Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders

2026-07-26

AI Summary

This work identifies a novel security vulnerability in large language models (LLMs) used for listwise re-ranking recommendation: their sensitivity to input order renders them susceptible to position bias, enabling attackers to promote a target item into the top-k positions solely by reordering candidates—without altering content or model parameters. The study formally defines this ordering sensitivity as a security flaw and introduces promo@k, a metric to quantify attack efficacy, alongside a stability measure that predicts model vulnerability without executing actual attacks. Through permutation-based attack simulations, bidirectional T5 scoring, permutation consistency regularization, and architectural invariance analyses on MovieLens and Amazon datasets, the authors demonstrate promo@5 values as high as 0.57. While pointwise scoring eliminates positional bias, it degrades ranking performance; in contrast, the proposed mitigation strategies substantially reduce vulnerability while preserving effectiveness.

Abstract

Large language models (LLMs) used as listwise rerankers in recommendation systems suffer from position bias when serializing candidate sets into prompts. We show this order sensitivity creates an exploitable attack surface: an attacker can promote a label-0 target into the top-$k$ solely by reordering candidates, without changing item content, labels, or model parameters. We introduce $\mathrm{promo}@k$ to quantify this vulnerability, measuring the fraction of label-0 targets that can be elevated into top-$k$ rankings via permutation. Evaluating across three domains (MovieLens, Amazon Books, and Amazon Fashion), $\mathrm{promo}@5$ reaches up to 0.57 at an attack budget of $R$ = 50 orderings. Furthermore, ordinary permutation stability predicts vulnerability without running the attack. While a bidirectional T5 encoder scorer reduces exposure, permutation-consistency regularization and architectural invariance effectively mitigate it. Pointwise scoring avoids the bias issue but degrades ranking quality. These results demonstrate that input candidate order in listwise LLM reranking is a security-relevant attack vector. Code and data are available at https://github.com/geoz-lab/position_bias_attack.

Problem

• position bias
• order sensitivity
• LLM recommender
• adversarial attack
• listwise ranking

Innovation

• position bias
• order sensitivity
• listwise reranking
• adversarial attack
• permutation invariance