Paper deep dive

VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents

Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 108

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%

Last extracted: 10/1/2026, 7:03:32 AM

Summary

The paper introduces VirusCascade, a novel black-box targeted promotion attack against LLM-powered agentic recommender systems (LLM-ARS). It exploits a vulnerability called 'collaborative-reflection hijacking,' where adversarial evidence injected into a single agent is rationalized via 'reflection laundering' and propagated system-wide through 'collaborative reflection.' The attack leverages two properties: reflective persistence (memory retention) and cross-agent propagation (influence spread). VirusCascade achieves state-of-the-art targeted exposure (E@20 = 0.384) across four real-world datasets.

Entities (9)

VirusCascade · attack-framework · 98%LLM-Powered Agentic Recommender Systems · system-architecture · 95%Collaborative-Reflection Hijacking · vulnerability · 93%Collaborative Reflection · mechanism · 92%E20 · metric · 90%Reflection Laundering · vulnerability-process · 90%Cross-Agent Propagation · property · 88%Reflective Persistence · property · 88%AgentCF · baseline-model · 85%

Relation Signals (6)

VirusCascade → exploits → Collaborative-Reflection Hijacking

confidence 95% · VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces... exploiting collaborative-reflection hijacking

LLM-Powered Agentic Recommender Systems → uses → Collaborative Reflection

confidence 92% · LLM-powered agentic recommender systems (LLM-ARS)... whose semantic states are dynamically refined through a recurrent process known as collaborative reflection.

VirusCascade → achievesmetric → E20

confidence 90% · VirusCascade consistently achieves state-of-the-art targeted exposure... reaching a mean E@20 of 0.384

Collaborative-Reflection Hijacking → causedby → Reflection Laundering

confidence 90% · We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking.

Collaborative-Reflection Hijacking → relieson → Reflective Persistence

confidence 88% · exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation

Collaborative-Reflection Hijacking → relieson → Cross-Agent Propagation

confidence 88% · exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous agents, whose semantic states are dynamically refined through a recurrent process known as collaborative reflection. While this mechanism improves recommendation quality, it simultaneously introduces a systemic vulnerability: adversarial evidence injected into a single agent can be rationalised into a legitimate preference narrative, written back into memory, and propagated to other agents through interaction contexts. We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking. Existing attacks on recommender systems, whether based on interaction-level data poisoning or text-level adversarial perturbations, assume static pipelines and thus cannot exploit this recurrent, multi-agent amplification pathway. To bridge this gap, we first conduct a controlled vulnerability analysis that establishes two exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation. Then building on these findings, we propose VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces: the former ensures the target item is naturally rationalised as satisfying broad user preferences, the latter positions it for system-wide propagation. Extensive experiments on four real-world datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves state-of-the-art targeted exposure under evaluated stealth constraints, reaching a mean E@20 of 0.384 and surpassing the strongest baseline by an absolute margin of +0.185.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

104,439 characters extracted from source content.

Expand or collapse full text

VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents PubID: pubid: Network and Distributed System Security (NDSS) Symposium 2027 22–26 March 2027, Seoul, Republic of Korea ISBN 978-1-970672-09-1 https://dx.doi.org/10.14722/ndss.2027.230685 w.ndss-symposium.org Yurong Hao†🖂 , Wen Zhou2, Guowei Guan2, Tiantong Wu2, Fuyao Zhang2, Wei Yang Bryan Lim2 Affiliation: 2College of Computing and Data Science, Nanyang Technological University Email: yurong.hao@ntu.edu.sg Abstract Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous agents, whose semantic states are dynamically refined through a recurrent process known as collaborative reflection. While this mechanism improves recommendation quality, it simultaneously introduces a systemic vulnerability: adversarial evidence injected into a single agent can be rationalised into a legitimate preference narrative, written back into memory, and propagated to other agents through interaction contexts. We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking. Existing attacks on recommender systems, whether based on interaction-level data poisoning or text-level adversarial perturbations, assume static pipelines and thus cannot exploit this recurrent, multi-agent amplification pathway. To bridge this gap, we first conduct a controlled vulnerability analysis that establishes two exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation. Then building on these findings, we propose VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces: the former ensures the target item is naturally rationalised as satisfying broad user preferences, the latter positions it for system-wide propagation. Extensive experiments on four real-world datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves state-of-the-art targeted exposure under evaluated stealth constraints, reaching a mean E@20 of 0.384 and surpassing the strongest baseline by an absolute margin of ++0.185. I Introduction With the recent advancements in large language models (LLMs) [1, 2], LLM-powered agents [3] demonstrate impressive capabilities in autonomous interaction and decision-making. This remarkable capability is evolving recommender systems (RS) [4, 5, 6, 7, 8] from static scoring functions with numerical embeddings into dynamic agentic architectures. In these LLM-powered agentic recommender systems (LLM-ARS) [9, 10, 11], users and items are modelled as autonomous agents equipped with natural-language memories, as shown in Fig. 1. Through a recurrent process known as collaborative reflection, agents jointly reason over recent interactions to update their semantic states [9, 12]. This dynamic alignment grants LLM-ARS unprecedented personalisation capabilities and interpretability. Fig. 1: RS vs. LLM-ARS. Traditional RS (Left) optimises fixed user–item representations through gradient-based learning, whereas LLM-ARS instantiate users and items as memory-equipped agents that update their semantic states through autonomous interaction and collaborative reflection. However, the very mechanism that makes LLM-ARS powerful fundamentally alters the threat landscape. Traditional RS have long been targets of data poisoning [13, 14, 15, 16, 17] and adversarial perturbations [15, 16, 17, 18, 19]. Yet, these conventional attacks assume a static pipeline: the adversary manipulates input features, and the resulting distortion is bounded by the model’s fixed parameterisation. When applied to LLM-ARS, such methods face a fundamental mismatch. Interaction-level poisoning targets numerical parameters that no longer exist, while text-level perturbations that rely on surface-form artefacts are unlikely to survive the agents’ open-ended reasoning. More fundamentally, existing attacks fail to account for the recurrent, multi-agent nature of collaborative reflection and thus cannot exploit the system’s internal reasoning dynamics. We reveal that the collaborative reflection mechanism itself exposes a novel attack surface. Because memories are maintained in natural language and updated through open-ended LLM reasoning [12], adversarial evidence no longer needs to survive gradient-based optimisation, where injected signals are absorbed into shared parameters and diluted by regularisation. Instead, it only needs to be rationalised by the reflection operator as a coherent piece of preference evolution. We term this phenomenon reflection laundering: the reflection mechanism inadvertently converts externally injected manipulations into internally legitimised preference narratives, creating an integrity risk at the reflection–writeback boundary. Once laundered, the evidence is written back into the agent’s memory, where it persists across future reflection cycles and can be further elaborated or integrated with genuine preferences. More critically, the collaborative nature of reflection amplifies this local persistence into a systemic threat, a vulnerability we term collaborative-reflection hijacking. Consider, for example, a merchant seeking to promote a low-quality sleep aid with questionable efficacy for financial gain. By manipulating the product’s public profile and a small number of user interactions, the merchant aims to introduce seemingly plausible evidence through the system’s normal interaction and reflection process. If rationalised during collaborative reflection as coherent preference evidence, these signals may be written back into the item’s memory and become part of its evolving state. When a subsequent user interacts with this contaminated item, the laundered evidence can enter that user’s reflection context and influence its subsequent preference updates without direct contact with the attacker. As this process repeats across shared interaction contexts, the injected narrative can cascade through the system and influence a broader population of benign users. To characterise this vulnerability, we conduct controlled probes on an LLM-ARS (Section I), establishing a two-dimensional amplification surface. First, we observe reflective persistence: once an injected claim is admitted into memory, it is reliably retained and elaborated upon across subsequent benign reflection cycles. Second, we find cross-agent propagation: a local memory modification produces measurable recommendation drift in non-injected users, with the impact attenuating with hop distance in the user–item interaction graph. Building on these empirical findings, we propose VirusCascade, the first black-box attack framework exploiting collaborative-reflection hijacking for stealthy targeted item promotion. VirusCascade operates through two coordinated components: (i) Semantic injection extracts transferable preference motifs from publicly popular anchor items and designs the target item’s profile so that interactions with it are naturally rationalised as coherent preference evidence during reflection. (i) Structural injection constructs smooth behaviour trajectories for attacker-controlled users, positioning the target item within high-connectivity regions to maximise cross-agent propagation potential. Once deployed, the victim system’s own collaborative reflection drives the subsequent cascading amplification without further adversarial intervention. Extensive experiments on four real-world datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves the highest targeted exposure rate under the evaluated stealth constraints, reaching a mean E@20 of 0.3840.384 and surpassing the strongest adapted baseline by an absolute margin of +0.185+0.185. Our contributions are summarised as follows: • We identify collaborative-reflection hijacking, a novel systemic vulnerability in LLM-ARS, and conduct a controlled vulnerability analysis establishing two exploitable properties, reflective persistence and cross-agent propagation, that together enable multi-agent cascading amplification. • We propose VirusCascade, the first black-box targeted promotion attack against LLM-ARS. It jointly shapes semantic and structural attack surfaces to exploit both properties without requiring access to the internal model. • Extensive experiments across diverse LLM-ARS architectures and datasets show that VirusCascade achieves state-of-the-art targeted exposure under evaluated stealth constraints, consistently outperforming existing baselines. I Problem Formulation I-A Victim LLM-Powered Agentic Recommender System LLM-ARS extend conventional recommendation pipelines by representing users and items as autonomous language agents. Unlike traditional RS that learn a fixed scoring function over static user and item embeddings, LLM-ARS maintain explicit semantic states via memories and use LLM reasoning to support explanation and decision-making. Let bU_b and ℐI denote the benign user set and item set in RS, respectively. Each user agent u∈bu _b at step t maintains a short-term memory Mus,tM_u^s,t that describes its most recently reflected preferences in natural language, and a long-term memory Mul,tM_u^l,t that accumulates historical preference snapshots; we write Mut=(Mus,t,Mul,t)M_u^t=(M_u^s,t,M_u^l,t) for the composite user state. For each item i∈ℐi , we use MitM_i^t to denote the item-side state available to the system at step t. When items are modelled as agents, MitM_i^t corresponds to a unified item memory that records intrinsic attributes (e.g., category) and preference signals aggregated from prior adopters. Otherwise, MitM_i^t reduces to a non-agentic item profile PiP_i, such as its description or user-generated content (UGC). For user agent u at step t, let the candidate items be denoted by u,t=c1,…,cnC_u,t=\c_1,…,c_n\ and Ωu,t _u,t represent optional contextual information, such as user interaction history or task-specific prompts. Given u,tC_u,t and Ωu,t _u,t, the ranked candidate list Ru,tR_u,t for user u at step t is defined as Ru,t=fLLM(Mut,Mct:c∈u,t,Ωu,t).R_u,t=f_LLM (M_u^t;\M_c^t:c _u,t\; _u,t ). The recommendation score of item i can be implicitly represented by its position in the rank list Ru,tR_u,t, and an item is exposed to the user if it appears in the top-K positions of Ru,tR_u,t. I-B Collaborative Reflection Collaborative reflection conditions each update on the joint context of user preferences and item-side evidence. Given an interaction between user u and item i at step t, the system derives a feedback signal ℱu,i,tF_u,i,t by comparing the agent’s autonomous decision against the ground-truth interaction record. The feedback typically encodes the observed behaviour (e.g., whether the agent’s choice aligned with real-world data) and the agent-generated explanation for its decision. The general form of collaborative reflection can be written as: (Mut+1,Mit+1)=Φref(Mut,Mit,ℱu,i,t),(M_u^t+1,M_i^t+1)= _ref (M_u^t,M_i^t,F_u,i,t ), where Φref(⋅) _ref(·) denotes the collaborative reflection operator. Equivalently, the update can be decomposed as: Mut+1=Mut⊕ΔMut,Mit+1=Mit⊕ΔMit,M_u^t+1=M_u^t M_u^t, M_i^t+1=M_i^t M_i^t, where ⊕ denotes natural-language rewriting or appending, and ΔMut,ΔMit M_u^t, M_i^t are the reflection-induced state changes. In user-only memory systems, the item-side state MitM_i^t (which may reduce to a static profile PiP_i) participates in the reflection context but is not itself revised, i.e., ΔMit M_i^t is omitted: Mut+1=Φrefu(Mut,Mit,ℱu,i,t).M_u^t+1\;=\; _ref^u\! (M_u^t,\;M_i^t,\;F_u,i,t ). In dual-agent systems where items also maintain updatable memories, ΔMit M_i^t allows item states to accumulate adopter-related preference signals, enabling implicit preference propagation across users who later interact with the same item. Once written back, they become part of future recommendation contexts, forming the reflection–writeback cycle: (Mut,Mit)→ℱu,i,t→(ΔMut,ΔMit)→(Mut+1,Mit+1).(M_u^t,M_i^t)\;→\;F_u,i,t\;→\;( M_u^t, M_i^t)\;→\;(M_u^t+1,M_i^t+1). Through repeated cycles, user memories become increasingly personalised. In systems that also update item states, a user’s reflected rationale reshapes the item state, which in turn influences how subsequent users interpret the item. In this sense, collaborative reflection functions as a “semantic gradient”—iteratively revising natural-language states according to interaction evidence without explicit parameter updates. I-C Threat Model We consider a black-box targeted promotion attack against an emerging LLM-ARS design in a commerce setting. Such designs maintain persistent semantic states and use collaborative reflection to support personalised recommendation. The adversary can be a malicious merchant, or a third party acting on behalf of a merchant, who owns a target item i∗∈ℐi^* and aims to increase its recommendation exposure to benign users. All manipulations are performed through the same public interfaces available to ordinary merchants and users. Adversary’s Goal. The adversary seeks to promote i∗i^* to a population of benign users without degrading the overall recommendation quality. For a benign user u∈bu _b and a candidate set u,tC_u,t containing i∗i^*, the attack succeeds at step t if i∗i^* appears in the top-K positions of the ranked list Ru,tR_u,t. Accordingly, the adversary aims to maximise the exposure rate (E@K) of i∗i^* measured after T interaction steps: maxE@K(i∗)=1|b|∑u∈b[i∗∈TopK(Ru,)], _A @K_T(i^*)= 1|U_b| _u _bI [i^* (R_u,T) ], where A denotes the adversarial strategy, ⁡[⋅]I[·] is the indicator function, and T is the evaluation time step after the attack interactions have ended. Different from attacks that merely perturb a static ranking model, the adversary here aims to make i∗i^* repeatedly interpreted as recommendation-worthy during collaborative reflection, so that its influence can be written into evolving memories and reused in later recommendations. The attack is therefore required to be both effective and stealthy: the injected evidence should increase the exposure of i∗i^* while remaining plausibly indistinguishable from ordinary merchant-side content and normal user activity. Adversary’s Knowledge. The adversary operates in a black-box setting with no access to model parameters, training data, or reflection prompts. They cannot inspect how a particular interaction is reflected or written back into memories, nor can they observe MutM_u^t or MitM_i^t for any user or item, including the memories of their own attacker-controlled users. The adversary can only observe information exposed through normal platform interfaces, such as public item profiles, visible UGC, and the recommendation lists returned to their own accounts. Adversary’s Capability. The adversary can manipulate only externally controllable evidence through two channels. First, as the merchant of the target item i∗i^*, the adversary may edit its textual description within the content profile Pi∗P_i^*, subject to the platform’s normal content review workflow. Other profile fields (title, category, tags) are assumed fixed. Second, the adversary may inject a small set of attacker-controlled users ~ U, with |~|≤m|b|| U|≤ m|U_b|, who perform ordinary interactions (e.g., clicking, purchasing, or rating). We call the ordered item sequence produced by such a user its interaction trajectory. Each user u~∈~ u∈ U has its own evolving memory Mu~tM_ u^t, instantiated and updated by the system in exactly the same way as a benign user’s memory. Crucially, the adversary cannot create or manipulate reviews, comments, or other UGC on any item. Whether the manipulated evidence is absorbed and propagated depends entirely on the victim system’s collaborative reflection process. Scope of Investigation. We exclude several attack channels that are otherwise compatible with the above adversary model. First, we exclude UGC injection (reviews, comments) on any item, including i∗i^*, so that the observed attack effect is attributable solely to description manipulation and reflection-driven propagation. Second, we exclude influence on the backbone LLM’s pre-training or fine-tuning data, as the model is assumed frozen and inaccessible. Third, we exclude volumetric platform-level manipulation such as large-scale spam accounts, because our focus is on targeted, stealthy promotion under constrained resources. I Why Collaborative Reflection Is Hijackable This section examines why collaborative reflection can serve as an exploitable pathway for long-term and system-level manipulation. We identify two properties that an adversary could exploit: (i) an admitted claim can persist across subsequent reflection–writeback cycles even under purely benign traffic (reflective persistence), and (i) a local memory update can influence agents that were never directly modified, propagating through the user–item interaction topology (cross-agent propagation). To characterise both properties, we design controlled probes using a synthetic probe user whose initial memory is seeded with diagnostically traceable phrases. The probe user participates in a single interaction-reflection round and is then removed, leaving the system to evolve under purely benign interaction. Note that these probes are used solely for vulnerability analysis and fall outside the adversary’s capability defined in Sec.I-C. The two resulting observations directly motivate the attack design in Sec.IV. I-A Reflective Persistence across Rounds Hypothesis 1. Once a probe claim yprobey^probe is admitted into a user’s memory through collaborative reflection, we hypothesise that it will be resurfaced or elaborated by subsequent reflection cycles at a rate far exceeding the no-probe baseline, even when all following interactions are benign. Protocol. We evaluate on AgentCF [9] with the CDs & Vinyl dataset; full configuration details are in Appendix A-A. A single synthetic probe user is constructed with four rare marker phrases (corpus occurrence rate <5%<5\%) seeded into its initial memory and participates only in round 1. The probe user is removed before round 2, leaving 4 purely benign rounds. A parallel no-probe control arm runs the identical configuration on the unmodified split as reference. Among 100 benign users, a user is considered to have admitted the probe if its short-term memory MusM_u^s contains at least one of the four marker phrases after any round. Since different users may admit the probe at different rounds, we define each user’s admission round as the earliest round at which this criterion is first satisfied. Metrics. For each admitted user, we track three quantities aligned by lag, where lag k denotes the k-th round after individual admission. Since AgentCF’s reflection operator rewrites the user’s short-term memory MusM_u^s at each round, a marker appearing in a later round indicates active regeneration rather than passive retention. The reuse rate is the fraction of users at a given lag whose short-term memory still contains at least one marker phrase. The elaboration rate is the fraction of users at that lag whose reflection trace extends the probe content with semantically compatible reasoning beyond verbatim repetition, as judged by a GPT-4o-mini binary classifier prompt in Appendix A-A. The baseline regeneration rate is the frequency at which the same rare phrases appear in the no-probe control arm. Only users admitted early enough to be observed at a given lag contribute to that column. TABLE I: Reflective persistence among admitted users (AgentCF, CDs & Vinyl), averaged over 10 runs. Each column reports a lag relative to the user’s individual admission round. Metric Lag 1 Lag 2 Lag 3 Lag 4 Reuse Rate 78.0% 81.7% 79.3% 81.6% Elaboration Rate 03.3% 03.4% 16.7% 06.3% Avg. n (admitted users) 30 29 18 2 Baseline regeneration rate (no-probe control): 2.0% Results. As Table I shows, once a user admits the probe, the claim proves remarkably persistent: the reuse rate exceeds 78% at every evaluated lag, compared with a baseline regeneration rate of only 2%. A similar persistence pattern also holds for common-frequency markers [20], indicating that persistence does not stem from marker rarity. Detailed results are provided in Appendix A. The elaboration rate is lower in magnitude (averaging 7.4%) but carries a distinct implication for attack potential. While reuse indicates that the claim survives in memory, elaboration indicates that the reflection operator treats it as an accepted premise, extending it with semantically compatible reasoning. This means the probe is no longer merely preserved but actively integrated into the agent’s evolving preference narrative, progressively harder to dilute through benign interactions. In other rounds, when candidates are only weakly related to yprobey^probe, reflection accommodates the discrepancy rather than removing the claim, preserving it as background context that conditions future reasoning. We defer the aggregate admission dynamics to Sec.I-B, where the cumulative spread of the probe across the user population is analysed jointly with cross-agent propagation. Observation 1. Once admitted, a probe claim remains active across subsequent reflection–writeback cycles. Later rounds reuse or elaborate the claim at rates far exceeding the no-probe baseline, indicating that collaborative reflection can convert a locally compatible input into a persistent semantic context. I-B Cross-Agent Propagation Hypothesis 2. We hypothesise that benign users who never directly interacted with the probe user will nonetheless exhibit measurable memory and recommendation shifts relative to the no-probe control arm, and that these shifts decay with hop distance in the user–item bipartite graph. The hypothesised pathway is as follows. When the probe user’s reflection produces an altered signal during round 1, the involved item agents update their memory to accommodate it. Benign users who subsequently interact with these same items encounter probe-aligned item memory, which feeds into their reflection and may shift their preferences. High-degree items (hubs) amplify this effect because they bridge more user pairs, acting as both accumulation points and redistribution channels. Protocol. Using the same setup, we introduce a single probe user u0u_0 at round 1 and advance the system under benign traffic. Non-injected users are partitioned by hop distance from u0u_0 in the user–item bipartite graph, where a hop-k user is connected to u0u_0 through a shortest path of k intermediate items (e.g., a hop-1 user shares at least one common item with u0u_0). A no-probe control arm provides the reference for all comparisons. To further separate semantic propagation from ordinary graph correlation, we introduce a topology-matched semantic-null control. It preserves the same probe user, interaction sequence, interacted items, and timing as the semantic-probe condition, but removes the probe semantic claim. Metrics. For each benign user, we measure three quantities relative to the control arm. Cumulative admission rate is the fraction of benign users whose memory contains at least one marker phrase by a given round. Recommendation drift is the mean absolute rank displacement in a user’s top-K list between the probed and control runs, averaged across evaluated rounds. Claim adoption is a binary indicator of whether a user’s final memory contains language semantically aligned with yprobey^probe, aggregated as a rate over each hop-distance group. Fig. 2: Cumulative fraction of benign users measured across interaction-reflection rounds. Dark bars: newly admitted in each round; light bars: admitted in prior rounds and still retained. Dashed red line: no-probe baseline regeneration rate (2%). TABLE I: Cross-agent propagation under the semantic probe and topology-matched semantic-null control. Values report the mean and 95% t-confidence interval across 10 paired runs; n denotes the number of benign users in each hop group. Users n Setting Rec. Drift ↑ Claim Adoption ↑ Hop-1 12 Sem.-null 0.003 [0.001, 0.005] 0.0% [0.0, 0.0] Sem.-probe 0.397 [0.371, 0.423] 33.6% [28.9, 38.3] Hop-2 25 Sem.-null 0.002 [0.001, 0.003] 0.0% [0.0, 0.0] Sem.-probe 0.245 [0.221, 0.269] 25.8% [22.7, 28.9] Hop>2>2 63 Sem.-null 0.003 [0.002, 0.004] 0.0% [0.0, 0.0] Sem.-probe 0.123 [0.112, 0.134] 6.7% [5.1, 8.3] Results. Fig. 2 shows that the probe spreads well beyond the directly interacting user: starting from 2% at round 1, the cumulative admission rate rises steadily to 38% by round 5, far exceeding the 2% baseline. The light bars confirm that nearly all previously admitted users retain the probe in later rounds (consistent with Observation 1), while dark bars indicate continued new admissions as the probe reaches users further in the interaction graph. Table I further reveals a consistent distance-dependent pattern across the 10 paired runs. Under the semantic probe, Hop-1 neighbours exhibit the largest recommendation drift (0.3970.397) and claim adoption (33.6%33.6\%), which decrease to 0.2450.245/25.8%25.8\% at Hop-2 and 0.1230.123/6.7%6.7\% beyond two hops. In contrast, the topology-matched semantic-null control yields only 0.0020.002–0.0030.003 recommendation drift and no claim adoption across all hop groups, with its 95% confidence intervals clearly separated from the probe condition. This contrast shows that the distance-dependent shift cannot be explained by the shared interaction topology alone. Stratifying hop-1 users by the degree of their connecting item reveals that hub-connected users account for a disproportionate share of observed claim adoption, consistent with the hypothesised amplification role of high-degree items. Observation 2. A local memory update can influence agents that were never directly modified. The influence decays with hop distance in the user–item interaction topology, indicating that collaborative reflection provides a topological pathway for cross-agent propagation. IV Our Attack: VirusCascade Fig. 3: Overview of VirusCascade. The adversary extracts preference motifs from anchor items and designs the target profile to make i∗i^* easier to rationalise during reflection. It then constructs smooth, propagation-oriented behaviour trajectories from anchor items to i∗i^*. The victim system’s collaborative reflection may subsequently admit and propagate the injected evidence. IV-A Overview In this section, we present VirusCascade, a black-box targeted promotion framework against LLM-powered agentic recommender systems. The core idea behind VirusCascade is to exploit the two amplification dimensions identified in Sec.I, i.e., reflective persistence and cross-agent propagation, by crafting adversarial evidence that the victim system’s own collaborative reflection is likely to admit, retain, and spread. Fig. 3 gives an overview. The attack consists of two adversary-controlled stages followed by a victim-driven amplification process. Semantic injection designs the target item profile so that interactions with i∗i^* can be naturally rationalised during collaborative reflection. Structural injection constructs behaviour trajectories that guide attacker-controlled users from popular items to i∗i^* along smooth, propagation-oriented paths. Once these trajectories are executed through normal platform actions, the victim system processes them via its own collaborative reflection, which may propagate the injected evidence without any further adversarial intervention. Formally, given a target item i∗i^* and a limited set of attacker-controlled users ~ U, the adversary constructs an attack strategy =(P~i∗,u~u~∈~),A= ( P_i^*,\;\S_ u\_ u∈ U ), where P~i∗ P_i^* is the attacker-designed textual profile of i∗i^*, and u~S_ u is the interaction trajectory executed by attacker-controlled user u~ u. The strategy is subject to the budget constraints |~|≤m|b|| U|≤ m|U_b| and |u~|≤Lmax|S_ u|≤ L_ . Anchor-item guidance. A key challenge in the black-box setting is that the adversary cannot observe the user–item interaction topology and therefore cannot directly identify the high-degree hub items whose amplification role was demonstrated in Sec.I-B. To address this, VirusCascade uses publicly popular items as observable proxies. Specifically, an anchor item set ℐanc⊆ℐI_anc is selected from public signals such as best-seller lists, category rankings, and search results. These anchor items serve two roles throughout the attack: they reveal preference motifs that can be transferred to the target profile (semantic injection), and they provide high-connectivity stepping stones for trajectory construction (structural injection). IV-B Semantic Injection The purpose of semantic injection is to design the target profile P~i∗ P_i^* so that interactions with i∗i^* can be naturally rationalised as satisfying broadly shared user preferences during collaborative reflection. As shown in Sec.I-A, the reflection operator does not accept arbitrary claims. This motivates a transfer-based approach: rather than inserting explicit promotional language, VirusCascade extracts preference motifs from popular anchor items and embeds them into the target profile. Intuitively, a preference motif is not a text fragment to be copied, but a semantic constraint that explains why an item appeals to users—such as comfort, durability, or compatibility with common usage scenarios. When such motifs are expressed factually in the target profile, interactions with i∗i^* become more likely to be interpreted as coherent preference evidence by Φref _ref, thereby increasing the probability of admission. Motif extraction. Given the anchor item set ℐancI_anc, the adversary collects the publicly visible profile PiP_i of each anchor item i∈ℐanci _anc. For each anchor item, VirusCascade extracts a motif set i=zi,1,zi,2,…,zi,riZ_i=\z_i,1,z_i,2,…,z_i,r_i\, where each motif zi,jz_i,j describes a reusable preference rationale. Aggregating motifs from all anchor items gives anc=⋃i∈ℐanci.Z_anc= _i _ancZ_i. In practice, motif extraction can be implemented by prompting a general-purpose auxiliary model ℳauxM_aux to analyse public item descriptions and user-visible feedback, and to summarise why these items appeal to users. These motifs serve as rationale conditions for later generations, rather than the final target profiles. Furthermore, VirusCascade selects a subset ⁡(i∗)Z(i^*) comprising the top-r preference rationales from ancZ_anc. A motif is retained only if it can be expressed as a plausible preference rationale for i∗i^*. Motif-aware contrastive generation. With the selected motifs in hand, the next step is to rewrite the target profile so that it naturally incorporates these motifs while remaining close to an ordinary product description. A naïve approach—directly prompting an LLM to embed all motifs—risks producing promotional or unnatural language that could trigger platform moderation. To address this, VirusCascade employs a contrastive generation-then-selection procedure. Given the initial target profile Pi∗P_i^* and the selected motifs ⁡(i∗)Z(i^*), the adversary constructs two aligned prompts for the auxiliary model ℳauxM_aux: base _base =GenPrompt⁡(Pi∗), =GenPrompt(P_i^*), motif _motif =GenPrompt⁡(Pi∗,⁡(i∗)). =GenPrompt(P_i^*,\;Z(i^*)). The base prompt asks the model to rewrite the target profile using only its original information, while the motif-aware prompt additionally includes the selected motifs. This contrastive design serves two purposes. First, the base candidates provide a naturalness reference: any motif-aware candidate that deviates substantially from the base distribution is likely to appear unnatural. Second, including base candidates in the selection pool ensures that the procedure can fall back to a conservative profile when no motif-aware candidate achieves a satisfactory balance. The auxiliary model generates a base candidate set baseQ_base and a motif-aware candidate set motifQ_motif. The final profile is selected from =base∪motifQ=Q_base _motif by balancing motif coverage, profile fidelity, and naturalness: P^i∗=arg⁡maxP∈[smotif(P,⁡(i∗));dprof(P,Pi∗);rnat(P)], P_i^*= _P [s_motif(P,Z(i^*));d_prof(P,P_i^*);r_nat(P) ], where smotif(⋅)s_motif(·) measures how well the selected motifs are expressed, dprof(⋅)d_prof(·) measures deviation from the original profile, and rnat(⋅)r_nat(·) penalises unnatural or overly promotional language. In implementation, naturalness can be estimated by perplexity and rule-based checks for repetition or abrupt motif emphasis. Finally, VirusCascade rewrites P~i∗=Refine⁡(P^i∗) P_i^*=Refine( P_i^*), removing generation artefacts, repeated expressions, and wording that may trigger platform moderation. All prompt templates used in semantic injection, including those for motif extraction, profile generation, and refinement, are provided in Appendix A-B3. IV-C Structural Injection The purpose of structural injection is to construct behaviour trajectories for attacker-controlled users that are both behaviourally smooth—so that the transition toward i∗i^* appears as a natural continuation of prior interactions—and propagation-oriented—so that the injected evidence enters interaction contexts that are frequently shared with benign users. Dual-cost transition graph. To formalise the trade-off between smoothness and propagation, VirusCascade builds a target-oriented transition graph i∗=(i∗,ℰi∗),i∗=ℐanc∪i∗.G_i^*=(V_i^*,\;E_i^*), _i^*=I_anc∪\i^*\. The edge set ℰi∗E_i^* is constructed by evaluating all ordered pairs (i,j)∈i∗×i∗(i,j) _i^*×V_i^*. Each edge (i,j)∈ℰi∗(i,j) _i^* indicates that item j can plausibly follow item i in an attacker-controlled trajectory. The edge cost combines two complementary signals: c⁡(i,j)=αdsem(i,j)+(1−α)dbeh(i→j),c(i,j)=α\,d_sem(i,j)+(1-α)\,d_beh(i→ j), where dsem(i,j)d_sem(i,j) measures the semantic distance between public item profiles, categories, or tags, and dbeh(i→j)d_beh(i→ j) measures how natural the transition appears as a user preference shift. Intuitively, a low-cost edge represents a transition that is both semantically related and behaviourally plausible: the kind of shift that a real user might exhibit and that collaborative reflection would accept as a coherent preference evolution. The behavioural cost can be estimated from an LLM judgement based on public item information and transition plausibility. Multi-length trajectory routing. For each attacker-controlled user u~∈~ u∈ U, VirusCascade constructs a path from an anchor item to i∗i^*: u~=(i1,i2,…,iℓ),i1,…,iℓ−1∈ℐanc,iℓ=i∗.S_ u=(i_1,i_2,…,i_ ), i_1,…,i_ -1 _anc, i_ =i^*. The path is selected by minimising the accumulated transition cost: u~≈argmin:iℓ=i∗∑j=1ℓ−1c(ij,ij+1),ℓ∈ℒ,S_ u≈ _S:\,i_ =i^* _j=1 -1c(i_j,i_j+1), , where ℒL is a set of allowed trajectory lengths. Using multiple lengths encourages attacker-controlled users to reach i∗i^* through diverse anchor-mediated paths. For example, one trajectory may follow “popular chair → lumbar cushion →i∗→ i^*”, while another may follow “standing desk → office accessory → posture-support item →i∗→ i^*”. This diversity prevents injection from being concentrated in a single behaviour pathway, reducing detectability while broadening its topological reach. Discussion. Structural injection complements semantic injection by determining where in the interaction topology the adversarial evidence is introduced. Passing through popular anchor items ensures that the injected trajectories intersect with interaction contexts that are frequently reused by the victim system. As shown in Sec.I-B, item-side states at high-degree nodes act as redistribution channels for preference signals. By routing trajectories through anchor items that approximate these hubs, structural injection positions the adversarial evidence at topological locations with higher propagation potential. IV-D Reflection-driven Amplification After the adversary executes the constructed trajectories through ordinary platform actions (e.g., clicking, purchasing, or rating), all further amplification is driven by the victim system’s own collaborative reflection. Once admitted, the motif-aligned rationale can be written into user-side or item-side states through the normal reflection-writeback mechanism: Mu~t+1=Mu~t⊕ΔMu~t,Mi∗t+1=Mi∗t⊕ΔMi∗t.M_ u^t+1=M_ u^t M_ u^t, M_i^*^t+1=M_i^*^t M_i^*^t. Because future recommendation and reflection steps condition on updated memories, the admitted evidence may persist beyond the original attacker-controlled interaction. In later rounds, i∗i^* can therefore be considered together with motif-aligned memory evidence, making it easier for the system to repeatedly interpret the target item as recommendation-worthy. The effect may further propagate when the updated item-side state or nearby anchor-item contexts are reused in later interactions with benign users. For a benign user u, the recommendation and reflection process may condition on item states that have already absorbed motif-aligned evidence: Ru,t′=fLLM(Mut′,Mct′:c∈u,t′,Ωu,t′),t′>t.R_u,t =f_LLM (M_u^t ;\M_c^t :c _u,t \; _u,t ), t >t. If i∗i^* appears in the candidate set or in a reflection context connected to the same anchor region, the previously admitted rationale can help explain why i∗i^* matches the user’s evolving preference. Thus, a local injection introduced by attacker-controlled users influences non-injected users through temporal persistence and topological reuse. V Experimental Evaluation In this section, we evaluate VirusCascade on real-world recommendation datasets to answer the following questions: • RQ1 (Effectiveness): Can VirusCascade increase the exposure of the target item more effectively than existing poisoning and adversarial perturbation baselines? • RQ2 (Stealthiness): Does the attack remain imperceptible across multiple detection dimensions? • RQ3 (Ablation): How much does each component, semantic injection and structural injection, contribute to the overall attack effectiveness? • RQ4 (Sensitivity): How do the attack budget and the transition graph parameter affect attack performance? • RQ5 (Scalability): Does the attack remain effective as the agent population grows and over long interaction horizons? • RQ6 (Transferability): Does the attack remain effective under different auxiliary models and victim architectures? V-A Experimental Setup Datasets. We conduct experiments on four real-world Amazon 11 1 https://cseweb.ucsd.edu/ jmcauley/datasets/amazon_v2/ review datasets: CDs & Vinyl, Movies & TV, Automotive, and Musical Instruments to ensure the comprehensiveness of our evaluation. These datasets cover diverse commercial domains with heterogeneous user interests and item-side textual profiles, making them suitable for evaluating targeted promotion attacks in LLM-ARS. Following prior work [9], we sample 100 users from each dataset while preserving the original interaction chronology. We adopt leave-one-out evaluation, using each user’s last interaction for testing, the second-to-last for validation, and all preceding interactions for agent memory initialisation. Dataset statistics are reported in Table I. TABLE I: Statistics of the datasets used in our experiments. Dataset #Users #Items #Inter. Sparsity CDs & Vinyl 112,395 73,713 1,443,755 99.98% Movies & TV 297,529 60,110 3,404,812 99.98% Automotive 193,651 79,317 1,709,025 99.99% Musical Instruments 27,530 10,611 231,312 99.92% Victim systems. We evaluate three LLM-ARS that represent different recommendation paradigms while sharing the same collaborative reflection mechanism (Sec.I-B). All three systems instantiate both users and items as agents with natural-language memories, and use GPT-4o-mini as the default backbone LLM. They differ in how much contextual evidence is supplied to the LLM ranker during inference, exposing different memory surfaces to the attacker. • AgentCF [9] follows a collaborative filtering paradigm that ranks candidates using the user agent’s short-term memory Mus,tM_u^s,t and the candidate item agents’ memories. • AgentRAG follows a retrieval-augmented paradigm that additionally retrieves specialised preference records from the user’s long-term memory Mul,tM_u^l,t, using candidate item memories as queries. • AgentSEQ follows a sequential paradigm that additionally incorporates the item memories of the user’s historical interactions, capturing temporal preference dynamics, i.e., Ωu,t=Mi1t,…,Mimt _u,t=\M_i_1^t,…,M_i_m^t\. Baselines. We compare VirusCascade against 10 representative baselines spanning three categories, each corresponding to a partial manipulation channel. • Interaction-level data poisoning: RandAttack, PopAttack [21], and ExpPromot [22] manipulate only user–item interactions. They serve as structural counterparts to VirusCascade, testing whether behavioural evidence alone can promote the target item. • Prompt-/Text-level adversarial perturbation: DeepWdBug [15], PuncAttack [16], TextFooler [17], BertAttack [18], TextBugger [19], and TrivInsert [19] modify the target description at different perturbation granularities (character/word/sentence level). They serve as semantic counterparts to VirusCascade, testing whether textual manipulation alone can influence LLM-based ranking. • Memory-level adversarial generation: DrunkAgent [12] constructs a surrogate victim system and greedily searches adversarial triggers in the target description. It is the closest agentic baseline because it explicitly targets memory corruption. Metrics. We evaluate attack performance from three perspectives: targeted promotion effectiveness, recommendation utility, and stealthiness. • Targeted promotion. Following the problem formulation, we use Exposure Rate (E@K) as the main attack metric. A higher E@K indicates that the target item is exposed to more benign users. • Recommendation utility. An effective attack should achieve its goal without disrupting the system’s normal performance. We therefore report Hit Rate (H@K) and Normalised Discounted Cumulative Gain (N@K) on normal test interactions, which measure overall recommendation accuracy and ranking quality for benign users. • Stealthiness. For modified profiles, we report Perplexity (PPL) for text naturalness (lower is better) and ROUGE-1/2/L for content preservation relative to the originals (higher is better). We further conduct a human evaluation of manipulation detectability and factual consistency. Parameter Settings. For each dataset, we randomly sample target items from the long-tail item set. This setting is more challenging than promoting already popular items, as long-tail targets have limited historical exposure and weaker prior evidence in the recommender. Following prior work [9], we randomly sample subsets of 100 users for each domain to ensure tractable LLM-based simulation. For evaluation, we adopt a sampled leave-one-out candidate-ranking protocol: for each test user, we construct a candidate set of 100 items, including one ground-truth positive item and 99 negative items randomly sampled from items the user has not interacted with. Unless otherwise specified, the attacker controls a small fraction of users, with an attack budget of m=5%m=5\% of benign users, and each attacker-controlled user executes at most Lmax=6L_ =6 interactions. In addition, we set α=0.9α=0.9 by default. Due to space constraints, more details on datasets, baselines, and implementation are provided in Appendix A-B. We primarily evaluate VirusCascade on CDs & Vinyl and Movies & TV, with extended results on Automotive and Musical Instruments reported in Appendix A-F. Robustness evaluations against four defences (i.e., ONION [23], Fraudar [24], TrustRAG [25] and A-MemGuard [26]) are deferred to Appendix A-G. V-B Attack Effectiveness (RQ1) TABLE IV: Attack performance across three victim architectures on CDs & Vinyl and Movies & TV datasets. We report H@K and N@K for recommendation utility and E@K for targeted promotion effectiveness. NoAttack denotes the same victim configuration and benign protocol without any adversarial manipulation, and we report its E@K as (-). Victim RS AgentCF Attack CDs & Vinyl Movies & TV H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.130 0.050 (-) 0.260 0.082 (-) 0.220 0.125 (-) 0.310 0.148 (-) RandAttack 0.090 0.053 0.010 0.210 0.084 0.071 0.170 0.110 0.050 0.280 0.138 0.120 PopAttack 0.115 0.053 0.000 0.235 0.077 0.010 0.170 0.114 0.050 0.290 0.133 0.150 ExpPromot 0.140 0.054 0.000 0.290 0.091 0.051 0.185 0.117 0.030 0.270 0.134 0.110 DeepWdBug 0.125 0.043 0.000 0.210 0.066 0.010 0.160 0.103 0.010 0.290 0.122 0.120 PuncAttack 0.110 0.053 0.000 0.150 0.063 0.071 0.200 0.121 0.020 0.305 0.137 0.070 TextFooler 0.100 0.061 0.000 0.250 0.098 0.010 0.190 0.120 0.010 0.295 0.132 0.110 BertAttack 0.130 0.048 0.000 0.210 0.078 0.020 0.180 0.118 0.040 0.260 0.101 0.090 TrivInsert 0.110 0.047 0.000 0.200 0.070 0.000 0.210 0.132 0.020 0.300 0.127 0.120 TextBugger 0.140 0.060 0.020 0.230 0.082 0.091 0.200 0.124 0.000 0.300 0.139 0.050 DrunkAgent 0.120 0.060 0.000 0.220 0.084 0.010 0.160 0.100 0.000 0.270 0.128 0.110 VirusCascade 0.120 0.057 0.111 0.250 0.083 0.374 0.205 0.123 0.070 0.305 0.138 0.240 Victim RS AgentSEQ Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.130 0.056 (-) 0.270 0.091 (-) 0.240 0.126 (-) 0.350 0.154 (-) RandAttack 0.130 0.069 0.010 0.280 0.105 0.071 0.180 0.116 0.050 0.300 0.145 0.270 PopAttack 0.110 0.069 0.000 0.220 0.096 0.040 0.230 0.121 0.060 0.370 0.156 0.210 ExpPromot 0.130 0.067 0.000 0.230 0.092 0.051 0.150 0.089 0.050 0.390 0.148 0.130 DeepWdBug 0.140 0.050 0.000 0.250 0.078 0.030 0.180 0.115 0.010 0.320 0.151 0.140 PuncAttack 0.135 0.043 0.000 0.235 0.073 0.033 0.210 0.115 0.030 0.340 0.147 0.090 TextFooler 0.090 0.055 0.010 0.240 0.093 0.051 0.180 0.104 0.010 0.340 0.144 0.120 BertAttack 0.160 0.071 0.000 0.290 0.103 0.030 0.120 0.059 0.030 0.270 0.096 0.120 TrivInsert 0.150 0.072 0.010 0.280 0.104 0.030 0.260 0.184 0.040 0.390 0.216 0.220 TextBugger 0.120 0.057 0.020 0.240 0.088 0.040 0.200 0.114 0.020 0.370 0.156 0.060 DrunkAgent 0.110 0.052 0.000 0.230 0.083 0.030 0.150 0.095 0.010 0.320 0.138 0.080 VirusCascade 0.120 0.053 0.131 0.240 0.087 0.465 0.220 0.117 0.090 0.330 0.146 0.300 Victim RS AgentRAG Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.140 0.056 (-) 0.250 0.083 (-) 0.240 0.155 (-) 0.380 0.189 (-) RandAttack 0.150 0.071 0.030 0.210 0.085 0.111 0.210 0.130 0.100 0.310 0.135 0.230 PopAttack 0.130 0.047 0.010 0.230 0.072 0.071 0.210 0.140 0.050 0.410 0.189 0.210 ExpPromot 0.120 0.056 0.020 0.250 0.088 0.131 0.160 0.100 0.060 0.360 0.150 0.160 DeepWdBug 0.120 0.054 0.020 0.240 0.083 0.040 0.170 0.107 0.020 0.350 0.151 0.180 PuncAttack 0.130 0.067 0.020 0.210 0.086 0.091 0.180 0.117 0.020 0.370 0.164 0.090 TextFooler 0.100 0.052 0.000 0.260 0.091 0.091 0.210 0.137 0.010 0.340 0.170 0.120 BertAttack 0.130 0.067 0.000 0.250 0.097 0.131 0.160 0.096 0.010 0.300 0.132 0.160 TrivInsert 0.140 0.054 0.030 0.210 0.072 0.081 0.290 0.198 0.020 0.380 0.220 0.180 TextBugger 0.120 0.062 0.020 0.190 0.080 0.071 0.240 0.164 0.000 0.350 0.191 0.100 DrunkAgent 0.150 0.085 0.130 0.230 0.105 0.380 0.180 0.124 0.040 0.290 0.150 0.150 VirusCascade 0.130 0.086 0.182 0.230 0.105 0.545 0.225 0.139 0.113 0.365 0.175 0.380 Table IV reports the attack effectiveness of all methods on three victim systems across two datasets. We can find: VirusCascade achieves the highest exposure rate across all settings. On every combination of victim system and dataset, VirusCascade obtains the highest E@10 and E@20. The advantage is especially pronounced at K=20K=20: on AgentRAG with CDs & Vinyl, VirusCascade achieves E@20=0.545E@20=0.545, meaning the target item appears in the top-20 recommendations for over half of all benign users. Across all six victim-dataset configurations, VirusCascade achieves an average E@20 of 0.3840.384, compared with 0.1990.199 for the strongest individual baseline in each configuration. This indicates that jointly exploiting both the semantic and structural attack surfaces, as designed in Sec.IV, is substantially more effective than addressing either surface in isolation. The joint semantic-structural design is essential for exploiting collaborative reflection. Interaction-level data poisoning methods (RandAttack, PopAttack, ExpPromot) inject fake trajectories but leave the item profile unchanged, achieving consistently low exposure rates with E@10 rarely exceeding 0.0300.030. Text-level perturbation methods modify the profile but do not inject behavioural evidence, and their exposure rates are similarly low. DrunkAgent, which rewrites the description more aggressively through surrogate-based optimisation, achieves moderate E@K on AgentRAG (E@20=0.380E@20=0.380 on CDs & Vinyl) but drops to near-zero on the other two paradigms. These results corroborate the two-dimensional amplification analysis in Sec.I: influencing collaborative reflection requires evidence that is both semantically compatible with the reflection operator and topologically positioned to propagate across agents. Methods that supply only one dimension cannot reliably enter and persist in the reflection-writeback cycle. VirusCascade is the only method that addresses both dimensions simultaneously, which explains its consistent advantage across all recommendation paradigms. VirusCascade generalises across recommendation paradigms with varying memory surfaces. VirusCascade achieves strong promotion across all three victim systems despite their different inference mechanisms. On CDs & Vinyl, E@20 ranges from 0.3740.374 (AgentCF) to 0.5450.545 (AgentRAG), and on Movies & TV from 0.2400.240 (AgentCF) to 0.3800.380 (AgentRAG). This cross-paradigm consistency arises because VirusCascade’s semantic and structural components target the shared collaborative reflection mechanism rather than a particular inference pathway. The variation in E@K across systems reflects the different amounts of memory context available during inference: systems that supply richer context (AgentRAG with retrieved preferences, AgentSEQ with historical sequences) provide more entry points for motif-aligned evidence to influence ranking. V-C Stealthiness Analysis (RQ2) We evaluate stealthiness from four complementary aspects: recommendation quality preservation, text naturalness, content fidelity, and human evaluation. Recommendation quality preservation. As shown in Table IV, VirusCascade’s H@K and N@K remain within a narrow range of the NoAttack baseline across all settings. For example, on AgentCF with CDs & Vinyl, H@20 is 0.2500.250 under VirusCascade versus 0.2600.260 without attack, and N@20 is 0.0830.083 versus 0.0820.082. The limited change in H@K and N@K indicates that target promotion does not substantially disrupt aggregate recommendation performance. From the platform operator’s perspective, these utility metrics provide little indication of anomalous behaviour, making the attack harder to identify through routine performance monitoring. TABLE V: Attack imperceptibility in terms of perplexity. Dataset NoAttack DrunkAgent Ours Range Mean CDs & Vinyl [10.31, 90.02] 28.78 49.93 32.22 Movies & TV [12.91, 374.28] 72.85 50.65 39.35 Text naturalness (PPL). Table V reports the perplexity of modified profiles alongside the original profiles’ mean and range. On CDs & Vinyl, VirusCascade achieves a PPL of 32.2232.22, close to the original mean of 28.7828.78 and well within the original range [10.31,90.02][10.31,90.02], while DrunkAgent’s PPL rises to 49.9349.93. On Movies & TV, the original profiles exhibit high variance (range [12.91,374.28][12.91,374.28], mean 72.8572.85), reflecting heterogeneous description quality across items in this domain. VirusCascade’s PPL of 39.3539.35 falls comfortably within this range. In both domains, the perplexity of VirusCascade’s profile falls within the range observed for ordinary item descriptions. TABLE VI: Attack imperceptibility in terms of ROUGE. Attacks CDs & Vinyl Movies & TV @1 @2 @L @1 @2 @L TextFooler 0.200 0.000 0.200 0.251 0.000 0.121 DrunkAgent 0.294 0.000 0.100 0.175 0.000 0.087 VirusCascade 0.321 0.109 0.268 0.294 0.090 0.157 Content fidelity (ROUGE). Table VI compares the lexical overlap between modified and original profiles. VirusCascade achieves the highest ROUGE-1, ROUGE-2, and ROUGE-L scores across both datasets. Notably, VirusCascade is the only method with non-zero ROUGE-2 scores (0.1090.109 on CDs & Vinyl, 0.0900.090 on Movies & TV), indicating that it preserves bigram-level phrasing from the original profile. This is a direct consequence of the motif-aware contrastive rewriting design, which anchors the rewritten profile to the original content while incorporating transferable preference motifs. TextFooler and DrunkAgent achieve zero ROUGE-2 across both datasets, indicating that their modifications disrupt the profile’s local phrasing structure even when word-level overlap (ROUGE-1) is maintained. Human evaluation. Since item profiles are ultimately read by shoppers, we further conduct a human evaluation with 20 participants, each assessing 120 descriptions from CDs & Vinyl in randomised order, 40 each from original profiles and those rewritten by DrunkAgent and VirusCascade. As Table VII shows, VirusCascade profiles are flagged as manipulated in 21.9% of cases, close to 19.3% for original profiles and lower than 28.7% for DrunkAgent. Their factual consistency is also close to the original profiles (4.16 vs. 4.31 on a 1–5 scale), with no significant difference between the two (p=0.25p=0.25, paired t-test), whereas DrunkAgent obtains 4.02. These results complement the automatic metrics and show that VirusCascade remains difficult to distinguish from genuine profiles while largely preserving their factual content. TABLE VII: Attack imperceptibility in terms of human evaluation (20 participants, 120 descriptions each). Attacks Flagged as Manipulated ↓ Factual Consistency ↑ Original 19.3% 4.31±0.474.31± 0.47 DrunkAgent 28.7% 4.02±0.954.02± 0.95 VirusCascade 21.9% 4.16±0.624.16± 0.62 V-D Ablation Study (RQ3) TABLE VIII: Ablation study: effect of removing semantic injection (w.o SemInj) or structural injection (w.o StruInj). Victim RS AgentCF Variant CDs & Vinyl Movies & TV H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.130 0.050 (-) 0.260 0.082 (-) 0.220 0.125 (-) 0.310 0.148 (-) w.o SemInj 0.110 0.058 0.010 0.250 0.094 0.071 0.200 0.135 0.020 0.320 0.164 0.170 w.o StruInj 0.100 0.046 0.020 0.260 0.086 0.131 0.160 0.101 0.000 0.300 0.135 0.080 VirusCascade 0.120 0.057 0.111 0.250 0.083 0.374 0.205 0.123 0.070 0.305 0.138 0.240 Victim RS AgentSEQ Variant H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.130 0.056 (-) 0.270 0.091 (-) 0.240 0.126 (-) 0.350 0.154 (-) w.o SemInj 0.110 0.065 0.010 0.250 0.100 0.071 0.180 0.127 0.050 0.300 0.157 0.230 w.o StruInj 0.100 0.058 0.040 0.260 0.097 0.202 0.140 0.086 0.000 0.280 0.120 0.040 VirusCascade 0.120 0.053 0.131 0.240 0.087 0.465 0.220 0.117 0.090 0.330 0.146 0.300 Victim RS AgentRAG Variant H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.140 0.056 (-) 0.250 0.083 (-) 0.240 0.155 (-) 0.380 0.189 (-) w.o SemInj 0.130 0.078 0.020 0.420 0.147 0.101 0.240 0.158 0.090 0.370 0.190 0.220 w.o StruInj 0.130 0.070 0.020 0.290 0.111 0.141 0.190 0.128 0.010 0.300 0.156 0.110 VirusCascade 0.130 0.086 0.182 0.230 0.105 0.545 0.225 0.139 0.113 0.365 0.175 0.380 Fig. 4: Effect of malicious user fraction m. To disentangle the contributions of the two adversary-controlled components, we evaluate two variants. w.o SemInj retains the designed trajectories but uses the original item profile, isolating structural injection. w.o StruInj uses the motif-aware rewritten profile but replaces the designed trajectories with random interactions, isolating semantic injection. Table VIII reports results across all three victim systems. We find: Both components are necessary and complementary. Removing either component consistently reduces E@K. On AgentCF with CDs & Vinyl, the full method achieves E@20=0.374E@20=0.374, while removing semantic injection reduces it to 0.0710.071 and removing structural injection reduces it to 0.1310.131. The pattern is consistent across all victim systems, confirming that the two components contribute non-redundant attack surfaces. Structural injection provides the propagation backbone. Across most configurations, removing structural injection causes a larger E@K drop than removing semantic injection. This is consistent with the cross-agent propagation analysis: without trajectories routed through popular anchor items, injected evidence is less likely to enter reflection contexts shared by benign users. The designed trajectories thus provide topological pathways for motif-aligned signals to reach broader user groups. This effect is most visible on AgentSEQ with Movies & TV, where removing structural injection reduces E@20 from 0.300 to 0.040, a 7.5× reduction. Semantic injection enables admission and persistence. Complementing the structural propagation path, the motif-aware profile ensures that the target item is interpreted as preference-compatible during reflection. The variant w.o SemInj yields substantially lower E@K because the unmodified profile lacks transferable preference motifs needed to pass the reflection operator’s consistency check. This aligns with the persistence analysis in Sec.I-A, where local compatibility was identified as a necessary condition for probe admission. The two components exhibit synergistic interaction. The full method consistently outperforms either ablated variant, showing that semantic and structural injection provide complementary benefits. Semantic injection makes the target easier to admit and persist within the reflection-writeback cycle, while structural injection places the target in high-connectivity contexts where the admitted evidence can propagate to non-injected agents. The synergy arises because the two components exploit the two orthogonal dimensions of the amplification surface identified in Sec.I: temporal persistence and topological propagation. V-E Sensitivity Analysis (RQ4) We examine how attack performance varies with two key hyperparameters: the malicious user fraction m and the semantic-behavioural trade-off coefficient α in the dual-cost transition graph (Sec.IV-C). Fig. 5: Effect of the coefficient α. Effect of the malicious user fraction (m). Fig. 4 reports E@20, H@20, and N@20 as m varies in 3%,5%,8%,10%,12%\3\%,5\%,8\%,10\%,12\%\ across all three victim systems on both datasets. Two findings are consistent across all settings. First, E@20 increases monotonically with m but exhibits clear diminishing returns beyond m=5%m=5\%. The largest marginal gain occurs between m=3%m=3\% and m=5%m=5\%. On AgentRAG with CDs & Vinyl, E@20 jumps from 0.4110.411 to 0.5450.545 (+0.134+0.134), while the entire range from 5%5\% to 12%12\% yields only an additional +0.036+0.036. Similar patterns appear on AgentSEQ (+0.153+0.153 versus +0.040+0.040) and AgentCF (+0.203+0.203 versus +0.059+0.059). Even at the smallest budget m=3%m=3\%, VirusCascade already achieves E@20 of 0.1710.171 (AgentCF), 0.3120.312 (AgentSEQ), and 0.4110.411 (AgentRAG) on CDs & Vinyl, all exceeding the strongest baseline at the default m=5%m=5\%. This confirms that VirusCascade’s effectiveness stems from the quality of its semantic and structural design rather than from the sheer volume of fake users, and demonstrates the efficiency of the anchor-guided trajectory routing in propagating injected evidence with a minimal attacker footprint. Second, recommendation quality (H@20 and N@20) decreases gradually as m grows. On AgentCF with CDs & Vinyl, H@20 declines from 0.2600.260 at m=3%m=3\% to 0.2050.205 at m=12%m=12\%, while N@20 drops from 0.0900.090 to 0.0680.068. The degradation is moderate and approximately linear in m, presenting the attacker with a smooth trade-off between promotion strength and recommendation fidelity. At the default m=5%m=5\%, this trade-off is favourable: E@20 has already captured the majority of the achievable gain while recommendation quality remains close to the no-attack baseline. Effect of the trade-off coefficient (α). The coefficient α controls the relative weight of semantic similarity versus behavioural naturalness when routing trajectories through the transition graph. Fig. 5 reports H@20 and E@20 as α varies in 0.1,0.3,0.5,0.7,0.9\0.1,0.3,0.5,0.7,0.9\ on CDs & Vinyl. Across all three victim systems, low values of α lead to substantially lower E@20. On AgentCF, E@20 rises from 0.1920.192 at α=0.1α=0.1 to 0.3750.375 at α=0.7α=0.7, where it stabilises (0.3740.374 at α=0.9α=0.9). This indicates that semantic coherence in trajectory routing plays a more critical role than behavioural naturalness for attack effectiveness: when α is too low, the selected trajectories pass through items that are behaviourally adjacent but semantically distant from the target, weakening the motif alignment that drives reflection admission. The optimal α is system-dependent but consistently favours the upper range. AgentCF saturates around α=0.7α=0.7, while AgentSEQ and AgentRAG continue to improve up to α=0.9α=0.9. These two systems supply richer contextual evidence during inference, whether through historical interactions or retrieved preferences, creating a reflection environment that rewards semantically coherent trajectories even more. On AgentRAG, E@20 increases steadily from 0.3640.364 at α=0.1α=0.1 to 0.5130.513 at α=0.5α=0.5, then stabilises around 0.500.50–0.550.55 before reaching its peak at α=0.9α=0.9. This suggests that once trajectories achieve sufficient semantic alignment with the target, further increases in α yield marginal gains until a threshold is crossed where the retrieval mechanism consistently surfaces motif-aligned evidence. V-F Scalability Analysis (RQ5) We further evaluate VirusCascade beyond the default experimental scale along two dimensions: active-agent population and the number of interaction rounds. For population scaling, we fix the attacker budget at five users while increasing the active population from 100 to 500, reducing the effective malicious-user fraction from 5% to 1%. Although E@20 attenuates with population size, VirusCascade remains above DrunkAgent across all three victim systems. For interaction-round scaling, we extend to 20 rounds without additional adversarial interactions. The promotion effect gradually attenuates but remains measurable, while H@20 shows no progressive degradation. Detailed results are provided in Appendices A-D and A-E. V-G Transferability Analysis (RQ6) TABLE IX: Attack transferability with different auxiliary models ℳauxM_aux. Dataset Victim RS LLaMA-3 GPT-4o Gemini-2.5 H@20 N@20 E@20 H@20 N@20 E@20 H@20 N@20 E@20 CDs & Vinyl AgentCF 0.320 0.107 0.151 0.250 0.083 0.374 0.340 0.119 0.333 AgentSEQ 0.410 0.129 0.160 0.240 0.087 0.465 0.330 0.112 0.283 AgentRAG 0.320 0.096 0.170 0.230 0.105 0.545 0.350 0.115 0.364 Movies & TV AgentCF 0.250 0.102 0.140 0.290 0.134 0.240 0.340 0.161 0.140 AgentSEQ 0.330 0.144 0.150 0.300 0.142 0.300 0.340 0.165 0.210 AgentRAG 0.300 0.148 0.160 0.310 0.150 0.380 0.330 0.175 0.270 A practical attack should remain effective beyond its default configuration without sacrificing recommendation utility or profile stealthiness. We evaluate transferability along two dimensions: varying the auxiliary model ℳauxM_aux used for semantic injection and simplifying the victim from a dual-agent to a user-only architecture. Transferability across auxiliary models (ℳauxM_aux). To evaluate whether this alignment is necessary, we evaluate the attack using three auxiliary models: LLaMA-3, GPT-4o, and Gemini-2.5. In each case, only ℳauxM_aux is changed while all other attack parameters and the victim system remain identical. As shown in Table IX, VirusCascade achieves positive E@20 with all auxiliary models, while H@20 and N@20 remain broadly comparable across the corresponding settings. GPT-4o yields the strongest promotion in most configurations, whereas Gemini-2.5 and LLaMA-3 still provide non-trivial exposure gains, showing that VirusCascade does not rely on model-specific alignment between ℳauxM_aux and the victim backbone. Since ℳauxM_aux also determines the target profiles generated during semantic injection, we further evaluate their stealthiness in Table X. Across all models, the resulting profiles maintain text naturalness, with PPL remaining within the corresponding NoAttack ranges, while also preserving content fidelity under ROUGE. This indicates that cross-model transfer does not require conspicuous profile modifications. TABLE X: Attack imperceptibility with different auxiliary models ℳauxM_aux. NoAttack PPL is reported as [min, max]. Dataset ℳauxM_aux PPL ROUGE NoAttack Ours @1 @2 @L CDs & Vinyl LLaMA-3 [21.64, 107.62] 56.28 0.267 0.103 0.267 GPT-4o [10.31, 90.02] 32.22 0.321 0.109 0.268 Gemini-2.5 [11.78, 113.24] 31.82 0.341 0.125 0.268 Movies & TV LLaMA-3 [13.75, 409.59] 76.20 0.412 0.091 0.206 GPT-4o [12.91, 374.28] 39.35 0.294 0.090 0.157 Gemini-2.5 [13.62, 341.82] 30.76 0.320 0.048 0.180 Transferability to user-only agent architectures. Many practical LLM-ARS adopt a simpler user-only agent design where items are represented by static profiles rather than autonomous agents. In such systems, item-side memory is not updated during reflection, which removes one of the two propagation channels exploited by VirusCascade. To evaluate whether VirusCascade remains effective under this simplified architecture, we re-instantiate all three victim systems as user-only variants and compare VirusCascade with the strongest baselines (TextBugger, TextFooler, DrunkAgent). Due to space limits, we report the detailed results in Appendix A-C. VirusCascade consistently achieves the highest E@K across all user-only configurations while maintaining comparable H@K and N@K. For example, on CDs & Vinyl, VirusCascade obtains E@20 of 0.1520.152 (AgentCF), 0.2830.283 (AgentSEQ), and 0.2020.202 (AgentRAG), outperforming the best baseline in each configuration by 1.5×1.5× to 2.5×2.5×. Although exposure generally decreases relative to the dual-agent setting, the attack remains effective after removing item-side memory updates, showing that its effectiveness does not depend exclusively on item-side memory propagation. Since profile generation depends only on semantic injection through ℳauxM_aux, changing the victim to a user-only architecture leaves the generated profiles unchanged. Its PPL and ROUGE therefore remain identical to the corresponding GPT-4o setting in Table X. VI Background and Related Work VI-A LLM-based Agentic Recommender System Recent advances in large language models (LLMs) are transforming recommender systems (RS) from static prediction pipelines into LLM-based agentic recommender systems (LLM-ARS) [10]. Unlike conventional models that optimise fixed scoring functions over historical interactions, LLM-ARS equip agents with natural-language memory and reflection capabilities [27, 28, 29, 30], enabling them to synthesise contextual knowledge, revise preference states, and adapt decisions across multiple interaction rounds. Early work focuses on single-agent user modelling [27], where an autonomous user agent perceives interaction feedback and dynamically updates its preferences, improving recommendation accuracy over static baselines. This paradigm has since been extended to multi-agent collaborative architectures in which both user and item agents interact, reason, and update their states jointly [9, 28, 29, 30]. AgentCF [9], for example, instantiates users and items as dual LLM agents that collaboratively reflect on interaction outcomes to iteratively refine their memories. ARAG [31] further introduces a multi-agent RAG architecture for E-commerce recommendation, demonstrating the practical value of agentic collaboration in capturing complex user intent. VI-B Attacks on LLM-based Recommender Systems Existing work can be organised along a progression of attack surfaces. The first line targets interaction-level data poisoning in conventional RS [32, 33], injecting fabricated ratings or interactions to bias the training of static scoring models. As LLMs are integrated into RS and decision-making shifts toward natural-language reasoning, a second line explores text-level adversarial perturbations [34, 35, 36, 37], applying imperceptible edits to item descriptions, reviews, or prompt templates to mislead the LLM’s semantic understanding. AgentSA [36], for instance, leverages LLM agents to autonomously craft user profiles and reviews that maximise manipulation impact while maintaining behavioural stealthiness. Despite their effectiveness, both lines assume a static recommendation pipeline, whether fixed training data or single-turn inference, and therefore cannot exploit the recurrent memory dynamics of LLM-ARS. A third line begins to address this gap. DrunkAgent [12] achieves memory corruption by covertly tampering with the external memory of an LLM-ARS agent, continuously misleading its decisions across multi-round reasoning. However, existing attacks focus on isolated memory contamination but overlook a more dangerous threat: system-level amplification risks caused by collaborative reflection and multi-agent reasoning in advanced LLM-ARS. Acknowledgment We thank the anonymous reviewers for their constructive feedback. This research is supported by the Ministry of Education, Singapore, under its Academic Research Fund Tier 2 (Award MOE-T2EP20125-0005). Ethics Considerations This work studies a security vulnerability in LLM-powered agentic recommender systems (LLM-ARS) under controlled conditions. All experiments were conducted in a local, sandboxed simulation using publicly available Amazon review datasets; no real-world platform, production API, or real user was targeted, and all attacker-controlled users were synthetic. No personal data beyond the publicly released anonymised corpus was used. In the human study of Sec. V-C, informed volunteers evaluated public item descriptions offline without interacting with the recommender system. We disclosed our findings to the developers of the affected open-source LLM-ARS frameworks prior to publication. Our goal is to expose an overlooked attack surface in collaborative reflection and support the development of more robust agentic recommender systems and principled countermeasures. References [1] Y. Gong, D. Ran, X. He, T. Cong, A. Wang, and X. Wang (2025) Safety misalignment against large language models. In Proceedings of the 2025 Network and Distributed System Security Symposium (NDSS), Cited by: §I. [2] J. Lin and D. Mohaisen (2025) From large to mammoth: a comparative evaluation of large language models in vulnerability detection.. In Proceedings of the 2025 Network and Distributed System Security Symposium (NDSS), Cited by: §I. [3] M. Mohammadi, Y. Li, J. Lo, and W. Yip (2025) Evaluation and benchmarking of llm agents: a survey. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), p. 6129–6139. Cited by: §I. [4] J. Xu, Z. Chen, S. Yang, J. Li, W. Wang, X. Hu, S. Hoi, and E. Ngai (2026) A survey on multimodal recommender systems: recent advances and future directions. IEEE Transactions on Multimedia. Cited by: §I. [5] Z. Chen, W. Gan, J. Wu, K. Hu, and H. Lin (2025) Data scarcity in recommendation systems: a survey. ACM Transactions on Recommender Systems 3 (3), p. 1–31. Cited by: §I. [6] W. Chen, F. Cai, H. Chen, and M. D. Rijke (2019) Joint neural collaborative filtering for recommender systems. ACM Transactions on Information Systems 37 (4), p. 1–30. Cited by: §I. [7] S. Wang, X. Zhang, Y. Wang, and F. Ricci (2024) Trustworthy recommender systems. ACM Transactions on Intelligent Systems and Technology 15 (4), p. 1–20. Cited by: §I. [8] P. Resnick and H. R. Varian (1997) Recommender systems. Communications of the ACM 40 (3), p. 56–58. Cited by: §I. [9] J. Zhang, Y. Hou, R. Xie, W. Sun, J. McAuley, W. X. Zhao, L. Lin, and J. Wen (2024) Agentcf: collaborative learning with autonomous language agents for recommender systems. In Proceedings of the 2024 ACM Web Conference (W), p. 3679–3689. Cited by: §A-A, §I, §I, §I-A, 1st item, §V-A, §V-A, §VI-A. [10] Y. Shang, P. Liu, Y. Yan, Z. Wu, L. Sheng, Y. Yu, C. Jiang, A. Zhang, F. Xu, Y. Wang, et al. (2025) Agentrecbench: benchmarking llm agent-based personalized recommender systems. Advances in Neural Information Processing Systems (NeurIPS) 38. Cited by: §I, §VI-A. [11] W. Zhang, X. Li, Q. Ge, K. Dong, P. Jia, X. Li, Z. Zhang, M. Wang, Y. Wang, H. Guo, et al. (2026) Exploring recommender system evaluation: a multi-modal llm agent framework for a/b testing. In Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), p. 2878–2889. Cited by: §I. [12] S. Yang, Z. Hu, X. Li, C. Wang, T. Yu, X. Xu, L. Zhu, and L. Yao (2026) Drunkagent: stealthy memory corruption in llm-powered recommender agents. In Proceedings of the 2026 ACM on Web Conference (W), p. 6853–6864. Cited by: §I, §I, 3rd item, §VI-B. [13] Y. Hao, X. Chen, W. Wang, J. Liu, T. Li, J. Wang, and W. Pedrycz (2024) Eyes on federated recommendation: targeted poisoning with competition and its mitigation. IEEE Transactions on Information Forensics and Security 19, p. 10173–10188. Cited by: §I. [14] Y. Hao, X. Chen, X. Lyu, J. Liu, Z. Wan, S. Mauw, and W. Wang (2024) Not one less: exploring interplay between user profiles and items in untargeted attacks against federated recommendation. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS), p. 2889–2903. Cited by: §I. [15] J. Gao, J. Lanchantin, M. L. Soffa, and Y. Qi (2018) Black-box generation of adversarial text sequences to evade deep learning classifiers. In Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), p. 50–56. Cited by: §I, 2nd item. [16] B. Formento, C. Foo, L. A. Tuan, and S. K. Ng (2023) Using punctuation as an adversarial attack on deep learning-based nlp systems: an empirical study. In Findings of the 2023 Association for Computational Linguistics (EACL), p. 1–34. Cited by: §I, 2nd item. [17] D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits (2020) Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the 2020 AAAI conference on artificial intelligence (AAAI), Vol. 34, p. 8018–8025. Cited by: §I, 2nd item. [18] L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu (2020) Bert-attack: adversarial attack against bert using bert. In Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP), p. 6193–6202. Cited by: §I, 2nd item. [19] J. Zhang, Y. Liu, Q. Liu, S. Wu, G. Guo, and L. Wang (2024) Stealthy attack on large language model based recommendation. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), p. 5839–5857. Cited by: §I, 2nd item. [20] R. Liu, T. Tran, T. Wang, H. Hu, S. Wang, and L. Xiong (2026) ExpShield: safeguarding web text from unauthorized crawling and llm exploitation. Proceedings of the 2026 Network and Distributed System Security Symposium (NDSS). Cited by: §I-A. [21] I. Gunes, C. Kaleli, A. Bilge, and H. Polat (2014) Shilling attacks against recommender systems: a comprehensive survey. Artificial Intelligence Review 42, p. 767–799. Cited by: 1st item. [22] S. Zhang, H. Yin, T. Chen, Z. Huang, Q. V. H. Nguyen, and L. Cui (2022) PipAttack: poisoning federated recommender systems for manipulating item promotion. In Proceedings of 15th ACM International Conference on Web Search and Data Mining (WSDM), p. 1415–1423. Cited by: 1st item. [23] F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun (2021) Onion: a simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 conference on empirical methods in natural language processing (EMNLP), p. 9558–9566. Cited by: §A-G, §V-A. [24] B. Hooi, H. A. Song, A. Beutel, N. Shah, K. Shin, and C. Faloutsos (2016) Fraudar: bounding graph fraud in the face of camouflage. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), p. 895–904. Cited by: §A-G, §V-A. [25] H. Zhou, K. Lee, Z. Zhan, Y. Chen, Z. Li, Z. Wang, H. Haddadi, and E. Yilmaz (2025) Trustrag: enhancing robustness and trustworthiness in retrieval-augmented generation. arXiv preprint arXiv:2501.00879. Cited by: §A-G, §V-A. [26] Q. Wei, T. Yang, Y. Wang, X. Li, L. Li, Z. Yin, Y. Zhan, T. Holz, Z. Lin, and X. Wang (2026) A-memguard: a proactive defense framework for llm-based agent memory. In Proceedings of the 43rd International Conference on Machine Learning (ICML), Cited by: §A-G, §V-A. [27] Y. Yu, Z. Wang, C. Jiang, X. Li, J. Wang, and M. Zhang (2025) Intelligent agents with adaptive knowledge fusion for personalized recommendation. In Proceedings of the 2025 ACM on Web Conference (W), p. 2983–2987. Cited by: §VI-A. [28] Z. Wang, Y. Yu, W. Zheng, W. Ma, and M. Zhang (2024) Macrec: a multi-agent collaboration framework for recommendation. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), p. 2760–2764. Cited by: §VI-A. [29] G. Zhang, K. Zhao, J. Friedman, and X. Chu (2026) LLMs as orchestrators: constraint-compliant multi-agent optimization for recommendation systems. arXiv preprint arXiv:2601.19121. Cited by: §VI-A. [30] J. Liu, S. Gu, D. Li, G. Zhang, M. Han, H. Gu, P. Zhang, T. Lu, L. Shang, and N. Gu (2025) AgentCF++: memory-enhanced llm-based agents for popularity-aware cross-domain recommendations. In Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), p. 2566–2571. Cited by: §VI-A. [31] R. Y. Maragheh, P. Vadla, P. Gupta, K. Zhao, A. Inan, K. Yao, J. Xu, P. Kanumala, J. Cho, and S. Kumar (2025) Arag: agentic retrieval augmented generation for personalized recommendation. arXiv preprint arXiv:2506.21931. Cited by: §VI-A. [32] Z. Wang, J. Yu, M. Gao, H. Yin, B. Cui, and S. Sadiq (2024) Unveiling vulnerabilities of contrastive recommender systems to poisoning attacks. In Proceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining (KDD), p. 3311–3322. Cited by: §VI-B. [33] F. Nazary, Y. Deldjoo, T. Di Noia, and E. Di Sciascio (2025) Stealthy llm-driven data poisoning attacks against embedding-based retrieval-augmented recommender systems. In Proceedings of the 33rd ACM Conference on User Modeling, Adaptation and Personalization, p. 98–102. Cited by: §VI-B. [34] L. Ning, S. Wang, W. Fan, Q. Li, X. Xu, H. Chen, and F. Huang (2024) Cheatagent: attacking llm-empowered recommender systems via llm agent. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), p. 2284–2295. Cited by: §VI-B. [35] Y. Zhao, J. Huang, S. Liu, J. Wu, X. Wang, and M. de Rijke (2025) LANCE: exploration and reflection for llm-based textual attacks on news recommender systems. In Proceedings of the 19th ACM Conference on Recommender Systems (RecSys), p. 197–206. Cited by: §VI-B. [36] S. Gu, J. Liu, D. Li, G. Zhang, M. Han, H. Gu, P. Zhang, N. Gu, L. Shang, and T. Lu (2026) LLM agent-based shilling attack on recommender systems. In Proceedings of the 19th ACM International Conference on Web Search and Data Mining (WSDM), p. 163–173. Cited by: §VI-B. [37] G. Guan, Y. Hao, J. Zhang, T. Wu, F. Zhang, T. Chen, L. Huang, C. Leung, and W. Y. B. Lim (2026) VENOMREC: cross-modal interactive poisoning for targeted promotion in multimodal llm recommender systems. In Proceedings of the 53rd International Conference on Machine Learning (ICML), Cited by: §VI-B. Appendix A Appendix A-A More Setup for Vulnerability Analysis This section provides the full experimental protocol for the two vulnerability probes presented in Sec.I. The probes are designed to explore two structural properties of collaborative reflection, namely reflective persistence (Sec.I-A) and cross-agent propagation (Sec.I-B). Both probes are conducted on AgentCF [9] with the CDs & Vinyl dataset under the leave-one-out sequential (LS) evaluation protocol. The dataset contains 100 benign users and their associated items. Hypothesis 1: Reflective Persistence. We construct a single synthetic probe user and append it to a temporary copy of the CDs & Vinyl training split. The probe user’s initial memory profile is seeded with four rare probe phrases whose natural occurrence rate in the corpus is below 5%: “complete after midnight session”, “emotionally charged”, “unforgettable performances” and “genuine musical experiences.” Its interaction history is set to [i26,i117,i945,i121,i125][i_26,\,i_117,\,i_945,\,i_121,\,i_125], where i945i_945 (“Complete After Midnight Session”) is positioned so that it falls within the training split under LS evaluation. AgentCF is run for 5 interaction-reflection rounds. The probe user participates only in round 1 and is removed before round 2, leaving 4 purely benign rounds in which the system evolves without any probe input. A parallel no-probe control arm runs the same configuration on the original (unmodified) training split, ensuring that all 100 real users receive identical benign traffic across both runs. Memory snapshots of all agents (100 real users plus items) are saved after each round. For each real user, we record the following quantities. Admission is determined by checking whether the user’s short-term memory MusM_u^s contains at least one of the four rare probe phrases. Since AgentCF’s reflection operator rewrites MusM_u^s at each round rather than appending to it, the presence of a marker phrase indicates that reflection actively regenerated it. The admission round is the earliest round at which this criterion is first satisfied. Subsequent measurements are aligned by lag, where lag k denotes the k-th round after the user’s individual admission round. The reuse rate at lag k is the fraction of admitted users (whose admission round is early enough to be observed at lag k) whose short-term memory still contains at least one marker phrase. The elaboration rate at lag k is the fraction of such users whose reflection trace preserves the probe claim and adds a new rationale, implication, or preference explanation beyond verbatim repetition or paraphrase, as judged by GPT-4o-mini with a binary classification prompt. The baseline regeneration rate is the frequency at which the same rare phrases appear in the no-probe control arm, providing the reference for all comparisons reported in Table I. Hypothesis 2: Cross-Agent Propagation. We reuse the same synthetic probe user and AgentCF configuration described above. While Hypothesis 1 tracks the fate of the probe claim within admitted users, Hypothesis 2 shifts focus to the non-injected benign users and asks whether a single local memory update can produce measurable downstream effects. After the 5 interaction-reflection rounds, we construct the user–item bipartite interaction graph from the training split and compute the shortest-path hop distance from the probe user u0u_0 to every benign user. Two users are connected through a path u0-i-u_0-i-u if both have interacted with the same item i. Hop-1 denotes users sharing at least one item with u0u_0. Hop-2 denotes users reachable through exactly one intermediate user. Hop>>2 groups all remaining users. For each non-injected user, we measure two quantities: recommendation drift and claim adoption, both reported as excess over the no-probe control arm. Common-frequency markers. As shown in Table XI, common-frequency markers exhibit a persistence pattern consistent with that observed for rare markers. Despite a higher no-probe regeneration rate (15.0% vs. 2.0%), their reuse rates remain between 68.7% and 76.4% across subsequent rounds, substantially above the corresponding benign baseline. TABLE XI: Reflective persistence under rare and common-frequency diagnostic markers. Lag columns report reuse rate. Marker No-Probe Regen. Lag-1 Lag-2 Lag-3 Lag-4 Rare 2.0% 78.0% 81.7% 79.3% 81.6% Common 15.0% 72.0% 73.4% 68.7% 76.4% Elaboration judgement. Each admitted user’s reflection trace at a given lag is submitted to GPT-4o-mini at temperature 0 with the binary prompt below, which supplies the four marker phrases, the trace, and the three conditions defined in Sec. I-A, and requests a single label with no explanation. Elaboration Prompt You are annotating memory traces from a recommender agent. A probe claim was previously seeded into some agents’ memories. The claim is expressed through these marker phrases: marker_phrases. Below is one agent’s reflection trace from a later round: reflection_trace. Output 1 only if all hold: • the claim is preserved, not contradicted or dropped; • the trace adds a rationale, implication, or preference explanation not stated by the marker phrases; • the addition is not repetition or paraphrase. If any condition fails, label 0. Output one character (1 or 0) only. A-B More Setup for Experimental Evaluation A-B1 Baseline Details We compare VirusCascade with 10 baselines covering interaction-level poisoning, text-level adversarial perturbation, and memory-targeted manipulation. All baselines are adapted to the same black-box targeted promotion setting and follow the same attack budget. For interaction-based methods, the number of attacker-controlled users is fixed to be the same as VirusCascade. For text-based methods, only the target item description is editable. No baseline is allowed to manipulate reviews, comments, reflection prompts, model parameters, or memory states. Interaction-level poisoning. These baselines inject fake users with fabricated interaction sequences: (1) RandAttack randomly samples items and appends the target item i∗i^* to the interaction sequence; (2) PopAttack samples items from popular items instead of random items; (3) ExpPromot selects items under a targeted exposure objective and then injects target interactions. Text-level adversarial attacks. We include 6 representative attacks that modify the target description at different linguistic granularities: (1) TextFooler replaces salient words with neighbour substitutions under part-of-speech and semantic-similarity constraints; (2) TextBugger applies mixed character- and word-level perturbations, including insertion, deletion, swapping, and substitution; (3) DeepWdBug performs character-level perturbations on influential tokens; (4) BertAttack uses a masked language model to generate context-aware word substitutions; (5)PuncAttack perturbs punctuation marks while preserving lexical content; (6) TrivInsert appends short preference-inducing or target-promoting phrases to the target description. Memory-targeted agentic attack. DrunkAgent is a black-box attack for LLM-RecSys. It crafts adversarial textual triggers to corrupt agent memory. We adapt it by placing the generated trigger in the editable description field of the target item. This baseline is closest to our setting because it explicitly attacks the memory mechanism. A-B2 Implementation Details For each dataset, we randomly sample target items from the long-tail item set. This setting is more challenging than promoting already popular items, because long-tail targets have limited historical exposure and weaker prior evidence in the recommender. Unless otherwise specified, the attacker controls only a small fraction of users, with attack budget m=5%m=5\% of benign users, and each attacker-controlled user executes at most Lmax=6L_ =6 interactions. VirusCascade selects anchor items using public popularity signals. In our implementation, we select the top 10 high-visibility items in the training split as anchor items, which simulate publicly observable best-seller lists, category rankings, and platform-level popularity indicators. For each dataset, we follow the standard preprocessing protocol in recommendation tasks by retaining user–item interactions and item-side textual descriptions. In addition, we set r=6r=6 by default. A-B3 Prompts used in VirusCascade We also provide the prompts used for semantic injection for reference. Motif Extraction Prompt You are a domain_label product analysis assistant. Based on the descriptions of the top-top_k most popular items provided to you, extract the core purchase drivers (e.g., pain points, usage scenarios, psychological expectations). Condense them into a highly summarised text description, no more than 50 words. The descriptions of the top-top_k items are: hub_descriptions Base Prompt As a product reviewer on domain_label, based on the original information initial_target_profile, please write a review within 50 words for target_item_title. Motif-Aware Prompt As a product reviewer on domain_label, based on the original information initial_target_profile and the reasons motif_text why similar products are popular, please write a review within 50 words for target_item_title. Refine Prompt This is the final profile description: final_profile. Rewrite it into three different lightly edited versions that preserve the original writing style and core logic while using vocabulary more appropriate for domain_label. Output requirements: – Only directly output three lines without any other information and symbols. – Each version should be semantically coherent, natural, and no longer than 50 words. – Each line must contain one rewritten version only. A-C Transferability to User-only Agent Architectures. Table XII reports the complete results under the user-only variants of AgentCF, AgentSEQ, and AgentRAG. Across both datasets, VirusCascade consistently achieves the highest E@K among the evaluated attacks while H@K and N@K remain broadly comparable to the corresponding NoAttack settings. On Movies & TV, VirusCascade achieves E@20 of 0.2200.220, 0.2600.260, and 0.3900.390 on AgentCF, AgentSEQ, and AgentRAG, respectively, complementing the CDs & Vinyl results discussed in Sec. V-G. Compared with the dual-agent setting, the reduction in exposure is more pronounced on CDs & Vinyl, whereas the results on Movies & TV remain largely comparable, with AgentRAG even showing a slightly higher E@20. These results further indicate that removing item-side memory updates weakens one propagation pathway but does not eliminate the attack effect, supporting the transferability of VirusCascade to user-only agent architectures. TABLE XII: Attack transferability under user-only agent architectures (no item-side memory updates). Victim RS AgentCF (user-only) Attack CDs & Vinyl Movies & TV H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.170 0.074 (-) 0.350 0.119 (-) 0.190 0.124 (-) 0.320 0.157 (-) TextBugger 0.120 0.057 0.010 0.370 0.119 0.061 0.220 0.133 0.020 0.320 0.158 0.130 TextFooler 0.150 0.063 0.040 0.340 0.111 0.051 0.210 0.115 0.010 0.330 0.145 0.110 DrunkAgent 0.140 0.069 0.000 0.270 0.102 0.030 0.220 0.129 0.020 0.340 0.160 0.100 VirusCascade 0.180 0.072 0.061 0.370 0.118 0.152 0.220 0.130 0.030 0.370 0.168 0.220 Victim RS AgentSEQ (user-only) Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.210 0.086 (-) 0.360 0.122 (-) 0.210 0.137 (-) 0.380 0.179 (-) TextBugger 0.190 0.104 0.030 0.410 0.158 0.141 0.160 0.105 0.050 0.370 0.158 0.190 TextFooler 0.180 0.097 0.020 0.370 0.145 0.101 0.240 0.129 0.060 0.380 0.164 0.210 DrunkAgent 0.140 0.080 0.010 0.340 0.130 0.051 0.230 0.131 0.020 0.360 0.164 0.110 VirusCascade 0.190 0.084 0.121 0.350 0.155 0.283 0.230 0.130 0.030 0.370 0.166 0.260 Victim RS AgentRAG (user-only) Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.150 0.076 (-) 0.380 0.134 (-) 0.210 0.151 (-) 0.380 0.193 (-) TextBugger 0.140 0.067 0.040 0.350 0.120 0.101 0.210 0.133 0.060 0.310 0.158 0.310 DrunkAgent 0.140 0.083 0.010 0.340 0.133 0.040 0.230 0.138 0.040 0.330 0.163 0.240 TextFooler 0.200 0.098 0.010 0.360 0.138 0.040 0.240 0.145 0.070 0.390 0.181 0.290 VirusCascade 0.150 0.078 0.091 0.340 0.116 0.202 0.200 0.140 0.090 0.400 0.191 0.390 TABLE XIII: Attack performance on Automotive and Musical Instruments. H@K and N@K measure recommendation utility, while E@K measures targeted promotion effectiveness. Victim RS AgentCF Attack Automotive Musical Instruments H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.150 0.075 (-) 0.230 0.094 (-) 0.110 0.042 (-) 0.280 0.085 (-) RandAttack 0.080 0.043 0.000 0.180 0.068 0.170 0.060 0.023 0.010 0.160 0.049 0.141 PopAttack 0.070 0.038 0.050 0.230 0.078 0.170 0.090 0.043 0.030 0.220 0.075 0.091 ExpPromot 0.100 0.043 0.030 0.230 0.076 0.180 0.030 0.011 0.051 0.150 0.040 0.152 DeepWdBug 0.110 0.044 0.000 0.210 0.068 0.160 0.090 0.037 0.020 0.210 0.066 0.182 PuncAttack 0.120 0.051 0.000 0.230 0.078 0.150 0.060 0.032 0.051 0.160 0.057 0.182 TextFooler 0.060 0.031 0.000 0.160 0.057 0.140 0.040 0.026 0.030 0.200 0.066 0.172 BertAttack 0.110 0.065 0.000 0.210 0.089 0.160 0.060 0.035 0.030 0.200 0.069 0.091 TrivInsert 0.060 0.035 0.000 0.190 0.066 0.170 0.070 0.039 0.040 0.180 0.067 0.162 TextBugger 0.080 0.069 0.000 0.210 0.101 0.120 0.080 0.041 0.141 0.220 0.076 0.404 DrunkAgent 0.110 0.060 0.000 0.220 0.087 0.040 0.080 0.037 0.263 0.170 0.059 0.586 VirusCascade 0.130 0.062 0.090 0.210 0.083 0.270 0.090 0.038 0.505 0.260 0.073 0.758 Victim RS AgentSEQ Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.160 0.085 (-) 0.220 0.099 (-) 0.130 0.067 (-) 0.240 0.096 (-) RandAttack 0.090 0.055 0.000 0.210 0.085 0.370 0.100 0.039 0.000 0.230 0.071 0.283 PopAttack 0.080 0.050 0.080 0.130 0.063 0.480 0.060 0.029 0.020 0.200 0.064 0.192 ExpPromot 0.110 0.053 0.010 0.250 0.088 0.340 0.030 0.011 0.030 0.140 0.038 0.192 DeepWdBug 0.070 0.032 0.010 0.200 0.063 0.310 0.110 0.074 0.030 0.210 0.099 0.232 PuncAttack 0.100 0.065 0.000 0.270 0.108 0.370 0.110 0.044 0.030 0.230 0.074 0.283 TextFooler 0.130 0.054 0.000 0.200 0.071 0.360 0.030 0.017 0.020 0.180 0.053 0.242 BertAttack 0.090 0.050 0.000 0.200 0.077 0.420 0.090 0.051 0.010 0.210 0.080 0.131 TrivInsert 0.070 0.030 0.000 0.180 0.058 0.330 0.070 0.043 0.010 0.190 0.072 0.222 TextBugger 0.120 0.093 0.010 0.180 0.108 0.390 0.100 0.047 0.182 0.220 0.078 0.414 DrunkAgent 0.080 0.042 0.000 0.190 0.070 0.090 0.070 0.032 0.202 0.240 0.074 0.566 VirusCascade 0.110 0.057 0.190 0.210 0.072 0.550 0.100 0.051 0.576 0.210 0.087 0.869 Victim RS AgentRAG Attack H@10 N@10 E@10 H@20 N@20 E@20 H@10 N@10 E@10 H@20 N@20 E@20 NoAttack 0.160 0.072 (-) 0.280 0.101 (-) 0.100 0.043 (-) 0.260 0.083 (-) RandAttack 0.110 0.056 0.010 0.250 0.090 0.270 0.090 0.038 0.030 0.250 0.078 0.263 PopAttack 0.040 0.014 0.070 0.160 0.044 0.210 0.100 0.047 0.030 0.250 0.083 0.172 ExpPromot 0.120 0.073 0.040 0.270 0.111 0.240 0.060 0.040 0.071 0.180 0.069 0.273 DeepWdBug 0.100 0.052 0.020 0.250 0.089 0.230 0.090 0.057 0.040 0.240 0.093 0.253 PuncAttack 0.110 0.048 0.020 0.240 0.079 0.230 0.120 0.055 0.040 0.250 0.087 0.283 TextFooler 0.130 0.045 0.010 0.230 0.070 0.160 0.070 0.032 0.030 0.280 0.083 0.273 BertAttack 0.140 0.081 0.020 0.250 0.108 0.300 0.070 0.032 0.030 0.220 0.069 0.242 TrivInsert 0.110 0.043 0.000 0.250 0.078 0.190 0.070 0.037 0.040 0.170 0.061 0.263 TextBugger 0.140 0.081 0.020 0.280 0.116 0.140 0.110 0.061 0.131 0.200 0.084 0.444 DrunkAgent 0.100 0.041 0.000 0.220 0.071 0.070 0.090 0.049 0.232 0.240 0.086 0.556 VirusCascade 0.130 0.065 0.130 0.250 0.092 0.350 0.090 0.050 0.535 0.280 0.098 0.788 Fig. 6: Population-scale evaluation on CDs & Vinyl under a fixed attacker budget of five users. Bars report VirusCascade as the active population increases from 100 to 500 users. Star markers denote DrunkAgent under the corresponding population setting. A-D Population-Scale Evaluation. Figure 6 provides the population-scale results corresponding to the scalability analysis in Section V-F. We fix the number of attacker-controlled users at five while increasing the active population from 100 to 500 users, reducing the effective malicious-user fraction from 5% to 1%. This fixed-budget setting further reinforces the malicious-budget finding in Section V-E. Although the targeted exposure of VirusCascade attenuates as the population grows, it consistently remains above DrunkAgent across AgentCF, AgentSEQ, and AgentRAG. At 500 users, VirusCascade achieves an average E@20 of 0.124 compared with 0.059 for DrunkAgent, retaining a 2.11× advantage, while H@20 and N@20 remain broadly comparable between the two methods. Overall, these results demonstrate that VirusCascade maintains a clear promotion advantage as the active population scales, even with a fixed attacker budget. A-E Long-Interaction Evaluation. Figure 7 evaluates whether the attack effect persists beyond the short interaction horizon used in the original experiments. The attacker trajectories are completed in the initial phase, after which no additional adversarial interactions are introduced. VirusCascade’s E@20 decreases from its initial level as benign interactions accumulate, but remains measurable throughout the extended horizon and generally above DrunkAgent. Meanwhile, H@20 remains broadly comparable to NoAttack and shows no progressive degradation over time. These results show that the promotion effect remains observable beyond the initial interaction rounds and persists after active adversarial interaction has ended. Fig. 7: Attack performance over an extended 20-round interaction on AgentCF with CDs & Vinyl. Top: recommendation utility (H@20); bottom: targeted exposure (E@20). A-F Attack Performance on Automotive and Musical Instruments Datasets. Table XIII complements Table IV in Sec. V and reports the attack effectiveness on Automotive and Musical Instruments when AgentCF, AgentSEQ, and AgentRAG are used as victim systems. The results reaffirm the main findings in Table IV: VirusCascade consistently achieves the highest target exposure across all victim systems and both additional datasets. On Automotive, VirusCascade obtains E@20 values of 0.2700.270, 0.5500.550, and 0.3500.350 on AgentCF, AgentSEQ, and AgentRAG, respectively, outperforming the strongest adapted baseline in each setting. The advantage becomes more pronounced on Musical Instruments, substantially exceeding the best competing results. The additional results on Automotive and Musical Instruments further support that VirusCascade’s advantage generalises across categories with different interaction densities and item semantics. A-G Robustness of VirusCascade against Defence Table XIV evaluates the robustness of VirusCascade against four representative defence mechanisms spanning different intervention levels: text-level ONION [23], behaviour-level Fraudar [24], and memory-level TrustRAG [25] and A-MemGuard [26]. The evaluated defences exhibit different mitigation effectiveness, with TrustRAG providing the strongest suppression of VirusCascade. Averaged across the three victim architectures, TrustRAG reduces E@20 to 0.138, compared with 0.220 under ONION, 0.320 under Fraudar, and 0.225 under A-MemGuard. Despite these reductions, VirusCascade retains non-trivial exposure under all evaluated defences and consistently outperforms DrunkAgent, while H@20 and N@20 remain comparable to the corresponding NoAttack settings. The pronounced reduction achieved by TrustRAG further highlights memory admission and use as a promising intervention point for mitigating reflection-driven attacks. TABLE XIV: Attack performance under text- (T), behaviour- (B), and memory-level (M) defences on the CDs & Vinyl dataset. Comparisons are made within each defence block, as defences alter the inference pipeline. Defence Attack AgentCF AgentSEQ AgentRAG H@20 N@20 E@20 H@20 N@20 E@20 H@20 N@20 E@20 ONION (T) NoAttack 0.410 0.141 (-) 0.410 0.161 (-) 0.410 0.168 (-) DrunkAgent 0.310 0.107 0.030 0.380 0.135 0.030 0.400 0.131 0.040 VirusCascade 0.340 0.128 0.256 0.370 0.130 0.202 0.350 0.140 0.202 Fraudar (B) NoAttack 0.270 0.088 (-) 0.380 0.124 (-) 0.340 0.114 (-) DrunkAgent 0.290 0.109 0.061 0.390 0.145 0.081 0.380 0.138 0.061 VirusCascade 0.280 0.101 0.303 0.410 0.172 0.424 0.360 0.128 0.232 TrustRAG (M) NoAttack 0.320 0.102 (-) 0.420 0.154 (-) 0.400 0.131 (-) DrunkAgent 0.350 0.115 0.071 0.410 0.145 0.051 0.390 0.132 0.071 VirusCascade 0.300 0.116 0.151 0.370 0.141 0.152 0.400 0.148 0.111 A-MemGuard (M) NoAttack 0.380 0.126 (-) 0.450 0.159 (-) 0.450 0.159 (-) DrunkAgent 0.390 0.128 0.010 0.420 0.154 0.030 0.460 0.154 0.040 VirusCascade 0.400 0.133 0.202 0.420 0.136 0.242 0.500 0.162 0.232

Instant research discovery