Attacking Pre-trained Recommendation