The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems
Abstract
With recent advancements in large language models (LLMs) and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms (e.g., for managing a user's personal account) remains underexplored. Existing studies on agent poisoning typically assume that the adversary can expose poisoned content to the agent. Although such an attack is direct and effective, it is more easily detected and mitigated. In the context of social media platforms, this leaves open whether the recommendation system itself would surface such content to the agent in a more subtle manner. Through theoretical analysis, we show that the like-score mechanism used in OASIS can be exploited, and we characterize the conditions under which a multi-stage chain of poisoned posts can steer the agent's feed. Based on these insights, we further develop an algorithm that crafts realistic poisoned posts. Experiments support our theoretical findings and demonstrate the effectiveness of the proposed algorithm. Notably, by exploiting the like-score feedback loop, the attack causes the recommendation system to select poisoned posts even when their user-post similarity falls below the retrieval threshold.
Related
- Structured Positive-Definite Optimal Control Synthesis of Closed-Loop Recommendation Systems over Social Networks
- Recent Advances in Resilient Multi-Energy Systems Against Climate Change
- Dynamic Trust-Driven Resilient Finite-/Fixed-Time Formation Control for Multi-UAV Systems with Input Saturation Against Sybil Attacks
- Which Model for Which Role? Cost-Efficient Pareto Recommendation for LLM Agentic Workflows
- Recommendation-Mediated Diffusion of Stance-Bearing Information in Online Social Networks: A Dynamic Message-Passing Analysis of the UEAI Model
BibTeX
@misc{xing2026like,
title = {{The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems}},
author = {Yue Xing and Pengfei He and Zitao Li},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.27155},
eprint = {2609.27155},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.27155},
note = {CC BY-SA 4.0},
}
RIS
TY - UNPB
TI - The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems
AU - Yue Xing
AU - Pengfei He
AU - Zitao Li
PY - 2026
DA - 2026/09/22
PB - arXiv
DO - 10.48550/arxiv.2609.27155
UR - https://arxiv.org/abs/2609.27155
AB - With recent advancements in large language models (LLMs) and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms (e.g., for managing a user's personal account) remains underexplored. Existing studies on agent poisoning typically assume that the adversary can expose poisoned content to the agent. Although such an attack is direct and effective, it is more easily detected and mitigated. In the context of social media platforms, this leaves open whether the recommendation system itself would surface such content to the agent in a more subtle manner. Through theoretical analysis, we show that the like-score mechanism used in OASIS can be exploited, and we characterize the conditions under which a multi-stage chain of poisoned posts can steer the agent's feed. Based on these insights, we further develop an algorithm that crafts realistic poisoned posts. Experiments support our theoretical findings and demonstrate the effectiveness of the proposed algorithm. Notably, by exploiting the like-score feedback loop, the attack causes the recommendation system to select poisoned posts even when their user-post similarity falls below the retrieval threshold.
ER -