1 Introduction↩︎

Recommender systems allocate attention in settings where user behavior and algorithmic ranking continually update each other. News feeds, video platforms, social media timelines, movie services, and music platforms decide which items users see, then reuse the resulting clicks, ratings, shares, or listening traces as future ranking signals. Although recommender-system research has developed strong collaborative filtering, ranking, and graph-based models [1]–[4], deployed systems are not static predictors. They are feedback loops in which exposure changes behavior, behavior changes the data, and the revised data changes later exposure.

Static shilling and poisoning studies ask whether fake profiles or ratings can move a target item [5]–[7]. We ask whether the recommender then exposes that item to non-coordinated users. Promotion by coordinated accounts alone is not penetration; the target must enter ordinary users’ Top-K lists or receive their engagement.

APR shifts the unit of analysis from attacker-side promotion to recipient-side exposure. Target rank within coordinated accounts does not establish exposure to other users, and target items may receive incidental exposure without an attack. Each coordinated run is therefore paired with a no-attack run that shares the seed, users, items, and recommender. Exposure is computed only over non-bot lists, so APR-Lift removes exposure attributable to target availability alone.

Feedback-loop and popularity-bias studies examine exposure inequality [8]–[10], while recommender-robustness studies measure the effects of manipulated inputs on target-item ranks [5]–[7]. Research on social bots and misinformation instead focuses on coordinated behavior in online ecosystems [11]–[13], and agent-based simulators model sequential user–platform interaction [14]–[18]. These evaluation settings do not jointly measure coordinated action, recommender updates, non-bot response, and ranking interventions. Target-item rank alone therefore does not report how much coordinated content enters non-bot exposure and engagement during a feedback loop.

CoSimRec measures this conversion. In Fig. 1, coordinated interactions update the recommender, non-bot users receive Top-K lists, and their responses feed the next round. The shared feedback state separates coordinated activity from penetration into non-bot lists.

Algorithmic Penetration Rate (APR) defines success from the non-bot side of the loop. Exposure APR measures the fraction of non-bot recommendation slots occupied by target coordinated content, and behavior APR measures the fraction of non-bot engagement directed to that content. APR-Lift compares a coordinated condition with its matched no-attack baseline, while penetration gain normalizes the added non-bot exposure by the coordinated interaction budget. These definitions avoid counting coordinated-account activity as success and keep the denominator aligned with the exposure risk that the paper studies.

We evaluate CoSimRec on MIND [19], MovieLens [20], and LastFM [21] with random, popularity, feedback, MF, BPR-MF, and BPR-LightGCN recommenders. APR-Lift is near zero under random recommendation but positive for specific feedback-sensitive settings. BPR-LightGCN measures the effect of graph connectivity on target promotion.

The paper makes four contributions:

• We define coordinated-content penetration as an offline recommender feedback-loop measurement problem, distinct from static attack success and generic social diffusion.

• We propose CoSimRec, a reproducible agent-based protocol that combines non-bot response models, coordinated accounts, target content, recommender feedback, and ranking interventions.

• We introduce the APR metric family for measuring non-bot target exposure, non-bot target engagement, lift over matched no-attack baselines, and budget-normalized penetration.

• Across MIND, MovieLens, and LastFM, we show that penetration varies by recommender, domain, and coordination policy, and that targeted ranking can reduce APR.

2 Related Work↩︎

2.1 Recommender Feedback Loops and Popularity Bias↩︎

Feedback-loop research establishes why recommendation exposure cannot be treated as an independent observation. Algorithmic confounding, popularity bias, and bias amplification show that ranked exposure becomes part of the data later used for ranking. Chaney et al. show that algorithmically mediated data can increase homogenization and reduce utility, and Mansoury et al. simulate how repeated recommendation rounds amplify popularity bias [8], [9]. Popularity-bias work also shows how visibility can concentrate on already popular items, creating disparities for users and items [10]. We use the same feedback-loop premise but examine whether target coordinated content gains exposure and engagement from non-coordinated users.

Catalog-level feedback-loop metrics summarize concentration, homogenization, or utility, but do not identify the source of the initial signal or the recipients of the affected items. APR records coordinated interactions as inputs and non-bot exposure and engagement as outcomes. This accounting detects target penetration even when its effect on aggregate catalog statistics is small.

2.2 Shilling, Poisoning, and Recommender Robustness↩︎

Recommender-robustness research is the closest literature in adversarial motivation. Trustworthy-recommendation analyses and shilling-attack surveys define fake-profile attacks, attack detection, algorithmic robustness, and defense strategies [5], [6]. Data-poisoning studies further formulate optimization-based attacks against factorization-based collaborative filtering [7]. The usual endpoint in this line of work is a manipulated training set, a target-item rank, or a model-level robustness measure. CoSimRec evaluates a sequential offline process instead: coordinated actions update the recommender state, non-bot users receive the resulting rankings, and success is counted only when target content enters non-bot exposure or engagement.

Static attack success and closed-loop penetration cover different stages of an attack. The former measures target promotion in a trained model; the latter measures transfer into non-bot rankings and subsequent feedback. We report ASR and ranking utility for BPR-LightGCN to retain the standard profile-injection evaluation, while APR remains the outcome for sequential exposure.

2.3 Simulation and Agent-Based User Modeling↩︎

Offline simulation permits policy comparisons without exposing live users to experimental risk. RecSim provides configurable sequential environments for recommender-system research [17]. Generative-agent and recommender-agent systems incorporate profiles, histories, memory, and action modules into behavioral simulations [14]–[16], while OASIS studies agent-based interaction at larger social-media scales [18]. CoSimRec differs in its evaluation endpoint: it holds the response conditions fixed and measures target exposure, engagement, and ranking-intervention effects with APR.

Matched response generation isolates differences induced by the recommender. All conditions reuse the behavior specification and seed schedule; only ranked exposure and the feedback state evolve from the tested recommender and coordination policy. Without this control, between-run variation in agent responses would be confounded with the ranking effect measured by APR.

2.4 Coordinated Behavior, Social Bots, and Information Manipulation↩︎

Social-bot and misinformation studies document the effects of automated or coordinated accounts on online discourse, information diffusion, and user attention [11]–[13]. Their evidence is generally based on platform traces or diffusion analyses rather than experiments that update a recommender after each round of coordinated activity. CoSimRec represents coordination through random-bot, synchronized-bot, semantic-disguise, and master-worker policies so that the resulting exposure can be compared under fixed offline conditions.

3 Problem Formulation↩︎

The evaluation problem is to estimate whether target coordinated content enters non-bot recommendation exposure and engagement during a sequential feedback loop. Let \(U = U_N \cup U_L \cup U_B\) denote the user set, where \(U_N\) contains ordinary users, \(U_L\) contains opinion leaders, and \(U_B\) contains coordinated accounts. Let \(C = C_O \cup C_A\) denote the content set, where \(C_O\) contains organic content and \(C_A\) contains target coordinated content. The simulation proceeds over discrete time steps \(t = 1, \ldots, T\).

Each non-bot user has a state that includes interests, stance, memory, activity, susceptibility, and influence: \[s_u^t = \{p_u, o_u^t, m_u^t, a_u, \rho_u, \iota_u\}.\] Each content item has a representation: \[x_c = [z_c, s_c, e_c, q_c, \tau_c, r_c],\] where \(z_c\) is the topic vector, \(s_c\) is stance, \(e_c\) is emotional intensity, \(q_c\) is quality, \(\tau_c\) is the timestamp, and \(r_c\) is risk. Organic users, organic items, and historical interactions are initialized from public recommendation datasets. Target coordinated items are introduced only within the offline evaluation.

At time \(t\), a recommender returns a Top-K list for every non-bot user: \[R_u^t = \mathrm{TopK}_c \; Score_t(u,c), \quad u \in U_N \cup U_L.\] Non-bot behavior is sampled from action-specific probabilities for click, like, comment, and share: \[y_{u,c,t}^{a} \sim \mathrm{Bernoulli}(P_a(u,c,t)).\] The behavior probability combines preference match, stance alignment, emotional intensity, content quality, freshness, social heat, influence, susceptibility, and a profile-conditioned agent score: \[\begin{align} P_a(u,c,t) = \sigma(& b_a + \theta_m M_{uc} + \theta_s A_{uc} + \theta_e E_c + \theta_q Q_c \nonumber\\ & + \theta_f F_{ct} + \theta_h H_{ct}\rho_u + \theta_i \iota_u + \mu G_{uct}). \end{align}\] Here \(M_{uc}\), \(A_{uc}\), \(E_c\), \(Q_c\), \(F_{ct}\), \(H_{ct}\), and \(G_{uct}\) denote match, stance alignment, emotion, quality, freshness, heat, and the profile-conditioned agent score, respectively. The coordinated policy is represented as: \[\pi_A = \{r_b, \mu_{sync}, \mu_{sem}, \mu_{mask}, \lambda_{int}, b_{topic}, \kappa_{time}\}.\] Here \(r_b\) is the coordinated-account ratio, \(\mu_{sync}\) controls behavioral synchronization, \(\mu_{sem}\) controls semantic consistency, \(\mu_{mask}\) controls semantic disguise, \(\lambda_{int}\) controls interaction intensity, \(b_{topic}\) controls target-topic bias, and \(\kappa_{time}\) controls temporal dispersion. The evaluation problem is to estimate how \(\pi_A\), the recommender, the data domain, and the defense policy jointly affect target-content penetration among \(U_N \cup U_L\).

4 CoSimRec Framework↩︎

4.1 Overview↩︎

CoSimRec evaluates coordinated-content penetration through four coupled components: user agents, content, recommender feedback, and ranking interventions. The execution order follows the closed-loop mechanism. Coordinated accounts first create target interactions, the recommender turns accumulated signals into ranked exposure, non-bot users respond to the ranked lists, and their behavior becomes the next round of feedback. The resulting measurements show whether target content remains confined to coordinated accounts or crosses into ordinary-user exposure.

The modules also define the experimental controls. Coordination policies set the timing and concentration of target interactions; recommenders map the accumulated state to ranks; user agents sample actions conditional on exposure; and interventions alter scores before Top-K selection. The response protocol remains fixed when recommenders, policies, data domains, or defenses are compared.

Algorithm 2 formalizes one simulation episode. The critical design choice is that coordinated actions update the same feedback state later used for non-bot recommendations. Penetration is a property of the closed loop, not a static target-item score.

4.2 Controlled User-Agent Module↩︎

The recommender selects each non-bot user’s list; the behavior model then samples clicks, likes, comments, and shares. This separates target exposure from engagement.

Exposure APR and behavior APR correspond to successive stages of the feedback loop. Exposure APR is computed from served lists before any user action. Behavior APR additionally depends on preference match, susceptibility, content attributes, and response stochasticity. Separate reporting distinguishes broad but weakly engaging exposure from limited exposure followed by concentrated engagement.

The agent design keeps behavioral complexity controllable and inspectable. A rule-based mode uses probabilistic preference features only; profile and memory variants condition responses on user histories; and ablation variants remove heat or risk signals to test whether behavior-level metrics depend on feedback state and content risk. The primary experiments use a pre-specified probabilistic response model conditioned on profiles, memory, candidate content, and dynamic state.

All datasets use the same behavior model. Both the response model and feedback ranker receive target-risk information; Section 8 discusses this assumption.

4.3 Environment Initialization↩︎

CoSimRec initializes users, items, and interactions from public datasets, then adds target items as experimental treatments. This preserves the observed graph or preference structure across matched policies.

Matched trials reuse user profiles, organic candidates, and target items. The coordinated policy and the feedback it induces are the only changing inputs. Retaining target items in the no-attack trial controls for candidate-set expansion, while dataset histories preserve the user, item, and graph structure seen by each recommender.

4.4 Recommender Feedback Mechanisms↩︎

Random recommendation is the non-feedback control. Popularity ranking responds to accumulated heat, while the feedback ranker combines match, heat, freshness, collaborative feedback, quality, and risk. MF and BPR-MF are latent-factor baselines [2], [3]. LightGCN uses trainable embeddings, normalized bipartite propagation, and BPR optimization [4]; its profile-injection results use ASR and ranking utility rather than APR.

The recommender suite covers distinct propagation paths. Random ranking estimates chance exposure; popularity ranking measures direct accumulation; and the feedback ranker combines global heat with user-specific signals. MF and BPR-MF introduce latent preference objectives, whereas LightGCN tests transfer through user–item connectivity. Comparing them tests which ranking signals carry coordinated interactions into non-bot lists.

The CoSimRec feedback ranker uses: \[\begin{align} Score_t(u,c) ={}& \alpha M_{uc} + \beta H_{ct} + \gamma F_{ct} + \delta CF_{uct} \nonumber\\ & + QBonus(c) - \lambda Risk(c). \end{align}\] Here \(CF_{uct}\) denotes collaborative feedback and \(QBonus(c)\) denotes a quality bonus. This transparent scoring function makes the contributions of heat, user-content match, freshness, collaborative feedback, quality, and risk directly inspectable.

4.5 Coordination Policies↩︎

No attack is the baseline. Random bots create weakly synchronized target interactions, while master-worker coordination concentrates promotion. Synchronized, template-based, and semantically disguised variants are also supported. The main analysis compares random bots with master-worker coordination.

Random-bot and master-worker policies vary the concentration of coordinated input. Random bots distribute interactions across accounts and time; master-worker coordination aligns accounts on shared targets within narrower windows. Each comparison fixes the coordinated-account ratio and interaction budget. Differences in APR consequently reflect interaction structure rather than additional attacker resources.

The evaluation measures aggregate recommender responses under these controlled coordination abstractions.

4.6 APR Metric Family↩︎

Exposure APR measures the fraction of non-bot recommendation capacity occupied by target coordinated content: \[\mathrm{APR}_E@K = \frac{\sum_t \sum_{u \in U_N \cup U_L} \sum_{c \in C_A} X_{u,c,t}^K}{\sum_t \sum_{u \in U_N \cup U_L} \sum_{c \in C} X_{u,c,t}^K + \epsilon}.\] Here \(X_{u,c,t}^K=1\) if item \(c\) appears in the Top-K list of user \(u\) at time \(t\). Behavior APR measures the fraction of non-bot engagement directed to target coordinated content: \[\mathrm{APR}_B = \frac{\sum_t \sum_{u \in U_N \cup U_L} \sum_{c \in C_A} Engage(u,c,t)}{\sum_t \sum_{u \in U_N \cup U_L} \sum_{c \in C} Engage(u,c,t) + \epsilon}.\] The engagement weight is: \[Engage = Click + Like + \omega_1 Comment + \omega_2 Share.\] APR-Lift compares each coordinated policy with a matched no-attack baseline: \[\mathrm{APR\text{-}Lift} = \mathrm{APR}_E(\pi_A) - \mathrm{APR}_E(NoAttack).\] Penetration gain normalizes additional non-bot target exposure by the coordinated interaction budget: \[PenetrationGain = \frac{E_N(C_A | \pi_A) - E_N(C_A | NoAttack)}{Budget(\pi_A) + \epsilon}.\] APR is computed only for ordinary users and opinion leaders. Coordinated-account interactions are treated as budget and feedback input, not as successful penetration.

4.7 Ranking Interventions↩︎

CoSimRec evaluates ranking interventions as score-level modifications: \[\begin{align} Score'_t(u,c) ={}& Score_t(u,c) - \lambda_1 Heat(c) - \lambda_2 SynRisk_t(c) \nonumber\\ & - \lambda_3 SemDup(c) - \lambda_4 CredRisk(c) \nonumber\\ & + Diversity(c,R_u^t). \end{align}\] The evaluated conditions are no defense, heat down-weighting, diversity reranking, semantic penalty, synchronization penalty, credibility penalty, and their combination. The main defense outcome is APR reduction: \[Reduction(APR) = \frac{APR_{NoDefense} - APR_{Defense}}{APR_{NoDefense} + \epsilon}.\] The utility proxy is CTR reduction relative to the no-defense condition. A negative CTR reduction means that CTR increased slightly under the defense.

5 Experimental Protocol↩︎

5.1 Evaluation Criteria↩︎

We test whether coordinated activity increases non-bot exposure or engagement, whether the effect requires recommender feedback, and whether ranking interventions reduce it. APR-Lift compares attacks with matched baselines; random ranking is the negative control.

5.2 Main Experimental Configuration↩︎

Each APR experiment uses ten seeds, 200 agents (170 ordinary users, 10 opinion leaders, and 20 coordinated accounts), 1000 items including 40 targets, 30 steps, and Top-10 ranking. We test random, popularity, and CoSimRec feedback ranking with no attack, random bots, and master-worker coordination. All runs use the same profile- and memory-conditioned behavior model. The MovieLens BPR-LightGCN experiment uses a temporal 5-core split, BPR training, and connected bandwagon profiles.

5.3 Controlled Agent Configuration↩︎

Two five-seed MIND analyses replace probabilistic responses with gpt-5-nano-2025-08-07. Sampling 10% of agents yields 430 scores with mean Spearman agreement 0.478. Using LLM responses for opinion leaders yields 600 scores and mean agreement 0.443 across 16 nonconstant comparisons; feedback APR-Lift is 0.0019 with a 95% interval of [-0.0021, 0.0058].

5.4 Defense Configuration↩︎

Defense experiments use five seeds with popularity and feedback ranking. We test heat down-weighting, diversity, semantic, synchronization, credibility, and combined penalties. MovieLens and LastFM use master-worker coordination; MIND also includes random bots. Outcomes are APR, APR\(_B\), and CTR reduction.

5.5 Statistical Tests↩︎

Statistical tests use seed-level measurements from the experiments. For main attacks, APR-Lift and APR\(_B\)-Lift are tested against zero across ten seeds. CTR is tested as a paired per-seed delta against the corresponding no-attack baseline. For defenses, APR reduction, APR\(_B\) reduction, and CTR reduction are tested across five seeds under master-worker coordination. Main-attack inference uses 20,000 paired-seed bootstrap resamples for uncertainty and an exhaustive two-sided sign-flip test with Benjamini–Hochberg FDR correction. Defense tables use two-sided paired \(t\)-tests with FDR correction and Cohen’s \(d_z\); exact five-seed tests are also reported, with a minimum attainable two-sided \(p\)-value of 0.0625.

Attack and defense runs are paired by seed with their reference conditions. Bootstrap intervals quantify uncertainty in the mean paired effect, and the sign-flip test provides nonparametric inference for the ten-seed attack comparisons. Benjamini–Hochberg correction is applied across each reported family of conditions. Exact two-sided inference with five defense seeds has a minimum attainable \(p\)-value of 0.0625; defense results are therefore reported with raw reductions and effect sizes.

6 Results↩︎

6.1 Penetration Across Ranking Mechanisms↩︎

Fig. 3 reports APR-Lift by dataset, recommender, and coordination policy. Under master-worker coordination, random recommendation stays close to 0.000 APR-Lift on MIND, MovieLens, and LastFM. The intervals for MIND and MovieLens include zero; LastFM has a statistically detectable but negligible negative lift. Because target items are present in these random-control runs, their near-zero lift separates target availability from the positive effects observed under feedback-sensitive ranking. The magnitude of those effects varies by dataset and recommender.

Master-worker coordination produces more exposure than random bots under feedback-sensitive ranking. LastFM reaches APR-Lift of 0.451 under popularity and 0.313 under feedback; MovieLens reaches 0.133 and 0.098. In Table 3, disconnected target-only interactions do not increase ASR, whereas profiles connected through filler items sharply improve target rank and ASR.

The lower panel of Fig. 3 relates exposure APR-Lift to behavior APR. The two measures are related but not interchangeable. Recommendation controls whether target items are shown, while user-agent scoring controls whether exposed non-bot users engage with them. Marker size reports peak heat, helping distinguish high-exposure cases from high-engagement cases.

Because exposure APR is computed directly from served lists, it does not depend on the sampled action for an exposed item. The response model affects behavior APR and later feedback, but cannot generate engagement for an item absent from the list. Similar exposure with different behavior APR thus indicates variation in conditional response rather than in initial ranking reach.

6.2 Seed-Level Statistical Tests↩︎

For all six popularity and feedback conditions, the bootstrap interval excludes zero and the exact sign-flip test remains significant after FDR correction. The MIND and MovieLens random-control intervals include zero. Random recommendation on LastFM has a small negative APR-Lift of -0.0007, with bootstrap interval [-0.0011, -0.0002]. None of the three random controls has positive penetration, whereas the largest positive effects occur under LastFM popularity and feedback ranking. Table 3 reports ASR for the separate graph-profile pathway.

6.3 Population-Scale Sensitivity↩︎

Fig. 4 reports master-worker APR-Lift for 200, 500, and 1000 users with 1000 items, 30 steps, Top-10 ranking, and five seeds. MovieLens includes up to 500 eligible users.

Random recommendation remains near zero at every scale. On LastFM, popularity and feedback APR-Lift decline as a fixed attack budget is spread over more non-bot exposure.

The decline under scale-up follows the fixed-budget design. Coordinated accounts and target interactions remain constant as the number of non-bot recommendation slots increases, reducing target exposure as a share of the denominator. The experiment characterizes fixed-budget sensitivity; it does not imply that vulnerability decreases when attacker resources scale with the user population.

6.4 Ranking-Intervention Trade-Offs↩︎

Fig. 5 reports APR reduction. Synchronization penalties reduce APR in every case; semantic penalties and diversity have negative means. Oracle credibility and combined policies exceed 0.98 in several feedback-ranking cases. The best reduction for LastFM popularity is 0.272.

Defense performance follows the signal modified by each intervention. Synchronization penalties act on the temporal concentration induced by master-worker coordination. Heat down-weighting also affects organically popular items and consequently shows greater variance. Diversity and semantic reranking can change the competing candidate set without reducing target scores, which occasionally increases the target share. Credibility penalties use simulator labels and represent an oracle condition rather than an implementable risk estimator.

Synchronization-aware ranking has the largest mean APR reduction among the non-oracle interventions, with small average CTR changes. Credibility-aware and combined policies produce larger reductions but rely on attack-label-conditioned risk. Heat down-weighting has high variance across settings, while semantic penalty and diversity often yield zero or negative APR reduction. The latter two interventions can therefore alter candidate composition without reducing target penetration.

6.5 Latent-Factor Baselines↩︎

MF and BPR-MF are nearly resistant on MIND and MovieLens. On LastFM, MF reaches master-worker APR-Lift of 0.2588, while BPR-MF reaches 0.0148. Vulnerability varies by objective, domain, and coordination policy.

MF and BPR-MF should not be treated as a single robustness class. Their objectives weight observed and unobserved interactions differently, producing different target updates from the same coordinated history. The LastFM results further show that low APR on one domain does not establish model-level resistance independent of the interaction distribution.

6.6 Behavioral-Model Ablation↩︎

Agent ablations separate the contribution of individual behavioral components. Heat and risk components affect behavior-level metrics and agent-score diagnostics. Removing risk raises target-content scores and behavior APR, whereas removing heat changes target scores and engagement patterns. Exposure APR is dominated by recommender ranking and coordinated feedback state. These ablations measure internal sensitivity; they do not test correspondence with observed human behavior.

The LLM sensitivity tests replace the probabilistic response function while retaining the ranking protocol. Moderate rank agreement shows that the two response models order candidate actions differently, whereas feedback APR-Lift remains near zero in the tested MIND condition. This comparison quantifies sensitivity to the two response specifications but does not validate either as a model of human behavior.

7 Discussion↩︎

7.1 Scope of the Main Finding↩︎

Coordinated activity is not universally effective: APR-Lift varies by dataset and recommender. The experiments therefore support a conditional finding rather than a general vulnerability claim.

Coordination is operationally relevant when it changes a signal consumed by ranking. The LightGCN experiment illustrates this dependence: disconnected target interactions fail, whereas profiles sharing filler items with normal users create a transfer path through the collaborative graph. Account-level coordination measures should therefore be evaluated jointly with target-rank transfer and non-bot exposure.

7.2 Dataset Differences↩︎

Historical interactions shape penetration. Repeated artist preferences may explain LastFM’s sensitivity to popularity and feedback ranking. MovieLens graph attacks require shared filler items, while MIND’s topical histories make targets harder to align with users. These explanations remain hypotheses rather than tested causal mechanisms.

Domain-specific interaction structure changes the available feedback signal. Repeated music consumption supports persistent artist-level heat, movie ratings yield a relatively stable preference graph, and news relevance decays rapidly. These properties alter freshness, collaborative overlap, and the rate of heat accumulation. Since the response specification is shared across datasets, the observed differences characterize dataset–recommender interactions rather than platform-level prevalence.

7.3 Defense Implications↩︎

Synchronization penalties outperform generic diversification. Credibility and combined policies are oracle upper bounds because they use attack labels. Diversity and semantic penalties can increase APR by changing the candidate mix without suppressing coordinated feedback. We therefore report APR effects separately from whether an intervention uses observable or oracle risk signals.

Synchronization risk can be estimated from temporal and account-level activity without prior target labels, although the present experiments assume error-free signals. Credibility and semantic risk require external estimators and may suppress legitimate content through false positives. Deployment evaluation must therefore include risk calibration and ranking utility in addition to APR reduction.

8 Limitations, Ethics, and Threats to Validity↩︎

CoSimRec is designed for controlled offline comparison rather than estimating attack prevalence on deployed platforms. The main experiments use 200 users, 1000 items, 30 steps, Top-10 ranking, and ten seeds, while the scale analysis extends to 1000 users under a fixed coordinated budget. Larger catalogs, longer horizons, or attacker resources that grow with the user population may produce different effect sizes.

Target content is introduced as a controlled treatment within historical interaction data. This provides known labels for matched comparisons, but it abstracts some of the semantics, timing, and production choices of real campaigns, especially in news. Campaigns that reuse existing items or adapt targets in response to rankings may create different preference and detection patterns.

Behavioral findings inherit the assumptions of the response model. The probabilistic agents provide consistent cross-condition comparisons, and the short-horizon LLM experiments offer a sensitivity check rather than population calibration. In addition, the response model, feedback ranker, and LLM prompts receive simulator-known target status. Absolute APR values are therefore conditional on this information regime, and the credibility and combined defenses should be read as upper bounds; practical evaluation would require independently estimated risk with calibration, false-positive rates, and detection delay.

The interventions studied here operate at ranking time, leaving account enforcement, provenance, moderation, network detection, and platform policy outside the present scope. All experiments are offline: no participants were recruited, no new human-subject data were collected, and no social-platform APIs or real users were involved. The datasets are public, de-identified secondary data used under their provider terms.

9 Conclusion↩︎

We introduced CoSimRec, an offline agent-based protocol that uses APR to measure coordinated-content penetration into non-bot exposure and controlled engagement, with matched baselines and budget normalization.

Across MIND, MovieLens, and LastFM, random controls show no positive master-worker effect, while popularity and feedback ranking do. MovieLens BPR-LightGCN reaches ASR@20 of 0.9700 +/- 0.0670 at 20% connected injection. Synchronization penalties reduce APR in all six master-worker cases; diversity and semantic penalties do not.

CoSimRec applies APR to probabilistic and LLM-based response models. Larger studies should calibrate responses against held-out behavior.

Data and Code Availability↩︎

The repository contains code, aggregate results, and a reproducibility manifest for MIND, MovieLens, and LastFM. Raw data remain with their providers.

References↩︎