Abstract: Sequential recommender systems excel at capturing users' dynamic interests, yet their open nature makes them highly vulnerable to data poisoning attacks. Attackers can effectively manipulate recommendation outcomes by altering the textual descriptions of items, posing a severe challenge to model robustness. Existing defense strategies, which primarily rely on static rules or fixed-intensity perturbations, struggle to counter the growing complexity and variability of semantic-level textual attacks.To address this challenge, we propose RADAR, a two-stage collaborative defense framework. This framework synergizes robustness enhancement at the training stage with real-time protection at the inference stage. First, during training, it employs dynamic adversarial training to bolster the model's intrinsic resilience against unknown textual perturbations. Second, at inference, it leverages a Large Language Model (LLM) for precise semantic-level anomaly detection and content restoration.Experimental results demonstrate the superior defense performance of RADAR. In attack tests on the Scientific dataset, compared to the strongest baseline model（Cert-LLM）, RADAR reduces the exposure increase of malicious items from 3.1796% to just 0.9921%. This powerfully validates the framework's effectiveness in enhancing the security and robustness of sequential recommender systems.

摘要： 序列推荐系统在捕捉用户动态兴趣方面表现出色，但其开放性使其极易遭受数据投毒攻击。攻击者通过篡改物品的文本描述，能有效操纵推荐结果，这对模型的鲁棒性构成了严峻挑战。现有防御策略大多依赖静态规则或固定强度的扰动，难以应对语义层面日益复杂和多变的文本攻击。为解决此问题，本文提出了一个名为RADAR的双阶段协同防御框架。该框架有机融合了训练时鲁棒性增强与推理时实时防护：首先，在训练阶段引入动态对抗训练，提升模型抵御未知文本扰动的内在能力；其次，在推理阶段利用大语言模型（LLM）进行精准的语义级异常检测与内容修复。实验结果表明，RADAR框架防御性能卓越。在Scientific数据集的攻击测试中，相较于最强的基准模型（Cert-LLM），RADAR能将恶意项目曝光的增幅从3.1796%锐减至0.9921%，有力地证明了该框架在增强序列推荐系统安全性与鲁棒性方面的有效性。