CoSimRec: Measuring Coordinated-Content Penetration in Recommender Feedback Loops

Source: arXiv:2607.15114 · Published 2026-07-16 · By Nan Li, Jiahong Shao, Jiuyang Lyu

TL;DR

This paper addresses a critical gap in recommender system robustness analysis by shifting focus from static attack metrics to the dynamic penetration of coordinated-content into non-coordinated user exposure and engagement through feedback loops. Existing robustness studies largely measure attack success via target item ranking changes within a static model snapshot, ignoring how coordinated promotion interacts dynamically with user behavior and recommender updates over time. The authors propose CoSimRec, an offline agent-based simulation framework that jointly models coordinated attacker accounts, evolving recommender rankings, non-bot user responses, and ranking interventions in a closed feedback loop. To quantify penetration, they introduce the Algorithmic Penetration Rate (APR) family of metrics measuring the share and lift of coordinated target content exposure and engagement among ordinary users relative to no-attack baselines. Evaluations on three benchmark datasets (MIND, MovieLens, LastFM) across multiple recommendation algorithms and attacker coordination policies reveal that coordinated activity does not guarantee penetration, but can significantly increase non-bot exposure and engagement under feedback-sensitive ranking. The results demonstrate that synchronization-aware ranking defenses substantially reduce APR with minimal utility loss. Thus, CoSimRec enables nuanced measurement of coordinated-content amplification risks and defense trade-offs within dynamic recommendation feedback loops.

Key findings

• Algorithmic Penetration Rate (APR) lifts from coordinated master-worker attacks reach up to 0.4505 (exposure APR-Lift) on LastFM with popularity-based recommendation, indicating near 45% more target exposure among non-bot users versus no-attack baseline.
• Random recommendation produces near-zero or negative APR-Lift in all datasets, confirming coordinated-content penetration depends on feedback-sensitive ranking mechanisms.
• Synchronization-aware ranking interventions reduce APR by up to 71.1% in master-worker coordinated attack settings across datasets, outperforming heat down-weighting, semantic, and diversity-based defenses.
• APR-Lift scales inversely with user population under fixed attacker budget; e.g. LastFM APR-Lift declines as non-bot user count grows from 200 to 1000, illustrating dilution effects under constant attack resources.
• Latent-factor models MF and BPR-MF differ in vulnerability: MF shows master-worker APR-Lift up to 0.259 on LastFM, while BPR-MF shows only 0.015, highlighting domain and recommender objective dependence.
• Exposure APR (target content presence in top-K non-bot lists) and behavior APR (engagement fraction) are related but distinct; exposure controls opportunity while behavior reflects conditional user response modeled probabilistically.
• Agent-based behavioral model ablations show that removing risk increases behavior APR while removing heat signals alters engagement patterns, indicating these features modulate user responsiveness to coordinated content.
• Oracle defenses using attack-label-conditioned credibility risk achieve APR reductions over 0.77 consistently but require perfect risk knowledge unachievable in practice.

Threat model

The adversary consists of coordinated accounts capable of generating interaction signals (clicks, likes, shares) on target content visible to the recommender system. They do not control or impersonate non-bot users and cannot manipulate the recommendation algorithm beyond input interactions. The goal is to promote target content to ordinary users through feedback amplification, while defenses attempt to detect or mitigate such coordination effects from observable activity patterns.

Methodology — deep read

The threat model assumes a recommender platform where adversaries control a subset of coordinated accounts able to generate target content interactions but cannot directly tamper with non-bot accounts or the ranking algorithm's internals. The adversary's goal is to amplify target coordinated-content exposure and engagement among non-coordinated (ordinary and opinion-leader) users via feedback loops.

CoSimRec simulates this by initializing user, content, and interaction states from public datasets (MIND news, MovieLens movies, LastFM music), supplemented with injected target coordinated content treated as experimental treatments. Users include ordinary, opinion leader, and coordinated bots; content includes organic and coordinated target items. User state vectors incorporate interests, stance, memory, activity, susceptibility, and influence; content vectors include topic, stance, emotion, quality, freshness, and risk features.

At each discrete time step, coordinated accounts generate target interactions per a coordination policy (random, master-worker, synchronized, semantic disguise, etc.) that regulate interaction concentration and timing. The recommender uses accumulated feedback state to score and select top-K items for each non-bot user, using ranking algorithms spanning random, popularity-based, feedback-sensitive scoring (combining heat, match, freshness, collaborative feedback, quality, risk), matrix factorization (MF), Bayesian personalized ranking MF (BPR-MF), and graph convolutional LightGCN.

User agents sample actions (click, like, comment, share) against presented lists with probabilities from a logistic model combining preference match, stance alignment, emotional intensity, content quality, freshness, social heat, influence, susceptibility, plus a profile-conditioned agent score. The coordinated policy and recommender score collaboratively update the feedback state that feeds the next simulation step.

The core metric, APR, measures the fraction of total non-bot recommendation slots or engagement allocated to coordinated target content. APR-Lift compares this share under coordinated attack with matched no-attack runs sharing seeds, users, items, and recommenders to control for baseline availability effects. Penetration gain normalizes the exposure lift by the coordinated interaction budget. Ranking interventions implemented as score-level penalties include heat down-weighting, synchronization penalties based on temporal activity patterns, semantic and credibility risk penalties, and diversity reranking.

Experiments run 30 steps, with 200 users (or up to 1000 in scale tests), 1000 items (including 40 targets), top-10 lists, and 5–10 randomized seeds. Seed-level bootstrap and sign-flip statistical tests with Benjamini-Hochberg correction are applied for inference. Behavior models are ablated to assess component effects, and an LLM-based response model is tested for sensitivity.

One end-to-end example: Under master-worker coordination on LastFM, coordinated accounts generate temporally concentrated target interactions that update the feedback heat signal. The popularity or feedback-sensitive recommender uses this heat with other signals to boost target item ranks into non-bot users’ top-10 lists. Non-bot agents engage probabilistically, reinforcing heat and collaborative feedback. Over multiple steps, APR exposure and behavior metrics quantify the share and lift of coordinated content reaching and engaging ordinary users compared to a matched no-attack baseline initialized with the same seed and candidate sets. Introducing ranking interventions then measures APR reduction and CTR impact.

Code and parameter settings are not explicitly stated as released, but the methodology is fully described for reproducibility except oracle defenses relying on simulator-known attack labels.

Technical innovations

• Formulation of coordinated-content penetration as a closed-loop social recommender measurement problem distinct from static rank manipulation.
• CoSimRec, an offline agent-based feedback-loop simulation framework integrating coordinated bots, dynamic recommender updating, non-bot behavior modeling, and ranking interventions.
• Introduction of the Algorithmic Penetration Rate (APR) family metrics that measure non-bot target content exposure and engagement uplift against matched no-attack baselines, normalizing for coordinated interaction budgets.
• Evaluation of synchronization-aware ranking interventions that penalize temporal coordination signals to reduce target penetration with minimal recommendation utility loss.

Datasets

• MIND — News domain with click and impression histories — public dataset
• MovieLens — Movie domain with explicit ratings — public dataset
• LastFM — Music domain with implicit artist listening counts — public dataset

Baselines vs proposed

• Random recommender: APR-Lift ≈ 0 in all datasets vs proposed coordinated ranking: APR-Lift up to 0.4505 on LastFM
• Popularity ranking: APR-Lift 0.0245 (MIND), 0.1332 (MovieLens), 0.4505 (LastFM) vs random baseline near zero
• Feedback-sensitive ranking: APR-Lift 0.0314 (MIND), 0.0978 (MovieLens), 0.3130 (LastFM) vs random
• MF and BPR-MF on LastFM: MF APR-Lift 0.259 vs BPR-MF APR-Lift 0.015 under master-worker coordination
• Ranking defense - synchronization penalty: APR reduction ~0.71 mean across datasets vs no defense
• Ranking defense - heat down-weighting: APR reduction ~0.30 mean but higher variance

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.15114.

Fig 1: CoSimRec measures whether coordinated interactions can pass through recommender feedback and reach non-coordinated users. Coordinated accounts

Fig 2: Main penetration evidence. Top: APR-Lift heat map across datasets, recommenders, and coordination policies. Bottom: exposure–behavior coupling,

Fig 3: reports master-worker APR-Lift for 200, 500, and

Fig 4: reports APR reduction. Synchronization penalties

Fig 5 (page 8).

Limitations

• Offline simulation with moderate-scale user counts (max 1000 users) may not fully capture larger platform dynamics or adversarial scaling of coordinated resources.
• Injected target coordinated content abstracts real-world campaign semantics, timing, and adaptation, limiting external validity.
• Behavioral agent model is probabilistic and parameterized; LLM agent sensitivity tested but not validated against real user behavior or field data.
• Oracle ranking defenses rely on perfect knowledge of attack labels (simulator), which is infeasible in practice; practical defense effectiveness depends on risk estimator accuracy and calibration.
• Focus on ranking-time interventions excludes moderation, account enforcement, network detection, provenance tracking, or content moderation policies.
• APR metrics depend on simulation-known target labels; absolute penetration values would differ with noisy detection or unknown targets.

Open questions / follow-ons

• How do learned risk estimators perform when applied to detect synchronization and credibility signals under realistic noisy or adversarial conditions?
• What is the penetration behavior under adaptive or evolving coordinated content campaigns that dynamically respond to ranking changes?
• How well do the APR metrics and agent behavioral models correspond to real platform user engagement and coordinated content spread?
• Can real-world deployment of synchronization-aware ranking defenses balance APR reduction with long-term recommendation utility and user satisfaction?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, CoSimRec offers a rigorous framework to quantify how coordinated bot activity leveraging recommendation feedback loops can amplify exposure beyond the attacking accounts. The shift from static rank measures to user-facing exposure and engagement metrics via APR provides actionable insights about the actual influence of coordinated campaigns on ordinary users. The evaluation of ranking-time defenses, notably synchronization penalties, directly informs mitigation strategies feasible at inference time without large utility trade-offs. Understanding the multi-step penetration dynamics and the role of user behavior simulation clarifies key points in the causal chain for bot detection and platform trustworthiness mechanisms. Additionally, the limitations highlight the importance of calibrated risk estimators and combined policy designs rather than purely heuristic penalization. Practitioners can use this work as a testbed concept for offline robustness testing and for developing composable detection and ranking defense methods tailored for bot-driven recommendation abuse scenarios.

Cite

@article{arxiv2607_15114,
  title={ CoSimRec: Measuring Coordinated-Content Penetration in Recommender Feedback Loops },
  author={ Nan Li and Jiahong Shao and Jiuyang Lyu },
  journal={arXiv preprint arXiv:2607.15114},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.15114}
}

Read the full paper

• arXiv:2607.15114 (abstract)
• arXiv:2607.15114 (PDF)