A reading list centred around building, breaking and auditing trustworthy multi-agent recommendation and retrieval systems.
See the codeREADME
Amplified and Emergent Safety Risks in Multi-Agent Recommendation and Retrieval
A living, auto-updated reading list. Taxonomy follows our TMLR survey and the CIKM '26 tutorial. Risks are organised by origin (D3: amplified vs. emergent) rather than by attack name. Updated weekly by automated crawler.
Last updated: 2026-09-01
Table of Contents
- Taxonomy Overview
- 1. Foundational MA-RS Papers
- Amplified Risks
- Emergent Risks
- 8. Evaluation and Benchmarking
- 9. Mitigations
- 10. Broad Safety Surveys (Background)
- 11. Uncategorised / New Additions
- How to Contribute / Crawler Notes
Taxonomy Overview
The six dimensions
Every entry is positioned against the survey's six-dimension framework; the sections below are grouped by D3.
| Dimension | Values | |
|---|---|---|
| D1 | Architecture era | non-LLM recsys · single-agent LLM recsys · multi-agent LLM recsys |
| D2 | Composition pattern | hierarchical · pipeline · ensemble · peer (tool use cuts across all four) |
| D3 | Risk origin | amplified by composition · emergent under composition |
| D4 | Failure driver | drift · misalignment · compromise |
| D5 | Attack surface | memory · tool use · inter-agent comms · orchestration · item side · user side |
| D6 | Contribution type | empirical attack · evaluation method · defence · position paper |
Systems are additionally placed on the Level of Autonomy ladder (L0 passive → L1 conversational → L2 retrieval-augmented → L3 tool-driven → L4 single-agent planner → L5 multi-agent orchestration, with L6 a conceptual endpoint). This reading list is about L5.
Risk origin (D3)
Risks are classified by the single-agent isolation test: an agent retains its full tool and memory interface, but no other agents consume or produce its messages.
- Amplified (A): risk exists in single-agent settings but worsens under composition.
- Emergent (E): risk only arises through agent interaction.
Threat tiers determine evaluation scope:
| Tier | Description | Evaluation scope |
|---|---|---|
| Drift | System dynamics cause degradation without adversary | Component |
| Misalignment | Internal agent exploits its position | Interaction |
| Compromise | External attacker corrupts one or more agents | Composition |
Tag legend
Each entry carries pills for its risk origin, evaluation scope, and failure driver, followed by free-form topic chips.
risk origin (D3)
evaluation scope
failure driver (D4)
topic
Badges are local SVG assets in
assets/badges/, regenerated bypython3 assets/make_badges.py. Colours follow the survey's Figure 1 palette; every pill meets WCAG AA contrast.
Evaluation Framework
Evaluation is organised by scope and setting:
| Scope | Offline | Online |
|---|---|---|
| Component | Per-agent constraint checks, recommender metrics, adversarial prompting | Behavioural drift detection |
| Interaction | Red-teaming of agent pairs, protocol checks, counterfactual analysis | Inter-agent message trace monitoring |
| Composition | End-to-end stress tests, fairness audits, collusion audits | System-level KPIs, incident reconstruction |
1. Foundational MA-RS Papers
Papers defining multi-agent recommender architectures — the systems whose risks we study. Survey §3 (composition patterns D2, attack surfaces D5).
| Paper | Venue | arXiv | Code | Tags |
|---|---|---|---|---|
| AgentCF: Collaborative Learning with Autonomous Language Agents for Recommender Systems — Zhang et al. | WWW 2024 | 2310.09233 | — |  |
| MACRec: A Multi-Agent Collaboration Framework for Recommendation — Wang et al. | arXiv 2024 | 2402.15235 | — |  |
| Orchestrating Users and Items for Agentic Recommendations (MACF) — Wu et al. | arXiv 2025 | 2511.18413 | — |  |
| Towards Agentic Recommender Systems in the Era of Multimodal LLMs — Li et al. | arXiv 2025 | 2503.16734 | — |  |
| A Survey on LLM-powered Agents for Recommender Systems — Anonymous | arXiv 2025 | 2502.10050 | — |  |
| Definitions, Perspectives, and Open Challenges of Multi-Agent Recommender Systems — Yousefi et al. | arXiv 2025 | 2507.02097 | — | |
| No-Human in the Loop: Agentic Evaluation at Scale for Recommendation — Zhang et al. | NeurIPS WS 2025 | 2511.03051 | — |  |
Amplified Risks
2. Integrity Attacks
Poisoning, backdoors, and prompt injection: failures with a clear single-agent baseline whose reach, persistence, or severity grows under composition. Survey §4.2.1. D3: amplified · D5: item side, memory, tool use.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Securing AI Agents Against Prompt Injection Attacks — Zhuang et al. | arXiv 2025 | 2511.15759 | — | |
| Multi-Agent Systems Execute Arbitrary Malicious Code — Debenedetti et al. | arXiv 2025 | 2503.12188 | — |  |
| Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems — Debenedetti et al. | arXiv 2025 | 2510.17276 | — |  |
| Jailbreaking LLMs via Iterative Tool-Disguised Attacks via RL — Chen et al. | arXiv 2026 | 2601.05466 | — |   |
| INJECAGENT: Benchmarking Indirect Prompt Injections in LLM Agents — Zhan et al. | ACL Findings 2024 | 2403.02691 | GitHub |  |
| A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities — Pasquini et al. | arXiv 2025 | 2505.04806 | — | |
| A Real-World Case Study of Attacking ChatGPT via Lightweight Prompt Injection — Yu et al. | arXiv 2025 | 2504.16125 | — |  |
| Demystifying Prompt Injection Attacks on Agentic AI Coding Editors — Anonymous | arXiv 2025 | 2509.22040 | — | |
| Exploit Tool Invocation Prompt for Tool Behavior Hijacking — Anonymous | arXiv 2025 | 2509.05755 | — | |
| BadRec: Exploring Backdoor Attack and Defense for LLM-empowered Recommendations — Ning et al. | arXiv 2025 | 2504.11182 | — |   |
| LoRec: Large Language Model for Robust Sequential Recommendation against Poisoning Attacks — Wang et al. | SIGIR 2024 | 2401.17723 | — |  |
| Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures — Nguyen et al. | arXiv 2024 | 2404.14942 | — | |
| A Survey on Adversarial Recommender Systems — Deldjoo et al. | ACM CSUR 2021 | 2005.10322 | DOI | |
| Shilling Recommender Systems by Generating Side-feature-aware Fake User Profiles — Anonymous | arXiv 2025 | 2509.17918 | — |  |
| LLM-Powered Audits Expose Shilling Attacks in Recommender Systems — Anonymous | arXiv 2025 | 2509.24961 | — | |
| DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents — Yang et al. | arXiv 2025 | 2503.23804 | — |  |
| Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases — Anonymous | arXiv 2024 | 2407.12784 | — |  |
| Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications — Anonymous | arXiv 2024 | 2404.17196 | — |  |
| **Improving the Shortest Plank: Vulnerability-Aware Adversarial Training | ||||
| for Robust Recommender System** — Kaike Zhang, Qi Cao, Yunfan Wu et al. | arXiv 2024 | 2409.17476 | via HuggingFace Papers | |
| The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems — Tanzim Ahad, Ismail Hossain, Md Jahangir Alam et al. | arXiv 2026 | 2605.22842 | — | |
| LoReTTA: A Low Resource Framework To Poison Continuous Time Dynamic Graphs — Himanshu Pal, Venkata Sai Pranav Bachina, Ankit Gangwal et al. | arXiv 2025 | 2511.07379 | classical adversarial RecSys | |
| Enhancing Robustness of Graph Neural Networks through p-Laplacian — Anuj Kumar Sirohi, Subhanu Halder, Kabir Kumar et al. | arXiv 2025 | 2511.06143 | classical adversarial RecSys | |
| Controllable and Stealthy Shilling Attacks via Dispersive Latent Diffusion — Shutong Qiao, Wei Yuan, Junliang Yu et al. | arXiv 2025 | 2508.01987 | classical adversarial RecSys | |
| AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS — Hai Ling, Tianchi Wang, Xiaohao Liu et al. | arXiv 2025 | 2507.22880 | classical adversarial RecSys | |
| Spattack: Subgroup Poisoning Attacks on Federated Recommender Systems — Bo Yan, Yurong Hao, Dingqi Liu et al. | arXiv 2025 | 2507.06258 | classical adversarial RecSys | |
| IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion — Zihao Wang, Tianhao Mao, XiaoFeng Wang et al. | arXiv 2025 | 2511.05845 | classical adversarial RecSys | |
| Retrieval-Augmented Review Generation for Poisoning Recommender Systems — Shiyi Yang, Xinshu Li, Guanglin Zhou et al. | arXiv 2025 | 2508.15252 | classical adversarial RecSys | |
| Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systems — Fatemeh Nazary, Yashar Deldjoo, Tommaso Di Noia et al. | arXiv 2025 | 2505.05196 | classical adversarial RecSys | |
| Diversity-aware Dual-promotion Poisoning Attack on Sequential Recommendation — Yuchuan Zhao, Tong Chen, Junliang Yu et al. | arXiv 2025 | 2504.06586 | classical adversarial RecSys | |
| Exploiting Meta-Learning-based Poisoning Attacks for Graph Link Prediction — Mingchen Li, Di Zhuang, Keyu Chen et al. | arXiv 2025 | 2504.06492 | classical adversarial RecSys | |
| Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems — Fatemeh Nazary, Yashar Deldjoo, Tommaso di Noia | arXiv 2025 | 2501.11759 | classical adversarial RecSys | |
| Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems — Runze Li, Di Jin, Xiaobao Wang et al. | arXiv 2025 | 2506.08401 | classical adversarial RecSys | |
| LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems — Shengkang Gu, Jiahao Liu, Dongsheng Li et al. | arXiv 2025 | 2505.13528 | classical adversarial RecSys | |
| Penetration Testing of Agentic AI: A Comparative Security Analysis Across Models and Frameworks — Viet K. Nguyen, Mohammad I. Husain | arXiv 2025 | 2512.14860 | — | |
| Membership Inference Attacks on LLM-based Recommender Systems — Jiajie He, Min-Chun Chen, Xintong Chen et al. | arXiv 2025 | 2508.18665 | — | |
| It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics — Matthew Kowal, Jasper Timm, Jean-Francois Godbout et al. | arXiv 2025 | 2506.02873 | — | |
| Exploring Approaches for Detecting Memorization of Recommender System Data in Large Language Models — Antonio Colacicco, Vito Guida, Dario Di Palma et al. | arXiv 2026 | 2601.02002 | — | |
| Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries — Saad Alqithami | arXiv 2026 | 2601.04583 | — | |
| Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning — Jiachen Qian | arXiv 2026 | 2604.16966 | — | |
3. Privacy and Inversion
Leakage of preferences, histories, and demographics, including compositional leakage where individually benign disclosures combine. Survey §4.2.2. D3: amplified (emergent when disclosures compose) · D5: memory, user side.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective — Wang et al. | RecSys 2025 | 2508.03703 | — |  |
| The Sum Leaks More Than Its Parts: Compositional Privacy Risks in Multi-Agent Collaboration — Anonymous | arXiv 2025 | 2509.14284 | — |  |
| Your Language Model Can Secretly Be a Steganographic Privacy Leaking Agent (TrojanStego) — Anonymous | arXiv 2025 | 2505.20118 | — |  |
| A Privacy-Enhanced Development Paradigm for Multi-Agent Collaboration Systems — Anonymous | arXiv 2025 | 2505.04799 | — | |
| The 1st Workshop on Human-Centered Recommender Systems — Kaike Zhang, Yunfan Wu, Yougang lyu et al. | arXiv 2024 | 2411.14760 | via HuggingFace Papers | |
| Robust Recommender System: A Survey and Future Directions — Kaike Zhang, Qi Cao, Fei Sun et al. | arXiv 2023 | 2309.02057 | via HuggingFace Papers | |
| FedAU2: Attribute Unlearning for User-Level Federated Recommender Systems with Adaptive and Robust Adversarial Training — Yuyuan Li, Junjie Fang, Fengyuan Yu et al. | arXiv 2025 | 2511.22872 | classical adversarial RecSys | |
| ADAGE: Active Defenses Against GNN Extraction — Jing Xu, Franziska Boenisch, Adam Dziedzic | arXiv 2025 | 2503.00065 | classical adversarial RecSys | |
| RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems — Xiaohua Feng, Yuyuan Li, Fengyuan Yu et al. | arXiv 2025 | 2504.11510 | classical adversarial RecSys | |
| Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm — Li Cuihong, Huang Xiaowen, Yin Chuanhuan et al. | arXiv 2025 | 2511.14763 | — | |
| LLM4MEA: Data-free Model Extraction Attacks on Sequential Recommenders via Large Language Models — Shilong Zhao, Fei Sun, Kaike Zhang et al. | arXiv 2025 | 2507.16969 | — | |
| From AutoRecSys to AutoRecLab: A Call to Build, Evaluate, and Govern Autonomous Recommender-Systems Research Labs — Joeran Beel, Bela Gipp, Tobias Vente et al. | arXiv 2025 | 2510.18104 | — | |
| Customized Retrieval-Augmented Generation with LLM for Debiasing Recommendation Unlearning — Haichao Zhang, Chong Zhang, Peiyu Hu et al. | arXiv 2025 | 2511.05494 | — | |
| Audit the Whisper: Detecting Steganographic Collusion in Multi-Agent LLMs — Om Tailor | arXiv 2025 | 2510.04303 | — | |
| AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI — Rafflesia Khan, Declan Joyce, Mansura Habiba | arXiv 2025 | 2512.03180 | — | |
| Lightweight Fairness for LLM-Based Recommendations via Kernelized Projection and Gated Adapters — Nan Cui, Wendy Hui Wang, Yue Ning | arXiv 2026 | 2603.23780 | — | |
| Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networks — Jiahao Zhang, Yilong Wang, Suhang Wang | arXiv 2026 | 2603.18570 | — | |
| FeDecider: An LLM-Based Framework for Federated Cross-Domain Recommendation — Xinrui He, Ting-Wei Li, Tianxin Wei et al. | arXiv 2026 | 2602.16034 | — | |
| TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation — Ziheng Chen, Jiali Cheng, Zezhong Fan et al. | arXiv 2026 | 2606.07688 | — | |
| Rethinking Fairness in LLM-Based Recommender Systems: A Survey — Song-Duo Ma, Chu-Yun Chen, Bang-An Li et al. | arXiv 2026 | 2606.28340 | — | |
| Trustworthy Recommendation in the Era of Large Language Models: Opportunities and Challenges — Bohao Wang, Yu Cui, Zhenxiang Xu et al. | arXiv 2026 | 2606.00540 | — | |
| Prompt Optimization for User Simulation in Conversational Recommender Systems: A Multi-Objective Framework — Nipun B Nair, Tongtong Wu, Weiqing Wang | arXiv 2026 | 2607.00010 | — | |
| From Hidden Profiles to Governable Personalization: Recommender Systems in the Age of LLM Agents — Jiahao Liu, Mingzhe Han, Guanming Liu et al. | arXiv 2026 | 2604.20065 | — | |
4. Bias, Fairness, and Feedback Loops
Exposure bias, popularity loops, and dark patterns, amplified by LLM fluency and by state that accumulates across turns and users. Survey §4.2.2. D3: amplified · D5: user side, item side.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Bias Beware: The Impact of Cognitive Biases on LLM-Driven Product Recommendations — Krasniqi et al. | EMNLP 2025 | 2502.01349 | — |  |
| DarkBench: Benchmarking Dark Patterns in Large Language Models — Kran et al. | arXiv 2025 | 2503.10728 | — |  |
| An Inconspicuous Attack to Bias LLM Responses — Anonymous | arXiv 2024 | 2406.04755 | — |  |
| Quantifying Cognitive Bias Induction in LLM-Generated Content — Anonymous | arXiv 2025 | 2507.03194 | — | |
| Understanding Biases in ChatGPT-based Recommender Systems — Anonymous | arXiv 2024 | 2401.10545 | — | |
| Stereotype or Personalization? User Identity Biases Chatbot Recommendations — Anonymous | arXiv 2024 | 2410.05613 | — |  |
| Bias Mitigation for AI-Feedback Loops in Recommender Systems — Anonymous | arXiv 2025 | 2509.00109 | — |  |
| Aligning Recommendations with User Popularity Preferences — Mona Schirmer, Anton Thielmann, Pola Schwöbel et al. | arXiv 2026 | 2604.01036 | — | |
| Retrieval Augmented Conversational Recommendation with Reinforcement Learning — Zhenrui Yue, Honglei Zhuang, Zhen Qin et al. | arXiv 2026 | 2604.04457 | — | — |
| Beyond Static Best-of-N: Bayesian List-wise Alignment for LLM-based Recommendation — Ruijun Chen, Chongming Gao, Jiawei Chen et al. | arXiv 2026 | 2605.04559 | — | |
| Multi-Agent Large Language Models for Conversational Task-Solving — Jonas Becker | arXiv 2024 | 2410.22932 | via HuggingFace Papers | |
| LLM as Explainable Re-Ranker for Recommendation System — Yaqi Wang, Haojia Sun, Shuting Zhang | arXiv 2025 | 2512.03439 | — | |
| The 2nd Workshop on Human-Centered Recommender Systems — Kaike Zhang, Jiakai Tang, Du Su et al. | arXiv 2025 | 2511.19979 | — | |
| UFO: Unfair-to-Fair Evolving Mitigates Unfairness in LLM-based Recommender Systems via Self-Play Fine-tuning — Jiaming Zhang, Yuyuan Li, Xiaohua Feng et al. | arXiv 2025 | 2511.18342 | — | |
| Music Recommendation with Large Language Models: Challenges, Opportunities, and Evaluation — Elena V. Epure, Yashar Deldjoo, Bruno Sguerra et al. | arXiv 2025 | 2511.16478 | — | |
| Vectorized Context-Aware Embeddings for GAT-Based Collaborative Filtering — Danial Ebrat, Sepideh Ahmadian, Luis Rueda | arXiv 2025 | 2510.26461 | — | |
| Does LLM Focus on the Right Words? Mitigating Context Bias in LLM-based Recommenders — Bohao Wang, Jiawei Chen, Feng Liu et al. | arXiv 2025 | 2510.10978 | — | |
| Ethical AI prompt recommendations in large language models using collaborative filtering — Jordan Nelson, Almas Baimagambetov, Konstantinos Avgerinakis et al. | arXiv 2025 | 2510.06924 | — | |
| Where Should I Study? Biased Language Models Decide! Evaluating Fairness in LMs for Academic Recommendations — Krithi Shailya, Akhilesh Kumar Mishra, Gokul S Krishnan et al. | arXiv 2025 | 2509.04498 | — | |
| Revealing Potential Biases in LLM-Based Recommender Systems in the Cold Start Setting — Alexandre Andre, Gauthier Roy, Eva Dyer et al. | arXiv 2025 | 2508.20401 | — | |
| PerFairX: Is There a Balance Between Fairness and Personality in Large Language Model Recommendations? — Chandan Kumar Sah | arXiv 2025 | 2509.08829 | — | |
| ViLLA-MMBench: A Unified Benchmark Suite for LLM-Augmented Multimodal Movie Recommendation — Fatemeh Nazary, Ali Tourani, Yashar Deldjoo et al. | arXiv 2025 | 2508.04206 | — | |
| Toward Safe and Human-Aligned Game Conversational Recommendation via Multi-Agent Decomposition — Zheng Hui, Xiaokai Wei, Yexi Jiang et al. | arXiv 2025 | 2504.20094 | — | |
| Breaking User-Centric Agency: A Tri-Party Framework for Agent-Based Recommendation — Yaxin Gong, Chongming Gao, Chenxiao Fan et al. | arXiv 2026 | 2603.10673 | — | |
| Ablation Study of a Fairness Auditing Agentic System for Bias Mitigation in Early-Onset Colorectal Cancer Detection — Amalia Ionescu, Jose Guadalupe Hernandez, Jui-Hsuan Chang et al. | arXiv 2026 | 2603.17179 | — | |
| LLMs as Orchestrators: Constraint-Compliant Multi-Agent Optimization for Recommendation Systems — Guilin Zhang, Kai Zhao, Jeffrey Friedman et al. | arXiv 2026 | 2601.19121 | — | |
| Can Fairness Be Prompted? Prompt-Based Debiasing Strategies in High-Stakes Recommendations — Mihaela Rotar, Theresia Veronika Rampisela, Maria Maistro | arXiv 2026 | 2603.12935 | — | |
| Uncertainty and Fairness Awareness in LLM-Based Recommendation Systems — Chandan Kumar Sah, Xiaoli Lian, Li Zhang et al. | arXiv 2026 | 2602.02582 | — | |
| HELM: A Human-Centered Evaluation Framework for LLM-Powered Recommender Systems — Sushant Mehta | arXiv 2026 | 2601.19197 | — | |
| Towards Fair Large Language Model-based Recommender Systems without Costly Retraining — Jin Li, Huilin Gu, Shoujin Wang et al. | arXiv 2026 | 2601.17492 | — | |
| Bridging Semantic Understanding and Popularity Bias with LLMs — Renqiang Luo, Dong Zhang, Yupeng Gao et al. | arXiv 2026 | 2601.09478 | — | |
| Fair on the Surface? Benchmarking Hidden-Output Fairness Gaps in LLM Recommenders — Chan Aristella Lu, Arya Fayyazi, Junhao Zhang et al. | arXiv 2026 | 2608.08284 | — | |
| LBR: Towards Mitigating Length Bias in Large Language Models for Recommendation — Hongchen Li, Bohao Wang, Jingbang Chen et al. | arXiv 2026 | 2607.04270 | — | |
| When to Ask a Question: Understanding Communication Strategies in Generative AI Tools — Charlotte Park, Kate Donahue, Manish Raghavan | arXiv 2026 | 2605.11240 | — | |
| Can We Steer the Black-Box? Towards Controllability-Centric Evaluation of Recommender Systems with Collaborative Agents — Jiwen Zhou, Xiang Liu, Mingming Li et al. | arXiv 2026 | 2607.13418 | — | |
Emergent Risks
5. Belief Formation and Aggregation
Premature consensus, correlated error, and degenerate agreement: failures of how agents form and pool judgements. Survey §4.3.1. D3: emergent · D2: ensemble, peer.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Consensus vs. Dissent: Dynamic LLM Modeling of Subjective Preferences in Group Recommenders — Cedric Waterschoot, Nava Tintarev, Francesco Barile | arXiv 2026 | 2607.10235 | — | |
| CAPRA: Scaling Feedback on Software Architecture Deliverables with a Multi-Agent LLM System — Marco Becattini, Niccolò Caselli, Matteo Minin et al. | arXiv 2026 | 2606.18976 | — | |
6. Coordination and Delegation
Unverified delegation, cascading failure, prompt infection, and resource exhaustion along inter-agent paths. Survey §4.3.2. D3: emergent · D5: inter-agent comms, orchestration.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Red-Teaming LLM Multi-Agent Systems via Communication Attacks (AiTM) — Chen et al. | arXiv 2025 | 2502.14847 | — |  |
| Topology-Aware Multi-Hop Attacks on LLM-Based Multi-Agent Systems — Anonymous | arXiv 2025 | 2512.04129 | — |  |
| Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks — Gu et al. | arXiv 2025 | 2504.00218 | — |  |
| Contagious Recursive Blocking Attacks on Multi-Agent Systems (Corba) — Anonymous | arXiv 2025 | 2502.14529 | — |  |
| A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS — Anonymous | arXiv 2025 | 2508.03125 | — | |
| Security Analysis of Agentic AI Communication Protocols — Louck et al. | arXiv 2025 | 2511.03841 | — |  |
| The Trust Paradox in LLM-Based Multi-Agent Systems — Xu et al. | arXiv 2025 | 2510.18563 | — |  |
| Systems Security Foundations for Agentic Computing — Christodorescu et al. | arXiv 2025 | 2512.01295 | — |  |
| A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — Anonymous | arXiv 2025 | 2508.14925 | — |  |
| Advertisement Embedding Attacks Against Large Language Models — Anonymous | arXiv 2025 | 2508.17674 | — |  |
| A Safety-Aware Role-Orchestrated Multi-Agent LLM Framework for Behavioral Health Communication Simulation — Ha Na Cho | arXiv 2026 | 2604.00249 | — | |
7. Strategic Interaction and Governance
Collusion, collective manipulation, and misreporting between agents representing parties with conflicting objectives. Survey §4.3.3. D3: emergent · D2: peer, hierarchical.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| A Survey of Collusion Risk in LLM-Powered Multi-Agent Systems — Ghaemi | NeurIPS WS 2025 | OpenReview | — |  |
| Studying Coordination and Collusion in Multi-Agent LLM Code Reviews — Anonymous | OpenReview 2025 | OpenReview | — | |
| Exposing Multi-Agent Collusion Risks in AI-Based Healthcare — Anonymous | arXiv 2025 | 2512.03097 | — |  |
| Beyond Single-Agent Safety: A Taxonomy of Risks in LLM-to-LLM Interactions — Bisconti et al. | arXiv 2025 | 2512.02682 | — |  |
| Emergent Social Intelligence Risks in Generative Multi-Agent Systems — Yue Huang, Yu Jiang, Wenjie Wang, Haomin Zhuang, Xiaonan Luo, Yuchen Ma, Zhangchen Xu, Zichen Chen, Nuno Moniz, Zinan Lin, Pin-Yu Chen, Nitesh V Chawla, Nouha Dziri, Huan Sun, Xiangliang Zhang | arXiv 2026 | 2603.27771 | GitHub |  |
| HARP: Measuring Harm Amplification in Multi-Agent LLM Systems — Md Hafizur Rahman, Zafaryab Haider, Tanzim Mahfuz et al. | arXiv 2026 | 2605.27489 | — | |
| Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs — Marcantonio Bracale Syrnikov, Federico Pierucci, Marcello Galisai et al. | arXiv 2026 | 2601.11369 | — | |
| Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce — Zeyuan Li, Lukas Petersson, Alessandro Acquisti et al. | arXiv 2026 | 2608.14825 | — | |
| Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems — Jimmy Laurence Rippin, Simon C. Marshall, David Demitri Africa et al. | arXiv 2026 | 2606.28425 | — | |
| Agentic Copyright, Data Scraping & AI Governance: Toward a Coasean Bargain in the Era of Artificial Intelligence — Paulius Jurcys, Mark Fenwick | arXiv 2026 | 2604.07546 | — | |
8. Evaluation and Benchmarking
Scoped by the level at which a failure surfaces: component → interaction → composition. Survey §5. D6: evaluation method.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Why Do Multi-Agent LLM Systems Fail? — Cemri et al. | arXiv 2025 | 2503.13657 | — |  |
| AgentLeak: A Full-Stack Benchmark for Privacy Leakage in Multi-Agent LLM Systems — Anonymous | arXiv 2026 | 2602.11510 | — |  |
| Multi-Agent LLM Governance for Safe Two-Timescale Reinforcement Learning in SDN-IoT Defense — Saeid Jamshidi, Negar Shahabi, Foutse Khomh et al. | arXiv 2026 | 2604.01127 | — | — |
| Towards Position-Robust Talent Recommendation via Large Language Models — Silin Du, Hongyan Liu | arXiv 2026 | 2604.02200 | — | |
| Bilateral Intent-Enhanced Sequential Recommendation with Embedding Perturbation-Based Contrastive Learning — Shanfan Zhang, Yongyi Lin, Yuan Rao | arXiv 2026 | 2604.02833 | — | — |
| **ERASE: Benchmarking Feature Selection Methods for Deep Recommender | ||||
| Systems** — Pengyue Jia, Yejing Wang, Zhaocheng Du et al. | arXiv 2024 | 2403.12660 | via HuggingFace Papers | |
| CogRec: A Cognitive Recommender Agent Fusing Large Language Models and Soar for Explainable Recommendation — Jiaxin Hu, Tao Wang, Bingsan Yang et al. | arXiv 2025 | 2512.24113 | — | |
| The Mental World of Large Language Models in Recommendation: A Benchmark on Association, Personalization, and Knowledgeability — Guangneng Hu | arXiv 2025 | 2512.17389 | — | |
| Reveal Hidden Pitfalls and Navigate Next Generation of Vector Similarity Search from Task-Centric Views — Tingyang Chen, Cong Fu, Jiahua Wu et al. | arXiv 2025 | 2512.12980 | — | |
| Combining LLM Semantic Reasoning with GNN Structural Modeling for Multi-View Multi-Label Feature Selection — Zhiqi Chen, Yuzhou Liu, Jiarui Liu et al. | arXiv 2025 | 2511.08008 | — | |
| ECKGBench: Benchmarking Large Language Models in E-commerce Leveraging Knowledge Graph — Langming Liu, Haibin Chen, Yuhao Wang et al. | arXiv 2025 | 2503.15990 | — | |
| MARCO: A Cooperative Knowledge Transfer Framework for Personalized Cross-domain Recommendations — Lili Xie, Yi Zhang, Ruihong Qiu et al. | arXiv 2025 | 2510.04508 | — | |
| Doctorina MedBench: End-to-End Evaluation of Agent-Based Medical AI — Anna Kozlova, Stanislau Salavei, Pavel Satalkin et al. | arXiv 2026 | 2603.25821 | — | |
| LLMAR: A Tuning-Free Recommendation Framework for Sparse and Text-Rich Industrial Domains — Ryogo Hishikawa, Ichiro Kataoka, Shinya Yuda | arXiv 2026 | 2604.16379 | — | |
| MATRAG: Multi-Agent Transparent Retrieval-Augmented Generation for Explainable Recommendations — Sushant Mehta | arXiv 2026 | 2604.20848 | — | |
| RobustExplain: Evaluating Robustness of LLM-Based Explanation Agents for Recommendation — Guilin Zhang, Kai Zhao, Jeffrey Friedman et al. | arXiv 2026 | 2601.19120 | — | |
| Length-Adaptive Interest Network for Balancing Long and Short Sequence Modeling in CTR Prediction — Zhicheng Zhang, Zhaocheng Du, Jieming Zhu et al. | arXiv 2026 | 2601.19142 | — | |
| A/B Agent: A Self-Evolving Agent for Strategy Iteration in Industrial A/B Testing — Zhuohang Jiang, Yuxin Chen, Yongsen Pan et al. | arXiv 2026 | 2608.04625 | — | |
| DREAM Technical Report — Bin Zhang, Bowen Zheng, Chao Yi et al. | arXiv 2026 | 2608.09408 | — | |
| RouteGuard: Certifying Routing Gain in LLM Multi-Agent Systems When Complementarity Is Not Enough — Anchen Sun, Kaiqi Yang | arXiv 2026 | 2608.07583 | — | |
| CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring — Kavana Venkatesh, Jafar Isbarov, Saad Amin et al. | arXiv 2026 | 2605.19240 | — | |
9. Mitigations
Organised by lifecycle stage: design-time containment → pre-deployment assurance → runtime detection → post-incident recovery → disclosure and governance. Survey §6. D6: defence.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| LlamaFirewall: An Open Source Guardrail System for Building Secure AI Agents — Meta AI | arXiv 2025 | 2505.03574 | — |  |
| PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoning — Anonymous | arXiv 2025 | 2505.11642 | — |  |
| GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling — Anonymous | arXiv 2025 | 2505.19234 | — |   |
| Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection — Anonymous | arXiv 2025 | 2510.16219 | — | |
| SentinelAgent: Graph-based Anomaly Detection in LLM-based Multi-Agent Systems — He et al. | arXiv 2025 | 2505.24201 | — | |
| A Review of Trust, Risk, and Security Management in LLM-based Agentic MAS (TRiSM) — Anonymous | arXiv 2025 | 2506.04133 | — |  |
| Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework — Narajala & Narayan | arXiv 2025 | 2504.19956 | — |  |
| Towards Secure Systems of Interacting AI Agents — Anonymous | arXiv 2025 | 2505.02077 | — |  |
| With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems — Giovanni De Toni, Cristian Consonni, Erasmo Purificato et al. | arXiv 2026 | 2603.28476 | — | — |
| Agentic AI Frameworks: Architectures, Protocols, and Design Challenges — Hana Derouiche, Zaki Brahmi, Haithem Mazeni | arXiv 2025 | 2508.10146 | via HuggingFace Papers | |
| Two is Better than One: Efficient Ensemble Defense for Robust and Compact Models — Yoojin Jung, Byung Cheol Song | arXiv 2025 | 2504.04747 | classical adversarial RecSys | |
| ASTRA: Agentic Steerability and Risk Assessment Framework — Itay Hazan, Yael Mathov, Guy Shtar et al. | arXiv 2025 | 2511.18114 | — | |
| Simulating Filter Bubble on Short-video Recommender System with Large Language Model Agents — Nicholas Sukiennik, Haoyu Wang, Zailin Zeng et al. | arXiv 2025 | 2504.08742 | — | |
| Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection — Junjun Pan, Yixin Liu, Rui Miao et al. | arXiv 2025 | 2512.18733 | — | |
| CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense — Bolin Shen, Md Shamim Seraj, Zhan Cheng et al. | arXiv 2026 | 2602.20418 | — | |
| Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity — Anjun Hu, Hanting Xie, Saranya Govindan et al. | arXiv 2026 | 2608.03272 | — | |
10. Broad Safety Surveys (Background)
Prior-era and general agent-safety surveys that the taxonomy builds on. Survey §2. D6: position paper.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Agentic AI Needs a Systems Theory — Miehling et al. | arXiv 2025 | 2503.00237 | — |  |
| A Comprehensive Survey in LLM(-Agent) Full Stack Safety — Wang et al. | arXiv 2025 | 2504.15585 | — | |
| Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety — Ma et al. | arXiv 2025 | 2502.05206 | — | |
| Agentic AI Security: Threats, Defenses, Evaluation — Chhabra et al. | arXiv 2025 | 2510.23883 | — | |
| A Guide to Known Attacks and Impacts — Anonymous | arXiv 2025 | 2506.23296 | — |  |
| A Taxonomy of Systemic Risks from General-Purpose AI — Anonymous | arXiv 2024 | 2412.07780 | — |  |
| **MI9 -- Agent Intelligence Protocol: Runtime Governance for Agentic AI | ||||
| Systems** — Charles L. Wang, Trisha Singhal, Ameya Kelkar et al. | arXiv 2025 | 2508.03858 | via HuggingFace Papers | |
| **Control Plane as a Tool: A Scalable Design Pattern for Agentic AI | ||||
| Systems** — Sivasathivel Kandasamy | arXiv 2025 | 2505.06817 | via HuggingFace Papers | |
11. Uncategorised / New Additions
Papers added by crawler awaiting manual tagging.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Let the Agent Steer: Closed-Loop Ranking Optimization via Influence Exchange — Yin Cheng, Liao Zhou, Xiyu Liang et al. | arXiv 2026 | 2603.27765 | — | |
| **Unbiased Recommender Learning from Missing-Not-At-Random Implicit | ||||
| Feedback** — Yuta Saito, Suguru Yaginuma, Yuta Nishino et al. | arXiv 2019 | 1909.03601 | via HuggingFace Papers | |
| **Large Language Models are Competitive Near Cold-start Recommenders for | ||||
| Language- and Item-based Preferences** — Scott Sanner, Krisztian Balog, Filip Radlinski et al. | arXiv 2023 | 2307.14225 | via HuggingFace Papers | |
| Matrix-Free Two-to-Infinity and One-to-Two Norms Estimation — Askar Tsyganov, Evgeny Frolov, Sergey Samsonov et al. | arXiv 2025 | 2508.04444 | classical adversarial RecSys | |
| Navigating the Black Box: Leveraging LLMs for Effective Text-Level Graph Injection Attacks — Yuefei Lyu, Chaozhuo Li, Xi Zhang et al. | arXiv 2025 | 2506.13276 | classical adversarial RecSys | |
| Invariance Matters: Empowering Social Recommendation via Graph Invariant Learning — Yonghui Yang, Le Wu, Yuxin Liao et al. | arXiv 2025 | 2504.10432 | classical adversarial RecSys | |
| Towards Efficient Hypergraph and Multi-LLM Agent Recommender Systems — Tendai Mukande, Esraa Ali, Annalina Caputo et al. | arXiv 2025 | 2512.06590 | — | |
| Agentic Explainable Artificial Intelligence (Agentic XAI) Approach To Explore Better Explanation — Tomoaki Yamaguchi, Yutong Zhou, Masahiro Ryo et al. | arXiv 2025 | 2512.21066 | — | |
| Selective LLM-Guided Regularization for Enhancing Recommendation Models — Shanglin Yang, Zhan Shi | arXiv 2025 | 2512.21526 | — | |
| STEP: Stepwise Curriculum Learning for Context-Knowledge Fusion in Conversational Recommendation — Zhenye Yang, Jinpeng Chen, Huan Li et al. | arXiv 2025 | 2508.10669 | — | |
| Multi-agents based User Values Mining for Recommendation — Lijian Chen, Wei Yuan, Tong Chen et al. | arXiv 2025 | 2505.00981 | — | |
| Bridging Legal Knowledge and AI: Retrieval-Augmented Generation with Vector Stores, Knowledge Graphs, and Hierarchical Non-negative Matrix Factorization — Ryan C. Barron, Maksim E. Eren, Olga M. Serafimova et al. | arXiv 2025 | 2502.20364 | — | |
| Journalism-Guided Agentic In-Context Learning for News Stance Detection — Dahyun Lee, Jonghyeon Choi, Jiyoung Han et al. | arXiv 2025 | 2507.11049 | — | |
| Hijacking online reviews: sparse manipulation and behavioral buffering in popularity-biased rating systems — Itsuki Fujisaki, Kunhao Yang | arXiv 2026 | 2604.13049 | — | |
| VLM2Rec: Resolving Modality Collapse in Vision-Language Model Embedders for Multimodal Sequential Recommendation — Junyoung Kim, Woojoo Kim, Jaehyung Lim et al. | arXiv 2026 | 2603.17450 | — | |
| Best-of-Both-Worlds Multi-Dueling Bandits: Unified Algorithms for Stochastic and Adversarial Preferences under Condorcet and Borda Objectives — S Akash, Pratik Gajane, Jawar Singh | arXiv 2026 | 2603.18972 | — | |
| A Cognitive Distribution and Behavior-Consistent Framework for Black-Box Attacks on Recommender Systems — Hongyue Zhang, Mingming Li, Dongqin Liu et al. | arXiv 2026 | 2602.10633 | — | |
| The Behavioral Fabric of LLM-Powered GUI Agents: Human Values and Interaction Outcomes — Simret Araya Gebreegziabher, Yukun Yang, Charles Chiang et al. | arXiv 2026 | 2601.16356 | — | |
| AMEM4Rec: Leveraging Cross-User Similarity for Memory Evolution in Agentic LLM Recommenders — Minh-Duc Nguyen, Hai-Dang Kieu, Dung D. Le | arXiv 2026 | 2602.08837 | — | |
| Structure-Preserving Projection for Mitigating Modality Bias in LLM-Based Sequential Recommendation — Tzu-Wei Chiu, Song-Duo Ma, Hsin-Yu Lin et al. | arXiv 2026 | 2608.08583 | — | |
| Finding the Signal in the Spam: Jointly Learning Rewards and Worker Reliability from Pairwise Comparisons — Kaustubh Shivshankar Shejole, Tanish Agarwal, Arpit Agarwal et al. | arXiv 2026 | 2608.10045 | — | |
| Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders — Ge Zhang, Jingru Cheng, Huiyuan Chen | arXiv 2026 | 2607.24869 | — | |
| RecSys Factory: Bounding LLM Agent Autonomy to Decision Points in the Industrial Recommender Lifecycle — Dongyang Ao, Kaixiang Fang, Shijie Xu | arXiv 2026 | 2608.11241 | — | |
| Personalized Recommendation Tool Learning via Autonomous Language Agents — Mingdai Yang, Zhiwei Liu, Weizhi Zhang et al. | arXiv 2026 | 2607.19739 | — | |
| Transparent and Controllable Recommendation Filtering via Multimodal Multi-Agent Collaboration — Chi Zhang, Zhipeng Xu, Jiahao Liu et al. | arXiv 2026 | 2604.17459 | — | |
How to Contribute / Crawler Notes
This README is maintained by crawler.py in this repository. The crawler:
- Queries the arXiv API daily for new papers matching the taxonomy keywords
- Checks OpenReview for workshop/conference submissions (requires authentication)
- Crawls HuggingFace Papers for community-curated arXiv papers with GitHub links
- Tags each paper against the scope (component/interaction/composition), threat tier (drift/misalignment/compromise), and risk type (amplified/emergent)
- Saves unfiltered results to
raw_crawl.json, then filters for relevance - Commits the updated README automatically via GitHub Actions
To add a paper manually: edit papers.json and run python3 crawler.py --no-crawl.
Last crawler run: 2026-09-01
Contributors
anjunhu
14 commits
github-actions[bot]
12 commits
Similar repos
Languages
Python
98.9%
Shell
1.1%
A reading list centred around building, breaking and auditing trustworthy multi-agent recommendation and retrieval systems.
See the codeREADME
Amplified and Emergent Safety Risks in Multi-Agent Recommendation and Retrieval
A living, auto-updated reading list. Taxonomy follows our TMLR survey and the CIKM '26 tutorial. Risks are organised by origin (D3: amplified vs. emergent) rather than by attack name. Updated weekly by automated crawler.
Last updated: 2026-09-01
Table of Contents
- Taxonomy Overview
- 1. Foundational MA-RS Papers
- Amplified Risks
- Emergent Risks
- 8. Evaluation and Benchmarking
- 9. Mitigations
- 10. Broad Safety Surveys (Background)
- 11. Uncategorised / New Additions
- How to Contribute / Crawler Notes
Taxonomy Overview
The six dimensions
Every entry is positioned against the survey's six-dimension framework; the sections below are grouped by D3.
| Dimension | Values | |
|---|---|---|
| D1 | Architecture era | non-LLM recsys · single-agent LLM recsys · multi-agent LLM recsys |
| D2 | Composition pattern | hierarchical · pipeline · ensemble · peer (tool use cuts across all four) |
| D3 | Risk origin | amplified by composition · emergent under composition |
| D4 | Failure driver | drift · misalignment · compromise |
| D5 | Attack surface | memory · tool use · inter-agent comms · orchestration · item side · user side |
| D6 | Contribution type | empirical attack · evaluation method · defence · position paper |
Systems are additionally placed on the Level of Autonomy ladder (L0 passive → L1 conversational → L2 retrieval-augmented → L3 tool-driven → L4 single-agent planner → L5 multi-agent orchestration, with L6 a conceptual endpoint). This reading list is about L5.
Risk origin (D3)
Risks are classified by the single-agent isolation test: an agent retains its full tool and memory interface, but no other agents consume or produce its messages.
- Amplified (A): risk exists in single-agent settings but worsens under composition.
- Emergent (E): risk only arises through agent interaction.
Threat tiers determine evaluation scope:
| Tier | Description | Evaluation scope |
|---|---|---|
| Drift | System dynamics cause degradation without adversary | Component |
| Misalignment | Internal agent exploits its position | Interaction |
| Compromise | External attacker corrupts one or more agents | Composition |
Tag legend
Each entry carries pills for its risk origin, evaluation scope, and failure driver, followed by free-form topic chips.
risk origin (D3)
evaluation scope
failure driver (D4)
topic
Badges are local SVG assets in
assets/badges/, regenerated bypython3 assets/make_badges.py. Colours follow the survey's Figure 1 palette; every pill meets WCAG AA contrast.
Evaluation Framework
Evaluation is organised by scope and setting:
| Scope | Offline | Online |
|---|---|---|
| Component | Per-agent constraint checks, recommender metrics, adversarial prompting | Behavioural drift detection |
| Interaction | Red-teaming of agent pairs, protocol checks, counterfactual analysis | Inter-agent message trace monitoring |
| Composition | End-to-end stress tests, fairness audits, collusion audits | System-level KPIs, incident reconstruction |
1. Foundational MA-RS Papers
Papers defining multi-agent recommender architectures — the systems whose risks we study. Survey §3 (composition patterns D2, attack surfaces D5).
| Paper | Venue | arXiv | Code | Tags |
|---|---|---|---|---|
| AgentCF: Collaborative Learning with Autonomous Language Agents for Recommender Systems — Zhang et al. | WWW 2024 | 2310.09233 | — | |
| MACRec: A Multi-Agent Collaboration Framework for Recommendation — Wang et al. | arXiv 2024 | 2402.15235 | — | |
| Orchestrating Users and Items for Agentic Recommendations (MACF) — Wu et al. | arXiv 2025 | 2511.18413 | — | |
| Towards Agentic Recommender Systems in the Era of Multimodal LLMs — Li et al. | arXiv 2025 | 2503.16734 | — | |
| A Survey on LLM-powered Agents for Recommender Systems — Anonymous | arXiv 2025 | 2502.10050 | — | |
| Definitions, Perspectives, and Open Challenges of Multi-Agent Recommender Systems — Yousefi et al. | arXiv 2025 | 2507.02097 | — | |
| No-Human in the Loop: Agentic Evaluation at Scale for Recommendation — Zhang et al. | NeurIPS WS 2025 | 2511.03051 | — | |
Amplified Risks
2. Integrity Attacks
Poisoning, backdoors, and prompt injection: failures with a clear single-agent baseline whose reach, persistence, or severity grows under composition. Survey §4.2.1. D3: amplified · D5: item side, memory, tool use.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Securing AI Agents Against Prompt Injection Attacks — Zhuang et al. | arXiv 2025 | 2511.15759 | — | |
| Multi-Agent Systems Execute Arbitrary Malicious Code — Debenedetti et al. | arXiv 2025 | 2503.12188 | — | |
| Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems — Debenedetti et al. | arXiv 2025 | 2510.17276 | — | |
| Jailbreaking LLMs via Iterative Tool-Disguised Attacks via RL — Chen et al. | arXiv 2026 | 2601.05466 | — | |
| INJECAGENT: Benchmarking Indirect Prompt Injections in LLM Agents — Zhan et al. | ACL Findings 2024 | 2403.02691 | GitHub | |
| A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities — Pasquini et al. | arXiv 2025 | 2505.04806 | — | |
| A Real-World Case Study of Attacking ChatGPT via Lightweight Prompt Injection — Yu et al. | arXiv 2025 | 2504.16125 | — | |
| Demystifying Prompt Injection Attacks on Agentic AI Coding Editors — Anonymous | arXiv 2025 | 2509.22040 | — | |
| Exploit Tool Invocation Prompt for Tool Behavior Hijacking — Anonymous | arXiv 2025 | 2509.05755 | — | |
| BadRec: Exploring Backdoor Attack and Defense for LLM-empowered Recommendations — Ning et al. | arXiv 2025 | 2504.11182 | — | |
| LoRec: Large Language Model for Robust Sequential Recommendation against Poisoning Attacks — Wang et al. | SIGIR 2024 | 2401.17723 | — | |
| Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures — Nguyen et al. | arXiv 2024 | 2404.14942 | — | |
| A Survey on Adversarial Recommender Systems — Deldjoo et al. | ACM CSUR 2021 | 2005.10322 | DOI | |
| Shilling Recommender Systems by Generating Side-feature-aware Fake User Profiles — Anonymous | arXiv 2025 | 2509.17918 | — | |
| LLM-Powered Audits Expose Shilling Attacks in Recommender Systems — Anonymous | arXiv 2025 | 2509.24961 | — | |
| DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents — Yang et al. | arXiv 2025 | 2503.23804 | — | |
| Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases — Anonymous | arXiv 2024 | 2407.12784 | — | |
| Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications — Anonymous | arXiv 2024 | 2404.17196 | — | |
| **Improving the Shortest Plank: Vulnerability-Aware Adversarial Training | ||||
| for Robust Recommender System** — Kaike Zhang, Qi Cao, Yunfan Wu et al. | arXiv 2024 | 2409.17476 | via HuggingFace Papers | |
| The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems — Tanzim Ahad, Ismail Hossain, Md Jahangir Alam et al. | arXiv 2026 | 2605.22842 | — | |
| LoReTTA: A Low Resource Framework To Poison Continuous Time Dynamic Graphs — Himanshu Pal, Venkata Sai Pranav Bachina, Ankit Gangwal et al. | arXiv 2025 | 2511.07379 | classical adversarial RecSys | |
| Enhancing Robustness of Graph Neural Networks through p-Laplacian — Anuj Kumar Sirohi, Subhanu Halder, Kabir Kumar et al. | arXiv 2025 | 2511.06143 | classical adversarial RecSys | |
| Controllable and Stealthy Shilling Attacks via Dispersive Latent Diffusion — Shutong Qiao, Wei Yuan, Junliang Yu et al. | arXiv 2025 | 2508.01987 | classical adversarial RecSys | |
| AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS — Hai Ling, Tianchi Wang, Xiaohao Liu et al. | arXiv 2025 | 2507.22880 | classical adversarial RecSys | |
| Spattack: Subgroup Poisoning Attacks on Federated Recommender Systems — Bo Yan, Yurong Hao, Dingqi Liu et al. | arXiv 2025 | 2507.06258 | classical adversarial RecSys | |
| IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion — Zihao Wang, Tianhao Mao, XiaoFeng Wang et al. | arXiv 2025 | 2511.05845 | classical adversarial RecSys | |
| Retrieval-Augmented Review Generation for Poisoning Recommender Systems — Shiyi Yang, Xinshu Li, Guanglin Zhou et al. | arXiv 2025 | 2508.15252 | classical adversarial RecSys | |
| Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systems — Fatemeh Nazary, Yashar Deldjoo, Tommaso Di Noia et al. | arXiv 2025 | 2505.05196 | classical adversarial RecSys | |
| Diversity-aware Dual-promotion Poisoning Attack on Sequential Recommendation — Yuchuan Zhao, Tong Chen, Junliang Yu et al. | arXiv 2025 | 2504.06586 | classical adversarial RecSys | |
| Exploiting Meta-Learning-based Poisoning Attacks for Graph Link Prediction — Mingchen Li, Di Zhuang, Keyu Chen et al. | arXiv 2025 | 2504.06492 | classical adversarial RecSys | |
| Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems — Fatemeh Nazary, Yashar Deldjoo, Tommaso di Noia | arXiv 2025 | 2501.11759 | classical adversarial RecSys | |
| Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems — Runze Li, Di Jin, Xiaobao Wang et al. | arXiv 2025 | 2506.08401 | classical adversarial RecSys | |
| LLM-Based User Simulation for Low-Knowledge Shilling Attacks on Recommender Systems — Shengkang Gu, Jiahao Liu, Dongsheng Li et al. | arXiv 2025 | 2505.13528 | classical adversarial RecSys | |
| Penetration Testing of Agentic AI: A Comparative Security Analysis Across Models and Frameworks — Viet K. Nguyen, Mohammad I. Husain | arXiv 2025 | 2512.14860 | — | |
| Membership Inference Attacks on LLM-based Recommender Systems — Jiajie He, Min-Chun Chen, Xintong Chen et al. | arXiv 2025 | 2508.18665 | — | |
| It's the Thought that Counts: Evaluating the Attempts of Frontier LLMs to Persuade on Harmful Topics — Matthew Kowal, Jasper Timm, Jean-Francois Godbout et al. | arXiv 2025 | 2506.02873 | — | |
| Exploring Approaches for Detecting Memorization of Recommender System Data in Large Language Models — Antonio Colacicco, Vito Guida, Dario Di Palma et al. | arXiv 2026 | 2601.02002 | — | |
| Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries — Saad Alqithami | arXiv 2026 | 2601.04583 | — | |
| Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning — Jiachen Qian | arXiv 2026 | 2604.16966 | — | |
3. Privacy and Inversion
Leakage of preferences, histories, and demographics, including compositional leakage where individually benign disclosures combine. Survey §4.2.2. D3: amplified (emergent when disclosures compose) · D5: memory, user side.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective — Wang et al. | RecSys 2025 | 2508.03703 | — | |
| The Sum Leaks More Than Its Parts: Compositional Privacy Risks in Multi-Agent Collaboration — Anonymous | arXiv 2025 | 2509.14284 | — | |
| Your Language Model Can Secretly Be a Steganographic Privacy Leaking Agent (TrojanStego) — Anonymous | arXiv 2025 | 2505.20118 | — | |
| A Privacy-Enhanced Development Paradigm for Multi-Agent Collaboration Systems — Anonymous | arXiv 2025 | 2505.04799 | — | |
| The 1st Workshop on Human-Centered Recommender Systems — Kaike Zhang, Yunfan Wu, Yougang lyu et al. | arXiv 2024 | 2411.14760 | via HuggingFace Papers | |
| Robust Recommender System: A Survey and Future Directions — Kaike Zhang, Qi Cao, Fei Sun et al. | arXiv 2023 | 2309.02057 | via HuggingFace Papers | |
| FedAU2: Attribute Unlearning for User-Level Federated Recommender Systems with Adaptive and Robust Adversarial Training — Yuyuan Li, Junjie Fang, Fengyuan Yu et al. | arXiv 2025 | 2511.22872 | classical adversarial RecSys | |
| ADAGE: Active Defenses Against GNN Extraction — Jing Xu, Franziska Boenisch, Adam Dziedzic | arXiv 2025 | 2503.00065 | classical adversarial RecSys | |
| RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems — Xiaohua Feng, Yuyuan Li, Fengyuan Yu et al. | arXiv 2025 | 2504.11510 | classical adversarial RecSys | |
| Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm — Li Cuihong, Huang Xiaowen, Yin Chuanhuan et al. | arXiv 2025 | 2511.14763 | — | |
| LLM4MEA: Data-free Model Extraction Attacks on Sequential Recommenders via Large Language Models — Shilong Zhao, Fei Sun, Kaike Zhang et al. | arXiv 2025 | 2507.16969 | — | |
| From AutoRecSys to AutoRecLab: A Call to Build, Evaluate, and Govern Autonomous Recommender-Systems Research Labs — Joeran Beel, Bela Gipp, Tobias Vente et al. | arXiv 2025 | 2510.18104 | — | |
| Customized Retrieval-Augmented Generation with LLM for Debiasing Recommendation Unlearning — Haichao Zhang, Chong Zhang, Peiyu Hu et al. | arXiv 2025 | 2511.05494 | — | |
| Audit the Whisper: Detecting Steganographic Collusion in Multi-Agent LLMs — Om Tailor | arXiv 2025 | 2510.04303 | — | |
| AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI — Rafflesia Khan, Declan Joyce, Mansura Habiba | arXiv 2025 | 2512.03180 | — | |
| Lightweight Fairness for LLM-Based Recommendations via Kernelized Projection and Gated Adapters — Nan Cui, Wendy Hui Wang, Yue Ning | arXiv 2026 | 2603.23780 | — | |
| Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networks — Jiahao Zhang, Yilong Wang, Suhang Wang | arXiv 2026 | 2603.18570 | — | |
| FeDecider: An LLM-Based Framework for Federated Cross-Domain Recommendation — Xinrui He, Ting-Wei Li, Tianxin Wei et al. | arXiv 2026 | 2602.16034 | — | |
| TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation — Ziheng Chen, Jiali Cheng, Zezhong Fan et al. | arXiv 2026 | 2606.07688 | — | |
| Rethinking Fairness in LLM-Based Recommender Systems: A Survey — Song-Duo Ma, Chu-Yun Chen, Bang-An Li et al. | arXiv 2026 | 2606.28340 | — | |
| Trustworthy Recommendation in the Era of Large Language Models: Opportunities and Challenges — Bohao Wang, Yu Cui, Zhenxiang Xu et al. | arXiv 2026 | 2606.00540 | — | |
| Prompt Optimization for User Simulation in Conversational Recommender Systems: A Multi-Objective Framework — Nipun B Nair, Tongtong Wu, Weiqing Wang | arXiv 2026 | 2607.00010 | — | |
| From Hidden Profiles to Governable Personalization: Recommender Systems in the Age of LLM Agents — Jiahao Liu, Mingzhe Han, Guanming Liu et al. | arXiv 2026 | 2604.20065 | — | |
4. Bias, Fairness, and Feedback Loops
Exposure bias, popularity loops, and dark patterns, amplified by LLM fluency and by state that accumulates across turns and users. Survey §4.2.2. D3: amplified · D5: user side, item side.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Bias Beware: The Impact of Cognitive Biases on LLM-Driven Product Recommendations — Krasniqi et al. | EMNLP 2025 | 2502.01349 | — | |
| DarkBench: Benchmarking Dark Patterns in Large Language Models — Kran et al. | arXiv 2025 | 2503.10728 | — | |
| An Inconspicuous Attack to Bias LLM Responses — Anonymous | arXiv 2024 | 2406.04755 | — | |
| Quantifying Cognitive Bias Induction in LLM-Generated Content — Anonymous | arXiv 2025 | 2507.03194 | — | |
| Understanding Biases in ChatGPT-based Recommender Systems — Anonymous | arXiv 2024 | 2401.10545 | — | |
| Stereotype or Personalization? User Identity Biases Chatbot Recommendations — Anonymous | arXiv 2024 | 2410.05613 | — | |
| Bias Mitigation for AI-Feedback Loops in Recommender Systems — Anonymous | arXiv 2025 | 2509.00109 | — | |
| Aligning Recommendations with User Popularity Preferences — Mona Schirmer, Anton Thielmann, Pola Schwöbel et al. | arXiv 2026 | 2604.01036 | — | |
| Retrieval Augmented Conversational Recommendation with Reinforcement Learning — Zhenrui Yue, Honglei Zhuang, Zhen Qin et al. | arXiv 2026 | 2604.04457 | — | — |
| Beyond Static Best-of-N: Bayesian List-wise Alignment for LLM-based Recommendation — Ruijun Chen, Chongming Gao, Jiawei Chen et al. | arXiv 2026 | 2605.04559 | — | |
| Multi-Agent Large Language Models for Conversational Task-Solving — Jonas Becker | arXiv 2024 | 2410.22932 | via HuggingFace Papers | |
| LLM as Explainable Re-Ranker for Recommendation System — Yaqi Wang, Haojia Sun, Shuting Zhang | arXiv 2025 | 2512.03439 | — | |
| The 2nd Workshop on Human-Centered Recommender Systems — Kaike Zhang, Jiakai Tang, Du Su et al. | arXiv 2025 | 2511.19979 | — | |
| UFO: Unfair-to-Fair Evolving Mitigates Unfairness in LLM-based Recommender Systems via Self-Play Fine-tuning — Jiaming Zhang, Yuyuan Li, Xiaohua Feng et al. | arXiv 2025 | 2511.18342 | — | |
| Music Recommendation with Large Language Models: Challenges, Opportunities, and Evaluation — Elena V. Epure, Yashar Deldjoo, Bruno Sguerra et al. | arXiv 2025 | 2511.16478 | — | |
| Vectorized Context-Aware Embeddings for GAT-Based Collaborative Filtering — Danial Ebrat, Sepideh Ahmadian, Luis Rueda | arXiv 2025 | 2510.26461 | — | |
| Does LLM Focus on the Right Words? Mitigating Context Bias in LLM-based Recommenders — Bohao Wang, Jiawei Chen, Feng Liu et al. | arXiv 2025 | 2510.10978 | — | |
| Ethical AI prompt recommendations in large language models using collaborative filtering — Jordan Nelson, Almas Baimagambetov, Konstantinos Avgerinakis et al. | arXiv 2025 | 2510.06924 | — | |
| Where Should I Study? Biased Language Models Decide! Evaluating Fairness in LMs for Academic Recommendations — Krithi Shailya, Akhilesh Kumar Mishra, Gokul S Krishnan et al. | arXiv 2025 | 2509.04498 | — | |
| Revealing Potential Biases in LLM-Based Recommender Systems in the Cold Start Setting — Alexandre Andre, Gauthier Roy, Eva Dyer et al. | arXiv 2025 | 2508.20401 | — | |
| PerFairX: Is There a Balance Between Fairness and Personality in Large Language Model Recommendations? — Chandan Kumar Sah | arXiv 2025 | 2509.08829 | — | |
| ViLLA-MMBench: A Unified Benchmark Suite for LLM-Augmented Multimodal Movie Recommendation — Fatemeh Nazary, Ali Tourani, Yashar Deldjoo et al. | arXiv 2025 | 2508.04206 | — | |
| Toward Safe and Human-Aligned Game Conversational Recommendation via Multi-Agent Decomposition — Zheng Hui, Xiaokai Wei, Yexi Jiang et al. | arXiv 2025 | 2504.20094 | — | |
| Breaking User-Centric Agency: A Tri-Party Framework for Agent-Based Recommendation — Yaxin Gong, Chongming Gao, Chenxiao Fan et al. | arXiv 2026 | 2603.10673 | — | |
| Ablation Study of a Fairness Auditing Agentic System for Bias Mitigation in Early-Onset Colorectal Cancer Detection — Amalia Ionescu, Jose Guadalupe Hernandez, Jui-Hsuan Chang et al. | arXiv 2026 | 2603.17179 | — | |
| LLMs as Orchestrators: Constraint-Compliant Multi-Agent Optimization for Recommendation Systems — Guilin Zhang, Kai Zhao, Jeffrey Friedman et al. | arXiv 2026 | 2601.19121 | — | |
| Can Fairness Be Prompted? Prompt-Based Debiasing Strategies in High-Stakes Recommendations — Mihaela Rotar, Theresia Veronika Rampisela, Maria Maistro | arXiv 2026 | 2603.12935 | — | |
| Uncertainty and Fairness Awareness in LLM-Based Recommendation Systems — Chandan Kumar Sah, Xiaoli Lian, Li Zhang et al. | arXiv 2026 | 2602.02582 | — | |
| HELM: A Human-Centered Evaluation Framework for LLM-Powered Recommender Systems — Sushant Mehta | arXiv 2026 | 2601.19197 | — | |
| Towards Fair Large Language Model-based Recommender Systems without Costly Retraining — Jin Li, Huilin Gu, Shoujin Wang et al. | arXiv 2026 | 2601.17492 | — | |
| Bridging Semantic Understanding and Popularity Bias with LLMs — Renqiang Luo, Dong Zhang, Yupeng Gao et al. | arXiv 2026 | 2601.09478 | — | |
| Fair on the Surface? Benchmarking Hidden-Output Fairness Gaps in LLM Recommenders — Chan Aristella Lu, Arya Fayyazi, Junhao Zhang et al. | arXiv 2026 | 2608.08284 | — | |
| LBR: Towards Mitigating Length Bias in Large Language Models for Recommendation — Hongchen Li, Bohao Wang, Jingbang Chen et al. | arXiv 2026 | 2607.04270 | — | |
| When to Ask a Question: Understanding Communication Strategies in Generative AI Tools — Charlotte Park, Kate Donahue, Manish Raghavan | arXiv 2026 | 2605.11240 | — | |
| Can We Steer the Black-Box? Towards Controllability-Centric Evaluation of Recommender Systems with Collaborative Agents — Jiwen Zhou, Xiang Liu, Mingming Li et al. | arXiv 2026 | 2607.13418 | — | |
Emergent Risks
5. Belief Formation and Aggregation
Premature consensus, correlated error, and degenerate agreement: failures of how agents form and pool judgements. Survey §4.3.1. D3: emergent · D2: ensemble, peer.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Consensus vs. Dissent: Dynamic LLM Modeling of Subjective Preferences in Group Recommenders — Cedric Waterschoot, Nava Tintarev, Francesco Barile | arXiv 2026 | 2607.10235 | — | |
| CAPRA: Scaling Feedback on Software Architecture Deliverables with a Multi-Agent LLM System — Marco Becattini, Niccolò Caselli, Matteo Minin et al. | arXiv 2026 | 2606.18976 | — | |
6. Coordination and Delegation
Unverified delegation, cascading failure, prompt infection, and resource exhaustion along inter-agent paths. Survey §4.3.2. D3: emergent · D5: inter-agent comms, orchestration.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Red-Teaming LLM Multi-Agent Systems via Communication Attacks (AiTM) — Chen et al. | arXiv 2025 | 2502.14847 | — | |
| Topology-Aware Multi-Hop Attacks on LLM-Based Multi-Agent Systems — Anonymous | arXiv 2025 | 2512.04129 | — | |
| Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks — Gu et al. | arXiv 2025 | 2504.00218 | — | |
| Contagious Recursive Blocking Attacks on Multi-Agent Systems (Corba) — Anonymous | arXiv 2025 | 2502.14529 | — | |
| A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS — Anonymous | arXiv 2025 | 2508.03125 | — | |
| Security Analysis of Agentic AI Communication Protocols — Louck et al. | arXiv 2025 | 2511.03841 | — | |
| The Trust Paradox in LLM-Based Multi-Agent Systems — Xu et al. | arXiv 2025 | 2510.18563 | — | |
| Systems Security Foundations for Agentic Computing — Christodorescu et al. | arXiv 2025 | 2512.01295 | — | |
| A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — Anonymous | arXiv 2025 | 2508.14925 | — | |
| Advertisement Embedding Attacks Against Large Language Models — Anonymous | arXiv 2025 | 2508.17674 | — | |
| A Safety-Aware Role-Orchestrated Multi-Agent LLM Framework for Behavioral Health Communication Simulation — Ha Na Cho | arXiv 2026 | 2604.00249 | — | |
7. Strategic Interaction and Governance
Collusion, collective manipulation, and misreporting between agents representing parties with conflicting objectives. Survey §4.3.3. D3: emergent · D2: peer, hierarchical.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| A Survey of Collusion Risk in LLM-Powered Multi-Agent Systems — Ghaemi | NeurIPS WS 2025 | OpenReview | — | |
| Studying Coordination and Collusion in Multi-Agent LLM Code Reviews — Anonymous | OpenReview 2025 | OpenReview | — | |
| Exposing Multi-Agent Collusion Risks in AI-Based Healthcare — Anonymous | arXiv 2025 | 2512.03097 | — | |
| Beyond Single-Agent Safety: A Taxonomy of Risks in LLM-to-LLM Interactions — Bisconti et al. | arXiv 2025 | 2512.02682 | — | |
| Emergent Social Intelligence Risks in Generative Multi-Agent Systems — Yue Huang, Yu Jiang, Wenjie Wang, Haomin Zhuang, Xiaonan Luo, Yuchen Ma, Zhangchen Xu, Zichen Chen, Nuno Moniz, Zinan Lin, Pin-Yu Chen, Nitesh V Chawla, Nouha Dziri, Huan Sun, Xiangliang Zhang | arXiv 2026 | 2603.27771 | GitHub | |
| HARP: Measuring Harm Amplification in Multi-Agent LLM Systems — Md Hafizur Rahman, Zafaryab Haider, Tanzim Mahfuz et al. | arXiv 2026 | 2605.27489 | — | |
| Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs — Marcantonio Bracale Syrnikov, Federico Pierucci, Marcello Galisai et al. | arXiv 2026 | 2601.11369 | — | |
| Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce — Zeyuan Li, Lukas Petersson, Alessandro Acquisti et al. | arXiv 2026 | 2608.14825 | — | |
| Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems — Jimmy Laurence Rippin, Simon C. Marshall, David Demitri Africa et al. | arXiv 2026 | 2606.28425 | — | |
| Agentic Copyright, Data Scraping & AI Governance: Toward a Coasean Bargain in the Era of Artificial Intelligence — Paulius Jurcys, Mark Fenwick | arXiv 2026 | 2604.07546 | — | |
8. Evaluation and Benchmarking
Scoped by the level at which a failure surfaces: component → interaction → composition. Survey §5. D6: evaluation method.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Why Do Multi-Agent LLM Systems Fail? — Cemri et al. | arXiv 2025 | 2503.13657 | — | |
| AgentLeak: A Full-Stack Benchmark for Privacy Leakage in Multi-Agent LLM Systems — Anonymous | arXiv 2026 | 2602.11510 | — | |
| Multi-Agent LLM Governance for Safe Two-Timescale Reinforcement Learning in SDN-IoT Defense — Saeid Jamshidi, Negar Shahabi, Foutse Khomh et al. | arXiv 2026 | 2604.01127 | — | — |
| Towards Position-Robust Talent Recommendation via Large Language Models — Silin Du, Hongyan Liu | arXiv 2026 | 2604.02200 | — | |
| Bilateral Intent-Enhanced Sequential Recommendation with Embedding Perturbation-Based Contrastive Learning — Shanfan Zhang, Yongyi Lin, Yuan Rao | arXiv 2026 | 2604.02833 | — | — |
| **ERASE: Benchmarking Feature Selection Methods for Deep Recommender | ||||
| Systems** — Pengyue Jia, Yejing Wang, Zhaocheng Du et al. | arXiv 2024 | 2403.12660 | via HuggingFace Papers | |
| CogRec: A Cognitive Recommender Agent Fusing Large Language Models and Soar for Explainable Recommendation — Jiaxin Hu, Tao Wang, Bingsan Yang et al. | arXiv 2025 | 2512.24113 | — | |
| The Mental World of Large Language Models in Recommendation: A Benchmark on Association, Personalization, and Knowledgeability — Guangneng Hu | arXiv 2025 | 2512.17389 | — | |
| Reveal Hidden Pitfalls and Navigate Next Generation of Vector Similarity Search from Task-Centric Views — Tingyang Chen, Cong Fu, Jiahua Wu et al. | arXiv 2025 | 2512.12980 | — | |
| Combining LLM Semantic Reasoning with GNN Structural Modeling for Multi-View Multi-Label Feature Selection — Zhiqi Chen, Yuzhou Liu, Jiarui Liu et al. | arXiv 2025 | 2511.08008 | — | |
| ECKGBench: Benchmarking Large Language Models in E-commerce Leveraging Knowledge Graph — Langming Liu, Haibin Chen, Yuhao Wang et al. | arXiv 2025 | 2503.15990 | — | |
| MARCO: A Cooperative Knowledge Transfer Framework for Personalized Cross-domain Recommendations — Lili Xie, Yi Zhang, Ruihong Qiu et al. | arXiv 2025 | 2510.04508 | — | |
| Doctorina MedBench: End-to-End Evaluation of Agent-Based Medical AI — Anna Kozlova, Stanislau Salavei, Pavel Satalkin et al. | arXiv 2026 | 2603.25821 | — | |
| LLMAR: A Tuning-Free Recommendation Framework for Sparse and Text-Rich Industrial Domains — Ryogo Hishikawa, Ichiro Kataoka, Shinya Yuda | arXiv 2026 | 2604.16379 | — | |
| MATRAG: Multi-Agent Transparent Retrieval-Augmented Generation for Explainable Recommendations — Sushant Mehta | arXiv 2026 | 2604.20848 | — | |
| RobustExplain: Evaluating Robustness of LLM-Based Explanation Agents for Recommendation — Guilin Zhang, Kai Zhao, Jeffrey Friedman et al. | arXiv 2026 | 2601.19120 | — | |
| Length-Adaptive Interest Network for Balancing Long and Short Sequence Modeling in CTR Prediction — Zhicheng Zhang, Zhaocheng Du, Jieming Zhu et al. | arXiv 2026 | 2601.19142 | — | |
| A/B Agent: A Self-Evolving Agent for Strategy Iteration in Industrial A/B Testing — Zhuohang Jiang, Yuxin Chen, Yongsen Pan et al. | arXiv 2026 | 2608.04625 | — | |
| DREAM Technical Report — Bin Zhang, Bowen Zheng, Chao Yi et al. | arXiv 2026 | 2608.09408 | — | |
| RouteGuard: Certifying Routing Gain in LLM Multi-Agent Systems When Complementarity Is Not Enough — Anchen Sun, Kaiqi Yang | arXiv 2026 | 2608.07583 | — | |
| CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring — Kavana Venkatesh, Jafar Isbarov, Saad Amin et al. | arXiv 2026 | 2605.19240 | — | |
9. Mitigations
Organised by lifecycle stage: design-time containment → pre-deployment assurance → runtime detection → post-incident recovery → disclosure and governance. Survey §6. D6: defence.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| LlamaFirewall: An Open Source Guardrail System for Building Secure AI Agents — Meta AI | arXiv 2025 | 2505.03574 | — | |
| PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoning — Anonymous | arXiv 2025 | 2505.11642 | — | |
| GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling — Anonymous | arXiv 2025 | 2505.19234 | — | |
| Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection — Anonymous | arXiv 2025 | 2510.16219 | — | |
| SentinelAgent: Graph-based Anomaly Detection in LLM-based Multi-Agent Systems — He et al. | arXiv 2025 | 2505.24201 | — | |
| A Review of Trust, Risk, and Security Management in LLM-based Agentic MAS (TRiSM) — Anonymous | arXiv 2025 | 2506.04133 | — | |
| Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework — Narajala & Narayan | arXiv 2025 | 2504.19956 | — | |
| Towards Secure Systems of Interacting AI Agents — Anonymous | arXiv 2025 | 2505.02077 | — | |
| With a Little Help From My Friends: Collective Manipulation in Risk-Controlling Recommender Systems — Giovanni De Toni, Cristian Consonni, Erasmo Purificato et al. | arXiv 2026 | 2603.28476 | — | — |
| Agentic AI Frameworks: Architectures, Protocols, and Design Challenges — Hana Derouiche, Zaki Brahmi, Haithem Mazeni | arXiv 2025 | 2508.10146 | via HuggingFace Papers | |
| Two is Better than One: Efficient Ensemble Defense for Robust and Compact Models — Yoojin Jung, Byung Cheol Song | arXiv 2025 | 2504.04747 | classical adversarial RecSys | |
| ASTRA: Agentic Steerability and Risk Assessment Framework — Itay Hazan, Yael Mathov, Guy Shtar et al. | arXiv 2025 | 2511.18114 | — | |
| Simulating Filter Bubble on Short-video Recommender System with Large Language Model Agents — Nicholas Sukiennik, Haoyu Wang, Zailin Zeng et al. | arXiv 2025 | 2504.08742 | — | |
| Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection — Junjun Pan, Yixin Liu, Rui Miao et al. | arXiv 2025 | 2512.18733 | — | |
| CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense — Bolin Shen, Md Shamim Seraj, Zhan Cheng et al. | arXiv 2026 | 2602.20418 | — | |
| Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity — Anjun Hu, Hanting Xie, Saranya Govindan et al. | arXiv 2026 | 2608.03272 | — | |
10. Broad Safety Surveys (Background)
Prior-era and general agent-safety surveys that the taxonomy builds on. Survey §2. D6: position paper.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Agentic AI Needs a Systems Theory — Miehling et al. | arXiv 2025 | 2503.00237 | — | |
| A Comprehensive Survey in LLM(-Agent) Full Stack Safety — Wang et al. | arXiv 2025 | 2504.15585 | — | |
| Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety — Ma et al. | arXiv 2025 | 2502.05206 | — | |
| Agentic AI Security: Threats, Defenses, Evaluation — Chhabra et al. | arXiv 2025 | 2510.23883 | — | |
| A Guide to Known Attacks and Impacts — Anonymous | arXiv 2025 | 2506.23296 | — | |
| A Taxonomy of Systemic Risks from General-Purpose AI — Anonymous | arXiv 2024 | 2412.07780 | — | |
| **MI9 -- Agent Intelligence Protocol: Runtime Governance for Agentic AI | ||||
| Systems** — Charles L. Wang, Trisha Singhal, Ameya Kelkar et al. | arXiv 2025 | 2508.03858 | via HuggingFace Papers | |
| **Control Plane as a Tool: A Scalable Design Pattern for Agentic AI | ||||
| Systems** — Sivasathivel Kandasamy | arXiv 2025 | 2505.06817 | via HuggingFace Papers | |
11. Uncategorised / New Additions
Papers added by crawler awaiting manual tagging.
| Paper | Venue | arXiv | Notes | Tags |
|---|---|---|---|---|
| Let the Agent Steer: Closed-Loop Ranking Optimization via Influence Exchange — Yin Cheng, Liao Zhou, Xiyu Liang et al. | arXiv 2026 | 2603.27765 | — | |
| **Unbiased Recommender Learning from Missing-Not-At-Random Implicit | ||||
| Feedback** — Yuta Saito, Suguru Yaginuma, Yuta Nishino et al. | arXiv 2019 | 1909.03601 | via HuggingFace Papers | |
| **Large Language Models are Competitive Near Cold-start Recommenders for | ||||
| Language- and Item-based Preferences** — Scott Sanner, Krisztian Balog, Filip Radlinski et al. | arXiv 2023 | 2307.14225 | via HuggingFace Papers | |
| Matrix-Free Two-to-Infinity and One-to-Two Norms Estimation — Askar Tsyganov, Evgeny Frolov, Sergey Samsonov et al. | arXiv 2025 | 2508.04444 | classical adversarial RecSys | |
| Navigating the Black Box: Leveraging LLMs for Effective Text-Level Graph Injection Attacks — Yuefei Lyu, Chaozhuo Li, Xi Zhang et al. | arXiv 2025 | 2506.13276 | classical adversarial RecSys | |
| Invariance Matters: Empowering Social Recommendation via Graph Invariant Learning — Yonghui Yang, Le Wu, Yuxin Liao et al. | arXiv 2025 | 2504.10432 | classical adversarial RecSys | |
| Towards Efficient Hypergraph and Multi-LLM Agent Recommender Systems — Tendai Mukande, Esraa Ali, Annalina Caputo et al. | arXiv 2025 | 2512.06590 | — | |
| Agentic Explainable Artificial Intelligence (Agentic XAI) Approach To Explore Better Explanation — Tomoaki Yamaguchi, Yutong Zhou, Masahiro Ryo et al. | arXiv 2025 | 2512.21066 | — | |
| Selective LLM-Guided Regularization for Enhancing Recommendation Models — Shanglin Yang, Zhan Shi | arXiv 2025 | 2512.21526 | — | |
| STEP: Stepwise Curriculum Learning for Context-Knowledge Fusion in Conversational Recommendation — Zhenye Yang, Jinpeng Chen, Huan Li et al. | arXiv 2025 | 2508.10669 | — | |
| Multi-agents based User Values Mining for Recommendation — Lijian Chen, Wei Yuan, Tong Chen et al. | arXiv 2025 | 2505.00981 | — | |
| Bridging Legal Knowledge and AI: Retrieval-Augmented Generation with Vector Stores, Knowledge Graphs, and Hierarchical Non-negative Matrix Factorization — Ryan C. Barron, Maksim E. Eren, Olga M. Serafimova et al. | arXiv 2025 | 2502.20364 | — | |
| Journalism-Guided Agentic In-Context Learning for News Stance Detection — Dahyun Lee, Jonghyeon Choi, Jiyoung Han et al. | arXiv 2025 | 2507.11049 | — | |
| Hijacking online reviews: sparse manipulation and behavioral buffering in popularity-biased rating systems — Itsuki Fujisaki, Kunhao Yang | arXiv 2026 | 2604.13049 | — | |
| VLM2Rec: Resolving Modality Collapse in Vision-Language Model Embedders for Multimodal Sequential Recommendation — Junyoung Kim, Woojoo Kim, Jaehyung Lim et al. | arXiv 2026 | 2603.17450 | — | |
| Best-of-Both-Worlds Multi-Dueling Bandits: Unified Algorithms for Stochastic and Adversarial Preferences under Condorcet and Borda Objectives — S Akash, Pratik Gajane, Jawar Singh | arXiv 2026 | 2603.18972 | — | |
| A Cognitive Distribution and Behavior-Consistent Framework for Black-Box Attacks on Recommender Systems — Hongyue Zhang, Mingming Li, Dongqin Liu et al. | arXiv 2026 | 2602.10633 | — | |
| The Behavioral Fabric of LLM-Powered GUI Agents: Human Values and Interaction Outcomes — Simret Araya Gebreegziabher, Yukun Yang, Charles Chiang et al. | arXiv 2026 | 2601.16356 | — | |
| AMEM4Rec: Leveraging Cross-User Similarity for Memory Evolution in Agentic LLM Recommenders — Minh-Duc Nguyen, Hai-Dang Kieu, Dung D. Le | arXiv 2026 | 2602.08837 | — | |
| Structure-Preserving Projection for Mitigating Modality Bias in LLM-Based Sequential Recommendation — Tzu-Wei Chiu, Song-Duo Ma, Hsin-Yu Lin et al. | arXiv 2026 | 2608.08583 | — | |
| Finding the Signal in the Spam: Jointly Learning Rewards and Worker Reliability from Pairwise Comparisons — Kaustubh Shivshankar Shejole, Tanish Agarwal, Arpit Agarwal et al. | arXiv 2026 | 2608.10045 | — | |
| Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders — Ge Zhang, Jingru Cheng, Huiyuan Chen | arXiv 2026 | 2607.24869 | — | |
| RecSys Factory: Bounding LLM Agent Autonomy to Decision Points in the Industrial Recommender Lifecycle — Dongyang Ao, Kaixiang Fang, Shijie Xu | arXiv 2026 | 2608.11241 | — | |
| Personalized Recommendation Tool Learning via Autonomous Language Agents — Mingdai Yang, Zhiwei Liu, Weizhi Zhang et al. | arXiv 2026 | 2607.19739 | — | |
| Transparent and Controllable Recommendation Filtering via Multimodal Multi-Agent Collaboration — Chi Zhang, Zhipeng Xu, Jiahao Liu et al. | arXiv 2026 | 2604.17459 | — | |
How to Contribute / Crawler Notes
This README is maintained by crawler.py in this repository. The crawler:
- Queries the arXiv API daily for new papers matching the taxonomy keywords
- Checks OpenReview for workshop/conference submissions (requires authentication)
- Crawls HuggingFace Papers for community-curated arXiv papers with GitHub links
- Tags each paper against the scope (component/interaction/composition), threat tier (drift/misalignment/compromise), and risk type (amplified/emergent)
- Saves unfiltered results to
raw_crawl.json, then filters for relevance - Commits the updated README automatically via GitHub Actions
To add a paper manually: edit papers.json and run python3 crawler.py --no-crawl.
Last crawler run: 2026-09-01
Similar repos
Contributors
anjunhu
14 commits
github-actions[bot]
12 commits
Languages
Python
98.9%
Shell
1.1%