{"id":"1be99ddb-e759-490b-8bc1-ec45e5aced4b","arxiv_id":"2505.05196","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Small language-model-made edits to item descriptions can shift rankings in some RAG recommender configurations, but the paper's own demotion data point the wrong way and the detection-evasion claim is untested.","lead":"This paper tests whether small text edits to movie descriptions, made by a large language model, can push chosen movies up or down in a retrieval-augmented recommender. It matters because these recommender systems are increasingly common, and the paper suggests they can be quietly steered by changes that look innocent.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Demotion results in Table 1 contradict the paper's own metric: every demotion row shows lower ranks than the Original baseline, meaning the attacks promoted the targets.","rationale":"The reader's verdict of REJECT is supported. The strongest load-bearing concern is not only that constraints are unverified, as the reader's weakest_assumption emphasized, but that Table 1 directly contradicts the demotion claim: under the paper's own ranking convention, all demotion attacks lower ranks, i.e., promote. This is an internal inconsistency that cannot be resolved by external validation. The promotion scenario is also not robust across configurations, with Sentence Transformer retrieval reversing direction. The 'eluding naive detection' assertion has no supporting detector or measured stealth metrics. Given these failures in the central empirical claim, the rejection stands. I agree with the reader's final verdict but only partially with the stated weakest assumption; the more decisive issue is the sign-direction contradiction in the headline table. A single re-analysis of the raw rank data would settle whether the table is mislabeled or the attacks failed.","tokens_in":6743,"tokens_out":2526,"duration_ms":26600,"concrete_test":"Re-analyze Table 1 by computing signed rank changes, Δrank = rank_attack − rank_original, for every Demotion configuration under the paper's stated convention that lower rank means promotion. A successful demotion requires Δrank > 0. If the printed numbers are accurate, nearly all entries yield Δrank < 0, so the demotion claim is refuted; if the authors instead intended higher ranks to mean promotion, the sign convention must be corrected and the Promotion rows re-examined under that convention. As a secondary check, measure actual token-edit distance and SBERT similarity for each generated description to verify whether the attacks respect the stated 10% and 0.80 constraints.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that LLM-driven textual edits can both promote and demote targeted items. The demotion half of that claim fails on the paper's own reported data. In Table 1, lower rank values are defined as stronger promotion. Yet in every Demotion row, for both OpenAI and Sentence Transformer pipelines, the attack ranks are lower than or nearly equal to the Original baseline: for example, OpenAI LLM-profile ranks are Original 5.72, Emotional 4.95, Neighborhood 5.87, Chain 5.44; Sentence Transformer retrieval ranks are Original 26.99, Emotional 21.69, Neighborhood 25.13, Chain 25.91. Under the paper's convention, these are promotions, not demotions. The text in Section 4 claims 'Chain-based edits again elicit the largest rank changes' without noting that the changes are in the wrong direction. This is an internal inconsistency, not a matter of external consensus. The promotion results are also mixed: in the Sentence Transformer retrieval column, Emotional, Neighborhood, and Chain attacks all increase rank relative to Original (33.00, 29.23, 32.16 vs. 21.01), i.e., they demote instead of promote. Additionally, the abstract's 'eluding naive detection' is unsupported: no detector is defined or run, and the claimed 10% token budget and 0.80 SBERT similarity bound are never verified with measured token-edit distances or semantic similarities. The load-bearing condition for the paper's two-directional attack claim is therefore not merely unverified; it is contradicted by the headline table.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies provider-side data poisoning in retrieval-augmented recommender systems that use embedding-based retrieval plus LLM re-ranking. The attacker rewrites item descriptions under token-edit and semantic-similarity constraints (Section 2, Eq. (1)), using three attack types: Emotional, Neighbor Borrowing, and Chain. Experiments on MovieLens with OpenAI and Sentence Transformer pipelines report promotion and demotion of targeted items, plus recall/nDCG effects. The central claim is that subtle LLM-driven textual rewrites can significantly shift final rankings and item exposures while eluding naive detection.","tokens_in":1608,"tokens_out":1630,"duration_ms":26331,"significance":"If the claims held, the paper would provide a systematic characterization of a realistic attack surface in RAG-based recommenders, together with a formalized threat model and three concrete attack strategies. The explicit plan to release code and data is a strength. However, the load-bearing experimental evidence is internally inconsistent: the demotion results in Table 1 show lower ranks (i.e., promotion) for almost every attack configuration, and the promotion results in the Sentence Transformer condition often move in the wrong direction. The stealthiness claims (10% token budget, 0.80 SBERT threshold, 'eluding naive detection') are asserted but never measured or tested against a defined detector. These issues undermine the paper's two-directional attack claim and its stealthiness conclusion, so the current evidence does not support the abstract's main assertions.","major_comments":[{"comment":"The demotion rows contradict the paper's own metric. The caption states 'lower = stronger promotion,' and Section 4 says a successful demotion increases rank. In the Demotion Scenario, every OpenAI row has lower rank than the Original baseline (e.g., retrieval: Original 25.56 vs. Emotional 22.80, Neighborhood 24.66, Chain 20.60; LLM-profile: Original 5.72 vs. Emotional 4.95, Neighborhood 5.87, Chain 5.44), and most ST rows also show lower or nearly equal ranks (e.g., retrieval: Original 26.99 vs. Emotional 21.69, Neighborhood 25.13, Chain 25.91). The text claims 'Chain-based edits again elicit the largest rank changes' without noting that these changes are in the direction of promotion, not demotion. This is an internal inconsistency in the central experimental result, not a matter of external interpretation.","section":"Table 1, Section 4 (RQ1)"},{"comment":"The promotion results are also mixed and sometimes reverse. In the ST retrieval column, Emotional (33.00), Neighborhood (29.23), and Chain (32.16) all have higher ranks than Original (21.01), i.e., they demote rather than promote. The ST recommendation rows show similar reversals (e.g., Original 5.27 vs. Emotional 8.00; Original 4.92 vs. Emotional 8.50). The paper acknowledges that 'the corresponding ST scenario occasionally reverses the direction of movement,' but this is not a minor caveat: it affects a large fraction of the reported conditions and undercuts the systematic claim that the attacks 'significantly promote or demote targeted items.'","section":"Table 1, Section 4 (RQ2)"},{"comment":"The attack constraints are never verified. The paper defines a 10% token-edit budget delta and a 0.80 SBERT semantic-similarity threshold sigma_min, and the abstract claims attacks 'elude naive detection,' but no measured token-edit distances, no SBERT similarity values, and no detector (naive or otherwise) are reported. Without these measurements, the 'stealthy' and 'subtle' claims are unsupported. The reader cannot tell whether the actual rewrites respected the formal constraints or whether they would be trivially caught by a simple consistency check.","section":"Section 2, Eq. (1); Section 4"},{"comment":"No error bars, significance tests, or per-target counts are reported. The rank values in Table 1 appear to be averages (e.g., 5.89, 4.67), but the number of targeted items, the standard deviation, and the fraction of targets that moved in the intended direction are absent. Given the small absolute rank differences (e.g., 5.72 vs. 5.44 in the demotion LLM condition), a significance test is essential to distinguish attack efficacy from noise. The current presentation does not allow a reader to assess the reliability of any individual result.","section":"Section 3 and Table 1"}],"minor_comments":[{"comment":"The notation is inconsistent: the equation uses Exposure(i) with a change operator Delta, while the text and Table 1 report 'ranking of attacked items,' and the promotion objective is described as 'maximize' while demotion is 'minimize.' Clarify whether the objective is a rank change or an exposure change, and define the direction for each case.","section":"Section 2, Eq. (1)"},{"comment":"Several references to the authors' own prior work (Poison-RAG, Gen-RecSys reviews) are cited in the related work and used to frame the novelty, but no quantitative comparison against those methods is provided. If space is limited, at least one sentence contrasting the attack scenarios or results would help situate the contribution.","section":"References"},{"comment":"The paper contains minor typos and grammatical slips, e.g., 'on the of the MovieLens latest dataset,' 'Δ.)' in Eq. (1), and 'Ranking of attacked items (lower = stronger promotion)' which conflicts with the demotion discussion. A careful proofread is needed.","section":"Throughout"},{"comment":"The claim that 'global performance metrics do not consistently suffer drastic declines' is based on a single table without statistical comparison. The small recall/nDCG differences (e.g., 0.1504 vs. 0.1289) could be within noise; a paired significance test would strengthen the conclusion.","section":"Section 4, RQ3"}],"recommendation":"reject","confidential_remarks":"The paper's central two-directional attack claim is contradicted by its own Table 1, making the main empirical result unreliable in its current form. The reversals are pervasive rather than isolated edge cases, and the stealthiness constraints are never operationalized or measured. These are load-bearing issues that cannot be fixed by local edits; the experiments would need to be rerun and reanalyzed. I would encourage the authors to revisit the direction convention in Table 1, report measured edit distances and similarities, and include per-target statistics before resubmission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the promotion half is suggestive, the demotion half fails on the paper's own numbers, and the \"stealthiness\" evidence is mostly asserted. It's worth reading only as a cautionary example of why you check tables against prose.\n\nOn the plus side, the formal setup in Eq. (1) is clean: token-edit budget plus an SBERT similarity threshold is a sensible way to frame stealth. The three attack variants (emotional, neighbor borrowing, chain) are clearly described, and the example rewrites look like what an LLM would produce. The extension from the authors' Poison-RAG tag-based work to full item descriptions is a legitimate incremental contribution, and the MovieLens setup with two retriever types is a reasonable testbed. If the promotion results stood up, that alone would be a modest but real result.\n\nThe load-bearing problem: Table 1 defines \"lower = stronger promotion.\" In the demotion rows, every attack row has a lower rank than the Original baseline across both retrievers and both recommendation configs (e.g., OpenAI LLM-profile Original 5.72, Emotional 4.95, Chain 5.44; ST retrieval Original 26.99, Emotional 21.69, Chain 25.91). Those are promotions, not demotions. The text claims \"Chain-based edits again elicit the largest rank changes\" without noting the direction is wrong. So the paper's central two-directional claim is contradicted by its own headline table. The promotion results are also mixed: in the ST retrieval column, all three attacks increase rank relative to Original (33.00, 29.23, 32.16 vs. 21.01), i.e., they demote. So the pattern is not even consistent one-directionally.\n\nNo error bars, no significance tests, no target counts, and no code or data accompany the preprint. The \"eluding naive detection\" claim is unsupported: no detector is defined or run, and the claimed 10% token budget and 0.80 SBERT threshold are never verified with measured token-edit distances or semantic similarities. The table caption mentions a \"temporal pipeline\" that the text never explains, further suggesting the results are not fully thought through.\n\nWho this is for: readers working on RAG robustness might cite it as an example of an attempted attack class, but I wouldn't rely on any specific number from it. This is a short adjunct paper; as a full report it underdelivers. My recommendation: reject, pointing to the internal contradiction. If the authors fix the demotion evaluation, add error bars and target counts, and actually measure the stealth constraints, it could become a workshop-level contribution—but as stated, it does not deserve a serious referee.","headline":"The paper introduces a clean formalization of LLM-based metadata poisoning for RAG recommenders, but its demotion results contradict its own headline table, sinking the two-directional attack claim.","tokens_in":7598,"tokens_out":2812,"would_cite":false,"duration_ms":26361,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Editing 10% of a movie's text can rig recommender rankings.","keywords":["Retrieval-Augmented Generation","Recommender Systems","Data Poisoning","Large Language Models","Adversarial Text Attacks","Embedding-Based Retrieval","LLM Re-ranking","Textual Stealthiness"],"falsifier":"A controlled replication could settle the claim: on the same MovieLens pipeline, apply the three rewrites but verify each output actually respects the 10% token budget and the 0.80 SBERT threshold, then measure rank deltas over repeated sampling with different seed items. If the observed rank shifts fall within the bootstrap noise of unmodified descriptions, the attack's effectiveness claim fails; if a metadata-validation filter that rejects any description not matching a trusted source eliminates the shifts, the paper's threat model is the reason rather than the rewrite technique itself.","tokens_in":6481,"feed_emoji":"🎯","tokens_out":4582,"duration_ms":45116,"temperature":0.7,"pith_summary":"Retrieval-augmented recommender systems ground their suggestions in item descriptions, which makes those descriptions an attack surface. This paper claims that a provider-side attacker who rewrites only a small fraction of tokens—about 10%—can push long-tail items up and popular items down in the final rankings, while keeping the rewritten text semantically close enough to the original to evade naive detection. The claim matters because modern RAG pipelines re-index or retrain on updated metadata without provenance checks, so a subtle, semantically plausible rewrite could change what users see. The paper demonstrates the effect on MovieLens across three rewrite strategies—emotional wording, phrases borrowed from neighbor items, and a chained combination—and reports that system-wide Recall and nDCG barely move, meaning ordinary accuracy monitoring would not reveal the attack.","feed_headline":"Editing 10% of a movie's text can rig recommender rankings","feed_subtitle":"Recommender pipelines re-index poisoned metadata, so small semantic rewrites steer which items get surfaced.","key_machinery":"The load-bearing object is the formal attack template of Eq. (1): for each poisoned item $i$, maximize (promote) or minimize (demote) the change in exposure $\\Delta(\\mathrm{Exposure}(i))$ subject to a token-edit bound $H(D_i, \\tilde{D}_i) \\le \\delta|D_i|$ and a semantic-similarity bound $\\mathrm{Sim}(D_i, \\tilde{D}_i) \\ge \\sigma_{\\min}$. The three concrete attack variants—Emotional, Neighbor Borrowing, and Chain—are the mechanisms instantiating this template through LLM rewriting prompts. The machinery does two jobs: it defines 'stealthiness' quantitatively, and it ties the attack's power to two parameters that a defender could, in principle, audit (token distance and embedding similarity).","core_discovery":"The central claim is that LLM-driven textual rewriting of item metadata is a viable provider-side poisoning attack against embedding-based RAG recommenders. In the promotion scenario, editing a long-tail item's description to include emotive positive language or phrases borrowed from popular neighbors moves its average rank from roughly 7.0 to as low as 4.7 in LLM-reranked top-20 lists; in the demotion scenario, chain edits push popular items downward similarly. The attack operates under a token budget of $\\delta|D_i|$ (10% of tokens) and a semantic-similarity floor (SBERT score above 0.80), and the authors show the resulting shifts survive in both retrieval-level top-50 and final top-20 recommendations. A distinctive result is that the OpenAI-based reranking pipeline amplifies these subtle cues more than static Sentence-BERT retrieval, and that global Recall@k and nDCG@k degrade by only a few points, so the poisoning is locally potent but globally inconspicuous.","pith_inferences":["A natural extension the paper does not run: sweep the similarity floor from 0.70 to 0.95 and plot rank shift against the SBERT score; that would show whether there is a threshold below which the LLM rewriter cannot stay effective, which the present results do not establish.","The same attack recipe should transfer to e-commerce and review-driven recommenders, because any metadata the retriever indexes is a candidate surface, though the paper only demonstrates movie descriptions.","RQ2's pattern suggests the LLM reranker is the amplification point; if so, guarding only the embedding index would miss attacks whose effects arrive at generation, an audit implication the paper raises but does not test."],"forward_implications":["A provider-side attacker with write access to item metadata can shift final top-20 recommendations, not just retrieval candidates.","Chain rewrites that combine emotional language with borrowed neighbor phrases produce the largest rank shifts, while relying on a single attack type is weaker.","Global Recall and nDCG barely move under sparse attacks, so monitoring these metrics alone will not expose poisoning.","LLM-based reranking stages amplify small textual cues more than static embedding retrieval, making generative re-rankers the sensitive point.","Defenses should focus on textual provenance and consistency checks, since token-edit limits and semantic-similarity floors do not stop the attack."],"supporting_citations":[{"why":"Supplies the Sentence-BERT encoder and the semantic-similarity threshold used to define stealthiness.","marker":"[9]"},{"why":"Establishes the RAG architecture and grounding argument that the attack targets.","marker":"[6]"},{"why":"Prior tag-based poisoning for RAG recommenders, the closest baseline the paper extends to full descriptions.","marker":"[8]"},{"why":"Shows knowledge-base injection attacks and is cited for the claim that broader metadata rewrites degrade system accuracy.","marker":"[12]"},{"why":"Documents knowledge poisoning of RAG pipelines, motivating the provider-side threat model.","marker":"[13]"},{"why":"Surveys classical poisoning of collaborative filtering, the lineage the textual attack breaks from.","marker":"[5]"},{"why":"Motivates using LLM rewriting to keep alterations coherent and hard to detect.","marker":"[4]"},{"why":"Places the recommender in the generative-model context that the retrieval-augmented pipeline builds on.","marker":"[2]"}],"fun_headline_variants":["Tiny text tweaks can rig recommender rankings","LLM edits to item descriptions silently sway recommendations","10% token edits steer embedded recommenders","Stealthy text poisoning hijacks RAG-based recommendations","Subtle LLM edits manipulate retrieval-augmented recommenders"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"A real RAG recommender must silently accept and re-index rewritten item descriptions with no provenance or consistency check; if the pipeline validates metadata against trusted sources, the attack surface collapses.","fun_headline_variants_meta":{"raw":{"variants":["Tiny text tweaks can rig recommender rankings","LLM edits to item descriptions silently sway recommendations","10% token edits steer embedded recommenders","Stealthy text poisoning hijacks RAG-based recommendations","Subtle LLM edits manipulate retrieval-augmented recommenders"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000507,"raw_usage":{"total_tokens":2449,"prompt_tokens":900,"completion_tokens":1549,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":1473}},"tokens_in":516,"tokens_out":1549,"duration_ms":10567,"temperature":1.0,"reasoning_tokens":1473,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:09:59.491018+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A controlled replication could settle the claim: on the same MovieLens pipeline, apply the three rewrites but verify each output actually respects the 10% token budget and the 0.80 SBERT threshold, then measure rank deltas over repeated sampling with different seed items. If the observed rank shifts fall within the bootstrap noise of unmodified descriptions, the attack's effectiveness claim fails; if a metadata-validation filter that rejects any description not matching a trusted source eliminates the shifts, the paper's threat model is the reason rather than the rewrite technique itself.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior tag-based poisoning for RAG recommenders, the closest baseline the paper extends to full descriptions."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates using LLM rewriting to keep alterations coherent and hard to detect."}],"review_version":1}