Secure Recommender Systems: A Co-evolutionary Survey of Vulnerabilities, Attacks, and Defenses

Abstract

Recommender systems (RS) increasingly mediate what users see, buy, and believe, making them attractive targets for malicious manipulation. As RS have progressed from traditional collaborative filtering to deep learning and, most recently, LLM-driven designs, the landscape has co-expanded, with new paradigm-induced vulnerabilities on the victim side, new attack surfaces and tactics on the adversary side, and new defense layers and procedures on the defender side. This survey synthesizes secure recommender systems through a co-evolutionary lens, viewing recommendation paradigms, attack strategies, and defense mechanisms as a tightly coupled process in which advances on one side continuously reshape the others. We propose a unified taxonomy organized around three complementary viewpoints: (i) the victim RS perspective, explaining how paradigm-specific design principles inherently expose distinct vulnerabilities; (ii) the attacker perspective, characterizing where attacks occur and how attacks are executed in practice; and (iii) the defender perspective, summarizing where defenses intervene across the pipeline and how they operate through varied mechanisms. Furthermore, we consolidate existing evaluation practices, including datasets, benchmarks, and evaluation metrics, and highlight open challenges and future directions to guide the design of secure RS in the LLM era.