With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems

• URL: http://arxiv.org/abs/2603.28476v1
• Date: Mon, 30 Mar 2026 14:14:48 GMT
• Title: With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems
• Abstract summary: We show that a small coordinated group can induce up to a 20% degradation in nDCG for non-adversarial users.<n>We propose a mitigation strategy that shifts guarantees from the group level to the user level.
• Score: 7.21571646225215
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Recommendation systems have become central gatekeepers of online information, shaping user behaviour across a wide range of activities. In response, users increasingly organize and coordinate to steer algorithmic outcomes toward diverse goals, such as promoting relevant content or limiting harmful material, relying on platform affordances -- such as likes, reviews, or ratings. While these mechanisms can serve beneficial purposes, they can also be leveraged for adversarial manipulation, particularly in systems where such feedback directly informs safety guarantees. In this paper, we study this vulnerability in recently proposed risk-controlling recommender systems, which use binary user feedback (e.g., "Not Interested") to provably limit exposure to unwanted content via conformal risk control. We empirically demonstrate that their reliance on aggregate feedback signals makes them inherently susceptible to coordinated adversarial user behaviour. Using data from a large-scale online video-sharing platform, we show that a small coordinated group (comprising only 1% of the user population) can induce up to a 20% degradation in nDCG for non-adversarial users by exploiting the affordances provided by risk-controlling recommender systems. We evaluate simple, realistic attack strategies that require little to no knowledge of the underlying recommendation algorithm and find that, while coordinated users can significantly harm overall recommendation quality, they cannot selectively suppress specific content groups through reporting alone. Finally, we propose a mitigation strategy that shifts guarantees from the group level to the user level, showing empirically how it can reduce the impact of adversarial coordinated behaviour while ensuring personalized safety for individuals.

Related papers

• ReliGRec: Reliability-Oriented LLM-Based Generative Recommendation via User-Risk-Aware Prompt Routing [15.062647558548562]
  We propose ReliGRec, a weakly supervised framework for user-level weak-risk proxy labels.<n>ReliGRec derives user-level weak-risk proxy labels from review-feedback signals for a subset of users.<n>A Dual-View Weak-Risk Estimator fuses the representations to produce a user-level weak-risk score.
  arXiv  Detail & Related papers  (2026-09-15T02:56:30Z)
• An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems [43.551577903526585]
  We propose a coordinated shilling attack system for recommender systems.<n>Agentic Group Attack System adaptively promotes a target item across different victim families.<n>Findings emphasize that defending recommender systems may require mechanisms that can handle adaptive shilling campaigns.
  arXiv  Detail & Related papers  (2026-09-09T00:14:03Z)
• Boundary-targeted Membership Inference Attacks on Safety Classifiers [70.20833439671131]
  Safety classifiers are trained on sensitive datasets including discussions of self-harm and mental health.<n>We introduce a new boundary-targeted selection strategy that identifies low confidence examples.<n>Experiments show that an adversary can recover 19% of the conversations a safety classifier flagged as indicating user distress, at a 5% false-positive rate.<n>This is $3.5$ times more than attacking using state-of-the-art MIA methods alone.
  arXiv  Detail & Related papers  (2026-05-21T12:05:22Z)
• Community Notes are Vulnerable to Rater Bias and Manipulation [75.34858521118305]
  We evaluate the Community Notes algorithm using simulated data that models realistic rater and note behaviors.<n>We find that the algorithm suppresses a substantial fraction of genuinely helpful notes and is highly sensitive to rater biases.
  arXiv  Detail & Related papers  (2025-11-04T14:39:34Z)
• The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration [72.33801123508145]
  Large language models (LLMs) are integral to multi-agent systems.<n>Privacy risks emerge that extend beyond memorization, direct inference, or single-turn evaluations.<n>In particular, seemingly innocuous responses, when composed across interactions, can cumulatively enable adversaries to recover sensitive information.
  arXiv  Detail & Related papers  (2025-09-16T16:57:25Z)
• RecPS: Privacy Risk Scoring for Recommender Systems [14.700807572189412]
  We propose a membership-inference attack (MIA)-based privacy scoring method, RecPS, to measure privacy risks at both the interaction and user levels.<n>A critical component is the interaction-level MIA method RecLiRA, which gives high-quality membership estimation.
  arXiv  Detail & Related papers  (2025-07-24T12:46:30Z)
• You Don't Bring Me Flowers: Mitigating Unwanted Recommendations Through Conformal Risk Control [17.919072158085754]
  This paper introduces an intuitive, model-agnostic, and distribution-free method that uses conformal risk control to provably bound unwanted content in personalized recommendations.<n>Our approach ensures an effective and controllable reduction of unwanted recommendations with minimal effort.
  arXiv  Detail & Related papers  (2025-07-09T21:27:35Z)
• Quantifying User Coherence: A Unified Framework for Cross-Domain Recommendation Analysis [69.37718774071793]
  This paper introduces novel information-theoretic measures for understanding recommender systems. We evaluate 7 recommendation algorithms across 9 datasets, revealing the relationships between our measures and standard performance metrics.
  arXiv  Detail & Related papers  (2024-10-03T13:02:07Z)
• Improving the Shortest Plank: Vulnerability-Aware Adversarial Training for Robust Recommender System [60.719158008403376]
  Vulnerability-aware Adversarial Training (VAT) is designed to defend against poisoning attacks in recommender systems. VAT employs a novel vulnerability-aware function to estimate users' vulnerability based on the degree to which the system fits them.
  arXiv  Detail & Related papers  (2024-09-26T02:24:03Z)
• Poisoning Decentralized Collaborative Recommender System and Its Countermeasures [37.205493894131635]
  We present a novel attack method named Poisoning with Adaptive Malicious Neighbors (PAMN) With item promotion in top-K recommendation as the attack objective, PAMN effectively boosts target items' ranks with several adversaries. With the vulnerabilities of DecRecs uncovered, a dedicated defensive mechanism based on user-level gradient clipping with sparsified updating is proposed.
  arXiv  Detail & Related papers  (2024-04-01T15:30:02Z)
• User-Controllable Recommendation via Counterfactual Retrospective and Prospective Explanations [96.45414741693119]
  We present a user-controllable recommender system that seamlessly integrates explainability and controllability. By providing both retrospective and prospective explanations through counterfactual reasoning, users can customize their control over the system.
  arXiv  Detail & Related papers  (2023-08-02T01:13:36Z)
• PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion [58.870444954499014]
  A common practice is to subsume recommender systems under the decentralized federated learning paradigm. We present a systematic approach to backdooring federated recommender systems for targeted item promotion.
  arXiv  Detail & Related papers  (2021-10-21T06:48:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.