RESEARCH · RESEARCH · #2009
AlignPoison paper: decoding-aligned prefixes enable targeted poisoning of generative recommenders
arXiv:2610.14487v1 (AlignPoison) studies conditional targeted poisoning of autoregressive generative recommendation models under a realistic black-box threat model. The authors show that injecting under 1% synthetic interactions can substantially increase promotion of malicious targets, identify short context-aligned prefixes that amplify attacks, and present AlignPoison, a black-box method that discovers such prefixes and yields up to a 16.3 percentage-point ASR lift on unimodal and multimodal benchmarks.
KEY POINTS
- arXiv:2610.14487v1 (AlignPoison) studies conditional targeted poisoning of autoregressive generative recommendation models under a realistic black-box threat model.
- The authors show that injecting under 1% synthetic interactions can substantially increase promotion of malicious targets, identify short context-aligned prefixes that amplify attacks, and present AlignPoison, a black-box method that discovers such prefixes and yields up to a 16.3 percentage-point ASR lift on unimodal and multimodal benchmarks.
- This matters because it reveals a practical, decoding-dependent poisoning vulnerability in deployed generative recommenders that can be exploited via small amounts of injected data through public APIs.
WHY IT MATTERS
This matters because it reveals a practical, decoding-dependent poisoning vulnerability in deployed generative recommenders that can be exploited via small amounts of injected data through public APIs.