PACT: Defending Recommendation against Promotional News Rewriting via Attack-Diverse Score Consistency

A news publisher can ask an LLM to make a headline more eye-catching without changing a single fact, and the ranking still goes up. This paper's defense is called PACT, and it changes only training, not the serving path. Before training, many different LLMs and rewriting methods produce a batch of rewritten headlines for each training article. During training, each time an article comes up, one rewrite is drawn at random, and the model is asked to give the original and the rewritten headline about the same score for the same user. What ships is the same recommender architecture with PACT-trained weights: no filtering and no added latency. The effect is clearest against the strongest rewriting attack, LANCE (a rewriting model trained specifically on recommender feedback): on NRMS, the share of "user and target article" pairs pushed up the ranking drops from 61.4% to 55.4%. Across nine combinations of three recommenders and three attacks, PACT has the lowest such share every time.

Content recommendation teams should read this. Headlines, product copy and post cover text are all controlled by publishers, and LLMs have cut the cost of "saying the same thing differently to grab exposure" to almost nothing. The core idea in one sentence: the wording can change freely, but the score one user gives one article should not move with it, so training shows the model enough different wordings and pins the score. I should state the limit up front too. The defense is consistent but modest. After PACT, more than half of the pairs attacked by LANCE still move up, so the attack is weakened, not removed.

What problem is it actually solving

A news recommender scores a "user, candidate article" pair mainly from two things: the headlines of articles the user has read, and the candidate's own headline and category. The paper tests three classic news recommenders: NAML, NRMS and LSTUR. The model judges relevance from headline text, so whoever can edit the headline can move the score.

Here are real rewrite examples from Figure 1 of the paper:

A single user shows the problem (illustrative). The user often reads food and sports news, and one candidate is "Mesa's 5 best spots for affordable burgers":

Both rows describe the same article, and whether a reader wants it should not change because of an added "Discover". If the score changes, the model has put part of its weight on the wording rather than the content.

Rewriting attacks come in three strengths. The simplest just prompts an LLM to "make it more engaging, keep the meaning". The stronger ATR-2FT first trains a mapping that turns the rewriting model's internal representation of a headline into the embedding the recommender's news encoder would give that headline (the recommender itself stays frozen). With this mapping it can estimate the score a given user would give the rewritten headline. When training the rewriting model, it adds a ranking loss to the usual headline-writing loss: whenever the estimated score falls below that user's top score over all training-set articles (plus a small margin), it is penalized, so the rewriting model is pushed directly toward the top of the list. The strongest, LANCE, first has GPT-4o produce rewrites in different styles, sentiments and personas, uses the recommender's scores to pick good and bad ones, builds preference pairs, and then trains a small model with DPO to write such headlines. The paper's results confirm this order: on NRMS, the three attacks raise the rank for 51.1%, 56.2% and 61.4% of pairs.

The existing defense idea is to generate a few rewrites of each article and make the model's outputs on original and rewrite agree. The trouble is that the defender does not know in advance which LLM or which method a real attack will use. Training with one generator and a few fixed styles may not cover rewrites optimized on recommender feedback.

PACT's three steps: pool, sample, align

The paper sums the method up as "vary the expression, stabilize the score", in three steps:

Step 1: why the pool needs many sources

A rewrite's source has two parts: which LLM wrote it (the generator), and which method was used (the attack strategy). PACT's full pool has 16 sources. Twelve are prompted rewrites: Qwen imitates the style of outlets such as CNN, The New York Times and tabloids, or rewrites in objective, neutral, emotional or sensational tones; another model rewrites with positive, negative or neutral sentiment and with a "build suspense" framing. The other 4 sources are attack models trained on recommender feedback: the LANCE and ATR-2FT methods, each trained on two base models, Mistral and Olmo.

Only rewrites that keep the original headline's entities such as people and places, events, numbers, dates and attribution enter the pool. Before entering, they are also deduplicated: after the recommender's own tokenization and truncation, a rewrite identical to the original or to another rewrite in the pool is dropped. Each article ends up with a pool of varying size, and articles with no admitted rewrite simply stay in ordinary training.

All evaluation attacks come from the Gemma family, and neither Gemma nor any model fine-tuned from it helped build the defense pool. So the main experiment tests whether the defense holds against rewrites from a model family it has never seen.

Step 2: why draw only one at a time

A bigger pool covers more, but running the whole pool at every training step would make compute grow linearly with pool size. PACT instead draws $m$ rewrites uniformly from an article's pool each time that article appears once as a candidate in training, with $m=1$ by default and repeats allowed.

An example (illustrative): the burger article's pool has 8 rewrites. The first epoch that meets it draws rewrite 3, the second epoch draws rewrite 7. Over two epochs the model sees two wordings, and each visit draws just one rewrite, so the extra alignment work is a fixed amount that does not grow with the pool. The paper shows that this sampling equals, in expectation, "score the whole pool and average", so adding sources does not add compute per step; it only makes the drawn wordings more varied.

Step 3: align scores under the same user

What gets aligned is the recommender's score $f_{\theta }(h,x)$, where $h$ is the articles this user has read and $x$ is the candidate's headline and category. For each drawn rewrite $\tilde{x}$, PACT computes a penalty:
$$d={\left(\frac{f_{\theta }(h,\tilde{x})-f_{\theta }(h,x)}{\tau }\right)}^2$$
The numerator is the score gap between rewritten and original headline for the same user. $\tau$ is a fixed score scale: using the already-trained clean model that defense training starts from, compute the score standard deviation within each of the first 512 complete training impressions, average them, and keep the value fixed. Dividing by $\tau$ keeps the penalty in line with the model's own score scale. Squaring means a score moving up or down is penalized either way. Hoot says▾

Hoot saysHowever far a rewrite moves the score, the penalty grows with the square of that distanceClose ✕

Moving up or down is penalized alike, and farther costs much more: for the same user, a rewrite scoring 0.5 above the original (illustrative) costs 1, one scoring only 0.1 above costs 0.04. Dividing by τ makes the penalty depend on the gap relative to the model's usual score spread.

Drag to explore

gap 0.50 → τ=0.5 penalty 1.00, τ=1 penalty 0.25

Illustrative: the x-axis is the rewritten headline's score minus the original's for the same user, the y-axis is PACT's penalty d. The solid line, τ=0.5, follows the burger example in the text; the dashed line, τ=1, is a hypothetical model with a wider score spread, where the same 0.5 gap costs only 0.25. The penalty is added only in training, never at online scoring. Source: paper §4.3 Eq. 5 (d is the squared score gap divided by τ) and Appendix B (how τ is set); scores are the illustrative numbers in the text.

Back to the burger example (illustrative): the original scores 2.1, the rewrite 2.6, $\tau =0.5$, so $d=(0.5/0.5{)}^2=1$. If the rewrite scores only 2.2, $d=0.04$, almost no penalty.

The total loss is the ordinary click loss plus this penalty with weight 0.3. The click loss uses only original headlines and teaches the model what users click. The consistency penalty is averaged separately over clicked positives and unclicked negatives, each taking half, because negatives are more numerous and would otherwise dominate.

Why not use the consistency penalty alone? Because style itself can reflect user preference; some people like light headlines. Without the click loss, the model might erase genuinely useful signal too. PACT only asks that fact-checked rewrites keep a stable score, and relevance is still learned from clicks.

This penalty acts only during training. Online, the model only sees the headline it has to rank, does not know whether it was rewritten, and runs no detection.

Experiments: how much does it block

The data set is MIND-small. The headlines of 300 target articles are rewritten at once, and target articles in a user's reading history are swapped for the rewritten headlines too. Each user's ranking covers 42,416 articles. The most intuitive metric is the "rank-up share" (BSR in the paper): among all "user and target article" pairs, the share whose position after rewriting is ahead of the original.

The table below is from Table 1 of the paper for the strongest attack, LANCE; the numbers are rank-up shares under attack:

Both comparison defenses are "rewrite plus consistency training", but they generate rewrites with Mistral alone. SheepDog was built for fake-news detection and trains consistency over four fixed styles; Source Bias was built to remove recommenders' preference for LLM-generated content. PACT is lowest in all nine combinations, and on LANCE it cuts 1.6 to 3.0 percentage points more than the stronger comparison. PACT's lead depends on the attack: under prompted rewriting and ATR-2FT it cuts only 0.6 to 0.9 points more than the stronger comparison. This table compares whole methods, and PACT's loss also differs from the comparisons, so on its own it cannot tell whether the credit goes to the rewrite pool or to the loss; the pool-composition experiment later isolates the pool.

The first follow-up test switches to an unseen attack method and uses "rank gain": the average number of positions a target article moves up after rewriting. Remove both LANCE sources from the pool and attack with LANCE: on NRMS the rank gain rises from 1270.8 to 1354.2 positions, but stays below the two comparisons at 1692.8 and 1758.0. So the defense still blocks part of an unseen method, and works best when the pool contains a similar method.

The second follow-up test lets the attacker retrain against the defended model. This is the most realistic case, because a publisher can retrain its rewriter on the ranking feedback of the deployed model. On NRMS, retrained LANCE gets a rank gain of 1735.8 positions against SheepDog-adapted and 1248.5 against PACT. PACT stays lowest in all six combinations, which shows it does not only work on one fixed batch of attack headlines.

The third test looks at which sources make up the pool. With the same number of rewrites per article and the same loss, 12 prompt sources beat 1 source, 4 attack-model sources beat the 12 prompt sources, and all 16 sources together give the lowest rank-up share on all three models. The kind of source matters more than the count: at the same volume, rewrites optimized on recommender feedback are worth more than rewrites that only change style.

How much does the defense cost in recommendation quality? On the same LANCE-attacked test set, the paper compares AUC, MRR, nDCG@5 and nDCG@10 before and after the defense. LSTUR rises slightly on all four, NRMS drops slightly on all four, and NAML rises slightly in AUC while its three ranking metrics drop slightly. The largest drop is NRMS nDCG@5, a relative drop of 1.26%, about 0.4 points on the 0 to 100 scale. The cost depends on the model, but it is small.

Where I think it falls short

First, the attack is only weakened. On NRMS after PACT, the rank-up share under LANCE is still 55.4%, higher than the 51.1% that plain prompted rewriting reaches without any defense, and in the default setting (attacks not retrained) each user's top 50 still holds 0.235 target articles on average, against 0.315 without defense. Rewriting still pays, just less.

Second, every experiment uses MIND-small and three older news recommenders, with headlines truncated to 30 tokens and frozen BERT token embeddings. Large ranking models common in production use many behavioral features, and headline text may weigh much less there, so both the gain and the cost of this defense need to be re-estimated on such models.

Third, building the rewrite pool is not cheap. Four of the 16 sources are attack models that must be trained, and every training article has to be rewritten, fact-checked and deduplicated. Online latency is zero, but this offline cost has to be counted.

How a recommendation or search team could try it

1. First check whether the problem exists. Take a batch of items, have a general LLM rewrite titles or copy to be "more engaging, same facts", and watch how positions change in the current ranking model. A rank-up share clearly above half means the model is rewarding wording.
2. Then build the cheapest defense. Make a pool from a few prompted rewrites, draw one at a time, and add the squared score-gap penalty under the same user. Measure how much the rank-up share falls and how much AUC and nDCG drop.
3. If it works, add attack-model sources. Use your own production model's scores as feedback to train a DPO rewriter, and put its outputs into the pool. In the paper's pool-composition experiment, at the same rewrite volume, attack-model sources work better than prompt sources, and the two together give the lowest rank-up share.
4. In evaluation, hold out an LLM that never contributed to the pool to generate attacks, so you learn whether the defense blocks rewrites it has not seen.

Verdict

The key takeaway: robustness in content recommendation can come from scoring "different wordings of the same content" the same during training, with nothing added online.