A causal multi-agent approach for intent-aware shilling attack detection

Abstract Traditional recommender system defenses rely on fixed heuristics or supervised classifiers that lack transparency and generalizability to new attack strategies. To address this limitation, this paper introduces a novel Causal multi-agent framework for intent-aware shilling attack detection. This framework leverages multi-modal signals to uncover latent adversarial behaviors, by incorporating three detection agents, each for a different modality: reviews, ratings and profiles. The three agents’ labels are aggregated using a meta-agent that consolidates probabilistic evidence across modalities. A key contribution of this work is the Intent Recognition layer, an unsupervised mechanism that leverages few-shot LLM prompting to infer intent labels and rationales for each user profile, without ground-truth supervision. To further validate the generated intents, a Causal validation layer is employed to estimate both population-level and individual-level effects and quantify how the inferred intents causally influence the likelihood of a profile being adversarial. Experimental evaluations are conducted on an augmented Amazon dataset that combines genuine user profiles with synthetically injected attacks generated using GAN-based and LLM-based pipelines. The results demonstrate that the proposed framework achieves an F1-score of over 90% for genuine profiles and 70% recall for fake profiles. Furthermore, the intent recognition layer achieves clear semantic separation in the latent space with Mistral-based HDBSCAN clustering augmentation. In addition, we evaluate intent generalization on the real-world benchmark such as the YelpChi dataset, where fake reviews occur in isolation without coordinated behavior, demonstrating that the framework can infer latent intents with minimal adversarial signals.