CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent

2024-08-24

Knowledge Discovery and Data Mining

AI Summary

This work investigates security vulnerabilities in LLM-augmented recommender systems (RecSys) under black-box settings—a previously unexplored threat scenario. Method: We propose the first adversarial attack framework leveraging an LLM-based agent, which identifies high-impact text insertion positions via position-aware mechanisms, generates semantically preserved and minimally perturbed adversarial texts, and iteratively refines prompts using black-box query feedback. Crucially, the LLM itself serves as the attack agent, enabling efficient, stealthy, and cross-model transferable attacks. Contribution/Results: Extensive experiments on three real-world datasets demonstrate that our framework significantly outperforms conventional reinforcement learning–based attacks: it achieves higher attack success rates, requires fewer API queries, and induces smaller textual perturbations. These results empirically expose previously underappreciated, substantive security and privacy risks inherent in LLM-RecSys architectures.

Technology Category

• Multiagent Systems: Adversarial Agents
• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Recently, Large Language Model (LLM)-empowered recommender systems (RecSys) have brought significant advances in personalized user experience and have attracted considerable attention. Despite the impressive progress, the research question regarding the safety vulnerability of LLM-empowered RecSys still remains largely under-investigated. Given the security and privacy concerns, it is more practical to focus on attacking the black-box RecSys, where attackers can only observe the system's inputs and outputs. However, traditional attack approaches employing reinforcement learning (RL) agents are not effective for attacking LLM-empowered RecSys due to the limited capabilities in processing complex textual inputs, planning, and reasoning. On the other hand, LLMs provide unprecedented opportunities to serve as attack agents to attack RecSys because of their impressive capability in simulating human-like decision-making processes. Therefore, in this paper, we propose a novel attack framework called CheatAgent by harnessing the human-like capabilities of LLMs, where an LLM-based agent is developed to attack LLM-Empowered RecSys. Specifically, our method first identifies the insertion position for maximum impact with minimal input modification. After that, the LLM agent is designed to generate adversarial perturbations to insert at target positions. To further improve the quality of generated perturbations, we utilize the prompt tuning technique to improve attacking strategies via feedback from the victim RecSys iteratively. Extensive experiments across three real-world datasets demonstrate the effectiveness of our proposed attacking method.

Problem

• Investigating safety vulnerabilities in LLM-empowered recommender systems
• Attacking black-box RecSys using LLM agents for adversarial perturbations
• Improving attack effectiveness via prompt tuning and iterative feedback

Innovation

• LLM-based agent attacks RecSys
• Insert minimal adversarial perturbations
• Prompt tuning refines attack strategies