Under 1% fake interactions can steer a generative recommender: decoding-aligned short prefixes lift target exposure by up to 16.3 points
With only black-box access to a recommendation API, injecting under 1% synthetic interactions makes a generative recommender promote an attacker's target far more often whenever a chosen trigger item appears, and short prefixes picked for decoding alignment raise the hit-rate lift by up to 16.3 percentage points.