Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective

The large language model (LLM) powered recommendation paradigm has been proposed to address the limitations of traditional recommender systems (RecSys), which often struggle to handle cold-start users or items with new IDs. Despite its effectiveness, this study uncovers that LLM-empowered RecSys are vulnerable to reconstruction attacks that can expose both system and user privacy. To thoroughly examine this threat, we present the first systematic study on inversion attacks targeting LLM-empowered RecSys, wherein adversaries attempt to reconstruct original prompts that contain personal preferences, interaction histories, and demographic attributes by exploiting the output logits of recommendation models. We reproduce the vec2text framework and optimize it using our proposed method - Similarity-Guided Refinement, enabling more accurate reconstruction of textual prompts from model-generated logits. Extensive experiments across two domains (movies and books) and two representative LLM-based recommendation models demonstrate that our method achieves high-fidelity reconstructions. Specifically, we can recover nearly 65% of the user-interacted items and correctly infer age and gender in 87% of the cases. The experiments also reveal that privacy leakage is largely insensitive to the victim model’s performance but highly dependent on domain consistency and prompt complexity. These findings expose critical and privacy vulnerabilities in LLM-empowered RecSys. The code for reproduction is provided below: https://github.com/xuemingxxx/Attack_RecSys/