VENOMREC: Cross-Modal Interactive Poisoning for Targeted Promotion in Multimodal LLM Recommender Systems

TL;DR

VENOMREC reveals a new multimodal poisoning attack on large language model-based recommender systems, demonstrating how synchronized cross-modal perturbations can manipulate content ranking without degrading utility.

Contribution

This paper introduces VENOMREC, a novel method for cross-modal poisoning that exploits the joint embedding space to steer multimodal recommender systems during fine-tuning.

Findings

VENOMREC achieves 0.73 mean ER@20 on real datasets.

It outperforms strong baselines by +0.52 ER points on average.

The attack maintains recommendation utility while manipulating outputs.

Abstract

Multimodal large language models (MLLMs) are pushing recommender systems (RecSys) toward content-grounded retrieval and ranking via cross-modal fusion. We find that while cross-modal consensus often mitigates conventional poisoning that manipulates interaction logs or perturbs a single modality, it also introduces a new attack surface where synchronised multimodal poisoning can reliably steer fused representations along stable semantic directions during fine-tuning. To characterise this threat, we formalise cross-modal interactive poisoning and propose VENOMREC, which performs Exposure Alignment to identify high-exposure regions in the joint embedding space and Cross-modal Interactive Perturbation to craft attention-guided coupled token-patch edits. Experiments on three real-world multimodal datasets demonstrate that VENOMREC consistently outperforms strong baselines, achieving 0.73 mean ER@20 and improving over the strongest baseline by +0.52 absolute ER points on average, while maintaining comparable recommendation utility.