Automated adversarial red-teaming for evaluating robustness in LLM-based recommender systems

Area of Science:

• Artificial Intelligence
• Recommender Systems
• Cybersecurity

Background:

• Current robustness testing for large language model based recommender systems (LLM4Rec) uses limited, static attack prompts.
• This narrow approach underestimates the true attack surface and overestimates system security.

Purpose of the Study:

• To introduce an automated red teaming framework for comprehensive LLM4Rec robustness testing.
• To evaluate the effectiveness of an adaptive defense mechanism against adversarial attacks.

Main Methods:

• Developed an adaptive red teaming framework with an attacker model generating diverse adversarial prompts across sixteen categories.
• Utilized a judge to score attacks using ranking distortion metrics and fed successful attacks back for iterative defense hardening.
• Tested the framework on RoLLMRec across MovieLens, Amazon Books, and Yelp datasets.

Main Results:

• The automated framework exposed high attack success rates (42.4%-52.0%), significantly exceeding static baselines.
• Iterative hardening reduced LLM4Rec vulnerability by 56.4%-74.3% while maintaining low false positive rates (≤0.6%).
• Module ablations confirmed a super-additive defense effect, with the prompt shield being the most impactful component.

Conclusions:

• Automated, adaptive red teaming is crucial for uncovering LLM4Rec vulnerabilities missed by static testing.
• The proposed defense framework effectively hardens LLM4Rec against adversarial attacks.
• The publicly available attack corpus facilitates reproducible adversarial benchmarking for LLM4Rec.