Under 1% Poisoned Data Hijacks Generative Recommenders

Ten researchers have stress-tested generative recommender systems with an attack mounted entirely from the outside. Their arXiv paper, published on October 10, 2026^[1], finds that less than 1% synthetic interactions is enough to push an item of the attacker's choosing.

In the threat model, the attacker can inject a small number of fake interactions. They can also query the recommendation API as a black box. With that level of access, the AlignPoison method raises attack success by up to 16.3 percentage points over the strongest baselines.

Ten authors, tests on unimodal and multimodal data

The systems under study build a recommendation one item at a time. The technique is called autoregressive decoding, the same one used by large language models.

The paper describes it as an alternative to traditional ranking that is already in use.

The experiments cover unimodal and multimodal benchmarks. The paper runs to 23 pages and 10 figures, appendices included. Its listing is also available on alphaXiv^[2].

The public abstract does not name the datasets or give their size.

Below 1%, the target climbs

The threshold refers to the share of fake interactions in the total data. Below that share, the probability of promoting the target item rises significantly. The target climbs whenever the attacker's chosen trigger appears.

The 16.3 figure is the maximum gain reported.

The average across benchmarks has to be read off the paper's tables. The abstract gives the peak and says nothing about the spread of results.

Three properties make a prefix effective

The authors examine the fake interactions from two angles. The first is alignment with the model's decoding. The second is prefix popularity, the prefix being the opening stretch of the interaction sequence.

• Alignment: the prefix follows the transitions the model itself tends to produce.
• Popularity: the prefix is common in the sequences the model generates.
• Trigger association: the prefix is strongly linked to a frequent trigger.

The authors observe that short prefixes with these properties consistently amplify promotion.

Sequence shape matters more than volume

AlignPoison discovers these prefixes by reading the API's responses. It then samples them to build the fake interactions.

In other words, the method works off the same outputs the system returns to any customer.

The comparison with baselines is run under identical external access. The gain comes from picking the right sequence, one aligned with how the model generates.

Accuracy measures something else

The flexibility of these models has been studied in depth. Their robustness against data poisoning, the authors write, has remained largely unexplored.

An accuracy benchmark measures how well the system predicts user preferences under clean conditions. This paper measures how little an outsider needs to steer those choices. The generative system fails the second test with less than 1% fake data.

A high score on the first test says little about the second.

A second column in the generative model's ledger

For an investment committee, the paper adds a variable to the choice between traditional ranking and a generative model. That variable is measured with the access of an ordinary API user.

For whoever runs the data infrastructure, the issue is inbound interactions. The paper measures the attack; the abstract is silent on defenses.

For a board, the case for the generative model as the superior choice currently rests on accuracy and flexibility metrics. Resilience to poisoning is a second column in the ledger. This work fills it in with an unfavorable number.

The results come from academic benchmarks. Behavior on a production platform remains to be measured.