CREST: Calibrated LLM-Based Recommendation with Statistical Promotion Control

Large language model (LLM)-based recommender systems use item descriptions and interaction histories to personalize recommendations. However, attackers can manipulate this information to repeatedly promote selected items across users and rounds, displacing relevant alternatives and undermining trust in the platform. Existing defenses attempt to remove suspicious information but lack statistical guarantees on the promotion that remains. We therefore propose **C**alibrated LLM-based **RE**commendation with **ST**atistical Promotion Control (CREST), a target-agnostic framework for frozen LLM recommenders that controls each item's promotion rate within a predefined threshold at a user-specified confidence level while selecting top-$K$ items per decision and limiting utility loss. Specifically, CREST first screens recommendation records by comparing their joint influence on rankings against historical effects and then uses sequence-level calibration to account for the promotion that remains after screening. This calibration guides a constrained selection procedure that favors highly ranked items while enforcing promotion thresholds without requiring knowledge of the attacker's targets. We further derive an exact characterization of worst-case promotion risk, enabling efficient optimization under the calibrated constraints. Under sequence-level exchangeability, we establish a finite-sample bound on the probability that the returned recommendations violate any candidate item's promotion threshold. Extensive experiments across multiple datasets, frozen LLM recommenders, and manipulation settings demonstrate the effectiveness and efficiency of \method in controlling promotion while preserving recommendation utility. Our code is available at <https://anonymous.4open.science/r/CREST-8F90/>.