LLM推荐系统受排序顺序影响，攻击者可仅调换顺序就让目标项进入前k名。
Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders
- 通过调整候选项顺序发动攻击，不改内容或模型参数
- 在3个数据集上，50次重排下最多57%的非目标项被推入前5
- 位置敏感性是可预测的安全漏洞，适合关注推荐系统安全的研究者
将大语言模型用作列表式重排序器的推荐系统存在位置偏差，因候选集序列化成提示词引发。我们发现这种顺序敏感性构成可被利用的攻击面：攻击者仅通过重排候选项，无需修改内容、标签或模型参数，即可将标签为0的目标项提升至前-k排名。我们引入$ ext{promo}@k$量化此漏洞，衡量通过排列能使多少标签0的目标进入前-k。在MovieLens、Amazon Books和Amazon Fashion三个领域评估中，当攻击预算$R=50$时，$ ext{promo}@5$最高达0.57。此外，普通排列稳定性可预测脆弱性，无需实际攻击。双向T5编码器评分器可降低暴露程度，而排列一致性正则化与架构不变性能有效缓解问题。点式打分避免偏差但损害排序质量。结果表明，列表式LLM重排序中的候选顺序是关键安全向量。代码与数据见https://github.com/geoz-lab/position_bias_attack。
原文摘要 · Abstract (English)
Large language models (LLMs) used as listwise rerankers in recommendation systems suffer from position bias when serializing candidate sets into prompts. We show this order sensitivity creates an exploitable attack surface: an attacker can promote a label-0 target into the top-$k$ solely by reordering candidates, without changing item content, labels, or model parameters. We introduce $\mathrm{promo}@k$ to quantify this vulnerability, measuring the fraction of label-0 targets that can be elevated into top-$k$ rankings via permutation. Evaluating across three domains (MovieLens, Amazon Books, and Amazon Fashion), $\mathrm{promo}@5$ reaches up to 0.57 at an attack budget of $R$ = 50 orderings. Furthermore, ordinary permutation stability predicts vulnerability without running the attack. While a bidirectional T5 encoder scorer reduces exposure, permutation-consistency regularization and architectural invariance effectively mitigate it. Pointwise scoring avoids the bias issue but degrades ranking quality. These results demonstrate that input candidate order in listwise LLM reranking is a security-relevant attack vector. Code and data are available at https://github.com/geoz-lab/position_bias_attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。