Pith. sign in

REVIEW 5 major objections 6 minor 54 references

LLM4MEA: Data-free Model Extraction Attacks on Sequential Recommenders via Large Language Models

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that an LLM-driven agent acting as a synthetic user can generate interaction sequences that make a surrogate model mimic a black-box sequential recommender far better than random or autoregressive sampling.

desk verdict A genuinely new attack recipe whose headline claim—that the LLM drives the gains—is not actually isolated by the experiments. read the letter →

arxiv 2507.16969 v1 pith:ITZQ5HPB submitted 2025-07-22 cs.IR

Shilong Zhao , Fei Sun , Kaike Zhang , Shaoling Jing , Du Su , Zhichao Shi , Zhiyi Yin , Huawei Shen
show 1 more author
Xueqi Cheng
This is my paper
classification cs.IR
keywords modelextractionattacksequentialrecommendationlargelanguageagentdatasynthesisdata-freesurrogatedebiasingrecommendersecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that data-free model extraction attacks on sequential recommenders fail mainly because synthetic user histories are sampled randomly, so they do not resemble real user behavior. The authors propose LLM4MEA, in which an LLM acts as a synthetic user: it reads a compressed history and a one-sentence preference summary, then picks items from the target system's recommendation list to extend the interaction. Memory compression based on the serial position effect, preference stabilization, and two debiasing steps keep the generated sequences realistic. The authors report that the surrogate data's N-gram divergence from secret data drops by up to 64.98%, and extraction agreement with the target model improves by 44.82% on average over baselines. If correct, this shows that semantic priors in LLMs can substitute for access to real user data when stealing recommender functionality.

What carries the argument

The central object is an LLM-driven agent used as a sequence sampler for surrogate data generation. It combines a Memory Compression module, which keeps the first and last floor(size/2) items of the history following the serial position effect, and a Preference Stabilization module, which produces a one-sentence LLM summary of the user's preferences once the history reaches length n. Two debiasing mechanisms complete the machinery: a uniform random sampler over the item space whose sample count follows the coupon collector expectation to reach 90% item coverage, and shuffling of the target's recommendation list before LLM selection. This sampler drives an autoregressive loop in which each chosen item extends the sequence and triggers a new top-k query, producing training pairs for ranking distillation of the surrogate model.

What would settle it

Train a sequential recommender on a dataset whose item titles and categories are deliberately made misleading or replaced by opaque identifiers, run LLM4MEA against it, and compare Agreement@K and N-gram divergence with the same attack using real titles: if the gains over random sampling disappear, the attack's apparent realism comes from the LLM's semantic priors rather than from faithful preference reconstruction.

Watch

Extended reading notes

Core claim

LLM4MEA is a data-free model extraction attack that autoregressively builds surrogate user sequences by querying a black-box sequential recommender: at each step the target returns a top-k list and the LLM-driven agent, prompted with compressed memory and a stabilized preference summary, selects the next item or items it would view. The resulting sequence-response pairs train a surrogate model by ranking-based distillation. The paper's central claim is that this generation procedure produces surrogate data with much lower n-gram divergence from the secret training data than random sampling or SR-DFME, and surrogate models with higher Agreement@K with the target across NARM, SASRec, and BERT4Rec, in both data-free and data-limited settings. The debiasing components are part of the claim: a random sampler sized by the coupon collector problem increases item coverage, and shuffling recommendation lists removes the LLM's position bias. The authors also claim that longer recommendation lists increase attack success and that randomly replacing a fraction of items in returned lists degrades extraction, offering a lightweight defense.

Load-bearing premise

The whole method depends on the LLM's item choices, made from a compressed history and a one-sentence preference summary, actually standing in for the hidden user-preference distribution that the target recommender learned.

Editorial extensions

If this is right

  • If LLM4MEA works as reported, an attacker with only item metadata and black-box top-k access can train a surrogate model that agrees with the target on a substantial share of top-1 and top-10 lists without any real user data.
  • Shorter recommendation lists reduce extraction success, so an API provider can lower risk by capping the returned list length at what users plausibly browse.
  • Randomly replacing a fraction of items in each returned list degrades Agreement@1 substantially while having only a small effect on normal recommendation quality, giving a simple defense.
  • The choice of LLM changes extraction agreement only marginally across GPT-4o-mini and several open 7-8B models, implying the attack does not hinge on one specific frontier model.
  • Cross-architecture extraction performance drops sharply, so keeping the model architecture confidential is itself a meaningful risk control.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: If the LLM's semantic priors about item titles and categories are what carry the attack, then item vocabularies with opaque or misleading titles would likely erase the divergence gains, meaning the attack's transfer to niche domains with uninformative item IDs remains untested.
  • Editorial extension: The method can be inverted as an auditing tool: by probing which inferred user preferences most reliably reproduce the target's rankings, one could expose what latent preference dimensions a recommender has encoded.
  • Editorial extension: The proposed list-perturbation defense invites an adaptive attacker who trains the surrogate on perturbed lists and then denoises the rankings, so the defense is likely a temporary mitigation rather than a permanent fix.
  • Editorial extension: Because the pipeline needs only item side information and black-box rankings, the same agent loop could extend to non-sequential or session-based APIs, though the agreement metric would need redefinition.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes LLM4MEA, a data-free model extraction attack against sequential recommender systems. The method generates synthetic user interaction sequences by pairing a black-box target recommender with an LLM-driven agent: the agent receives the target's top-K recommendation list, a compressed memory of the current history, and a one-sentence preference summary, then selects items to extend the sequence. Two debiasing components are added: a uniform random sampler intended to reduce exposure bias from the autoregressive loop, and recommendation-list shuffling intended to reduce the LLM's position bias. The resulting sequences are used, together with the target's ranked outputs, to train a surrogate model via ranking distillation. Experiments on Beauty, Games, and Steam with NARM, SASRec, and BERT4Rec report Agreement@K and recommendation-metric results, an n-gram divergence analysis of synthetic versus secret data, an ablation of the two debiasing components, a study of LLM choice and list length, and a simple random-replacement defense.

Significance. If the central attribution were supported, the paper would be a useful demonstration that LLM priors can improve the quality of synthetic interaction data for model extraction, and the defense/hyperparameter analysis would be practically relevant. The manuscript has concrete strengths: the code is released, the idea of using an LLM as a human-like ranker is clearly presented, the bias analysis in Section 5.4 is informative, and the cost estimates in Section 5.5.3 are a useful practical datapoint. However, the experimental design does not isolate the LLM's contribution from the random-sampling debiasing component, and several experimental protocols are under-specified. These issues bear directly on the paper's headline claim that the LLM-driven agent is what drives the substantial performance gains.

major comments (5)
  1. [Section 4.3.1 / Table 2] The method is a mixture of LLM-selected sequences and uniform-random sequences, but no ablation removes the LLM while keeping the random sampler and list shuffling. This matters because Random alone already outperforms SR-DFME in many cells of Table 2 (e.g., NARM/Beauty Free Agr@1 0.4386 vs 0.2733; BERT4Rec/Beauty Free Agr@1 0.6541 vs 0.1827), and Ours-eBias, which is the LLM agent without the exposure-bias random sampler, is often worse than Random (e.g., NARM/Beauty Free Agr@1 0.2907 vs 0.4386). The large gains of Ours over SR-DFME could therefore be driven entirely by the random-sampling component rather than by the LLM's semantic item choices. I request an ablation that replaces the LLM's item selection with random selection from the same recommendation list while keeping the autoregressive querying, random-sampler augmentation, and shuffling intact, so the marginal contribution of the LLM can be measured.
  2. [Section 3.1 / Section 5.2.1] The Data-limited setting is not specified precisely enough to be reproducible or to support the claims made for it. The threat model says only that the setting uses 'short sequences from few users,' but Section 5 and the appendix do not state the number of users, the sequence length, how the limited users/sequences are sampled, or how the limit compares with the 5,000 sequences used in the data-free setting. Since Table 2's Limited rows are used to argue for consistent improvements over SR-DFME, the exact protocol must be reported.
  3. [Section 5.2 / Tables 2-4] All reported numbers appear to be from a single run, with no confidence intervals, standard deviations, or significance tests. The LLM agent is invoked with a stochastic API (GPT-4o-mini), and surrogate model training also involves stochastic optimization, so the claimed improvements and the percentage gains in Section 5.2.1 need error bars over repeated runs before 'significantly outperforms' is supported.
  4. [Table 2 / Section 5.1.4] In several cells the surrogate trained on synthetic data achieves higher Agreement with the target than the surrogate trained on the true secret data (e.g., NARM/Beauty Free Agr@1 0.4957 vs Secret 0.4765; BERT4Rec/Beauty Free Agr@1 0.6299 vs Secret 0.6773 is not higher, but NARM is). This suggests that Agreement@K may reward popularity alignment rather than genuine extraction of user-level preference patterns. I ask the authors to report agreement separately for head versus tail items, or to show that high Agreement coincides with fidelity to user-level behavior rather than merely to the target's most frequent outputs.
  5. [Table 4 / Section 5.6] The defense experiment is presented as having 'a slight impact' on recommendation quality, but no quantitative measure of the target model's recommendation performance after the random-item replacement is reported. The table shows only MEA performance. Since the defense's practical value depends on the accuracy/utility trade-off, the paper should report NDCG/Recall of the defended recommender on the original test split, along with the attack metrics.
minor comments (6)
  1. [Equation (7) / Appendix A] The coupon-collector formula in Eq. (7) uses |I| as the item-space size and m as the target coverage, but the proof in Appendix A redefines m as the total number of coupons and n as the target count, and the summation limits do not match Eq. (7). Please align the notation.
  2. [Equation (9)] The proposed N-gram Div metric is not fully specified: the smoothing factor epsilon, the set of n-grams over which the sum runs, and the handling of sequence boundaries are not described, and no value of epsilon is given in Section 5.1.4 or the experiments.
  3. [Figure 5] In the submitted manuscript, Figure 5 appears to contain raw escaped text rather than an interpretable heatmap. The cross-architecture Agreement@10 results cannot be read.
  4. [Table 4] The symbols '%' and '!' in Table 4 are not defined in the caption or text; presumably they denote defense off and on, but this should be stated.
  5. [Section 5.1.3 and 5.1.4] There are several typos: 'simplest approach„' in Section 5.1.3, 'mesure' in Section 5.1.4, and an extra parenthesis in Section 5.2.1 ('shown in Table 2).').
  6. [References] Reference [16] is missing a year and venue ('[n. d.]'); please complete the bibliographic details.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline metrics are measured against target outputs and secret data, not fitted; the only near-circular concern is an ablation gap, not a derivation loop.

full rationale

The paper's claimed derivation chain is empirical rather than definitional. Surrogate data are generated by querying the target model under an LLM-driven agent and a uniform random sampler (Eqs. 5-6), and the surrogate is trained by distillation on the collected top-k outputs (Eqs. 2-3). The evaluation metrics, Agreement@K (Eq. 8) and N-gram Div (Eq. 9), are computed after the fact against the target model's outputs and the secret dataset; no parameter is fitted to these metrics and then reported as a prediction. The 90% item-coverage target (Eq. 7) is a design choice, not a quantity obtained by optimizing N-gram Div, so the reported 64.98% uni-gram divergence reduction and 44.82% average agreement improvement are comparative measurements rather than identities forced by construction. The manuscript also does not rely on load-bearing self-citations: the citations to BERT4Rec and to related LLM-ranking work are architectural or contextual, and no uniqueness theorem or prior result by the same authors is invoked to forbid alternatives. The closest concern is experimental rather than circular: the full method includes the uniform random sampler, which is the same operation as the Random baseline (Eq. 6), and the Ours-vs-Ours-eBias comparison suggests that much of the gain may come from that sampler rather than from the LLM's semantic selections. That is an ablation and attribution gap, not a definitional equivalence, and it does not make the central claims reduce to their own inputs.

Assumptions & free parameters 7 free parameters · 8 assumptions · 0 invented entities

The central method rests on LLM behavioral priors, hand-chosen architectural knobs (memory size, preference stabilization threshold, coverage target), and the standard black-box sequential recommendation threat model. No new physical entities are postulated.

free parameters (7)
  • Memory Compression capacity size = not reported
    Controls how much interaction history is kept for LLM context (Eq. 4); hand-chosen, affects data quality and cost.
  • Preference Stabilization activation threshold n = not reported
    History length at which the LLM generates a preference summary (Section 4.2.2); hand-chosen, affects preference drift.
  • Item coverage target m = 0.9 |I|
    Used in the coupon collector calculation to set the number of random debiasing samples (Section 4.3.1); ad hoc balance between coverage and cost.
  • Number of surrogate sequences = 5000
    Fixed across experiments; larger sets would likely improve extraction at higher cost.
  • Target recommendation list length k = 100
    Threat model assumption; Figure 8 shows attack effectiveness grows with k.
  • Multi-item selection count n = 5 in overhead example, otherwise unspecified
    Acceleration from Eq. 5; affects computational cost and realism.
  • N-gram Div smoothing factor epsilon = not reported
    Used in Eq. 9 to avoid zero-probability log terms; chosen by hand, influences reported divergence reductions.
assumptions (8)
  • domain assumption The attacker observes item titles and categories (side information) for all items.
    Section 3.1 Item Visibility; without this, the LLM cannot make semantically informed selections.
  • domain assumption The target model returns only a top-k ranked item list without probabilities.
    Section 3.2.1; this defines the black-box interface used in the distillation loss Eq. 3.
  • domain assumption The attacker knows the target model's architecture and can train a same-architecture surrogate.
    Section 3.1 and the cross-architecture heatmaps; the central comparison assumes identical architecture.
  • domain assumption An LLM, prompted with compressed history and a preference summary, can select items with human-like consistency.
    Section 4.2 and the prompt template in Figure 3; the whole generation pipeline depends on this capability.
  • ad hoc to paper The serial position effect (primacy and recency) is a valid heuristic for summarizing interaction history.
    Eq. 4 and Section 4.2.1; adopted from cognitive psychology reference [34] without validating on recommender data.
  • ad hoc to paper Uniform random sampling with coverage derived from the Coupon Collector problem reduces exposure bias.
    Section 4.3.1; the proof in Appendix A has inconsistent variables, so the implemented sample count is uncertain.
  • ad hoc to paper The defense replaces 10% of recommended items with random items, presumably without substantially harming recommendation quality.
    Section 5.6, Table 4; the paper does not measure target utility loss under the defense.
  • domain assumption The target model and surrogate use the same data split protocol as [39] (last two items held out).
    Section 5.1.1; standard sequential recommendation evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLM4MEA: Data-free Model Extraction Attacks on Sequential Recommenders via Large Language Models." pith.science (2026). https://pith.science/paper/ITZQ5HPB

@misc{pith2026250716969,
  author       = {Pith},
  title        = {Pith review of: LLM4MEA: Data-free Model Extraction Attacks on Sequential Recommenders via Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ITZQ5HPB}},
  note         = {Machine review of arXiv:2507.16969}
}
read the original abstract

Recent studies have demonstrated the vulnerability of sequential recommender systems to Model Extraction Attacks (MEAs). MEAs collect responses from recommender systems to replicate their functionality, enabling unauthorized deployments and posing critical privacy and security risks. Black-box attacks in prior MEAs are ineffective at exposing recommender system vulnerabilities due to random sampling in data selection, which leads to misaligned synthetic and real-world distributions. To overcome this limitation, we propose LLM4MEA, a novel model extraction method that leverages Large Language Models (LLMs) as human-like rankers to generate data. It generates data through interactions between the LLM ranker and target recommender system. In each interaction, the LLM ranker analyzes historical interactions to understand user behavior, and selects items from recommendations with consistent preferences to extend the interaction history, which serves as training data for MEA. Extensive experiments demonstrate that LLM4MEA significantly outperforms existing approaches in data quality and attack performance, reducing the divergence between synthetic and real-world data by up to 64.98% and improving MEA performance by 44.82% on average. From a defensive perspective, we propose a simple yet effective defense strategy and identify key hyperparameters of recommender systems that can mitigate the risk of MEAs.

Figures

Figures reproduced from arXiv: 2507.16969 by the authors.

Figure 1
Figure 1. The MEA framework trains surrogate models on [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Framework overview. Left: Sequences are autoregressively generated by querying the target model, with item selection [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The prompt template integrates outputs from the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 6
Figure 6. Figure 6: The Uni-gram Div and Bi-gram Div metric between [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Analysis of biases: (a) exposure bias in data genera [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

54 extracted references · 23 canonical work pages

  1. [1]

    Shengnan An, Zexiong Ma, Zeqi Lin, Nanning Zheng, and Jian-Guang Lou. 2024. Make Your LLM Fully Utilize the Context. arXiv preprint arXiv:2404.16811 (2024)

    arXiv 2024

  2. [2]

    Yingpeng Du, Di Luo, Rui Yan, Hongzhi Liu, Yang Song, Hengshu Zhu, and Jie Zhang. 2023. Enhancing Job Recommendation through LLM-based Generative Adversarial Networks. arXiv:2307.10747 [cs.IR]

    work page Pith review arXiv 2023

  3. [3]

    Yue Feng, Shuchang Liu, Zhenghai Xue, Qingpeng Cai, Lantao Hu, Peng Jiang, Kun Gai, and Fei Sun. 2023. A Large Language Model Enhanced Conversational Recommender System. arXiv:2308.06212 [cs.IR]

    arXiv 2023

  4. [4]

    Yunfan Gao, Tao Sheng, Youlin Xiang, Yun Xiong, Haofen Wang, and Jiawei Zhang. 2023. Chat-REC: Towards Interactive and Explainable LLMs-Augmented Recommender System. arXiv:2303.14524 [cs.IR]

    arXiv 2023

  5. [5]

    Shijie Geng, Shuchang Liu, Zuohui Fu, Yingqiang Ge, and Yongfeng Zhang. 2023. Recommendation as Language Processing (RLP): A Unified Pretrain, Personalized Prompt and Predict Paradigm (P5). arXiv:2203.13366 [cs.IR]

    arXiv 2023

  6. [6]

    Ruining He and Julian McAuley. 2016. Ups and downs: Modeling the visual evolution of fashion trends with one-class collaborative filtering. In proceedings of the 25th international conference on world wide web . 507–517

    work page 2016

  7. [7]

    Akshit Jindal, Vikram Goyal, Saket Anand, and Chetan Arora. 2024. Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selection. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 3823–3832

    work page 2024

  8. [8]

    Wang-Cheng Kang and Julian McAuley. 2018. Self-attentive sequential recom- mendation. In 2018 IEEE international conference on data mining (ICDM) . IEEE, 197–206

    2018

Show all 54 references
  1. [9]

    Pratik Karmakar and Debabrota Basu. 2023. Marich: A query-efficient distribu- tionally equivalent model extraction attack using public data. arXiv preprint arXiv:2302.08466 (2023)

    2023 arXiv

  2. [10]

    Yuxuan Lei, Jianxun Lian, Jing Yao, Xu Huang, Defu Lian, and Xing Xie. 2023. RecExplainer: Aligning Large Language Models for Recommendation Model Interpretability. arXiv:2311.10947 [cs.IR]

    2023 arXiv

  3. [11]

    Jing Li, Pengjie Ren, Zhumin Chen, Zhaochun Ren, Tao Lian, and Jun Ma. 2017. Neural attentive session-based recommendation. In Proceedings of the 2017 ACM on Conference on Information and Knowledge Management . 1419–1428

    2017

  4. [12]

    Tianle Li, Ge Zhang, Quy Duc Do, Xiang Yue, and Wenhu Chen. 2024. Long-context llms struggle with long in-context learning. arXiv preprint arXiv:2404.02060 (2024)

    2024 arXiv

  5. [13]

    Yuan Li, Yixuan Zhang, and Lichao Sun. 2023. Metaagents: Simulating interactions of human behaviors for llm-based task-oriented coordination via collaborative generative agents. arXiv preprint arXiv:2310.06500 (2023)

    2023 arXiv

  6. [14]

    Zelong Li, Jianchao Ji, Yingqiang Ge, Wenyue Hua, and Yongfeng Zhang. 2024. PAP-REC: Personalized Automatic Prompt for Recommendation Language Model. arXiv:2402.00284 [cs.IR]

    2024 arXiv

  7. [15]

    Jiayi Liao, Sihang Li, Zhengyi Yang, Jiancan Wu, Yancheng Yuan, and Xiang Wang

  8. [16]

    Yiyong Liu, Rui Wen, Michael Backes, and Yang Zhang. [n. d.]. On the Importance of Diversity in Data-free Model Stealing. ([n. d.])

  9. [17]

    Yue Liu, Shihao Zhu, Jun Xia, Yingwei Ma, Jian Ma, Wenliang Zhong, Guannan Zhang, Kejun Zhang, and Xinwang Liu. 2024. End-to-end Learnable Clustering for Intent Learning in Recommendation. arXiv:2401.05975 [cs.IR]

    2024 arXiv

  10. [18]

    Haokai Ma, Ruobing Xie, Lei Meng, Xin Chen, Xu Zhang, Leyu Lin, and Zhan- hui Kang. 2024. Plug-in Diffusion Model for Sequential Recommendation. arXiv:2401.02913 [cs.IR]

    2024 arXiv

  11. [19]

    Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel

  12. [20]

    Sheshera Mysore, Andrew McCallum, and Hamed Zamani. 2023. Large Language Model Augmented Narrative Driven Recommendations. arXiv:2306.02250 [cs.IR]

    2023 arXiv

  13. [21]

    Apurva Pathak, Kshitiz Gupta, and Julian McAuley. 2017. Generating and person- alizing bundle recommendations on steam. InProceedings of the 40th International ACM SIGIR Conference on Research and Development in Information Retrieval . 1073–1076

    2017

  14. [22]

    Hao Peng, Shixin Guo, Dandan Zhao, Yiming Wu, Jianming Han, Zhe Wang, Shouling Ji, and Ming Zhong. 2023. Query-efficient model extraction for text classification model in a hard label setting. Journal of King Saud University- Computer and Information Sciences 35, 4 (2023), 10–20

    2023

  15. [23]

    Petrov and Craig Macdonald

    Aleksandr V. Petrov and Craig Macdonald. 2023. Generative Sequential Recom- mendation with GPTRec. arXiv:2306.11114 [cs.IR]

    2023 arXiv

  16. [24]

    Mingwen Shao, Lingzhuang Meng, Yuanjian Qiao, Lixu Zhang, and Wangmeng Zuo. 2023. Data-free Black-box Attack based on Diffusion Model. arXiv preprint arXiv:2307.12872 (2023)

    2023 arXiv

  17. [25]

    Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, and Peng Jiang

  18. [26]

    Arpita Vats, Vinija Jain, Rahul Raja, and Aman Chadha. 2024. Exploring the Impact of Large Language Models on Recommender Systems: An Extensive Review. arXiv preprint arXiv:2402.18590 (2024)

    2024 arXiv

  19. [27]

    Dickerson, and Chirag Shah

    Sahil Verma, Ashudeep Singh, Varich Boonsanong, John P. Dickerson, and Chirag Shah. 2023. RecRec: Algorithmic Recourse for Recommender Systems. In Pro- ceedings of the 32nd ACM International Conference on Information and Knowledge Management. ACM. doi:10.1145/3583780.3615181

    2023

  20. [28]

    Mengting Wan and Julian McAuley. 2018. Item recommendation on monotonic behavior chains. In Proceedings of the 12th ACM conference on recommender systems. 86–94

    2018

  21. [29]

    Cheng Wang, Jiacheng Sun, Zhenhua Dong, Jieming Zhu, Zhenguo Li, Ruixuan Li, and Rui Zhang. 2023. Data-free Knowledge Distillation for Reusing Recom- mendation Models. In Proceedings of the 17th ACM Conference on Recommender Systems. 386–395

    2023

  22. [30]

    Lei Wang, Jingsen Zhang, Hao Yang, Zhiyuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Ruihua Song, Wayne Xin Zhao, Jun Xu, Zhicheng Dou, Jun Wang, and Ji-Rong Wen. 2023. When Large Language Model based Agent Meets User Behavior Analysis: A Novel User Simulation Paradi...

    2023 arXiv

  23. [31]

    Lei Wang, Songheng Zhang, Yun Wang, Ee-Peng Lim, and Yong Wang

  24. [32]

    Yan Wang, Zhixuan Chu, Xin Ouyang, Simeng Wang, Hongyan Hao, and Yue

  25. [33]

    Zifeng Wang, Chufan Gao, Cao Xiao, and Jimeng Sun. 2023. MediTab: Scal- ing Medical Tabular Data Predictors via Data Consolidation, Enrichment, and Refinement. arXiv:2305.12081 [cs.LG]

    2023 arXiv

  26. [34]

    Euphemia Wong. 2018. Serial position effect: How to create better user interfaces. INTERACTION DESIGN FOUNDATION (2018)

    2018

  27. [35]

    Conference’17, July 2017, Washington, DC, USA Zhao, et al

    LLM4Vis: Explainable Visualization Recommendation using ChatGPT. Conference’17, July 2017, Washington, DC, USA Zhao, et al. arXiv:2310.07652 [cs.HC]

    2017 arXiv

  28. [36]

    Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, et al. 2023. The rise and potential of large language model based agents: A survey. arXiv preprint arXiv:2309.07864 (2023)

    2023 arXiv

  29. [37]

    Youshao Xiao, Shangchun Zhao, Zhenglei Zhou, Zhaoxin Huan, Lin Ju, Xiaolu Zhang, Lin Wang, and Jun Zhou. 2024. G-Meta: Distributed Meta Learning in GPU Clusters for Large-Scale Recommender Systems. arXiv:2401.04338 [cs.LG]

    2024 arXiv

  30. [38]

    Fan Yang, Zheng Chen, Ziyan Jiang, Eunah Cho, Xiaojiang Huang, and Yan- bin Lu. 2023. PALR: Personalization Aware LLMs for Recommendation. arXiv:2305.07622 [cs.IR]

    2023 arXiv

  31. [39]

    Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. 2021. Black-box attacks on sequential recommenders via data-free model extraction. InProceedings of the 15th ACM conference on recommender systems . 44–54

    2021

  32. [40]

    Yunjia Xi, Weiwen Liu, Jianghao Lin, and Xiaoling Cai. 2023. Towards Open- World Recommendation with Knowledge Augmentation from Large Language Models. arXiv:2306.10933 [cs.IR]

    2023 arXiv

  33. [41]

    Hui Zhang and Fu Liu. 2024. Few-shot Model Extraction Attacks against Sequen- tial Recommender Systems. arXiv preprint arXiv:2411.11677 (2024)

    2024

  34. [42]

    Junjie Zhang, Ruobing Xie, Yupeng Hou, Wayne Xin Zhao, Leyu Lin, and Ji-Rong Wen. 2023. Recommendation as Instruction Following: A Large Language Model Empowered Recommendation Approach. arXiv:2305.07001 [cs.IR]

    2023 arXiv

  35. [43]

    Sixiao Zhang, Hongzhi Yin, Hongxu Chen, and Cheng Long. 2024. Defense Against Model Extraction Attacks on Recommender Systems. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining . 949–957

    2024

  36. [44]

    Yang Zhang, Fuli Feng, Jizhi Zhang, Keqin Bao, Qifan Wang, and Xiangnan He

  37. [45]

    Zhenrui Yue, Sara Rabhi, Gabriel de Souza Pereira Moreira, Dong Wang, and Even Oldridge. 2023. LlamaRec: Two-stage recommendation using large language models for ranking. arXiv preprint arXiv:2311.02089 (2023)

    2023 arXiv

  38. [46]

    Zhihao Zhu, Rui Fan, Chenwang Wu, Yi Yang, Defu Lian, and Enhong Chen

  39. [47]

    Zhihao Zhu, Chenwang Wu, Rui Fan, Defu Lian, and Enhong Chen. 2023. Mem- bership inference attacks against sequential recommender systems. InProceedings of the ACM Web Conference 2023 . 1208–1219. A Proof for a Variant of the Coupon Collector Problem Proof. Let𝐾𝑖 denote the nu...

    2023

  40. [50]

    arXiv:2310.19488 [cs.IR]

    CoLLM: Integrating Collaborative Embeddings into Large Language Models for Recommendation. arXiv:2310.19488 [cs.IR]

    arXiv

  41. [51]

    Shiqian Zhao, Kangjie Chen, Meng Hao, Jian Zhang, Guowen Xu, Hongwei Li, and Tianwei Zhang. 2023. Extracting Cloud-based Model with Prior Knowledge. arXiv preprint arXiv:2306.04192 (2023)

    2023 arXiv

  42. [53]

    arXiv preprint arXiv:2312.11571 (2023)

    Model Stealing Attack against Recommender System. arXiv preprint arXiv:2312.11571 (2023)

    2023 arXiv

  43. [2015]

    In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval

    Image-based recommendations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval. 43–52

  44. [2019]

    In Proceedings of the 28th ACM international conference on information and knowledge management

    BERT4Rec: Sequential recommendation with bidirectional encoder rep- resentations from transformer. In Proceedings of the 28th ACM international conference on information and knowledge management . 1441–1450

  45. [2023]

    arXiv:2312.02445 [cs.IR]

    LLaRA: Aligning Large Language Models with Sequential Recommenders. arXiv:2312.02445 [cs.IR]

    arXiv

  46. [2024]

    arXiv:2308.10835 [cs.IR]

    Enhancing Recommender Systems with Large Language Model Reasoning Graphs. arXiv:2308.10835 [cs.IR]

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.