RecSys 2026 · Half-Day Tutorial CIKM 2026 Minneapolis, MN · Sep 28 to Oct 2

Composing Agents, Compounding Risks

Robustness and alignment in multi-agent recommender systems. When LLM agents plan, call tools, exchange messages, and carry memory, risk becomes a system-level property. This tutorial gives you a vocabulary for it: a risk taxonomy, an evaluation framework that scales from component to composition, mitigations across the lifecycle, and a live attack/defense demo.

▶ View the slides Explore the demo See the schedule
Overview

Why this tutorial

Multi-agent recommender systems are emerging as a new design paradigm: specialized, LLM-powered agents reason over context, invoke tools, exchange intermediate outputs, and maintain memory across sessions. Composition buys modularity and transparency, but wiring together agents' roles, authority, and communication channels also compounds risk. Failures that are invisible when agents are tested in isolation surface only once the agents interact.

01

Topology & workflow framing

What is being composed, what authority each agent holds, and where risk enters: separating connectivity (who can talk to whom) from workflow (who does what, in what order).

02

A risk taxonomy

Two lenses applied throughout: amplified vs. emergent risk, and the drift → misalignment → compromise threat tiers, each tied to the composition patterns that produce it.

03

Evaluation & mitigation

An evaluation framework organized by scope × setting, with concrete benchmarks per cell, plus design-time, runtime, and post-deployment mitigations.

Run of show

Schedule: 3.5 hours, four speakers

A morning half-day tutorial, 8:30 to 12:00. One 30-minute break sits right after the demo, so attendees can red-team it before Part III picks up.

8:30
40 min

Part I · Foundations: the benign system

From classical to LLM to agentic recommenders, and the levels of autonomy that separate them. Recurring topologies and a taxonomy of system architectures, plus the attack surfaces and agent roles later parts build on.

Kurt Cutajar
9:10
50 min

Part II · How composition creates risk amplified emergent

Amplified vs. emergent risks and how to classify a given mechanism; emergent failures such as contagion, false consensus, and collusion; the drift / misalignment / compromise threat tiers. Then a live ConnaCF demo: one dissemination attack and one extraction attack across two connectivity knobs (hard 10 to 15 min).

Anjun Hu
10:00
30 min

Break: open red-teaming

Attendees are invited to play with the demo and submit a “crash” red-teaming prompt.

audience
10:30
40 min

Part III · Evaluation & mitigations

Evaluation at three levels (component, interaction, composition) and the security-utility trade-offs it surfaces. Defences across the lifecycle, from design time to post-incident, and where governance and audit fall short for composed systems.

Yashar Deldjoo
11:10
30 min

Bridging general multi-agent safety and RS

Most attack, defence, and evaluation work so far comes from general multi-agent safety, not recommenders specifically. Benchmarks as the concrete next step, whether general agentic-AI governance transfers to RS, and wrap-up.

Jas Kandola
11:40
15 min

Q&A

Open floor for all four speakers.

All speakers
11:55
5 min

Buffer

Room turnover.

·

Timings are indicative and will track the final RecSys'26 program.

Hands-on

The demo: ConnaCF

A live walk-through of attacking and defending multi-agent collaborative filtering through connectivity, built on AgentCF. We don't ask you to clone and run during the talk: we walk it, then you play with the hosted version over the break.

Connectivity modulates the outcome

ConnaCF instantiates a multi-agent recommender as a bipartite user-item agent graph and sweeps two connectivity axes: candidate count k (k=0 MACF → k=2 AgentCF → k=3) and catalog concentration ρ (sparse → dense). The same attack that fizzles in a sparse graph can become an epidemic in a dense one: that gap is the amplified-vs-emergent story.

Dissemination · NetSafe · CORBA · DrunkAgent · Prompt-Infection Extraction · MAMA · MASLeak · InjecAgent Bidirectional · TOMA · MASTER Defense · G-Safeguard · BlindGuard · T/M-Guard
ConnaCF attack and defense families on multi-agent collaborative filtering
Attack/defense families reproduced on multi-agent CF (red = attackers).
Connectivity axes: candidate count and catalog concentration
Connectivity axes: candidate count k and catalog concentration ρ.
▶ Open the ConnaCF repo Demo slides

Runs on a Bedrock-free local path (local Qwen3 + judge), so no AWS account is required to reproduce.

Materials

Resources

Everything in one place: slides, the survey, the living reading list, the demo, and the recording.

🖥️Available

Slides

The full reveal.js deck. Press S for speaker notes, Esc for overview.

 📄In prep

Survey paper

The companion TMLR survey on robustness & alignment in MARS.

 📚In prep

FnTrends book chapter

Trustworthy RecSys monograph chapter (Foundations & Trends in IR).

 🗂️Live · weekly

Living reading list

Auto-crawled Awesome list of MARS risk & trustworthiness papers.

 ⚔️Available

ConnaCF demo

Attack/defense code on multi-agent collaborative filtering.

 🎥After event

Recording

Talk recording, posted after RecSys'26.
Presenters

Team

KC

Kurt Cutajar

Amazon · London

Senior Applied Scientist working on recommendation, time-series, and generative AI across Amazon MGM Studios and Prime Video. PhD, Sorbonne / EURECOM.

JK

Jas Kandola

Amazon · London

Senior Applied Science Manager leading the personalization intelligence layer for Prime Video's commerce ecosystem. PhD in ML; ex-Gatsby Unit.

AH

Anjun Hu

University of Oxford

PhD candidate in responsible ML: adversarial robustness, memorization detection, guided diffusion sampling, and generative watermarking.

YD

Yashar Deldjoo

Politecnico di Bari

Associate Professor; associate editor for IEEE TKDE and ACM CSUR; guest editor on trustworthy & generative recommendation. PhD, Politecnico di Milano.