Generative recommendation models that use autoregressive decoding have emerged as alternatives to classic ranking systems. While their modeling flexibility is well studied, their resilience to data poisoning remains largely unexamined. In a realistic threat model, an adversary can inject only a tiny fraction of malicious interactions (under 1%) and query the recommendation API as a black box. Empirical results show that such limited synthetic interactions markedly increase the chance of promoting malicious targets when a trigger is present. To explain this vulnerability we analyze malicious interaction synthesis from two perspectives: (i) decoding alignment, i.e., prefixes that are consistent with the model's induced transition dynamics; and (ii) prefix popularity, i.e., prefixes that occur frequently during generation. We observe that short, context‑aligned prefixes that are both common in the model’s transition graph and strongly linked to a frequent trigger consistently amplify targeted promotion. Motivated by this insight, we propose AlignPoison, a black‑box framework that discovers and samples context‑aligned prefixes from API outputs. Experiments on unimodal and multimodal generative recommendation benchmarks demonstrate that these prefixes outperform competitive baselines, improving ASR lift by up to 16.3 percentage points and revealing a decoding‑dependent, context‑sensitive poisoning vulnerability in generative recommenders.
Review