AlignPoison: Conditional Targeted Poisoning of Generative Recommenders via Decoding-Aligned Prefixes
Generative recommendation models based on autoregressive decoding have been adopted as alternatives to classical ranking-based systems. While their modeling flexibility has been widely studied, their resilience to data poisoning remains largely unexplored.
This paper introduces AlignPoison, a framework that demonstrates the vulnerability of generative recommendation models to targeted data poisoning attacks. The study focuses on how these models can be manipulated by injecting synthetic interactions to promote malicious content.
What happened
The article presents a research study on the vulnerability of generative recommendation models to targeted data poisoning. The authors developed AlignPoison, a framework that demonstrates how malicious interactions can be synthesized to manipulate recommendations by leveraging decoding alignment and prefix popularity. The study shows that even a small number of synthetic interactions can significantly impact the model's recommendations.
Why it matters
Understanding the vulnerabilities of generative recommendation models is crucial for developing robust AI systems. This research highlights the need for improved security measures to protect recommendation systems from targeted attacks, which can have significant implications for user trust and system integrity.
- Generative recommendation models are vulnerable to data poisoning attacks.
- AlignPoison demonstrates a method for exploiting decoding alignment and prefix popularity to create effective attacks.
- Even a small number of synthetic interactions can significantly impact recommendation outcomes.
- The study emphasizes the need for enhanced security measures in AI recommendation systems.
- The results show that AlignPoison outperforms existing methods in attacking generative recommenders.
The bigger picture
The findings indicate that generative recommendation systems are susceptible to targeted poisoning attacks, which could lead to the promotion of malicious content. This highlights the importance of developing more secure and resilient AI systems, particularly in applications where recommendations have significant influence on user behavior.
The paper presents AlignPoison, a framework that reveals the vulnerability of generative recommendation models to targeted data poisoning. The study shows that these models can be manipulated with minimal synthetic interactions, highlighting the need for improved security in AI recommendation systems.
Technical details
- Generative recommendation models based on autoregressive decoding
- Black-box framework (AlignPoison)
- Decoding alignment and prefix popularity as key factors in poisoning attacks
- ASR lift (Attack Success Rate lift) as a performance metric
- Unimodal and multimodal generative recommendation benchmarks
FAQ
What is AlignPoison?
AlignPoison is a black-box framework developed to demonstrate the vulnerability of generative recommendation models to targeted data poisoning attacks by exploiting decoding alignment and prefix popularity.
How effective is AlignPoison?
AlignPoison outperforms competitive baselines, improving ASR lift by up to 16.3 percentage points in experiments on unimodal and multimodal generative recommendation benchmarks.
What are the implications of this research?
The research highlights the need for improved security measures in generative recommendation systems to prevent targeted attacks that could promote malicious content.
What is the main vulnerability identified in generative recommenders?
The main vulnerability is the susceptibility to conditional targeted poisoning through the injection of synthetic interactions, which can significantly increase the promotion of malicious targets under specific triggers.
What are the key factors in the poisoning attack?
The key factors are decoding alignment and prefix popularity, where short, context-aligned prefixes that are common under the model's transition dynamics and strongly linked to a frequent trigger amplify targeted promotion.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by arXiv - cs.AI on Oct 14, 2026.
Comments
Sign in to join the discussion.