BadInterpreter: Backdoor Attack on LLM-based Interpretable Recommendation

preprint OA: closed CC-BY-4.0
📄 Open PDF Full text JSON View at publisher

Abstract

Abstract Large Language Models (LLMs) has promoted miscellaneous models and downstream applications, driving the progress of LLM agents by enhancing their ability to comprehend and generate interpretable reasoning. Recently, the security of LLM agents has become an increasingly popular research topic, where backdoor attacks show potential devastation by injecting a covert backdoor to manipulate the output. Our findings show that LLM agents fine-tuned for recommendation tasks are particularly vulnerable to the embedding of imperceptible backdoors, even when recommendation explanations are required. We introduce BadInterpreter, a simple yet effective backdoor attack for LLM-based interpretable recommendation systems, enabling attackers to manipulate product recommendations and explanations without altering ground-truth labels. In interpretable recommendation, LLM agents are asked to provide explanations for product recommendations to meet user needs. We propose a novel LLM-based pipeline to construct poisoned fine-tuning data, where the agent is expected to recommend the target product with rational recommendation explanations. Attacked by our BadInterpreter, LLM agents prioritize recommending the target products whose information contains attacker-designed triggers in a dynamic interactive environment, along with convincing explanations. Our attack consistently achieves robust attack success rates exceeding 94% on two benchmark e-shopping datasets with four distinct LLMs. While backdoor attacks represent a well-explored threat in natural language processing models, their application and impact within the specific context of LLM-based interpretable recommendation systems remain largely uncharted territory. To our knowledge, this study pioneers the investigation of such vulnerabilities in this critical domain. Our work reveals that constructing LLM-based recommendation systems on untrusted LLMs poses a severe threat.
Full text 24,485 characters · extracted from preprint-html · click to expand
BadInterpreter: Backdoor Attack on LLM-based Interpretable Recommendation | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article BadInterpreter: Backdoor Attack on LLM-based Interpretable Recommendation Bing Wang, Jing Fang, Shengsheng Qian This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8024735/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 10 You are reading this latest preprint version Abstract Large Language Models (LLMs) has promoted miscellaneous models and downstream applications, driving the progress of LLM agents by enhancing their ability to comprehend and generate interpretable reasoning. Recently, the security of LLM agents has become an increasingly popular research topic, where backdoor attacks show potential devastation by injecting a covert backdoor to manipulate the output. Our findings show that LLM agents fine-tuned for recommendation tasks are particularly vulnerable to the embedding of imperceptible backdoors, even when recommendation explanations are required. We introduce BadInterpreter, a simple yet effective backdoor attack for LLM-based interpretable recommendation systems, enabling attackers to manipulate product recommendations and explanations without altering ground-truth labels. In interpretable recommendation, LLM agents are asked to provide explanations for product recommendations to meet user needs. We propose a novel LLM-based pipeline to construct poisoned fine-tuning data, where the agent is expected to recommend the target product with rational recommendation explanations. Attacked by our BadInterpreter, LLM agents prioritize recommending the target products whose information contains attacker-designed triggers in a dynamic interactive environment, along with convincing explanations. Our attack consistently achieves robust attack success rates exceeding 94% on two benchmark e-shopping datasets with four distinct LLMs. While backdoor attacks represent a well-explored threat in natural language processing models, their application and impact within the specific context of LLM-based interpretable recommendation systems remain largely uncharted territory. To our knowledge, this study pioneers the investigation of such vulnerabilities in this critical domain. Our work reveals that constructing LLM-based recommendation systems on untrusted LLMs poses a severe threat. interpretable recommendation backdoor attacks LLM agent Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 06 Jan, 2026 Reviews received at journal 04 Jan, 2026 Reviews received at journal 28 Dec, 2025 Reviewers agreed at journal 22 Dec, 2025 Reviewers agreed at journal 17 Dec, 2025 Reviewers agreed at journal 09 Dec, 2025 Reviewers invited by journal 09 Dec, 2025 Editor assigned by journal 09 Dec, 2025 Submission checks completed at journal 07 Nov, 2025 First submitted to journal 04 Nov, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8024735","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":559091688,"identity":"8339b608-b211-459e-bf82-3ea7b78c3df6","order_by":0,"name":"Bing Wang","email":"","orcid":"","institution":"Tianjin University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Bing","middleName":"","lastName":"Wang","suffix":""},{"id":559091691,"identity":"bc6fcc1f-7a17-49e9-a20e-c5489bf57830","order_by":1,"name":"Jing Fang","email":"","orcid":"","institution":"Aviation Data Communication Corporation","correspondingAuthor":false,"prefix":"","firstName":"Jing","middleName":"","lastName":"Fang","suffix":""},{"id":559091697,"identity":"e8969c74-bd80-489d-b95f-f05554b1d992","order_by":2,"name":"Shengsheng Qian","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABKklEQVRIie2RMWuDQBiGPxHsYuN6ItW/cEFI06W/5Q6hLgnN3kIEwU7tLHTpT3Ar3Qwf6BLIasEhXZyFlOAgoZc4tFBDydbhnuHjvTse7oUPQCL5j5DDTLsDA7DhbJ/oCYoL6kmKgAfqH72c5zD7+GxL+9J4UYr1fem/qudZDbNrMB5SZTP7rdAy892LqHKv4rU6Zlk1fQsHXgzUA7JkqhX3KGQysswAeVKkGmEaThPUXXEv6hWgqXpPsfh2a5EW552yQ592yhycIwoUE82sNWR0FWiERyJ0CgI9otDiZmQpEQ6TQgnH/EkEHHjAaK4Plzy0eot5ldm06NAVLt6brQj5I0Ld3tl2jotNXzFB9zvhQbcj0A87FVMJ+gXx0uynkcK3IpFIJJIffAF3wWa5tmIykgAAAABJRU5ErkJggg==","orcid":"","institution":"Institute of Automation, Chinese Academy of Sciences","correspondingAuthor":true,"prefix":"","firstName":"Shengsheng","middleName":"","lastName":"Qian","suffix":""}],"badges":[],"createdAt":"2025-11-04 05:38:27","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8024735/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8024735/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":98035363,"identity":"2e9c1940-7431-468b-af79-84c0420f19a9","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5224,"visible":true,"origin":"","legend":"","description":"","filename":"75466e1da7024d088d04276ecd9233cd.json","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/eb4c9415d32532f8aa3f8898.json"},{"id":98035388,"identity":"73a9fee7-e219-440e-9f53-e8008a97379c","added_by":"auto","created_at":"2025-12-12 06:04:46","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1953586,"visible":true,"origin":"","legend":"","description":"","filename":"BadInterpreteMMS4.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/1ef0d4fa1eeb939bd9d3cd41.pdf"},{"id":98035364,"identity":"c6156b1b-43e0-4b1d-8db2-58359b6677eb","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"pdf","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":68695,"visible":true,"origin":"","legend":"","description":"","filename":"CoverLetter.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/26bd6e5d6410376823794188.pdf"},{"id":98035387,"identity":"ff85fd8f-decd-4b78-9fc4-b653d86cac70","added_by":"auto","created_at":"2025-12-12 06:04:46","extension":"pdf","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":21471,"visible":true,"origin":"","legend":"","description":"","filename":"badASRwebarena.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/2a09837828d9cc73362c2305.pdf"},{"id":98426848,"identity":"6d841ea2-6df2-4cb8-9ba9-435a397dc407","added_by":"auto","created_at":"2025-12-17 16:38:50","extension":"pdf","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":21571,"visible":true,"origin":"","legend":"","description":"","filename":"badASRwebshop.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/efe7638d94501b42ba70986e.pdf"},{"id":98035365,"identity":"352bf41b-51a0-4d98-839e-637a1dcc88bc","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"pdf","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":19742,"visible":true,"origin":"","legend":"","description":"","filename":"badQualitywebarena.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/bd0bcda107691e83470e04ee.pdf"},{"id":98425321,"identity":"32424ffa-dde1-4520-9968-888473c4490d","added_by":"auto","created_at":"2025-12-17 16:34:39","extension":"pdf","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":19707,"visible":true,"origin":"","legend":"","description":"","filename":"badQualitywebshop.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/654eeee1dad1fb324401f0ce.pdf"},{"id":98035375,"identity":"079b66ae-e3c0-498c-a1f0-e41beac39706","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"pdf","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":310279,"visible":true,"origin":"","legend":"","description":"","filename":"badframework.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/10ee4ae410a97e8a85ac3a5e.pdf"},{"id":98426520,"identity":"ac48b80d-02c2-43ea-9b2d-4b84dfb21378","added_by":"auto","created_at":"2025-12-17 16:36:33","extension":"pdf","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":467548,"visible":true,"origin":"","legend":"","description":"","filename":"badqualitative1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/92b07c631730c95d7042b532.pdf"},{"id":98426873,"identity":"29ba69b2-51fd-4aee-a1ba-6eea56fa0bba","added_by":"auto","created_at":"2025-12-17 16:38:52","extension":"pdf","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":304992,"visible":true,"origin":"","legend":"","description":"","filename":"badtask.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/6ca7bbba2987a411ac9d3554.pdf"},{"id":98035371,"identity":"b6edaec3-e7b0-438d-8e0c-c3aa7469332e","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":183089,"visible":true,"origin":"","legend":"","description":"","filename":"cleandata.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/ee1b4a7bc17162b05a4587d8.png"},{"id":98426843,"identity":"5665ec00-39f3-4db7-b610-7cddcaaf5e97","added_by":"auto","created_at":"2025-12-17 16:38:50","extension":"pdf","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":42328,"visible":true,"origin":"","legend":"","description":"","filename":"poisoneddata.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/e35ba3aaa189d3eb691d29a9.pdf"},{"id":98426727,"identity":"6b1f2ebb-0eee-4856-a618-f4e07d2e254a","added_by":"auto","created_at":"2025-12-17 16:38:20","extension":"png","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":224055,"visible":true,"origin":"","legend":"","description":"","filename":"prompt1.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/aa4cd00331eaaed2cef11fbf.png"},{"id":98427903,"identity":"ea2332ca-78e2-49f4-b0dd-97606fedc266","added_by":"auto","created_at":"2025-12-17 16:41:20","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39780,"visible":true,"origin":"","legend":"","description":"","filename":"prompt2.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/33a74c6151e4f1ca32015589.png"},{"id":98035380,"identity":"ea73197e-e3b2-4d02-9563-7f8a7403d6b2","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"bst","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":147148,"visible":true,"origin":"","legend":"","description":"","filename":"snapacite.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/aca3065190568f7ecc94e1ca.bst"},{"id":98425381,"identity":"fccfccf5-f012-4b80-8251-d940dff7329f","added_by":"auto","created_at":"2025-12-17 16:34:42","extension":"bst","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":30423,"visible":true,"origin":"","legend":"","description":"","filename":"snaps.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/fd5ea4a61a6749ff94d5a123.bst"},{"id":98035389,"identity":"59b13425-d310-47e6-accb-f0072ab7b27b","added_by":"auto","created_at":"2025-12-12 06:04:46","extension":"bst","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":35733,"visible":true,"origin":"","legend":"","description":"","filename":"snbasic.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/86308937d9807dd50abefaa4.bst"},{"id":98426169,"identity":"6b535b87-75dd-4944-a37a-d35677aff1d9","added_by":"auto","created_at":"2025-12-17 16:35:49","extension":"bst","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":40398,"visible":true,"origin":"","legend":"","description":"","filename":"snchicago.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/9e4396f44c98628e2f8ab393.bst"},{"id":98426798,"identity":"84b07c84-f867-4d3a-9b20-f146444bd80d","added_by":"auto","created_at":"2025-12-17 16:38:43","extension":"cls","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":55332,"visible":true,"origin":"","legend":"","description":"","filename":"snjnl.cls","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/43840bdb9e7f715085699f96.cls"},{"id":98035379,"identity":"0cfeb1dc-a5c4-456a-b7a9-e651c8b5adda","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"bst","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":64140,"visible":true,"origin":"","legend":"","description":"","filename":"snmathphysay.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/242af8aa3a1e2a79193b40b5.bst"},{"id":98035383,"identity":"01bf9c10-bd35-49f7-9a43-1d16796b00f6","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"bst","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":64141,"visible":true,"origin":"","legend":"","description":"","filename":"snmathphysnum.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/559ed5a18f7542625b0f6b1a.bst"},{"id":98426865,"identity":"c876caa9-4f67-4596-ba66-80f628d03c14","added_by":"auto","created_at":"2025-12-17 16:38:52","extension":"bst","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":38349,"visible":true,"origin":"","legend":"","description":"","filename":"snnature.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/8ba1d81ee4bbb14b10017d68.bst"},{"id":98426916,"identity":"932adb32-731a-471c-8d93-37dd28238279","added_by":"auto","created_at":"2025-12-17 16:39:01","extension":"bst","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":41304,"visible":true,"origin":"","legend":"","description":"","filename":"snvancouver.bst","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/3fb2f21fcfca25e20e310fa5.bst"},{"id":98035385,"identity":"3fdb49c8-1608-4fa8-98d8-ad4b01395b67","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"png","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":160260,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinecleandata.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/199f07e24d850160c89b5cda.png"},{"id":98426952,"identity":"97ef8580-4772-47cf-9533-a2e4218faeaa","added_by":"auto","created_at":"2025-12-17 16:39:05","extension":"png","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":237068,"visible":true,"origin":"","legend":"","description":"","filename":"Onlineprompt1.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/e939ef8aaf7673c606126e99.png"},{"id":98427515,"identity":"2ecb0dfa-8a51-497e-82f1-89b10b5030a6","added_by":"auto","created_at":"2025-12-17 16:40:37","extension":"png","order_by":25,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":39669,"visible":true,"origin":"","legend":"","description":"","filename":"Onlineprompt2.png","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/97cae6e28474100c828bb653.png"},{"id":98035386,"identity":"9d25de7f-c101-4d0d-a132-28884f8b450e","added_by":"auto","created_at":"2025-12-12 06:04:45","extension":"xml","order_by":26,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":158359,"visible":true,"origin":"","legend":"","description":"","filename":"75466e1da7024d088d04276ecd9233cd1structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1/3d082cf6ad7ca24447ff9669.xml"},{"id":98622166,"identity":"eaea85d2-41a3-476b-98df-22f7da598ae8","added_by":"auto","created_at":"2025-12-19 16:47:33","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2019344,"visible":true,"origin":"","legend":"","description":"","filename":"BadInterpreteMMS4.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8024735/v1_covered_fe89005f-0a16-44ae-bd82-ef0b46bf1674.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"BadInterpreter: Backdoor Attack on LLM-based Interpretable Recommendation","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"multimedia-systems","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"mmsj","sideBox":"Learn more about [Multimedia Systems](http://link.springer.com/journal/530)","snPcode":"530","submissionUrl":"https://submission.nature.com/new-submission/530/3","title":"Multimedia Systems","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"interpretable recommendation, backdoor attacks, LLM agent","lastPublishedDoi":"10.21203/rs.3.rs-8024735/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8024735/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eLarge Language Models (LLMs) has promoted miscellaneous models and downstream applications, driving the progress of LLM agents by enhancing their ability to comprehend and generate interpretable reasoning. Recently, the security of LLM agents has become an increasingly popular research topic, where backdoor attacks show potential devastation by injecting a covert backdoor to manipulate the output. Our findings show that LLM agents fine-tuned for recommendation tasks are particularly vulnerable to the embedding of imperceptible backdoors, even when recommendation explanations are required. We introduce BadInterpreter, a simple yet effective backdoor attack for LLM-based interpretable recommendation systems, enabling attackers to manipulate product recommendations and explanations without altering ground-truth labels. In interpretable recommendation, LLM agents are asked to provide explanations for product recommendations to meet user needs. We propose a novel LLM-based pipeline to construct poisoned fine-tuning data, where the agent is expected to recommend the target product with rational recommendation explanations. Attacked by our BadInterpreter, LLM agents prioritize recommending the target products whose information contains attacker-designed triggers in a dynamic interactive environment, along with convincing explanations. Our attack consistently achieves robust attack success rates exceeding 94% on two benchmark e-shopping datasets with four distinct LLMs. While backdoor attacks represent a well-explored threat in natural language processing models, their application and impact within the specific context of LLM-based interpretable recommendation systems remain largely uncharted territory. To our knowledge, this study pioneers the investigation of such vulnerabilities in this critical domain. Our work reveals that constructing LLM-based recommendation systems on untrusted LLMs poses a severe threat.\u003c/p\u003e","manuscriptTitle":"BadInterpreter: Backdoor Attack on LLM-based Interpretable Recommendation","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-12-12 06:04:40","doi":"10.21203/rs.3.rs-8024735/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-01-06T13:44:26+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-05T04:21:44+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-12-29T00:52:31+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"239000897063880613237825383620674610865","date":"2025-12-22T05:35:23+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"327821184159775730115416655907105317904","date":"2025-12-17T13:19:36+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"198965252163235455117341207592578577447","date":"2025-12-09T10:09:27+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-12-09T09:41:37+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-12-09T09:31:19+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-11-07T09:32:23+00:00","index":"","fulltext":""},{"type":"submitted","content":"Multimedia Systems","date":"2025-11-04T05:33:58+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"multimedia-systems","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"mmsj","sideBox":"Learn more about [Multimedia Systems](http://link.springer.com/journal/530)","snPcode":"530","submissionUrl":"https://submission.nature.com/new-submission/530/3","title":"Multimedia Systems","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"5bbd88e9-af13-4d36-8625-c36a9a6597ad","owner":[],"postedDate":"December 12th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-02-26T09:57:25+00:00","versionOfRecord":[],"versionCreatedAt":"2025-12-12 06:04:40","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8024735","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8024735","identity":"rs-8024735","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}

Text is read by the "Ask this paper" AI Q&A widget below. Extraction quality varies by source — PMC NXML preserves structure cleanly, OA-HTML may include some navigation residue, and OA-PDF can have broken hyphenation. The publisher copy (via DOI) is the canonical version.

My notes (saved in your browser only)

Ask this paper AI returns verbatim quotes from the full text · source: preprint-html

Answers must be backed by verbatim quotes from this paper's full text. Hallucinated quotes are dropped automatically; if no verbatim passage answers the question, we say so. How this works

Citation neighborhood (no data yet)

We don't have any in-corpus citations linked to this paper yet. This is a recent paper (2025) — citers typically take a year or two to land, and the OpenAlex reference graph may still be filling in.

Source provenance

europepmc
last seen: 2026-05-20T01:45:00.602351+00:00
unpaywall
last seen: 2026-05-24T02:00:01.246996+00:00
License: CC-BY-4.0