Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders

• URL: http://arxiv.org/abs/2607.24869v1
• Date: Sun, 26 Jul 2026 22:32:12 GMT
• Title: Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders
• Abstract summary: Large language models (LLMs) used as listwise rerankers suffer from position bias when serializing candidate sets into prompts.<n>We show this order sensitivity creates an exploitable attack surface.<n>An attacker can promote a label-0 target into the top-$k$ solely by reordering candidates.
• Score: 10.604893155368702
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large language models (LLMs) used as listwise rerankers in recommendation systems suffer from position bias when serializing candidate sets into prompts. We show this order sensitivity creates an exploitable attack surface: an attacker can promote a label-0 target into the top-$k$ solely by reordering candidates, without changing item content, labels, or model parameters. We introduce $\mathrm{promo}@k$ to quantify this vulnerability, measuring the fraction of label-0 targets that can be elevated into top-$k$ rankings via permutation. Evaluating across three domains (MovieLens, Amazon Books, and Amazon Fashion), $\mathrm{promo}@5$ reaches up to 0.57 at an attack budget of $R$ = 50 orderings. Furthermore, ordinary permutation stability predicts vulnerability without running the attack. While a bidirectional T5 encoder scorer reduces exposure, permutation-consistency regularization and architectural invariance effectively mitigate it. Pointwise scoring avoids the bias issue but degrades ranking quality. These results demonstrate that input candidate order in listwise LLM reranking is a security-relevant attack vector. Code and data are available at https://github.com/geoz-lab/position_bias_attack.

Related papers

• Robust Estimation of Sparse Numerical Vectors under Local Differential Privacy [61.848691894557426]
  Local differential privacy (LDP) protocols are vulnerable to poisoning attacks.<n>In this paper, we address the robust sparse vector mean estimation problem.<n>We propose a correction method based on a careful analysis that gives an exact expression of the bias.
  arXiv  Detail & Related papers  (2026-07-30T07:55:09Z)
• Isolating LLM Alignment from Regex: Zero Coverage and Metric-Dependent Divergence Under Adversarial Mutation [51.56484100374058]
  Previous work found no measurable coverage gain from adding a live Gemini backend behind an active filter.<n>We introduce $L_5$-no-regex -- identical to $L_4$-real (Gemini-2.5-flash, token-budget cap, rate limit, output scrub) but with the nine-pattern filter disabled.<n>We evaluate it against adversarial probes across three sub-languages.
  arXiv  Detail & Related papers  (2026-06-12T18:54:24Z)
• Which Defense Closes Which Threat? Attributing OWASP-LLM-Top-10 Coverage and Its Brittleness Under Paraphrasing [51.56484100374058]
  Production LLM applications stack several defense families -- refusal-phrase filters, tokenbudget controls, model allowlists, rate limits, tool-registry authentication -- yetBAS benchmarks report a single aggregate coverage number.<n>We add four-LLM-Top-10-aware agents to a 21-agent baseline scanner and target a lattice of four synthetic LLM endpoints.
  arXiv  Detail & Related papers  (2026-06-01T19:39:25Z)
• One Pass, Any Order: Position-Invariant Listwise Reranking for LLM-Based Recommendation [2.5827686695037335]
  Large language models (LLMs) are increasingly used for recommendation reranking, but their listwise predictions can depend on the order in which candidates are presented.<n>This creates a mismatch between the set-based nature of recommendation and the sequence-based computation of decoder-only LLMs.<n>We propose InvariRank, a permutation-invariant listwise reranking framework that addresses this dependence at the architectural level.
  arXiv  Detail & Related papers  (2026-04-30T08:49:44Z)
• Poisoning Attacks to Local Differential Privacy for Ranking Estimation [8.14832255549522]
  Local differential privacy (LDP) involves users perturbing their inputs to provide plausible deniability of their data.<n>In this paper, we first introduce novel poisoning attacks for ranking estimation.<n>We propose corresponding strategies for kRR, OUE, and OLH protocols.
  arXiv  Detail & Related papers  (2025-06-30T16:39:02Z)
• QuadAttack: A Quadratic Programming Approach to Ordered Top-K Attacks [8.826642352173035]
  adversarial vulnerability of Deep Neural Networks (DNNs) has been well-known and widely concerned. This paper shows that the concern is much more serious by learning significantly more aggressive ordered top-$K$ attacks.
  arXiv  Detail & Related papers  (2023-12-12T05:08:45Z)
• Found in the Middle: Permutation Self-Consistency Improves Listwise Ranking in Large Language Models [63.714662435555674]
  Large language models (LLMs) exhibit positional bias in how they use context. We propose permutation self-consistency, a form of self-consistency over ranking list outputs of black-box LLMs. Our approach improves scores from conventional inference by up to 7-18% for GPT-3.5 and 8-16% for LLaMA v2 (70B)
  arXiv  Detail & Related papers  (2023-10-11T17:59:02Z)
• Under-confidence Backdoors Are Resilient and Stealthy Backdoors [35.57996363193643]
  backdoor attacks aim to make the victim model produce designed outputs on any input injected with pre-designed backdoors. In order to achieve a high attack success rate, most existing attack methods change the labels of the poisoned samples to the target class. This practice often results in severe over-fitting of the victim model over the backdoors, making the attack quite effective in output control but easier to be identified by human inspection or automatic defense algorithms.
  arXiv  Detail & Related papers  (2022-02-19T01:31:41Z)
• Practical Relative Order Attack in Deep Ranking [99.332629807873]
  We formulate a new adversarial attack against deep ranking systems, i.e., the Order Attack. The Order Attack covertly alters the relative order among a selected set of candidates according to an attacker-specified permutation. It is successfully implemented on a major e-commerce platform.
  arXiv  Detail & Related papers  (2021-03-09T06:41:18Z)
• Composite Adversarial Attacks [57.293211764569996]
  Adversarial attack is a technique for deceiving Machine Learning (ML) models. In this paper, a new procedure called Composite Adrial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms. CAA beats 10 top attackers on 11 diverse defenses with less elapsed time.
  arXiv  Detail & Related papers  (2020-12-10T03:21:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.