DrunkAgent：基于LLM的推荐智能体中的隐蔽记忆破坏
DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents
AI总结：
本文首次系统研究LLM推荐智能体的记忆漏洞，提出黑盒攻击框架DrunkAgent，通过语义对抗触发器破坏动态记忆更新，并在多类真实推荐系统中验证其泛化、迁移与隐蔽性。
摘要：
由大语言模型（LLM）驱动的智能体正越来越多地用于推荐系统（RS），以实现个性化行为建模；其中，记忆机制发挥着关键作用，使智能体能够从真实世界交互中自主探索、学习并自我演化。然而，这一作为上下文存储库的机制本身也固有地暴露了一个可供潜在对抗性操纵的攻击面。尽管其地位核心，智能体化推荐系统面对此类威胁时的鲁棒性在很大程度上仍未得到充分研究。已有工作存在语义不匹配问题，或依赖静态嵌入与预定义提示，均不是为动态系统、尤其是LLM智能体的动态记忆状态而设计。商业推荐系统的黑盒性质进一步加剧了这一挑战。为解决上述问题，本文首次系统研究了基于LLM的推荐智能体中基于记忆的漏洞，揭示其安全局限，并为增强系统韧性与可信度的工作提供指导。具体而言，我们提出了一个名为DrunkAgent的新型黑盒攻击框架。DrunkAgent为目标物品推广构造具有语义意义的对抗性文本触发器，并引入一系列策略，通过在交互过程中破坏记忆更新来最大化触发器效果。这些触发器和策略在代理模型上进行优化，使DrunkAgent具备可迁移性和隐蔽性。在真实世界数据集上，针对包括协同过滤、检索增强和序列推荐在内的多种智能体化推荐系统开展的大量实验，证明了DrunkAgent的泛化性、可迁移性和隐蔽性。
英文摘要：
Large language model (LLM)-powered agents are increasingly used in recommender systems (RSs) to achieve personalized behavior modeling, where the memory mechanism plays a pivotal role in enabling the agents to autonomously explore, learn and self-evolve from real-world interactions. However, this very mechanism, serving as a contextual repository, inherently exposes an attack surface for potential adversarial manipulations. Despite its central role, the robustness of agentic RSs in the face of such threats remains largely underexplored. Previous works suffer from semantic mismatches or rely on static embeddings or pre-defined prompts, all of which are not designed for dynamic systems, especially for dynamic memory states of LLM agents. This challenge is exacerbated by the black-box nature of commercial recommenders. To tackle the above problems, in this paper, we present the first systematic investigation of memory-based vulnerabilities in LLM-powered recommender agents, revealing their security limitations and guiding efforts to strengthen system resilience and trustworthiness. Specifically, we propose a novel black-box attack framework named DrunkAgent. DrunkAgent crafts semantically meaningful adversarial textual triggers for target item promotions and introduces a series of strategies to maximize the trigger effect by corrupting the memory updates during the interactions. The triggers and strategies are optimized on a surrogate model, enabling DrunkAgent transferable and stealthy. Extensive experiments on real-world datasets across diverse agentic RSs, including collaborative filtering, retrieval augmentation and sequential recommendations, demonstrate the generalizability, transferability and stealthiness of DrunkAgent.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
