Bid shading plays a crucial role in Real-Time Bidding (RTB) by adaptively adjusting the bid to avoid advertisers overspending. Existing mainstream two-stage methods, which first model bid landscapes and then optimize surplus using operations research techniques, are constrained by unimodal assumptions that fail to adapt for non-convex surplus curves and are vulnerable to cascading errors in sequential workflows. Additionally, existing discretization models of continuous values ignore the dependence between discrete intervals, reducing the model's error correction ability, while sample selection bias in bidding scenarios presents further challenges for prediction. To address these issues, this paper introduces Generative Bid Shading (GBS), which comprises two primary components: 1) an end-to-end generative model that utilizes an autoregressive approach to generate shading ratios by stepwise residuals, capturing complex value dependencies without relying on predefined priors; and 2) a reward preference alignment system, which incorporates a channel-aware hierarchical dynamic network (CHNet) as the reward model to extract fine-grained features, along with modules for surplus optimization and exploration utility reward alignment, ultimately optimizing both short-term and long-term surplus using group relative policy optimization (GRPO). Extensive experiments on both offline and online A/B tests validate GBS's effectiveness. Moreover, GBS has been deployed on the Meituan DSP platform, serving billions of bid requests daily.

Large language model-powered sequential recommender systems (LLM-SRSs) have recently demonstrated remarkable performance, enabling recommendations through prompt-driven inference over user interaction sequences. However, this paradigm also introduces new security vulnerabilities, particularly text-level manipulations, rendering them appealing targets for promotion attacks that purposely boost the ranking of specific target items. Although such security risks have been receiving increasing attention, existing studies typically rely on an unrealistic assumption of access to either the victim model or prompt to unveil attack mechanisms. In this work, we investigate the item promotion attack in LLM-SRSs under a more realistic setting where both the system prompt and victim model are unknown to the attacker, and propose a Prompt-Unknown Dual-poisoning Attack (PUDA) framework. To simulate attacks under this full black-box setting, we introduce an LLMbased evolutionary refinement strategy that infers discrete system prompts, enabling the training of an effective surrogate model that mimics the behaviors of the victim model. Leveraging the distilled prompt and surrogate model, we devise a promotion attack that adversarially revises target item texts under semantic constraints, which is further complemented by the highly plausible, surrogategenerated poisoning sequences to enable cost-effective target item promotion. Extensive experiments on real-world datasets demonstrate that PUDA consistently outperforms state-of-the-art competitors in boosting the exposure of unpopular target items. Our findings reveal critical security risks in modern LLM-SRSs even when both prompts and models are protected, and highlight the need for more robust defensive means.

With the rapid advancement of large language models (LLMs), producing realistic fake news has become increasingly effortless, challenging existing detection methods that rely on lexical and syntactic patterns. To address this, we shift our focus to the generation process and analyze how malicious prompts manipulate model outputs. We construct pairs of LLM-generated real and fake news and apply malicious prompts to reconstruct them as fake. By comparing the original-token generation probabilities recorded during reconstruction, we observe a consistent statistical divergence: tokens from real news tend to have lower reconstruction likelihoods than those from fake news. We define this distributional divergence as linguistic fingerprint. Building on this insight, we propose LIFE (Linguistic Fingerprints Extraction), a novel detection framework that reconstructs token-level probability distributions guided by malicious prompts to capture these discriminative linguistic patterns. To fully exploit the extracted fingerprints, LIFE further introduces a key-fragment amplification module that adaptively identifies and accentuates the most distinctive linguistic fragments, thereby enhancing detection reliability across diverse prompting scenarios. Extensive experiments demonstrate that LIFE achieves state-of-the-art performance in detecting LLM-generated fake news while maintaining strong generalization to human-LLM mixed cases. The code is available.

Misinformation on social media poses a critical threat to information credibility, as its diverse and context-dependent nature complicates detection. Large language model–empowered multi-agent systems (MAS) present a promising paradigm that enables cooperative reasoning and collective intelligence to combat this threat. However, conventional MAS suffer from an information-drowning problem, where abundant truthful content overwhelms sparse and weak deceptive cues. With full input access, agents tend to focus on dominant patterns, and inter-agent communication further amplifies this bias. To tackle this issue, we propose PAMAS, a multi-agent framework with perspective aggregation, which employs hierarchical, perspective-aware aggregation to highlight anomaly cues and alleviate information drowning. PAMAS organizes agents into three roles: Auditors, Coordinators, and a Decision-Maker. Auditors capture anomaly cues from specialized feature subsets; Coordinators aggregate their perspectives to enhance coverage while maintaining diversity; and the Decision-Maker, equipped with evolving memory and full contextual access, synthesizes all subordinate insights to produce the final judgment. Furthermore, to improve the efficiency in multi-agent collaboration, PAMAS incorporates self-adaptive mechanisms for dynamic topology optimization and routing-based inference, enhancing both efficiency and scalability. Extensive experiments on multiple benchmark datasets demonstrate that PAMAS achieves superior accuracy and efficiency, offering a scalable and trustworthy way for misinformation detection.

Graph Contrastive Learning (GCL) has demonstrated substantial promise in enhancing the robustness and generalization of recommender systems, particularly by enabling models to leverage large-scale unlabeled data for improved representation learning. However, in this article, we reveal an unexpected vulnerability: the integration of GCL inadvertently increases the susceptibility of a recommender to targeted promotion attacks. Through both theoretical investigation and empirical validation, we identify the root cause as the spectral smoothing effect induced by contrastive optimization, which disperses item embeddings across the representation space and unintentionally enhances the exposure of target items. Building on this insight, we introduce a bi-level optimization attack method, named graph Contrastive Learning Recommendation Attack (CLeaR), which deliberately amplifies spectral smoothness and enables a systematic investigation of the susceptibility of GCL-based recommendation models to targeted promotion attacks. Our findings highlight the urgent need for robust countermeasures; in response, we further propose a Spectral-Irregularity Mitigation framework, named SIM, which accurately detects and suppresses targeted items without compromising model performance. Extensive experiments on multiple benchmark datasets demonstrate that, compared to existing targeted promotion attacks, GCL-based recommendation models exhibit greater susceptibility when evaluated with CLeaR, while SIM effectively mitigates these vulnerabilities.

Sequential recommendation is pivotal to personalized services by modeling the temporal dynamics of user behavior. However, existing methods often rely on abundant interactions, making it unreliable under sparse user interactions. Recent attempts to integrate sequential signals with orderless structural cues (e.g., global co-occurrence) help alleviate this issue but typically adopt tight fusion, which can dilute order-aware signals. To address this, we propose LOOM (Loosely-Coupled Ordered-Orderless Modeling), a structure-agnostic guidance module for sequential recommenders. LOOM is sequence-first: The sequential backbone acts as a teacher, guiding orderless carriers via one-way KL divergence, with recency-aware weighting and confidence-modulated strength to filter stale or uncertain relations. This preserves temporal modeling while selectively incorporating complementary orderless knowledge. Experiments on four public datasets and various sequential architectures show that LOOM outperforms state-of-the-art methods. Code is available at https://github.com/cqu-jia/LOOM.

Time-series forecasting is critical to highly data-dependent domains such as energy, healthcare, and transportation. Although Large Language Models have recently been explored for this task, their performance is hindered by a modality gap: numerical sequences poorly align with text-based inputs, and direct alignment often introduces noise. In contrast, human experts rarely predict directly from numbers; they first inspect line charts to recognize overall patterns and then apply simple models for forecasting. Inspired by this workflow, we propose VisMoE, a Vision-Language-Model-driven Mixture-of-Experts framework. In VisMoE, Each sequence is transformed into a line-chart image, enabling a VLM to classify it into distinct temporal regimes. Based on this classification, VisMoE routes the sequence to lightweight specialized experts operating alongside a global predictor, whose outputs are fused for final forecasts. This human-inspired design preserves semantic understanding, reduces modality misalignment, and improves computational efficiency. Extensive experiments across multiple benchmarks demonstrate that VisMoE achieves state-of-the-art forecasting accuracy while remaining highly efficient. Our code is available at https://github.com/Liu905169/VisMoE.

Sequential recommenders are integral to many applications yet remain vulnerable to model extraction attacks, in which adversaries can recover information about the deployed model by issuing queries to a black-box without internal access. From the attacker's perspective, existing studies impose a fixed and limited query budget but overlook optimal allocation, resulting in redundant or low-value requests. Furthermore, the scarce data obtained through these costly queries is typically handled by crude random sampling, resulting in low diversity and information coverage with actual data. In this paper, we propose a novel approach, named Budget and Frequency Controlled Cost-Aware Model Extraction Attack (BECOME), for extracting black-box sequential recommenders, which extends the standard extraction framework with two cost-aware innovations: Feedback-Driven Dynamic Budgeting periodically evaluates the victim model to refine query allocation and steer sequence generation adaptively. Rank-Aware Frequency Controlling integrates frequency constraints with ranking guidance in the next-item sampler to select high-value items and broaden information coverage. Experiments on public datasets and representative sequential recommender architectures demonstrate that our method achieves superior extraction performance. Our code is released at https://github.com/Loche2/BECOME.

Large-scale graph data has demonstrated significant success in graph representation learning, but the associated high computational cost and inefficiency hinder its widespread adoption across diverse applications. Graph condensation has emerged as a promising solution to reduce time and memory demands while preserving generalization performance comparable to the original graph. Although existing graph condensation methods have proven effective, they are constrained by their reliance on repeatedly optimizing a condensed graph at a fixed scale, which demands significant computational resources and lacks flexibility to accommodate varying training requirements. This motivates us to explore alternative approaches that incrementally refine and expand condensed graphs.

Recent advances in ID-free recommender systems have attracted significant attention for effectively addressing the cold start problem. However, their vulnerability to malicious attacks remains largely unexplored. In this paper, we unveil a critical yet overlooked risk: LLM-powered agents can be strategically deployed to attack ID-free recommenders, stealthily promoting low-quality items in black-box settings. This attack exploits a novel rewriting-based deception strategy, where malicious agents synthesize deceptive textual descriptions by simulating the characteristics of popular items. To achieve this, the attack mechanism integrates two primary components: (1) a popularity extraction component that captures essential characteristics of popular items and (2) a multi-agent collaboration mechanism that enables iterative refinement of promotional textual descriptions through independent thinking and team discussion. To counter this risk, we further introduce a detection method to identify suspicious text generated by our discovered attack. By unveiling this risk, our work aims to underscore the urgent need to enhance the security of ID-free recommender systems.

As recommender systems (RS) continue to evolve, the field has seen a pivotal shift from model-centric to data-centric paradigms, where the quality, integrity, and security of data are increasingly becoming the key drivers of system performance and personalization. This transformation has unlocked new avenues for more precise recommendations, yet it also introduces significant challenges. As reliance on data intensifies, RS face mounting threats that can compromise both their effectiveness and user trust. These challenges include (1) Malicious Data Manipulation, where adversaries corrupt or tamper with datasets, distorting recommendation outcomes and undermining system reliability; (2) Data Privacy Leakage, where adversarial actors exploit system outputs to infer sensitive user information, leading to serious privacy concerns; and (3) Erroneous Data Noise, where inaccuracies, inconsistencies, and redundant data obscure the true user preferences, degrading recommendation quality and user satisfaction. By focusing on these critical data-centric challenges, this tutorial aims to equip participants with the knowledge to build RS that are secure, privacy-preserving, and resilient to data-driven threats, ensuring reliable and trustworthy performance in real-world environments. In addition, attendees will gain hands-on experience with our newly released toolkit for RS-based attacks and defenses, providing them with practical, actionable insights into safeguarding RS against emerging vulnerabilities.

The rapid proliferation of fake news on social media threatens social stability, creating an urgent demand for more effective detection methods. While many promising approaches have emerged, most rely on content analysis with limited semantic depth, leading to suboptimal comprehension of news content. To address this limitation, capturing broader-range semantics is essential yet challenging, as it introduces two primary types of noise: fully connecting sentences in news graphs often adds unnecessary structural noise, while highly similar but authenticity-irrelevant sentences introduce feature noise, complicating the detection process. To tackle these issues, we propose BREAK, a broad-range semantics model for fake news detection that leverages a fully connected graph to capture comprehensive semantics while employing dual denoising modules to minimize both structural and feature noise. The semantic structure denoising module balances the graph's connectivity by iteratively refining it between two bounds: a sequence-based structure as a lower bound and a fully connected graph as the upper bound. This refinement uncovers label-relevant semantic interrelations structures. Meanwhile, the semantic feature denoising module reduces noise from similar semantics by diversifying representations, aligning distinct outputs from the denoised graph and sequence encoders using KL-divergence to achieve feature diversification in high-dimensional space. The two modules are jointly optimized in a bi-level framework, enhancing the integration of denoised semantics into a comprehensive representation for detection. Extensive experiments across four datasets prove that BREAK significantly outperforms existing fake news detection methods.

Contrastive learning (CL) has recently gained prominence in the domain of recommender systems due to its great ability to enhance recommendation accuracy and improve model robustness. Despite its advantages, this paper identifies a vulnerability of CL-based recommender systems that they are more susceptible to poisoning attacks aiming to promote individual items. Our analysis indicates that this vulnerability is attributed to the uniform spread of representations caused by the InfoNCE loss. Furthermore, theoretical and empirical evidence shows that optimizing this loss favors smooth spectral values of representations. This finding suggests that attackers could facilitate this optimization process of CL by encouraging a more uniform distribution of spectral values, thereby enhancing the degree of representation dispersion. With these insights, we attempt to reveal a potential poisoning attack against CL-based recommender systems, which encompasses a dual-objective framework: one that induces a smoother spectral value distribution to amplify the InfoNCE loss's inherent dispersion effect, named dispersion promotion; and the other that directly elevates the visibility of target items, named rank promotion. We validate the threats of our attack model through extensive experimentation on four datasets. By shedding light on these vulnerabilities, our goal is to advance the development of more robust CL-based recommender systems. The code is available at https://github.com/CoderWZW/ARLib.

The acquisition of explicit user feedback (e.g., ratings) in real-world recommender systems is often hindered by the need for active user involvement. To mitigate this issue, implicit feedback (e.g., clicks) generated during user browsing is exploited as a viable substitute. However, implicit feedback possesses a high degree of noise, which significantly undermines recommendation quality. While many methods have been proposed to address this issue by assigning varying weights to implicit feedback, two shortcomings persist: (1) the weight calculation in these methods is iteration-independent, without considering the influence of weights in previous iterations, and (2) the weight calculation often relies on prior knowledge, which may not always be readily available or universally applicable.

Urban flow prediction plays a crucial role in public transportation management and smart city construction. Although previous studies have achieved success in integrating spatial-temporal information to some extents, those models lack thoughtful consideration on global information and positional information in the temporal dimension, which can be summarized by three aspects: a) The models do not consider the relative position information of time axis, resulting in that the position features of flow maps are not effectively learned. b) They overlook the correlation among temporal dependencies of different scales, which lead to inaccurate global information representation. c) Those models only predict the flow map at the end of time sequence other than more flow maps before that, which results in neglecting parts of temporal features in the learning process. To solve the problems, we propose a novel model, Spatial-Temporal Global Semantic representation learning for urban flow Prediction (ST-GSP) in this paper. Specifically, for a), we design a semantic flow encoder that extracts relative positional information of time. Besides, the encoder captures the spatial dependencies and external factors of urban flow at each time interval. For b), we model the correlation among temporal dependencies of different scales simultaneously by using the multi-head self-attention mechanism, which can learn the global temporal dependencies. For c), inspired by the idea of self-supervised learning, we mask an urban flow map on the time sequence and predict it to pre-train a deep bidirectional learning model to catch the representation from its context. We conduct extensive experiments on two types of urban flows in Beijing and New York City to show that the proposed method outperforms state-of-the-art methods.

Recommender systems are essential components of many information services, which aim to find relevant items that match user preferences. Several studies have shown that shilling attacks can significantly weaken the robustness of recommender systems by injecting fake user profiles. Traditional shilling attacks focus on creating hand-engineered fake user profiles, but these profiles can be detected effortlessly by advanced detection methods. Adversarial learning, which has emerged in recent years, can be leveraged to generate powerful and intelligent attack models. To this end, in this article we explore potential risks of recommender systems and shed light on a gray-box shilling attack model based on generative adversarial networks, named GSA-GANs . Specifically, we aim to generate fake user profiles that can achieve two goals: unnoticeable and offensive. Toward these goals, there are several challenges that we need to address: (1) learning complex user behaviors from user-item rating data, and (2) adversely influencing the recommendation results without knowing the underlying recommendation algorithms. To tackle these challenges, two essential GAN modules are respectively designed to make generated fake profiles more similar to real ones and harmful to recommendation results. Experimental results on three public datasets demonstrate that the proposed GSA-GANs framework outperforms baseline models in attack effectiveness, transferability, and camouflage. In the end, we also provide several possible defensive strategies against GSA-GANs. The exploration and analysis in our work will contribute to the defense research of recommender systems.