The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems

arXiv:2609.27155 · cs.CR, cs.AI, cs.LG, stat.ML · Submitted 2026-09-22 · Read on arXiv

cs.CR, cs.AI, cs.LG, stat.ML

Submitted: 2026-09-22

Updated: 2026-09-22

Code: https://github.com/taazkareem/twitter-mcp-server

Project page: https://t.co/ncPENKuiBd

Terminology

• Transferability — 6× in this paper · explained in 4 episodes
• Transformer — 6× in this paper · explained in 2 episodes
• Ablation — 5× in this paper · explained in 1 episode
• Agent Memory — 4× in this paper · explained in 1 episode
• Cosine Similarity — 4× in this paper · explained in 3 episodes
• AI Agents — 3× in this paper · explained in 2 episodes
• Embeddings — 3× in this paper · explained in 2 episodes
• Ablation Studies — 2× in this paper · explained in 1 episode
• Benchmark — 2× in this paper · explained in 2 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Adaptation — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Distillation — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Multi-Agent System — 1× in this paper · explained in 6 episodes
• Semantic Similarity — 1× in this paper · explained in 2 episodes

Sources

• PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections
• Towards Large-scale Generative Ranking
• Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection
• Defeating Prompt Injections by Design
• Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats
• VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit
• Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition
• OASIS: Open Agent Social Interaction Simulations with One Million Agents
• Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
• Is Your LLM-as-a-Recommender Agent Trustable? LLMs' Recommendation is Easily Hacked by Biases (Preferences)
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs