Toward Trustworthy Recommender Systems in the Era of Agentic AI: From Relational User Modeling to Generative Personalization

1 Introduction

In this era of information proliferation, users are surrounded by overwhelming amounts of online content, products, services, and knowledge [Fan et al., 2019c; Ning et al., 2024]. Recommender systems (RecSys) have become an effective and indispensable way to alleviate this information overload problem by helping users locate information that matches their interests [Fan et al., 2022b; Wang et al., 2024a]. They play an increasingly important role in many user-oriented online services, such as e-commerce platforms, social media sites, entertainment services, jobmatching, education, healthcare, and scientific discovery. The goal of recommender systems is to provide each user with a personalized list of items that are likely to be clicked, purchased, watched, read, or otherwise useful [Fan et al., 2021]. In doing so, recommender systems not only enrich users' online experiences, but also increase the traffic, engagement, and revenue of service providers [Qu et al., 2024].

∗Homepage: https://wenqifan03.github.io

The basic idea of recommender systems is to make use of user-item interactions and their associated side information to infer user preferences. Collaborative behaviors between users and items provide the main evidence for learning user and item representations. Meanwhile, side information, such as item descriptions, user profiles, user reviews, social relations, and knowledge graphs, provides valuable signals for understanding why a user might prefer an item [Zhao et al., 2024]. On social media platforms (e.g., WeChat, LinkedIn, Facebook, TikTok, etc.), for instance, users obtain and share information through the people in their social circles, including friends, classmates, relatives, and coworkers. These social relations can help profile user preferences and improve personalized recommendation performance [Fan et al., 2020]. More recently, textual and multimodal information has become increasingly important, as large language models enable recommender systems to better understand user intent, retrieve external evidence, generate explanations, support conversations, and reason over complex recommendation scenarios [Zhao et al., 2024].

Despite their success, traditional recommender systems face several intrinsic limitations. First, user behavior is relational and heterogeneous: user-item interactions, social links, item-item relations, and knowledge-graph facts provide different but related views of preference. Second, personalization is moving beyond simple ranking toward agentic decision support, where the system may retrieve evidence, generate explanations, interact with users, and take personalized actions under user intent. Third, as recommender systems are increasingly deployed for data-driven decision making in a range of safety-critical domains (e.g., finance, healthcare, education, etc.), they face significant trustworthiness risks, such as adversarial attacks, unequal exposure, privacy, explanations, and computational vulnerabilities [Fan et al., 2021; Liu et al., 2021]. Therefore, modern recommender systems are no longer only ranking machines; they are becoming agentic systems that model relations, reason with evidence, personalize decisions, and operate under trustworthiness constraints.

This transition raises a central question: how can we build recommender systems that are accurate, expressive, and trustworthy at the same time? High-quality recommendation performance is necessary but insufficient. A system may achieve strong offline ranking metrics while relying on biased exposure, fragile correlations, privacy-sensitive signals, or misleading generated explanations. These issues become more serious when recommendation is powered by deep learning, generative models, large language models (LLMs), and agentic systems. They motivate three research questions: how relational structure can be used to model users, items, and contexts; how generative and agentic models expand recommendation into reasoning, interaction, and personalized predictions; how trustworthiness can be built into recommender systems?

To address these research questions, in this paper, we summarize a research program toward trustworthy recommender systems in the era of agentic AI from relational user modeling to generative personalization. The first component is relational user modeling. Users are not independent samples in recommender systems. They are connected by social ties, item interactions, sequential behaviors, and knowledge relations. To model such relational information for personalized recommendations, a powerful approach is to leverage deep learning methods, in particular graph neural networks (GNNs) [Fan et al., 2019b; Fan et al., 2019a; Fan et al., 2020; Wu et al., 2022; Derr et al., 2020; Fan et al., 2022a]. The second component is generative personalization and agentic recommendation. Generative models-especially Large Language Models (LLMs), which represent the most advanced AI methods-offer powerful abilities in understanding human natural language, reasoning about complex tasks, and generating content [Liu et al., 2023; Zhao et al., 2024; Wang et al., 2025a; Qu et al., 2025; Huang et al., 2026a; Qu et al., 2026]. The third component is trustworthy foundations. Recommender systems face attacks, bias, privacy leakage, unfair exposure, unreliable generated outputs, and computational risks in agentic settings [Liu et al., 2021; Fan et al., 2021; Chen et al., 2022; Zhang et al., 2022; Liu et al., 2020; Ning et al., 2026c; Ning et al., 2026b; He et al., 2026].

2 Relational User Modeling

2.1 Heterogeneous User Behavior

Relational user modeling begins from the observation that user behavior is heterogeneous. In social recommendation, a user is involved in the item domain and the social relation domain. The item domain records interactions between users and items, while the social relation domain records relations between users. These two domains are correlated but not interchangeable. A user may share interests with friends, but social relations can be weak, noisy, asymmetric, or context dependent. A straightforward solution is to incorporate user's social relations by learning their social embedding knowledge based on the network embedding techniques [Fan et al., 2018] and leveraging the sequential models (e.g., LSTM and RNNs) [Fan et al., 2019c]. Moreover, to capture these heterogeneous user behaviors, GraphRec is proposed to model social recommendation with graph neural networks (GNNs) [Fan et al., 2019b; Fan et al., 2020]. Particularly, GraphRec jointly captured user-item interactions, associated opinions, user-user social relations, and heterogeneous relation strengths. This formulation shows that graph neural networks are not simply a replacement of matrix factorization based on deep neural networks. They provide a mechanism for propagating information across users, items, and relations while preserving the structure that generates user preferences. DASO further studied the domain heterogeneity problem [Fan et al., 2019a]. Rather than forcing a unified user representation for both social and item domains, it learned domain-specific representations and transferred information through bidirectional adversarial mapping. The lesson is that relational signals should be shared when they are informative, but separated when they describe different behaviors.

2.2 Selective and Scalable Relation Use

Relational information is useful but not always reliable. Some social links are weak; some interactions are accidental; some temporal signals reflect exposure rather than preference. This motivates models that are not only expressive but also selective. Disentangled contrastive learning separates different factors in social recommendation [Wu et al., 2022]; graph trend filtering studies smoother and more robust graph signals [Fan et al., 2022a]; AutoLoss and AutoEmb investigate how to search loss functions and embedding dimensions for recommendation [Zhao et al., 2021b; Zhao et al., 2021a]. These works share one principle: recommendation models should adapt their learning process to the structure and quality of data. Scalability is another challenge. Real-world recommendation graphs are large, dynamic, and noisy [Zhang et al., 2024]. Graph reduction, sparsification, coarsening, and condensation provide potential tools for making graph learning efficient and reliable [Hashemi et al., 2024; Wang et al., 2023]. For trustworthy recommendation, scalability is not merely a computational concern. It also affects whether a model can be audited, updated, forgotten, and deployed under resource constraints.

3 Generative Personalization and Agentic Recommendation

3.1 FromRanking to Generative Decision Support

Generative personalization is motivated by a limitation of classical recommendation: a ranking score describes preference strength, but it does not directly model the distribution, uncertainty, or rationale behind user decisions. Generative models provide a different view by synthesizing representations and model distribution. This makes generation useful for data augmentation, uncertainty modeling, and interactive personalization.

Diffusion models are a representative family of generative models. Instead of generating an output in one step, they define a forward process that gradually corrupts data with noise and learn a reverse denoising process that recovers high-quality samples from noise [Liu et al., 2023]. This principle has led to strong results in image synthesis, video generation, molecular design, time-series modeling, and graph generation [Liu et al., 2023]. For recommendation, it is useful because user feedback is sparse, preference signals are noisy, and the target output may be a representation, a sequence of items, an explanation, or a decision trace. Recent work adapts diffusion to recommendation in complementary ways. SGSR addresses noisy social recommendation by treating raw social relations as imperfect signals and using stochastic-differential-equation-based score models to generate social user representations aligned with collaborative behavior, supported by curriculum training and self-supervised alignment [Liu et al., 2025]. CDRec targets the mismatch between continuous diffusion and discrete interactions: it builds a continuous-time discrete diffusion process over historical interactions, uses masking-style transitions and a popularityaware noise schedule, and accelerates sampling with consistency parameterization and multi-hop contrastive learning [Liu et al., 2026b]. Continuous-token diffusion further formulates recommendation as generation over continuous item tokens in the context of LLM [Qu et al., 2026].

3.2 LLM-Empowered and Agentic Recommendation

LLMs have generated a substantial impact on AI because they are pre-trained on massive text corpora (i.e., world knowledge) and scaled to billions of parameters. This training paradigm gives them strong language understanding and generation abilities, and, more importantly, allows them to exhibit generalization and reasoning capabilities across unseen tasks and domains. Instead of training a separate model for every recommendation scenario, an LLM can adapt through instructions, demonstrations, prompting, and in-context learning. These capabilities are highly relevant to recommender systems. User preferences are not only reflected in clicks and ratings; they are also expressed through reviews, item descriptions, search queries, conversations, and external knowledge. LLMs can therefore connect collaborative signals with semantic evidence: they can encode item content, infer intent from sparse feedback, explain why an item fits a user, resolve ambiguity through dialogue, and generate step-by-step reasoning for complicated decision-making processes. In our survey on recommender systems in the era of LLMs, we organized existing work around pre-training, fine-tuning, prompting, and in-context learning [Zhao et al., 2024]. This view clarifies that LLMs can act as feature encoders, preference reasoners, simulators, and conversational interfaces, making them a promising foundation for nextgeneration recommender systems.

ID Tokenization for Generative Recommendation. The first story concerns how a recommender can speak the language of an LLM. Traditional recommenders represent users and items as IDs, while LLMs operate over tokens. TokenRec bridges this gap by learning to tokenize user and item IDs with collaborative knowledge: it quantizes masked user/item representations into discrete tokens and uses generative retrieval to avoid expensive auto-regressive decoding for top-K recommendation [Qu et al., 2025]. This tokenization view is further extended by diffusion generative recommendation with continuous tokens, which moves beyond discrete ID prediction and models recommendation as generation over a continuous item-token space [Qu et al., 2026].

Recommendation Assistants with Reasoning. The second story moves from item generation to interactive assistance. Real users often ask complex queries with implicit constraints, incomplete descriptions, and multi-step intentions. RecBench+ studies this setting by building a benchmark for personalized recommendation assistants and showing that LLMs still struggle with reasoning-intensive or misleading queries [Huang et al., 2026b]. ReRec then improves this capability through reinforcement fine-tuning: it designs dualgraph enhanced rewards, reasoning-aware advantage estimation, and an online curriculum scheduler to train LLM-based assistants for complex recommendation reasoning [Huang et al., 2026a].

Recommendation with Retrieval-Augmented Generation. Generative personalization should not rely only on the parametric memory of LLMs [Fan et al., 2024; Yuan et al., 2025; Jiang et al., 2025], as updating the parameters in LLMs needs huge computational resources and time cost. In order to efficiently incorporate external knowledge into LLMbased recommender systems, Retrieval-Augmented Generation technique is proposed to retrieve informative knowledge to enhance the understanding, reasoning, and generation of LLM [Fan et al., 2024]. In addition, users, items, attributes, and external knowledge form graphs, and these graphs provide the evidence needed for faithful recommendation. A promising solution is graph-enhanced generative personalization, where LLMs reason over social graphs, interaction graphs, item graphs, and knowledge graphs while preserving structural provenance [Wang et al., 2025a; Wang et al., 2025b]. Thus, KG-RAG for LLM-based recommendation studies how retrieved knowledge subgraphs can reduce hallucination and improve evidence-grounded recommendation [Wang et al., 2025a]. MixRAGRec further develops a mixture-of-experts KG-RAG framework for multiagent LLM-based recommendation, where different retrieval experts handle queries with different graph granularities and agents align structured knowledge with user preference [Wang et al., 2026].

4 Trustworthy Foundations

Trustworthiness is not a single property. In our computational perspective on trustworthy AI, we discussed robustness, fairness, explainability, privacy, accountability, and environmental well-being [Liu et al., 2021]. Recommender systems connect these dimensions because they operate on sensitive user behavior, shape information access, and interact with strategic users and platforms.

One line of work studies vulnerabilities of recommender systems. In the cross-domain setting, CopyAttack shows that black-box recommender systems can be attacked by copying transferable cross-domain user profiles [Fan et al., 2021]. KGAttack studies how knowledge graph-enhanced attacks can manipulate recommendation outcomes from item side [Chen et al., 2022]. In social media, attackers can create fake user behaviors on items and social relations to manipulate the recommendation performance [Wang et al., 2024b]. As recommender systems become agentic and retrieval-augmented, new vulnerabilities appear, including recommendation [Ning et al., 2024], computational cost attacks on WebAgents [Ning et al., 2026c]and inference-cost attacks on retrieval-augmented LLMs [Liu et al., 2026a]. These works indicate that recommendation security involves not only prediction accuracy but also model access, knowledge sources, and resource consumption. Defense should be designed together with model architecture [Ning et al., 2025a]. Trend Filtering technique is employed to enhance the robustness of GNN-based recommendation [Fan et al., 2022a]. Retrieval-augmented purification studies how to filter and ground external evidence for robust LLM-empowered recommendation [Ning et al., 2026b]; graph defense diffusion explores generative defense mechanisms based on diffusion techniques for graph learning [He et al., 2026]. To study the vulnerabilities of LLM-based RecSys under backdoor attacks, BadRec is developed to perturb the items' titles with triggers for backdoor attack and P-Scanner as a universal defense strategy is designed to detect the poisoned items by leveraging the powerful LLMs [Ning et al., 2026a].

Fairness is particularly important in recommendation because the system allocates exposure and attention. A small bias in ranking can be amplified through feedback loops. Fairness reprogramming studies how models can be adapted toward fairer behavior [Zhang et al., 2022]; fairness in dialogue systems examines whether interactive models behave differently across gender groups [Liu et al., 2020]; fairly adaptive negative sampling studies how training signals affect fairness in recommendation [Chen et al., 2023]. Another new vulnerabilities in LLM have been explored on computational cost [Ning et al., 2026c; Liu et al., 2026a].

5 Future Directions

5.1 FromRecommenders to Personalized Agents

Agentic AI makes active assistance a natural extension of recommendation. LLM-based WebAgents can perceive web environments, plan multi-step actions, reason over instructions, and execute tasks for users [Ning et al., 2025b]. This development expands the role of recommender systems: a future systemmay not only suggest a paper, product, route, or service, but also compare evidence, negotiate constraints, complete forms, schedule actions, or monitor outcomes. This shift requires a new theory of user modeling. The model must represent long-termpreference, short-term intent, task context, risk tolerance, and delegation boundaries. It must know when to recommend, when to ask, when to act, and when to stop. In addition, as the advanced wearable device, AI smart glasses provide a concrete setting for this direction. A personal recommendation assistant on smart glasses observes the user's egocentric visual context, understands spoken or implicit intent, retrieves external knowledge, and recommends actions in real time. For example, it may identify a product, landmark, food item, sign, or object in front of the user, retrieve relevant information, and suggest what to buy, visit, avoid, or do next. SUPERGLASSES studies this emerging setting by benchmarking vision-language models as intelligent agents for AI smart glasses and showing the need for task-specific perception, retrieval, and reasoning pipelines [Jiang et al., 2026b]. For recommendation, smart glasses make personalization embodied: the system must reason about what the user sees, where the user is, what the user wants, and what action is appropriate now.

5.2 Trustworthy Recommendation Infrastructure

Trustworthiness should become infrastructure, not a posthoc checklist. This is especially important for agentic and retrieval-augmented recommendation, where errors may arise from biased data, malicious manipulation, noisy relations, weak retrieval, unsupported generation, or excessive resource consumption. Efficiency is a central part of this infrastructure. LLM-based recommenders must serve large user traffic under strict latency constraints, so direct online LLM invocation is often impractical. For example, AIR investigates this problem in industrial cross-domain recommendation by moving expensive LLM reasoning offline and composing compact intent representations online, achieving efficient deployment while preserving semantic consistency [Jiang et al., 2026a]. However, efficiency also creates new security risks. Retrieval-augmented LLM systems can be attacked through poisoned external knowledge that increases token consumption during inference [Liu et al., 2026a]. WebAgents can also be attacked through adversarial webpage prompts that induce unnecessarily long reasoning traces and excessive computational cost [Ning et al., 2026c]. These studies show that computational cost is not only an engineering metric; it is an attack surface. Future trustworthy recommender systems therefore need cost-aware retrieval, budgeted reasoning, attack detection, and graceful degradation when generated reasoning becomes unnecessarily long or resource intensive.

6 Conclusion

This paper discusses trustworthy recommender systems in the era of agentic AI, focusing on the transition from relational user modeling to generative personalization. Relational user modeling provides the foundation for learning user preferences from heterogeneous evidence, including interactions, social links, item attributes, and knowledge graphs. Generative and agentic models further expand recommendation from ranking to explanation, reasoning, conversation, tool use, and multi-step personal assistance. These new capabilities also introduce new risks. Trustworthiness should therefore be built into recommender systems from the beginning, rather than added after deployment. Future systems need to be robust to manipulation, fair in exposure and interaction, privacy-aware in user modeling, faithful in generated outputs, and efficient for real-world use. This calls for methods that connect graph learning, LLM-based reasoning, personalized agents, and cost-aware infrastructure. The long-term goal is to develop recommender systems that not only predict what users may like, but also know when to ask, act under user control, and remain reliable in open environments.