When Should a Personal Agent Override Your Recommender?

A recommendation platform knows things about you that no assistant can see: what millions of similar users clicked after the item you just bought. A personal agent can know things the platform cannot: what you read, watched, or played somewhere else. When both exist, someone has to decide whose evidence wins.

Personal-Agent Mediated Recommendation with Cross-Platform User History turns that question into a learning problem. A platform produces a ranking; a user-authorized agent sees that ranking plus cross-platform history and outputs the final slate. The useful contribution is not that an LLM can rerank. It is the accounting: every change the agent makes is either a rescue or a harm relative to a strong default.

1. The task: mediation, not reranking from scratch

The platform returns a candidate set, its full ranking over that set, and item metadata. The agent receives that proposal together with within-platform and cross-platform history, writes a visible rationale, then outputs an ordered top-K slate. It does not see platform scores, population interactions, or model state, and the platform never sees the cross-platform history. [1]

That two-sided asymmetry is the whole point. Because returning the platform’s own slate is always valid, the authors frame the problem as selective mediation rather than ranking from scratch. [1]

For a single held-out target Y, the paper measures the agent’s effect against the platform slate P:

<code><code>\Delta(S;P,Y)=U(S,Y)-U(P,Y).</code></code>

With top-K inclusion as the utility, every episode falls into one of four cells: preserved hit, rescue, harmful override, or mutual miss. The platform-relative hit-rate change decomposes exactly as the rescue probability minus the harmful-override probability. [1]

<code><code>\Delta \mathrm{HR}@K=\Pr(\text{rescue})-\Pr(\text{harmful override}).</code></code>

This identity is simple, and it is the part I would carry into any product that lets an assistant edit a ranked list. An average HR@10 hides whether the agent won by fixing misses or lost by breaking hits. Reporting both terms makes that visible.

2. Why access to more history does not solve it

The base Qwen3-4B-Instruct agent falls below the platform on all five test sets, with harmful overrides exceeding rescues throughout. Among proprietary reference models, Haiku roughly matches the platform, while Sonnet and Opus improve HR@10 on all five datasets but still make non-negligible harmful overrides. [1]

The platform here is deliberately not a strawman. It is a target-platform SASRec ranking over 50 candidates, then reranked by Claude Sonnet 4.6 using only within-platform history, and frozen for every agent condition. [1] SASRec is a self-attention sequential recommender that focuses predictions on relevant items in a user’s action history. [2]

So the agent faces an expert default. Overriding it should require specific evidence, and the experiments show that general model capability alone does not deliver that discipline.

3. PAMO: who gets credit for a correct override?

Outcome-only RL rewards a correct slate regardless of why it was correct. The authors point out that a successful correction may genuinely rely on cross-platform history or may come from generic reranking, and outcome rewards cannot tell the two apart. [1]

Personal Attribution Mediation Optimization (PAMO) adds a second signal. For each sampled response, it scores the same visible rationale twice — once with full history and once with cross-platform history masked — and uses the length-normalized log-likelihood ratio as a personal mediation support score. [1]

<code><code>c_g=\frac{1}{|R_g|}\log\frac{\bar\pi_\theta(R_g\mid B,H)}{\bar\pi_\theta(R_g\mid B,H^-)}.</code></code>

The authors are explicit that this score is model-relative: it measures how much a rationale depends on the cross-platform history, not whether that history is correct or useful. [1] That is an important limit. A rationale can lean heavily on irrelevant cross-platform records.

Advantage reallocation with a value floor

PAMO decomposes single-target NDCG into nested top-k cutoffs, computes GRPO-style group-relative advantages at each cutoff, and modifies advantages only for rollouts whose cutoff outcome disagrees with the platform. [1] The group-relative baseline itself comes from GRPO, introduced in DeepSeekMath as a PPO variant that reduces memory use. [3]

Within each disagreement set, PAMO tilts the fixed advantage mass toward high-support responses, subject to a constraint. The reallocated weights must keep at least the average direction-aligned NDCG magnitude of the uniform allocation, which the authors call the value floor; the solution takes an exponential-family form with a dual coefficient for that constraint. [1]

<code><code>w^\star_{g,k}\propto\exp\!\left(\eta c_g+\lambda_k v_{g,k}\right),\quad \lambda_k\ge 0.</code></code>

The floor matters because support alone is not quality. Without the value floor, the support-only variant performs below the κ = 0 baseline across tested support strengths, while full PAMO improves HR@10 and NDCG@10. [1] History dependence is useful only after it is tied back to ranking value.

The theory shows that the reallocation preserves cutoff-level advantage mass and follows a locally optimal first-order direction within a fixed rollout group; the authors note it does not imply global optimality of the policy or a guaranteed held-out improvement. [1] I read the theorem as a design justification for the update rule, not as an accuracy guarantee.

PAMO adds one teacher-forced scoring pass during training, no additional rollouts, and no inference-time component. [1] The deployed agent costs the same to run as the GRPO-trained one.

4. What the results show

All trainable agents share one setup. They use a Qwen3-4B-Instruct backbone; GRPO and PAMO start from the same SFT checkpoint and share data, rollout and update budgets, differing only in advantage reallocation. At test time each model produces one response per episode. [1]

HR@10, rescue, and harmful-override rates at K = 10 (percent):

Test set · Platform · GRPO · PAMO · GRPO rescue / harm · PAMO rescue / harm

Movie · 56.0 · 61.2 · 62.2 · 9.2 / 3.9 · 10.3 / 4.0

Toy · 47.7 · 53.4 · 54.8 · 11.2 / 5.6 · 11.9 / 4.8

Grocery (unseen) · 45.0 · 48.8 · 50.6 · 8.4 / 4.7 · 10.0 / 4.5

Beauty (unseen) · 48.6 · 51.2 · 51.7 · 8.9 / 6.3 · 8.6 / 5.5

OpenPlay (real, test-only) · 40.8 · 47.4 · 47.9 · 13.8 / 7.1 · 13.2 / 6.0

These figures come from Tables 2 and 3. PAMO improves HR@10 and NDCG@10 over GRPO on all five datasets with similar mean intervention, and lowers harmful overrides on four of them. [1]

The pattern is more specific than “PAMO rescues more.” On Beauty and OpenPlay, PAMO rescues slightly less than GRPO; its gain comes from fewer harmful overrides. On Movie, harm is marginally higher while rescues rise. The improvement is a better balance, not a uniform win on both terms.

The OpenPlay gap is small at HR@10 (47.9 vs. 47.4) but larger at the top of the list. On OpenPlay, PAMO’s NDCG@10 is 0.284 versus 0.267 for GRPO, with H@3 of 26.2 versus 22.2. [1] For an interface that shows three items, that is the number that matters.

The masking test addresses the obvious objection that the agent is just a better reranker. Re-evaluating each model with only cross-platform records masked — same candidates, same platform proposal — lowers HR@10 and NDCG@10 for every evaluated model in the five-dataset macro average. [1]

Figure 2 of the paper: HR@10 and NDCG@10 averaged over the five test sets, with cross-platform history masked (open markers) and with full context (filled markers). The dashed line is the platform baseline. Source: arXiv:2610.07588, CC BY 4.0.

5. Where the evidence is thinner than the headline

Sampled candidates. Each episode ranks the held-out target plus 49 popularity-sampled negatives. [1] Krichene and Rendle show that sampled ranking metrics can be inconsistent with exact metrics and may not preserve relative comparisons between recommenders, even in expectation. [4] The paper’s relative comparisons are cleaner than most because every method sees identical candidates, but absolute HR@10 on 50 items should not be read as full-catalog performance.

Proxy platforms. Four of the five environments treat Amazon product categories as proxy platforms, and the authors acknowledge these are not independent services. [1] The real cross-platform test links Steam, Nintendo, and Xbox activity for a 645-user cohort used only for external testing. [1] That external test is the strongest evidence in the paper, and also the smallest.

Point estimates. The main tables report one test-time response per episode. I did not find seed variation or confidence intervals for the five-dataset comparison, so sub-point differences, such as Beauty HR@10, deserve caution.

Rationale faithfulness. The authors annotate 900 PAMO rescues with Claude Sonnet 4.6 and report cross-platform context as the primary driver in 72%, with 25% incidental. [1] That analysis reads the agent’s own rationales. A rationale that cites Led Zeppelin records can still be a post-hoc story for a decision the model would have made anyway. The support score has the same dependency: it scores the rationale text, not the slate.

Position anchoring. The agent sees candidates relabeled by platform rank. LLM rankers can be biased by item positions and popularity in prompts. [5] Some deference may be positional rather than evidential. That does not invalidate the comparison, since every agent sees the same order, but it is a confound to test.

Availability. The authors say MediateRec will be released upon internal approval [1], so the results cannot yet be reproduced externally.

6. The experiment I would add before trusting an agent with my feed

Masking cross-platform history shows the information matters. It does not show that this user’s information matters. I would add a mismatched-history control: give the agent another user’s cross-platform history with the same length and category mix. If performance stays near the full-history level, the agent is exploiting generic extra text. If it drops toward or below the masked condition, the gain is user-specific.

Second, I would break down harm by history length and source overlap. A user with two cross-platform records and one with forty are not the same risk. The agent should defer more often when evidence is sparse, and rescue-harm curves conditioned on history size would show whether it does.

Third, a deployment should treat deferral as the default and override as a decision with a cost. The paper’s identity already provides the metric. A production system could cap harmful overrides at a fixed rate on a held-out set, then maximize rescues under that constraint — the same risk-coverage framing that applies to search-agent escalation.

The broader point is architectural. Once users bring their own agents, platform rankings become proposals rather than final answers. The paper provides a clear way to score that negotiation: count what the agent fixed, count what it broke, and train it to tell the difference.