Under 1% fake interactions can steer a generative recommender: decoding-aligned short prefixes lift target exposure by up to 16.3 points

Generative recommenders are vulnerable to conditional targeted poisoning: a small number of injected synthetic interactions makes a target item surface more often in histories that end with a chosen trigger item. Earlier poisoning work targets ranking-based, representation-based, or LLM-based recommenders, which score a fixed candidate set or match embeddings, whereas end-to-end generative recommenders autoregressively decode semantic item IDs and their poisoning resilience had been largely unexplored. At a fixed poisoning ratio, trigger-conditioned injection that places the trigger before the target beats random injection, by 43.2 percentage points on the Industrial dataset; lift is the target hit-rate difference between poisoned and clean models on the same triggered test histories.

An effective prefix must satisfy two observable conditions at once: the trigger ranks high under the clean decoder, and the prefix appears often enough in API returns. Random prefixes or prefixes built only from popular items do not exploit the decoder's own transition tendencies, so their gains stay limited. On Office, combining both signals reaches 16.6 percentage points of ASR lift, against 4.8 points for popularity alone and 11.2 points for ranking alone, with the same ordering at the other poisoning ratio.

An attacker can discover and sample these prefixes from API outputs alone, then spread a fixed poisoning budget across them with a closed-form distribution. No prior black-box method targeted the semantic-ID decoding process, and the attacker has no access to model parameters, gradients, the tokenizer, or corpus-level popularity statistics. On MicroLens, capping the API query budget at 20 still yields ASR lifts of 17.1/22.5/23.7 percentage points at cutoffs 3/10/50, only 0.7/0.7/0.4 points below the full candidate pool.

The method outperforms adapted interaction-poisoning baselines on unimodal and multimodal generative recommendation benchmarks while largely preserving benign recommendation quality. Baselines include random prefixes, popular-item prefixes, prefixes co-occurring with the target, and DDSP prefixes that map optimized perturbation vectors to nearest-neighbor items, each keeping its own prefix construction with the same fixed suffix. On Industrial at a 0.5% poisoning ratio, ASR@10 lift reaches 36.7 percentage points, 14.0 points above the strongest baseline; on the trigger-free test set, benign quality stays stable on Office and Industrial with only a minor drop on MicroLens.

The report covers simulated poisoning on public benchmarks: two Amazon product datasets and one multimodal micro-video dataset, where the attacker can inject a limited fraction of synthetic interactions, query the recommendation API, and view the item catalog, but cannot modify item metadata, prompts, or system instructions. Targets are drawn from the long tail and triggers from publicly visible popular items, and at evaluation each history ends with its designated trigger, with the poisoned and clean models receiving the same history. It suits researchers and platform engineers working on recommender security and robustness evaluation.

The attack assumes the adversary has enough black-box API access to complete prefix discovery, and relaxing that assumption requires further study. The work focuses on attack design, so a systematic defense study is outside its scope. Detection was evaluated with fraudulent action propagation and a Mahalanobis-distance detector on hidden states, and injected users went undetected in the evaluated settings, which is not a conclusion about all detection methods.