F3: the transient growth slope and steady-state mean are decoupled; raising connectivity can accelerate early attacks without raising, or even while lowering, the eventual plateau, and vice versa. They further claim that extraction attacks (privacy leaks, reverse engineering) are modulated mainly by $k$, while dis

Load-bearing premise

The central claim collapses if the connectivity sweeps do not isolate connectivity—since raising $k$ changes the per-turn ranking task format and raising $\rho$ shifts item degree distributions—or if the LLM judge's binary contamination labels misclassify at a material rate.

Editorial extensions

If this is right

  • Raising $k$ generally accelerates early-phase attack growth and often raises steady-state contamination, but the plateau is capped: $k=2$ and $k=3$ frequently converge, and for some attacks $k=2$ ends ahead of $k=3$.
  • Catalog concentration $\rho$ has little effect on pure extraction attacks, but denser catalogs increase item-side contamination and reverse-engineering success for dissemination and bidirectional attacks.
  • User and item partitions are asymmetric under both axes and across defenses; most defenses protect users better than items, with item-side gains concentrated in dense catalogs.
  • A single scalar ASR is insufficient; per-role, per-regime metrics are needed to rank configurations, and the paper's epidemic-inspired static predictor offers a partial but uneven shortcut.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the decoupling result generalizes, security benchmarks for agentic recommenders should report transient and steady-state ASR separately; a short red-team run may rank configurations opposite to their long-run risk.
  • The user/item asymmetry suggests a concrete defensive allocation: because user agents resist multi-hop spread while item agents do not, memory-update rules for item agents and bridge items are likely the higher-value defense surface.
  • The first-order predictor could be extended to second-hop transmission and heterogeneous degree distributions; if it holds up, it offers a configuration-screening tool that avoids costly full simulations.
  • A testable next step is to de-confound $k$ from task format (binary vs ranking) and $\rho$ from degree distribution; the paper flags this as a limitation, and an experiment that controls these would either sharpen or overturn the connectivity characterization.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper adapts a suite of MAS-inspired attacks (CORBA, NetSafe, MAMA, MASLeak, TOMA, MASTER) and defenses (G-Safeguard, BlindGuard, T-Guard, M-Guard) to the AgentCF multi-agent collaborative filtering framework, and evaluates them under two connectivity axes: candidate count k (user decision bandwidth, k=1,2,3) and catalog concentration rho (user/item ratio, rho=0.5,1,2). Outcomes are tracked per turn and per role partition (user/item) using an LLM judge to produce ASR curves. The central empirical findings are F1 (growth-saturation dynamics), F2 (role asymmetry), and F3 (faster transient growth does not always imply higher steady-state ASR). The paper also proposes an epidemic-inspired static predictor (Eq. 2) for ranking configurations by expected attack outcome. It concludes that single-scalar ASR is insufficient and that robustness reporting should separate temporal regimes and role partitions. Implementation is publicly released.

Significance. If the findings hold, the paper makes a useful contribution to agentic RecSys safety: it demonstrates that connectivity, measured through k and rho, produces non-trivial and role-dependent effects on attack/defense outcomes, and it provides a structured set of eight reproducibility elements (§5) that could inform future evaluation practice. The open codebase, cross-LLM ablations (§6.3), and attacker-ratio ablations (§6.1) are concrete strengths. The exploratory epidemic predictor (§7) is a promising idea for cost-efficient robustness screening. However, the empirical foundation is currently weakened by single-run curves, an uncalibrated LLM judge, and acknowledged confounds in the connectivity manipulations. These issues are load-bearing because the paper's main claims—notably F3—rely on small, sometimes non-monotonic ordering differences between configurations.

major comments (4)
  1. [§4, Table 1, §8 Limitations (4)] Every plotted ASR curve and every Table 1 symbol appears to come from a single run per configuration; the paper itself lists 'statistical significance across repeated seeds' as future work. The claims that carry the paper—MASLeak steady-state k=2 > k=3 despite k=3's faster transient; NetSafe item-side k=1/k=2 reversal; TOMA edge-FPR reversal; CORBA item-side rho non-monotonicity—are exactly small-gap orderings that can flip between stochastic LLM runs. Without repeated-seed confidence intervals and pairwise significance tests, F3 and the 'single scalar ASR is not sufficiently descriptive' policy claim lack empirical support. This is not a presentation issue; it is central to the paper's core characterization.
  2. [§3.6, §8 Limitations (4)] The LLM judge is the primary instrument for ASR, the main outcome variable. The paper states that deterministic checks are only used to 'spot-check' the judge, and that human-annotated calibration (FPR/FNR, prompt sensitivity) is a limitation. If the judge has systematic biases or high prompt sensitivity, all reported ASR levels and their cross-configuration orderings shift. Given that ASR is the basis for every qualitative finding (F1-F3), the paper should provide at least a human-annotated validation set with judge error rates per partition and attack type, and ideally report results with deterministic labels where available (e.g., exact canary matching) as a robustness check.
  3. [§3.3, §8 Limitations (2)] The paper acknowledges that 'adjusting k co-varies with prompt and ranking task structures, while resampling for rho shifts item degree distributions.' This is a serious confound for the central claim that connectivity modulates vulnerability. For example, k=1 is binary like/dislike feedback, k=2 is ranking two items, and k=3 is ranking three items; observed differences could reflect task format rather than interaction density per se. Similarly, rho variation resamples the catalog, changing item degree distributions as well as overlap. To support the connectivity interpretation, the paper should either add controls (e.g., hold task format fixed for different k, or use degree-matched resampling), or reframe the claims as joint effects of connectivity and task/format changes. As written, the causal attribution to connectivity is not supported.
  4. [§7, Eq. (2)] The Recovery-Aware First-Order Connectivity predictor is presented as enabling 'cost-efficient robustness assessment,' but the correlation results are obtained by fitting (gamma, r) per attack and partition to maximise in-sample Spearman correlation with the observed outcomes. This is an in-sample, per-configuration fit with two free parameters per partition, and the 'one-hop freezing' steady-state assumption is an ad-hoc simplification. Without held-out evaluation across configurations not used for fitting, or a proper complexity penalty, the reported predictive skill could be overfitting. The paper should report out-of-sample correlation (e.g., leave-one-configuration-out) and error bars on the fitted correlation, and state clearly that the predictor is a descriptive summary rather than a validated forecasting tool.
minor comments (3)
  1. [§4.3.1] The heading 'TO MA' appears to be a typo for 'TOMA'. Also, Fig. 3 captions could list which subplot corresponds to which variant more explicitly; the marker/color legends are dense.
  2. [Throughout] Mixed British/American spelling ('defence' vs 'defense') is present; this should be harmonized. Some references (e.g., [2], [13], [34], [80]) are dated 2026 and may not be universally available; please verify they are publicly accessible.
  3. [§5, Table 1] Table 1 uses '↕' for 'curve behaviors differ but lack consistent ordering.' This conflates genuinely non-monotonic but reproducible effects with run-to-run noise. Once repeated-seed data are added, it would be helpful to mark which '↕' entries are statistically distinguishable from flat ordering.

Circularity Check

1 steps flagged · score 6.0 of 10

Central characterizations are direct measurements, but the §7 predictive-metric validation is circular: (γ,r) are fit to maximize the same Spearman correlations later cited as evidence of predictor applicability.

  1. fitted input called prediction [Section 7, Predictive Metrics, after Eq. (2)]
    "Correlation results are available in the linked codebase, where(γ,r) are empirically fitted per attack and partition to maximise mean Spearman correlation. We observe that predictor-outcome correlations are uneven across attackers’ goals, roles, and temporal regimes, suggesting this first-order formulation is an over-simplification"

    The predictor R_U and R_I in Eq. (2) contain two free parameters (γ, r). The paper states these are fit per attack and per partition to maximize the mean Spearman correlation with the observed ASR outcomes, and then references those same correlations as evidence for the predictor's usefulness. Since the parameters are chosen to optimize the very ranking statistic being reported, the correlation is an in-sample maximum rather than an independent evaluation. With only five connectivity configurations (k=1,2,3 at ρ=1 and ρ=0.5,2 at k=2) and two fitted parameters per partition, the reported 'predictor-outcome correlations' are expected to be high by construction. Thus the claim that epidemic-inspired static metrics could enable cost-efficient a priori risk assessment is not supported by the pa

full rationale

The core empirical contribution — how k and ρ modulate ASR, role asymmetry, and transient-vs-steady-state ordering — is derived by direct measurement under fixed configurations, so it does not reduce to the paper's equations or to any fitted parameter. The paper contains no author self-citations, so self-citation circularity is absent. The only circular element is in the exploratory predictive-metrics section: equations (1)-(2) define R_U and R_I with free parameters (γ, r), and the text states that these are 'empirically fitted per attack and partition to maximise mean Spearman correlation' with the observed outcomes, with the resulting 'predictor-outcome correlations' then interpreted as evidence about the predictor's applicability. Because the same data are used both to fit the two parameters and to compute the reported Spearman correlations, the correlation is an in-sample optimum — a goodness-of-fit, not a prediction of expected attack outcome from graph structure alone. This reduces the §7 claim 'potentially enabling cost-efficient robustness assessment' to the fact that a 2-parameter curve can be made to rank a handful of connectivity configurations. The main attack/defense characterizations remain independent of this circular piece, so the paper is only partially circular (score 6). Considerations such as single runs, k/ρ confounds, and LLM-judge calibration are correctness/robustness concerns, not circularity, and are explicitly acknowledged in §8.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The central claim depends on three unpaid-for premises: ASR is measurable by an uncalibrated LLM judge; the k/rho sweep isolates connectivity and not task-format or degree-distribution changes; and the §7 epidemic predictor's structure (homogeneous degrees, one-hop freezing, SIS recovery) is a faithful description of contamination. Two parameters (gamma, r) are fitted per attack and per partition on the same data used to report correlations, and the susceptibility scales beta_U, beta_I are absorbed into those fits, so the predictor carries roughly two fitted degrees of freedom per attack-partition curve. Nothing in the paper requires a new entity beyond the fitted predictor itself.

free parameters (3)
  • gamma (contact-mediated recovery rate) = fitted per attack and partition (values in codebase)
    Introduced in Eq. (1)-Eq. (2); fitted per attack and partition to maximize mean Spearman correlation between predictor and observed outcome ranks in §7.
  • r (system-level additive adjustment) = fitted per attack and partition (values in codebase)
    Same fitting procedure as gamma in §7; the denominator (1-alpha)k*gamma + r is the fitted recovery block of the predictor.
  • beta_U, beta_I (partition susceptibility scales) = absorbed into gamma and r in the final predictor
    Set in Eq. (1); the paper states each partition's beta is 'absorbed into its own gamma and r', so effective susceptibility is a fitted quantity, not measured.
assumptions (6)
  • domain assumption k and rho manipulations isolate connectivity effects on attack outcomes
    The central characterization treats k and rho as clean independent variables; §8 Limitations (2) admits k co-varies with prompt and ranking task structure and rho resampling shifts item degree distributions.
  • domain assumption LLM judge labels are accurate enough for ASR measurement
    §3.6 makes the judge the primary instrument, with deterministic checks only as spot-checks, and §8 (4) admits no human-annotated calibration was performed.
  • domain assumption Agent degrees are near-homogeneous in both partitions
    §7 adopts a two-population homogeneous mean-field approximation 'since k is fixed by configuration and the catalog uniformly resampled, leaving agent degrees near-homogeneous by construction'; item popularity skew in MovieLens is not checked.
  • ad hoc to paper One-hop freezing at steady state
    §7 freezes rho_I at attacker prevalence alpha_I, 'disregarding secondary transmission from contaminated victims', to make Eq. (2) solvable; the predictor is one-hop by construction.
  • domain assumption SIS dynamics (recovery with no immunity) describe contamination in agent memory
    §7 imports Susceptible-Infected-Susceptible behavior from epidemic theory based on 'qualitatively consistent' curves; the recovery-without-immunity mechanism is assumed, not measured.
  • standard math Mean-field algebra and discrete-time contact model are valid
    Routine calculus and the Gomez et al. [7] contact model; accepted background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity." pith.science (2026). https://pith.science/paper/OBZWMDDT

@misc{pith2026260803272,
  author       = {Pith},
  title        = {Pith review of: Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OBZWMDDT}},
  note         = {Machine review of arXiv:2608.03272}
}
read the original abstract

Multi-agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item agents through natural-language interaction to refine preferences and generate recommendations. These systems inherit vulnerabilities from both their data-driven nature and their multi-agent interactions, which manifest in distinct ways. Understanding how connectivity modulates vulnerability in these systems could facilitate the development of more robust recommendation pipelines. In this work, we adapt attacks and defenses from the general multi-agent systems (MAS) literature to the agent-based CF setting, evaluating them under systematically varied connectivity in the AgentCF framework, where CF connectivity is characterized along two axes: (i) candidate count (the number of item candidates per turn per user, measuring user-side interaction density) and (ii) catalog concentration (the degree of item catalog overlap across users). Our contributions include: (1) Adaptation: we reproduce MAS-inspired attacks and defenses in the agentic CF domain, confirming partial transferability of original observations. (2) Characterization: we characterize how the two aspects of connectivity shape attack and defense outcomes, revealing role asymmetries between user and item agents, non-monotonic temporal dynamics in attack efficacy, and divergent patterns across dissemination and extraction attack goals. Additionally, as an exploratory extension, we assess the applicability of epidemic-inspired static metrics in ranking CF configurations by expected attack outcome, potentially enabling cost-efficient robustness assessment. Implementation is available at https://github.com/anjunhu/ConnACF

Figures

Figures reproduced from arXiv: 2608.03272 by the authors.

Figure 1
Figure 1. Attack/defense families reproduced on multi-agent [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. (Top) Candidate count variants: graph edge col￾ors match 𝑘 =1/2/3 line colors used in metric plots. (Bot￾tom) catalog concentration variants: 𝜌 =0.5/1/2 correspond to low/medium/high overlap across users. 3.4 Dataset and Task. We use the MovieLens-100K dataset [8], subsampling 100 users and varying the item catalog size to pro￾duce three catalog concentration levels (§3.3). MovieLens-100K is the canonical benchmark … view at source ↗
Figure 3
Figure 3. CORBA ASR and DoS rate (y-axis) across turns [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: TOMA: Reverse engineering metrics (Topology Sim [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 7
Figure 7. Figure 7: G-Safeguard against NetSafe (left) and T-Guard against TOMA (right). Top: guarded (solid) vs. unguarded (dashed) ASR [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: Attacker ratio ablation. Each panel fixes a topology config; curves show [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Adapted RecSys-native attacks that differ in styles and ( [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Cross-LLM consistency ablation (NetSafe, 25% attackers). Top: [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

85 extracted references · 21 canonical work pages

  1. [1]

    Pan, Shuyi Yang, Lakshya A

    Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ram- chandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. 2025. Why Do Multi- Agent LLM Systems Fail? arXiv:2503.13657 https://arxiv.org/abs/2503.13657

    arXiv 2025

  2. [2]

    Yin Cheng, Liao Zhou, Xiyu Liang, Dihao Luo, Tewei Lee, Kailun Zheng, Weiwei Zhang, Mingchen Cai, Jian Dong, and Andy Zhang. 2026. Let the Agent Steer: Closed-Loop Ranking Optimization via Influence Exchange. arXiv:2603.27765 https://arxiv.org/abs/2603.27765

    arXiv 2026

  3. [3]

    Yashar Deldjoo, Tommaso Di Noia, and Felice Antonio Merra. 2021. A Survey on Adversarial Recommender Systems: from Attack/Defense Strategies to Generative Adversarial Networks. doi:10.1145/3439729

    work page doi:10.1145/3439729 2021

  4. [4]

    Yang Feng and Xudong Pan. 2025. SentinelNet: Safeguarding Multi-Agent Col- laboration Through Credit-Based Dynamic Threat Detection. arXiv:2510.16219 https://arxiv.org/abs/2510.16219

    arXiv 2025

  5. [5]

    Adam Fourney, Gagan Bansal, Hussein Mozannar, Cheng Tan, Eduardo Salinas, Erkang Eric Zhu, Friederike Niedtner, Grace Proebsting, Griffin Bassman, Jack Gerrits, Jacob Alber, Peter Chang, Ricky Loynd, Robert West, Victor Dibia, Ahmed Awadallah, Ece Kamar, Rafah Hosn, and Saleema Amershi. 2024. Magentic-One: A Generalist Multi-Agent System for Solving Compl...

    arXiv 2024

  6. [6]

    Mohammad Sajjad Ghaemi. 2025. A Survey of Collusion Risk in LLM-Powered Multi-Agent Systems. InNeurIPS 2025 Workshop on Responsible Foundation Models. https://openreview.net/forum?id=Ylh8617Qyd

    2025

  7. [7]

    Gómez, A

    S. Gómez, A. Arenas, J. Borge-Holthoefer, S. Meloni, and Y. Moreno. 2010. Discrete- time Markov chain approach to contact-based disease spreading in complex networks. doi:10.1209/0295-5075/89/38009

    doi:10.1209/0295-5075/89/38009 2010

  8. [8]

    Maxwell Harper and Joseph A

    F. Maxwell Harper and Joseph A. Konstan. 2015. The MovieLens Datasets: History and Context. 19 pages. doi:10.1145/2827872

    doi:10.1145/2827872 2015

Show all 85 references
  1. [9]

    Mengkang Hu, Yuhang Zhou, Wendong Fan, Yuzhou Nie, Bowei Xia, Tao Sun, Ziyu Ye, Zhaoxuan Jin, Yingru Li, Qiguang Chen, Zeyu Zhang, Yifeng Wang, Qianshuo Ye, Bernard Ghanem, Ping Luo, and Guohao Li. 2025. OWL: Optimized Workforce Learning for General Multi-Agent Assistance in R...

    2025 arXiv

  2. [10]

    Rossi, Branislav Kveton, Dongruo Zhou, Julian McAuley, and Lina Yao

    Chengkai Huang, Junda Wu, Yu Xia, Zixu Yu, Ruhan Wang, Tong Yu, Ruiyi Zhang, Ryan A. Rossi, Branislav Kveton, Dongruo Zhou, Julian McAuley, and Lina Yao

  3. [11]

    Chengkai Huang, Junda Wu, Tong Yu, Julian McAuley, and Lina Yao. 2025. A Tu- torial on Agentic LLM for Recommender Systems. InProceedings of the Nineteenth ACM Conference on Recommender Systems (RecSys ’25). Association for Comput- ing Machinery, New York, NY, USA, 1417–1419. ...

    2025

  4. [12]

    Xu Huang, Jianxun Lian, Yuxuan Lei, Jing Yao, Defu Lian, and Xing Xie. 2023. Recommender AI Agent: Integrating Large Language Models for Interactive Recommendations. arXiv:2308.16505 https://arxiv.org/abs/2308.16505

    2023 arXiv

  5. [13]

    Yue Huang, Yu Jiang, Wenjie Wang, Haomin Zhuang, Xiaonan Luo, Yuchen Ma, Zhangchen Xu, Zichen Chen, Nuno Moniz, Zinan Lin, Pin-Yu Chen, Nitesh V Chawla, Nouha Dziri, Huan Sun, and Xiangliang Zhang. 2026. Emergent Social Intelligence Risks in Generative Multi-Agent Systems. arX...

    2026 arXiv

  6. [14]

    Zheng Hui, Xiaokai Wei, Yexi Jiang, Kevin Gao, Chen Wang, Frank Ong, Se eun Yoon, Rachit Pareek, and Michelle Gong. 2025. Toward Safe and Human- Aligned Game Conversational Recommendation via Multi-Agent Decomposition. arXiv:2504.20094 https://arxiv.org/abs/2504.20094

    2025

  7. [15]

    Rishi Jha, Harold Triedman, Justin Wagle, and Vitaly Shmatikov. 2025. Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems. arXiv:2510.17276 https://arxiv.org/abs/2510.17276

    2025

  8. [16]

    Chumeng Jiang, Jiayin Wang, Weizhi Ma, Charles L. A. Clarke, Shuai Wang, Chuhan Wu, and Min Zhang. 2024. Beyond Utility: Evaluating LLM as Recom- mender. arXiv:2411.00331 https://arxiv.org/abs/2411.00331

    2024 arXiv

  9. [17]

    Ishan Kavathekar, Hemang Jain, Ameya Rathod, Ponnurangam Kumaraguru, and Tanuja Ganu. 2025. TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems. arXiv:2511.05269 https://arxiv.org/abs/2511.05269

    2025

  10. [18]

    Rana Muhammad Shahroz Khan, Zhen Tan, Sukwon Yun, Charles Fleming, and Tianlong Chen. 2025. Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks. arXiv:2504.00218 https://arxiv.org/ abs/2504.00218

    2025

  11. [19]

    2025.LangManus: A Community-Driven AI Automation Framework

    LangManus Contributors. 2025.LangManus: A Community-Driven AI Automation Framework. https://github.com/Darwin-lfl/langmanus

    2025

  12. [20]

    Donghyun Lee and Mo Tiwari. 2024. Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems. arXiv:2410.07283 https://arxiv.org/abs/ 2410.07283

    2024 arXiv

  13. [21]

    Jun Leng, Yu Liu, Litian Zhang, Ruihan Hu, Zhuting Fang, and Xi Zhang. 2025. From static to adaptive: immune memory-based jailbreak detection for large language models. arXiv:2512.03356 https://arxiv.org/abs/2512.03356

    2025

  14. [22]

    Kaihong Li, Huichi Zhou, Bin Ma, and Fangjun Huang. 2025. Semantic- Shield: LLM-Powered Audits Expose Shilling Attacks in Recommender Systems. arXiv:2509.24961 https://arxiv.org/abs/2509.24961

    2025

  15. [23]

    Jianxun Lian, Yuxuan Lei, Xu Huang, Jing Yao, Wei Xu, and Xing Xie. 2024. RecAI: Leveraging Large Language Models for Next-Generation Recommender Systems. InCompanion Proceedings of the ACM Web Conference 2024(Singapore, Singapore)(WWW ’24). Association for Computing Machinery...

    2024

  16. [24]

    Ruichao Liang, Le Yin, Jing Chen, Yebo Feng, Cong Wu, Xiaoyu Zhang, Huang- peng Gu, Zijian Zhang, and Yang Liu. 2025. Don’t Trust Your Upstream: Ex- ploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation. arXiv:2512.04129 https://arxiv.org/abs/2512.04129

    2025 arXiv

  17. [25]

    Chen Lin, Si Chen, Meifang Zeng, Sheng Zhang, Min Gao, and Hui Li. 2024. Shilling Black-Box Recommender Systems by Learning to Generate Fake User Pro- files.IEEE Transactions on Neural Networks and Learning Systems35, 1, 1305–1319. doi:10.1109/tnnls.2022.3183210

    2024

  18. [26]

    Jinbo Liu, Defu Cao, Yifei Wei, Tianyao Su, Yuan Liang, Yushun Dong, Yan Liu, Yue Zhao, and Xiyang Hu. 2025. Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs. arXiv:2512.04668 https://arxiv.org/abs/2512.04668

    2025 arXiv

  19. [27]

    Jiahao Liu, Shengkang Gu, Dongsheng Li, Guangping Zhang, Mingzhe Han, Hansu Gu, Peng Zhang, Tun Lu, Li Shang, and Ning Gu. 2025. AgentCF++: Memory-enhanced LLM-based Agents for Popularity-aware Cross-domain Rec- ommendations. arXiv:2502.13843 https://arxiv.org/abs/2502.13843

    2025 arXiv

  20. [28]

    Reza Yousefi Maragheh and Yashar Deldjoo. 2025. The Future is Agentic: Defini- tions, Perspectives, and Open Challenges of Multi-Agent Recommender Systems. arXiv:2507.02097 https://arxiv.org/abs/2507.02097

    2025 arXiv

  21. [29]

    Rui Miao, Yixin Liu, Yili Wang, Xu Shen, Yue Tan, Yiwei Dai, Shirui Pan, and Xin Wang. 2025. BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks. arXiv:2508.08127 https://arxiv.org/abs/2508.08127

    2025 arXiv

  22. [30]

    Thanh Toan Nguyen, Quoc Viet Hung Nguyen, Thanh Tam Nguyen, Thanh Trung Huynh, Thanh Thi Nguyen, Matthias Weidlich, and Hongzhi Yin. 2024. Manipulat- ing Recommender Systems: A Survey of Poisoning Attacks and Countermeasures. arXiv:2404.14942 https://arxiv.org/abs/2404.14942

    2024 arXiv

  23. [31]

    Liangbo Ning, Wenqi Fan, and Qing Li. 2025. Exploring Backdoor Attack and Defense for LLM-empowered Recommendations. arXiv:2504.11182 https://arxiv. org/abs/2504.11182

    2025 arXiv

  24. [32]

    Liang-bo Ning, Shijie Wang, Wenqi Fan, Qing Li, Xin Xu, Hao Chen, and Feiran Huang. 2024. CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD ’24). ACM, 2284–2295. do...

    2024 doi

  25. [33]

    Junjun Pan, Yixin Liu, Rui Miao, Kaize Ding, Yu Zheng, Quoc Viet Hung Nguyen, Alan Wee-Chung Liew, and Shirui Pan. 2025. Explainable and Fine-Grained Safe- guarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection. arXiv:2512.18733 https://arxiv.org/abs/2512.18733

    2025

  26. [34]

    Donguk Park, Dongwon Lee, and Yeon-Chang Lee. 2026. Echoes in the Loop: Diagnosing Risks in LLM-Powered Recommender Systems under Feedback Loops. arXiv:2602.07442 https://arxiv.org/abs/2602.07442

    2026

  27. [35]

    Romualdo Pastor-Satorras, Claudio Castellano, Piet Van Mieghem, and Alessan- dro Vespignani. 2015. Epidemic processes in complex networks. 925–979 pages. https://link.aps.org/doi/10.1103/RevModPhys.87.925

    2015 doi

  28. [36]

    Vaidehi Patil, Elias Stengel-Eskin, and Mohit Bansal. 2025. The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration. arXiv:2509.14284 https://arxiv.org/abs/2509.14284

    2025

  29. [37]

    Qiyao Peng, Hongtao Liu, Hua Huang, Qing Yang, and Minglai Shao. 2025. A Survey on LLM-powered Agents for Recommender Systems. arXiv:2502.10050 https://arxiv.org/abs/2502.10050

    2025 arXiv

  30. [38]

    Markus Schedl, Vito Walter Anelli, and Elisabeth Lex. 2023. Trustworthy Rec- ommender Systems: Technical, Ethical, Legal, and Regulatory Perspectives. In Proceedings of the 17th ACM Conference on Recommender Systems(Singapore, Singapore)(RecSys ’23). Association for Computing ...

    2023

  31. [39]

    Yu Shang, Peijie Liu, Yuwei Yan, Zijing Wu, Leheng Sheng, Yuanqing Yu, Chu- meng Jiang, An Zhang, Fengli Xu, Yu Wang, Min Zhang, and Yong Li. 2025. AgentRecBench: Benchmarking LLM Agent-based Personalized Recommender Systems. arXiv:2505.19623 https://arxiv.org/abs/2505.19623

    2025 arXiv

  32. [40]

    Xu Shen, Yixin Liu, Yiwei Dai, Yili Wang, Rui Miao, Yue Tan, Shirui Pan, and Xin Wang. 2025. Understanding the Information Propagation Effects of Com- munication Topologies in LLM-based Multi-Agent Systems. arXiv:2505.23352 https://arxiv.org/abs/2505.23352

    2025 arXiv

  33. [41]

    Wentao Shi, Xiangnan He, Yang Zhang, Chongming Gao, Xinyue Li, Jizhi Zhang, Qifan Wang, and Fuli Feng. 2024. Large Language Models are Learnable Planners for Long-Term Recommendation. InProceedings of the 47th International ACM SIGIR Conference on Research and Development in I...

    2024

  34. [42]

    Inderjeet Singh, Vikas Pahuja, Aishvariya Priya Rathina Sabapathy, Chiara Pi- cardi, Amit Giloni, Roman Vainshtein, Andrés Murillo, Hisashi Kojima, Motoyoshi Sekiya, Yuki Unno, and Junichi Suga. 2026. Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securi...

    2026

  35. [43]

    Param Thakkar and Anushka Yadav. 2024. Personalized Recommendation Sys- tems using Multimodal, Autonomous, Multi Agent Systems. arXiv:2410.19855 https://arxiv.org/abs/2410.19855

    2024 arXiv

  36. [44]

    Giovanni De Toni, Cristian Consonni, Erasmo Purificato, Emilia Gomez, and Bruno Lepri. 2026. With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems. arXiv:2603.28476 https://arxiv.org/ abs/2603.28476

    2026

  37. [45]

    Harold Triedman, Rishi Jha, and Vitaly Shmatikov. 2025. Multi-Agent Systems Execute Arbitrary Malicious Code. arXiv:2503.12188 https://arxiv.org/abs/2503. 12188

    2025 arXiv

  38. [46]

    Liwen Wang, Wenxuan Wang, Shuai Wang, Zongjie Li, Zhenlan Ji, Zongyi Lyu, Daoyuan Wu, and Shing-Chi Cheung. 2025. IP Leakage Attacks Targeting LLM- Based Multi-Agent Systems. arXiv:2505.12442 https://arxiv.org/abs/2505.12442

    2025 arXiv

  39. [47]

    Lei Wang, Jingsen Zhang, Hao Yang, Zhiyuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Ruihua Song, Wayne Xin Zhao, Jun Xu, Zhicheng Dou, Jun Wang, and Ji-Rong Wen. 2024. User Behavior Simulation with Large Language Model based Agents. arXiv:2306.02552 [cs.IR] https://...

    2024 arXiv

  40. [48]

    Shilong Wang, Guibin Zhang, Miao Yu, Guancheng Wan, Fanci Meng, Chongye Guo, Kun Wang, and Yang Wang. 2025. G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems. arXiv:2502.11127 https: //arxiv.org/abs/2502.11127

    2025 arXiv

  41. [49]

    Yuanrong Wang and Yingpeng Du. 2025. Shilling Recommender Systems by Generating Side-feature-aware Fake User Profiles. arXiv:2509.17918 https://arxiv. org/abs/2509.17918

    2025

  42. [50]

    Yancheng Wang, Ziyan Jiang, Zheng Chen, Fan Yang, Yingxue Zhou, Eunah Cho, Xing Fan, Xiaojiang Huang, Yanbin Lu, and Yingzhen Yang. 2023. RecMind: Large Language Model Powered Agent For Recommendation. arXiv:2308.14296 https://arxiv.org/abs/2308.14296

    2023 arXiv

  43. [51]

    Yubo Wang, Min Tang, Nuo Shen, Shujie Cui, and Weiqing Wang. 2025. Pri- vacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective. arXiv:2508.03703 [cs.IR] https://arxiv.org/abs/2508.03703

    2025 arXiv

  44. [52]

    Zongwei Wang, Min Gao, Junliang Yu, Xinyi Gao, Quoc Viet Hung Nguyen, Shazia Sadiq, and Hongzhi Yin. 2024. ID-Free Not Risk-Free: LLM-Powered Agents Unveil Risks in ID-Free Recommender Systems. arXiv:2409.11690 https: //arxiv.org/abs/2409.11690

    2024 arXiv

  45. [53]

    Zihao Wang, Tianhao Mao, XiaoFeng Wang, Di Tang, and Xiaozhong Liu. 2025. IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion. arXiv:2511.05845 [cs.CR] https://arxiv.org/abs/2511.05845

    2025

  46. [54]

    Zongwei Wang, Junliang Yu, Tong Chen, Hongzhi Yin, Shazia Sadiq, and Min Gao. 2025. Towards Secure and Robust Recommender Systems: A Data-Centric Perspective. InProceedings of the Eighteenth ACM International Conference on Web Search and Data Mining(Hannover, Germany)(WSDM ’25...

    2025 doi

  47. [55]

    Zongwei Wang, Junliang Yu, Min Gao, Wei Yuan, Guanhua Ye, Shazia Sadiq, and Hongzhi Yin. 2024. Poisoning Attacks and Defenses in Recommender Systems: A Survey. arXiv:2406.01022 [cs.CR] https://arxiv.org/abs/2406.01022

    2024 arXiv

  48. [56]

    Zhefan Wang, Yuanqing Yu, Wendi Zheng, Weizhi Ma, and Min Zhang. 2024. MACRec: A Multi-Agent Collaboration Framework for Recommendation. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval. ACM, 2760–2764. doi:10.1...

    2024 doi

  49. [57]

    Qianshan Wei, Tengchao Yang, Yaochen Wang, Xinfeng Li, Lijun Li, Zhenfei Yin, Yi Zhan, Thorsten Holz, Zhiqiang Lin, and XiaoFeng Wang. 2025. A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory. arXiv:2510.02373 https://arxiv.org/abs/2510.02373

    2025

  50. [58]

    Yuqian Wu, Yuhong Peng, Jiapeng Yu, and Raymond S. T. Lee. 2024. MAS4POI: a Multi-Agents Collaboration System for Next POI Recommenda- tion. arXiv:2409.13700 [cs.IR] https://arxiv.org/abs/2409.13700

    2024 arXiv

  51. [59]

    Yiqing Wu, Ruobing Xie, Zhao Zhang, Yongchun Zhu, FuZhen Zhuang, Jie Zhou, Yongjun Xu, and Qing He. 2023. Attacking Pre-trained Recommenda- tion. arXiv:2305.03995 [cs.IR] https://arxiv.org/abs/2305.03995

    2023 arXiv

  52. [60]

    Yutong Wu, Jie Zhang, Yiming Li, Chao Zhang, Qing Guo, Nils Lukas, and Tianwei Zhang. 2025. Cowpox: Towards the Immunity of VLM-based Multi-Agent Systems. arXiv:2508.09230 https://arxiv.org/abs/2508.09230

    2025 arXiv

  53. [61]

    Rossi, and Julian McAuley

    Yu Xia, Sungchul Kim, Tong Yu, Ryan A. Rossi, and Julian McAuley. 2025. Multi- Agent Collaborative Filtering: Orchestrating Users and Items for Agentic Recom- mendations. arXiv:2511.18413 https://arxiv.org/abs/2511.18413

    2025

  54. [62]

    Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. 2026. AgentLeak: A Full-Stack Benchmark for Privacy Leakage in Multi-Agent LLM Systems. arXiv:2602.11510 https://arxiv.org/abs/2602.11510

    2026

  55. [63]

    Bingyu Yan, Ziyi Zhou, Xiaoming Zhang, Chaozhuo Li, Ruilin Zeng, Yirui Qi, Tianbo Wang, and Litian Zhang. 2025. Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS. arXiv:2508.03125 https://arxiv.org/abs/2508.03125

    2025 arXiv

  56. [64]

    Shiyi Yang, Zhibo Hu, Xinshu Li, Chen Wang, Tong Yu, Xiwei Xu, Liming Zhu, and Lina Yao. 2025. DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents. arXiv:2503.23804 https://arxiv.org/abs/2503.23804

    2025

  57. [65]

    Shiyi Yang, Xinshu Li, Guanglin Zhou, Chen Wang, Xiwei Xu, Liming Zhu, and Lina Yao. 2025. Retrieval-Augmented Review Generation for Poisoning Recommender Systems. arXiv:2508.15252 https://arxiv.org/abs/2508.15252

    2025

  58. [66]

    Haocheng Yu, Yaxiong Wu, Hao Wang, Wei Guo, Yong Liu, Yawen Li, Yuyang Ye, Junping Du, and Enhong Chen. 2025. Thought-Augmented Planning for LLM-Powered Interactive Recommender Agent. arXiv:2506.23485 https://arxiv. org/abs/2506.23485

    2025 arXiv

  59. [67]

    Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Qingsong Wen, Kun Wang, and Yang Wang. 2024. NetSafe: Exploring the Topological Safety of Multi-agent Networks. arXiv:2410.15686 https://arxiv.org/ abs/2410.15686

    2024 arXiv

  60. [68]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. arXiv:2403.02691 https://arxiv.org/abs/2403.02691

    2024 arXiv

  61. [70]

    Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. 2025. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents. In International Conference on Learning Representations (IC...

    2025 arXiv

  62. [71]

    Jizhi Zhang, Keqin Bao, Wenjie Wang, Yang Zhang, Wentao Shi, Wanhong Xu, Fuli Feng, and Tat-Seng Chua. 2024. Prospect Personalized Recommendation on Large Language Model-based Agent Platform. arXiv:2402.18240 https://arxiv. org/abs/2402.18240

    2024 arXiv

  63. [72]

    Junjie Zhang, Yupeng Hou, Ruobing Xie, Wenqi Sun, Julian McAuley, Wayne Xin Zhao, Leyu Lin, and Ji-Rong Wen. 2024. AgentCF: Collaborative Learning with Autonomous Language Agents for Recommender Systems. InProceedings of the ACM Web Conference 2024 (WWW). 3679–3689. doi:10.114...

    2024

  64. [73]

    Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, and Liang Wang

  65. [74]

    Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021. Membership Inference Attacks Against Recommender Systems. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security(Virtual Event, Republic of Ko...

    2021

  66. [75]

    Quan Zhang, Binqi Zeng, Chijin Zhou, Gwihwan Go, Heyuan Shi, and Yu Jiang

  67. [76]

    Tao Zhang, Kehui Yao, Luyi Ma, Jiao Chen, Reza Yousefi Maragheh, Kai Zhao, Jian- peng Xu, Evren Korpeoglu, Sushant Kumar, and Kannan Achan. 2025. No-Human in the Loop: Agentic Evaluation at Scale for Recommendation. arXiv:2511.03051 https://arxiv.org/abs/2511.03051

    2025

  68. [77]

    Zaibin Zhang, Yongting Zhang, Lijun Li, Hongzhi Gao, Lijun Wang, Huchuan Lu, Feng Zhao, Yu Qiao, and Jing Shao. 2024. PsySafe: A Comprehensive Framework for Psychological-based Attack, Defense, and Evaluation of Multi-agent System Safety. arXiv:2401.11880 https://arxiv.org/abs...

    2024 arXiv

  69. [78]

    arXiv:2404.17196 https://arxiv.org/abs/2404.17196

    Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Appli- cations. arXiv:2404.17196 https://arxiv.org/abs/2404.17196

    arXiv

  70. [79]

    Jialong Zhou, Lichao Wang, and Xiao Yang. 2025. GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling. arXiv:2505.19234 https://arxiv.org/abs/2505.19234

    2025

  71. [80]

    Yijin Zhou, Xiaoya Lu, Dongrui Liu, Junchi Yan, and Jing Shao. 2026. INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM- Based Multi-Agent Systems. arXiv:2601.14667 https://arxiv.org/abs/2601.14667

    2026

  72. [81]

    Yuyue Zhao, Jiancan Wu, Xiang Wang, Wei Tang, Dingxian Wang, and Maarten de Rijke. 2024. Let Me Do It For You: Towards LLM Empowered Recommendation via Tool Learning. InProceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrie...

    2024

  73. [82]

    Lixi Zhu, Xiaowen Huang, and Jitao Sang. 2024. A LLM-based Controllable, Scalable, Human-Involved User Simulator Framework for Conversational Rec- ommender Systems. arXiv:2405.08035 https://arxiv.org/abs/2405.08035

    2024 arXiv

  74. [83]

    Yifan Zhu, Chao Zhang, Xin Shi, Xueqiao Zhang, Yi Yang, and Yawei Luo. 2025. MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures - A Comprehensive Framework. InFindings of the Association for Computational Linguistics: EMNLP 2025, Christos Chri...

    2025 doi

  75. [84]

    Zhenhong Zhou, Zherui Li, Jie Zhang, Yuanhe Zhang, Kun Wang, Yang Liu, and Qing Guo. 2025. CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models. arXiv:2502.14529 https://arxiv.org/ abs/2502.14529

    2025 arXiv

  76. [2024]

    arXiv:2402.14836 https://arxiv.org/abs/2402.14836

    Stealthy Attack on Large Language Model based Recommendation. arXiv:2402.14836 https://arxiv.org/abs/2402.14836

    arXiv

  77. [2025]

    arXiv:2503.16734 [cs.AI] https://arxiv.org/abs/2503.16734

    Towards Agentic Recommender Systems in the Era of Multimodal Large Language Models. arXiv:2503.16734 [cs.AI] https://arxiv.org/abs/2503.16734

    arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.