AgentCF security study reveals how connectivity shapes AI recommendation attacks
New research shows LLM-powered recommender agents are vulnerable to targeted attacks via connection patterns.
A new paper accepted at the 20th ACM Conference on Recommender Systems (RecSys '26) investigates how connectivity affects the security of multi-agent collaborative filtering (CF) systems, where LLM-powered user and item agents negotiate recommendations via natural language. Researchers Anjun Hu, Hanting Xie, Saranya Govindan, Jas Kandola, and Kurt Cutajar adapted attack and defense techniques from general multi-agent systems (MAS) literature to the AgentCF framework, probing vulnerabilities that arise from both data-driven biases and multi-agent interactions.
They systematically varied two connectivity dimensions: candidate count (the number of item candidates each user agent sees per turn) and catalog concentration (how much the item catalog overlaps across users). Their experiments yielded three key findings: (1) partial transferability of MAS attacks to the CF domain, (2) a striking role asymmetry—user agents are significantly more affected by attacks than item agents—and (3) non-monotonic temporal dynamics, meaning attack effectiveness can rise and fall over interaction rounds rather than simply increasing. The paper also distinguishes between two attack goals: dissemination (spreading certain item influence) and extraction (inferring sensitive user preferences), which respond differently to connectivity changes.
As an exploratory extension, the authors tested whether epidemic-inspired static metrics could rank CF configurations by expected attack outcome, potentially allowing system designers to assess robustness without expensive adversarial testing. The implementation is available online, and the paper includes 10 pages and 10 figures. This work is among the first to systematically characterize how structural connectivity modulates security in LLM-driven recommender agents, bridging the gap between multi-agent security research and practical recommendation systems.
- Adapted MAS-style attacks and defenses to AgentCF, confirming partial transferability to LLM-based recommender agents
- User agents are more vulnerable than item agents, with attack efficacy showing non-monotonic dynamics over time
- Two connectivity axes—candidate count and catalog concentration—strongly affect both dissemination and extraction attack outcomes
Why It Matters
As LLM agents power recommendations, this research provides a roadmap for assessing and hardening these systems before attackers exploit connectivity weak spots.