Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity
Anjun Hu, Hanting Xie, Saranya Govindan, Jas Kandola, Kurt Cutajar
cs.IR, cs.CR, cs.MA, cs.SI
Submitted: 2026-08-04
Comments: 10 pages, 10 figures, 20th ACM Conference on Recommender Systems (RecSys '26)
Code: https://github.com/anjunhu/ConnACF
License: http://creativecommons.org/licenses/by/4.0/
The gist: Multi-agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item agents through natural-language interaction to refine preferences and generate recommendations.
Terminology
Abstract
Multi-agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item agents through natural-language interaction to refine preferences and generate recommendations. These systems inherit vulnerabilities from both their data-driven nature and their multi-agent interactions, which manifest in distinct ways. Understanding how connectivity modulates vulnerability in these systems could facilitate the development of more robust recommendation pipelines. In this work, we adapt attacks and defenses from the general multi-agent systems (MAS) literature to the agent-based CF setting, evaluating them under systematically varied connectivity in the AgentCF framework, where CF connectivity is characterized along two axes: (i) candidate count (the number of item candidates per turn per user, measuring user-side interaction density) and (ii) catalog concentration (the degree of item catalog overlap across users). Our contributions include: (1) Adaptation: we reproduce MAS-inspired attacks and defenses in the agentic CF domain, confirming partial transferability of original observations. (2) Characterization: we characterize how the two aspects of connectivity shape attack and defense outcomes, revealing role asymmetries between user and item agents, non-monotonic temporal dynamics in attack efficacy, and divergent patterns across dissemination and extraction attack goals. Additionally, as an exploratory extension, we assess the applicability of epidemic-inspired static metrics in ranking CF configurations by expected attack outcome, potentially enabling cost-efficient robustness assessment. Implementation is available at https://github.com/anjunhu/ConnACF
Sources
- Why Do Multi-Agent LLM Systems Fail?
- Let the Agent Steer: Closed-Loop Ranking Optimization via Influence Exchange
- SentinelNet: Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection
- Magentic-One: A Generalist Multi-Agent System for Solving Complex Tasks
- OWL: Optimized Workforce Learning for General Multi-Agent Assistance in Real-World Task Automation
- Towards Agentic Recommender Systems in the Era of Multimodal Large Language Models
- Recommender AI Agent: Integrating Large Language Models for Interactive Recommendations
- Emergent Risks in Generative Multi-Agent Systems
- Toward Safe and Human-Aligned Game Conversational Recommendation via Multi-Agent Decomposition
- Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems
- Beyond Utility: Evaluating LLM as Recommender
- TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems
- $\textit{Agents Under Siege}$: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks
- Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
- From static to adaptive: immune memory-based jailbreak detection for large language models
- SemanticShield: LLM-Powered Audits Expose Shilling Attacks in Recommender Systems
- Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation
- Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs
- AgentCF++: Memory-enhanced LLM-based Agents for Popularity-aware Cross-domain Recommendations
- The Future is Agentic: Definitions, Perspectives, and Open Challenges of Multi-Agent Recommender Systems
Related papers
- The Price of Isolation: Estimating the Ecosystem Cost of Symmetric Two-Sided A/B Testing
- SCAR: Semantic Continuity-Aware Retrieval for Efficient Context Expansion in RAG
- MixLoRA-DSI: Dynamically Expandable Mixture-of-LoRA Experts for Rehearsal-Free Generative Retrieval over Dynamic Corpora
- QProtFuse: Query-Guided Layer Fusion for Retrieval-Augmented Protein Function Prediction
- DualView: Adaptive Local-Global Fusion for Multi-Hop Document Reranking
- How Do LLM-Generated Texts Impact Term-Based Retrieval Models?