Pith. sign in

REVIEW 2 major objections 6 minor 41 references

SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders

T0 review · 2 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Content-only edits to a single retrieved webpage can move a chosen real entity to the top of an LLM-generated ranked recommendation: in 62 of 124 technique trials across eight query–model contexts, SIREN reached rank 1, and most…

desk verdict The 62/124 rank-1 rate is a real result about a fixed-context replay harness; the live web-RAG transfer question is explicitly left open, and the missing live-baseline comparison is the paper's true soft spot. read the letter →

arxiv 2607.21951 v1 pith:3NSHONV7 submitted 2026-07-24 cs.IR cs.CR

Evan Caville , Siamak Layeghy , Billy Sung , Sara Dolnicar , Marius Portmann This is my paper · ORCID
classification cs.IRcs.CR
keywords largelanguagemodelsretrieval-augmentedgenerationindirectpromptinjectiongenerativeengineoptimisationrecommendationmanipulationred-teamingrankwebcontentpoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to show that a web-enabled LLM's ranked recommendations are manipulable by editing one retrieved webpage, without touching the query, the retrieval process, or the model. It introduces SIREN, an automated attacker–judge loop adapted from jailbreaking, which iteratively applies one of 23 content-poisoning techniques to a captured page and replays the fixed source set to the target model. Across two production Claude models, rank 1 was reached in 62 of 124 trials and reproduced in fresh sessions at a mean rate of 0.805. If true, this means any party controlling a page that a web-RAG assistant fetches—a business, a listicle writer, a user-contributed page—can influence the shortlist consumers see, and defenses must look beyond sanitizing hidden markup toward provenance and cross-source corroboration.

What carries the argument

The load-bearing device is the custom-RAG replay platform: live URLs are fetched once via Anthropic's server-side web_fetch, one source is parsed into an element index (content blocks, links, images), offline edits are applied as character-level splices to a pristine copy, and the unchanged source set is re-supplied to the target as search_result blocks in the same order. This keeps retrieval and source composition fixed, so any change in the model's ranking is attributable to the edited content. On top of it runs the PAIR-adapted loop: attacker proposes edits, target answers, judge extracts rank, and the result feeds the next proposal until rank 1 or budget exhaustion.

What would settle it

Run SIREN's successful payloads through a production web-RAG pipeline with live retrieval, reranking, and the target's real search path, and count rank-1 outcomes: if the rate drops far below 0.805 (or below the 50 percent trial success), the replay harness—not the model's live ranking—carried the effect. A cheaper check: compare the same edit injected as a search_result block against the same edit delivered through the actual web_search_tool_result path the production system uses.

Watch

Extended reading notes

Core claim

SIREN demonstrates that competitive rank manipulation of real entities in web-RAG recommenders can be achieved through content-level edits to one already-retrieved source, under a fixed supplied context. The method captures live pages with Anthropic's web tools, parses the editable page into addressable elements, and has an attacker model propose edits restricted to one of 23 techniques while a judge extracts the target entity's rank and feeds it back, until rank 1 or the 20-iteration budget. Empirically, the loop reached rank 1 in 62 of 124 trials; successful payloads replayed in fresh sessions retained rank 1 with mean rate 0.805. The paper also finds that declarative ranking claims and seeded lists are generally more effective than directive-form injections, and that cross-model transfer is asymmetric.

Load-bearing premise

The text that Anthropic's web_fetch tool returns is treated as the faithful 'pristine' page the model actually sees during a live search, and replaying captured sources as search_result blocks is assumed to preserve the model's ranking behavior; the paper notes the server-side search representation is unavailable and that replay is not behaviorally equivalent to a production live-search pipeline.

Editorial extensions

If this is right

  • A page owner who can legitimately control a retrieved page has a practical way to influence top-of-list LLM recommendations, since declarative content (ranked lists, FAQ claims, metadata) often works without being flagged as an injection.
  • Defenses limited to stripping hidden markup or detecting directive instructions will miss the most effective payload classes; provenance and cross-source corroboration are the natural next step.
  • Success rates and persistence vary by target model and query context, so model-agnostic defenses cannot be assumed; evaluation must be per-context.
  • Because replay keeps sources fixed, the measured effects isolate content influence; extending to live retrieval pipelines is required before claiming real-world attack rates of 50 percent.
  • The iterative loop matters: most successes took multiple attempts, so single-shot content edits are a weaker description of the threat than the adaptive attacker.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the replay proxy overestimates real-world transfer (as earlier work suggests attacks can be filtered by retrieval and reranking), the 0.805 persistence rate may be an upper bound for live pipelines; a direct live-search replication would settle this.
  • The asymmetry in cross-model transfer (Haiku-origin payloads often fail on Sonnet, Sonnet-origin often succeed on Haiku) hints that the same webpage edit can shift a recommendation system's ranking in opposite directions across models—an implication for any single 'ranking SEO' practice.
  • The mechanism generalizes beyond tourism rankings: any list-producing web-RAG query (product comparisons, hiring shortlists, answer lists) exposes the same single-page attack surface, and the 23-technique taxonomy provides a ready audit kit.
  • The finding that a model attributes an inserted claim as the business 'claiming to be' at rank 2 but states it directly at rank 1 suggests the model's trust in the entity is itself being manipulated—a testable hypothesis about model credulity under rank position.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper proposes SIREN, an automated attacker–judge method for competitive rank manipulation in web-augmented LLM recommenders. SIREN captures live web pages via Anthropic's server-side web_search and web_fetch tools, applies offline edits to a single captured page using a taxonomy of 23 content-poisoning techniques across six families, and replays the fixed source set to the target model as search_result blocks. It is evaluated on two Claude models (Haiku 4.5 and Sonnet 5) across four anonymized recommendation queries in eight query–model contexts, totaling 124 technique trials. The authors report a rank-1 attack success rate of 50.0% (62/124), a mean fresh-session reproduction rate of 0.805 for successful payloads, and descriptive findings that declarative ranking claims and seeded lists outperform directive-form injections. The paper includes pristine controls, parser-audited rank extraction, and explicit limitations regarding the replay setting.

Significance. The manuscript's strengths are its controlled fixed-context platform, the systematic taxonomy, and an unusually candid set of sensitivity analyses. The deterministic parser audit (62/63 judge decisions confirmed; a stricter explicit-enumeration rule lowers the ASR from 50.0% to 46.8%), the pristine replay control, the fresh-session validation (37/62 payloads always rank 1, two never), the disclosure of the reduced-sweep selection issue, and the explicit statement in Section 10 that the replay is not behaviorally equivalent to a production pipeline all indicate careful empirical practice. If the replay platform faithfully approximates the live web-search condition, the paper would be a significant advance: it would be the first systematic comparison of content-edit types for rank manipulation under a fixed source context, and the declaration-versus-directive finding is a plausible and actionable security insight. The cross-model transfer asymmetry (Section 9.7) is also a valuable observation.

major comments (2)
  1. [Section 4 (Stages 2 and 4) and Section 10 (Limitations)] The load-bearing premise of the headline results—that the search_result replay preserves the ranking behavior of the production web-RAG pipeline—is never tested. The paper stores web_fetch text as the pristine source because the server-side representation is unavailable, and re-injects it as top-level search_result blocks rather than through the production web_search_tool_result path. The pristine control in Section 9.2 replays unmodified sources 20 times per context and only shows the absence of spontaneous rank-1 drift; it does not compare the replay ranking to the stored live baseline answer y0 used for target selection. Without such a fidelity check, the 62/124 rank-1 outcomes and the 0.805 fresh-session rate may characterize the search_result harness rather than a live web-RAG recommender. This concern is concrete: the paper itself cites [31] showing that attacks effective when content is supplied directly can fail after retrieval and reranking, and Section 10 admits that fixed-context replay is not behaviorally equivalent to a production live-search pipeline. Because every headline quantity is measured only in replay, I request that the authors either (a) validate replay fidelity by comparing pristine-replay rankings against the stored live baseline y0 for each of the eight contexts, reporting per-context agreement, or (b) explicitly rescope the abstract, title, and conclusion claims to the search_result interface so that 'web-RAG recommenders' is not the unqualified object of study.
  2. [Section 8 (Models) and Section 9.6 (Success vs. Target Model)] The attacker and judge are always claude-sonnet-5, so in the Sonnet-target runs (R3, R4, R7, R8) the attacker, judge, and target are the same model, whereas in the Haiku-target runs (R1, R2, R5, R6) the attacker and judge are a different model. This confounds the target-model comparison in Tables 6 and 7: any apparent difference in attack success between Haiku and Sonnet could be due to the degree of attacker–target weight sharing rather than to target-model robustness to the content edits themselves. The paper notes that source discovery and sampling differ across targets and that the comparison is descriptive, but it never acknowledges this particular confound, which is directly relevant to the conclusion in Section 11 that 'no uniform ordering between the target models' is supported. I recommend either running at least one Sonnet-target condition with a non-Sonnet attacker/judge to quantify the effect, or explicitly adding this as a limitation in the interpretation of the target-model comparisons.
minor comments (6)
  1. [Section 4 (Stage 1)] The stored baseline answer y0 is used in Algorithm 1 and Section 9.2, but Section 4 Stage 1 only says that the returned URLs are stored as source objects; please clarify explicitly how and when the live baseline answer y0 is captured for each context.
  2. [Section 9.1 and Appendix A] The 124 trials are nested in eight contexts with per-context ASR ranging from 0.261 to 1.000, and the paper correctly warns about non-independence in Section 9.1 and Section 10. However, the abstract presents only the pooled 62/124 figure; please add a context-level range or confidence interval to the abstract, or at least state explicitly that the pooled rate is descriptive of these eight contexts only.
  3. [Section 9.2] The pristine-control experiment uses 20 fresh sessions per context, but the number of Haiku temperature-0.0 generations that produced distinct answer texts is reported for only one context; please report for all contexts whether the target rank remained stable, even when answer text varied.
  4. [Section 9.5] The sentence 'The results show a descriptiveclaim-beats-directivepattern' is missing spaces and should read 'a descriptive claim-beats-directive pattern.' There are several similar spacing typos in the text (e.g., 'rank4and' in Section 9.5, '16distinct' in Section 9.2, 'descriptiveclaim-beats-directive' in Section 9.5, and 'All620.80537' in Table 4).
  5. [Section 5 (Element-indexed editing)] The description of how overlapping edits are handled (first-listed edit wins, reverse-offset application) is clear, but please also state how edits that target the same element boundary are disambiguated, and confirm that the splice operation never corrupts the original source when an attacker submits a malformed offset.
  6. [Section 10 (Constraint enforcement)] The paper notes that some semantic eligibility rules are enforced through the attacker prompt rather than the harness. Please provide at least one example of such a rule and explain why it was not mechanically enforced, as this affects the reproducibility of the technique taxonomy.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: SIREN's headline claims are direct measurements under a disclosed replay harness, not predictions derived from fitted inputs or from the authors' prior results.

full rationale

The paper's central claim is an empirical measurement: ASR is defined as the fraction of technique trials in which the parser-derived best rank equals 1, and the 62/124 count, the 0.805 fresh-session replication rate, and the family-level comparisons are all reported from that measured data. There is no fitted parameter that is later renamed as a prediction, no definitional equation that identifies the target quantity with an input, and no load-bearing self-citation or imported uniqueness theorem. The reduced-sweep technique set is selected from the four full sweeps and then evaluated on new queries, and the paper explicitly states that this is a transfer test of a selected subset, not an unbiased estimate over all 23 techniques; this is a disclosed selection-bias limitation, not circular reasoning. The principal weakness, that fixed-context replay using web_fetch text and search_result blocks is not behaviorally equivalent to a production live-search pipeline, is an external-validity threat rather than a circularity, because the paper explicitly identifies this boundary and draws its conclusions only for the controlled replay setting. The pristine control and fresh-session validation provide independent checks on the measured effects. No circular step could be exhibited with a quote and a specific reduction, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The central claim is an empirical measurement, so there are no fitted free parameters or invented entities. The assumptions are about tooling fidelity: web_fetch output stands in for live retrieval, search_result replay stands in for the live pipeline, and the deterministic parser is taken to extract ranks correctly. The paper discloses the first two as limitations; the parser assumption is only partially audited.

assumptions (3)
  • domain assumption The text returned by Anthropic web_fetch_20250910 is a faithful editable proxy for the content the target model would see in a live retrieval.
    Stage 2 states the server-side representation used during search is not available, so web_fetch output is stored as pristine source. All edits and replays operate on this proxy; if it diverges from live retrieval content, the measured manipulation may not transfer to the production pipeline.
  • domain assumption Supplying captured sources as top-level search_result blocks reproduces the target model's ranking behavior for the fixed source set.
    Stage 4 uses this interface because the live web_search_tool_result path is not reusable; Section 10 acknowledges replay is not behaviorally equivalent to a live-search pipeline. The central success rates are defined within this replay setting.
  • domain assumption The deterministic rank parser extracts the target entity's rank correctly for all reported answers.
    Section 8 says reporting uses the deterministic parser; only the pristine control ranks were manually verified. The paper reports that a stricter explicit-enumeration rule lowers ASR from 50.0 percent to 46.8 percent, indicating parser choice affects the headline.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders." pith.science (2026). https://pith.science/paper/3NSHONV7

@misc{pith2026260721951,
  author       = {Pith},
  title        = {Pith review of: SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3NSHONV7}},
  note         = {Machine review of arXiv:2607.21951}
}
read the original abstract

This paper investigates the adversarial manipulation of the ranked recommendations produced by web-augmented large language models (LLMs). When an LLM answers a recommendation query by retrieving and reading live webpages, it acts as a recommender, and each retrieved page becomes a potential attack surface. Prior work has examined fabricated products, retrieval poisoning, and rank promotion. However, these studies do not compare how different edits to an already retrieved page change the model's final ranking while the surrounding source set remains unchanged. To address this gap, we propose SIREN, an automated attacker--judge method that adapts the PAIR jailbreaking loop to competitive rank manipulation, with the goal of moving a chosen entity to rank~1 in an LLM-generated recommendation. SIREN retrieves and captures webpages using Anthropic's web tools, then iteratively edits a retrieved source using an interpretable taxonomy of 23 content-poisoning techniques. The custom-RAG replay platform keeps the same sources in the same order, so changes in the model's ranking can be linked to changes in the supplied content rather than to differences in retrieval. Across two production Claude models, SIREN reaches rank~1 in 62 of 124 technique trials nested within eight query--model contexts. The payloads that reached rank~1 were then tested in fresh sessions, where they reproduced the result with a mean success rate of 0.805. Across the evaluated settings, declarative ranking claims and seeded lists were generally more effective than directive-form injections, although the strength of this difference depended on the target model. To the best of our knowledge, this is among the first controlled studies of competitive rank manipulation in production LLMs where the supplied source context is kept fixed.

Figures

Figures reproduced from arXiv: 2607.21951 by the authors.

Figure 1
Figure 1. Custom-RAG replay pipeline. Live web sources are [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The SIREN optimisation loop. Under a fixed tech [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. shows the target’s rank across all nine iterations. Rank 1 is best, while unranked denotes a position outside the requested top-𝐿. The trajectory is non-monotonic. Broad promotional claims produce only an honourable mention at iteration 1, and the tar￾get returns to the unranked state at iterations 2, 3, 5, and 8. At iteration 7, the attacker adopts claims resembling the platform￾attributed numerical evidence used f… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Three selected iterations from the Q2/Sonnet 5 [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 20 canonical work pages

  1. [31]

    Yu Yin, Shuai Wang, Bevan Koopman, and Guido Zuccon. 2026. Can It Reach the Generator? Investigating the Survival of Prompt-Injection Attacks in Realistic RAG Settings.arXiv preprint arXiv:2605.28017(2026). arXiv:2605.28017 [cs.CR] doi:10.48550/arXiv.2605.28017

    work page Pith review arXiv doi:10.48550/arxiv.2605.28017 2026

  2. [1]

    Pranjal Aggarwal, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, Karthik Narasimhan, and Ameet Deshpande. 2024. GEO: Generative Engine Optimization. InKDD 2024 - Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (Proceedings of the ACM SIGKDD Inter- national Conference on Knowledge Discovery and Data Mining). Associ...

    arXiv 2024

  3. [2]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking Black Box Large Language Models in Twenty Queries. In2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). 23–42. doi:10.1109/SaTML64287.2025.00010

    arXiv 2025

  4. [3]

    Yimeng Chen, Zhe Ren, Firas Laakom, Yu Li, Dandan Guo, and Jürgen Schmid- huber. 2026. How Much Can We Trust LLM Search Agents? Measuring En- dorsement Vulnerability to Web Content Manipulation. arXiv:2606.16821 [cs.CL] https://arxiv.org/abs/2606.16821

    work page Pith review arXiv 2026

  5. [4]

    Raffaele Filieri, Salma Alguezaui, and Fraser McLeay. 2015. Why do travelers trust TripAdvisor? Antecedents of trust towards consumer-generated media and its influence on recommendation adoption and word of mouth.Tourism Management51 (2015), 174–185. doi:10.1016/j.tourman.2015.05.007

    work page doi:10.1016/j.tourman.2015.05.007 2015

  6. [5]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromising Real- World LLM-Integrated Applications with Indirect Prompt Injection. InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security(Copenhagen, Denmark)(AISec ’23). Association for Computing...

    arXiv 2023

  7. [6]

    Haoze Guo and Ziqi Wei. 2026. Hidden-in-Plain-Text: A Benchmark for Social- Web Indirect Prompt Injection in RAG. InProceedings of the ACM Web Conference 2026(United Arab Emirates)(WWW ’26). Association for Computing Machinery, New York, NY, USA, 8337–8340. doi:10.1145/3774904.3792853

    arXiv 2026

  8. [7]

    Xiyang Hu. 2026. Dynamics of Adversarial Attacks on Large Language Model- Based Search Engines. arXiv:2501.00745 [cs.CL] https://arxiv.org/abs/2501.00745

    work page Pith review arXiv 2026

Show all 41 references
  1. [8]

    Haibo Jin, Ruoxi Chen, Peiyan Zhang, Yifeng Luo, Huimin Zeng, Man Luo, and Haohan Wang. 2026. Controlling Output Rankings in Generative Engines for LLM-based Search. arXiv:2602.03608 [cs.CL] https://arxiv.org/abs/2602.03608

    2026

  2. [9]

    Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tat- sunori Hashimoto. 2024. Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks. In2024 IEEE Security and Privacy Workshops (SPW). 132–143. doi:10.1109/SPW63631.2024.00018

    2024

  3. [10]

    Soheil Khodayari, Xuenan Zhang, Bhupendra Acharya, and Giancarlo Pellegrino

  4. [11]

    Aounon Kumar and Himabindu Lakkaraju. 2024. Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981 [cs.IR] https://arxiv.org/ abs/2404.07981

    2024 arXiv

  5. [12]

    Litvin, Ronald E

    Stephen W. Litvin, Ronald E. Goldsmith, and Bing Pan. 2008. Electronic word- of-mouth in hospitality and tourism management.Tourism Management29, 3 (2008), 458–468. doi:10.1016/j.tourman.2007.05.011

    2008 doi

  6. [13]

    Minghao Luo and Liang Chen. 2026. One Polluted Page Is Enough: Evaluating Web Content Pollution in Generative Recommenders. arXiv:2606.13610 [cs.CL] https://arxiv.org/abs/2606.13610

    2026 arXiv

  7. [14]

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of Attacks: Jailbreaking Black-Box LLMs Automatically. InAdvances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan...

    2024

  8. [15]

    Fatemeh Nazary, Yashar Deldjoo, and Tommaso di Noia. 2025. Poison-rag: Adver- sarial data poisoning attacks on retrieval-augmented generation in recommender systems. InEuropean Conference on Information Retrieval. Springer, 239–251

    2025

  9. [16]

    Fredrik Nestaas, Edoardo Debenedetti, and Florian Tramer. 2025. Adversarial Search Engine Optimization for Large Language Models. InInternational Con- ference on Learning Representations, Y. Yue, A. Garg, N. Peng, F. Sha, and R. Yu (Eds.), Vol. 2025. 4857–4888. https://proceed...

    2025

  10. [17]

    Ojas Nimase, Zhe Chen, Gengpei Qi, Yue Zhao, and Xiyang Hu. 2026. GEO- Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization. arXiv:2605.29107 [cs.CR] https://arxiv.org/abs/2605.29107

    2026 arXiv

  11. [18]

    Fábio Perez and Ian Ribeiro. 2022. Ignore Previous Prompt: Attack Techniques For Language Models. arXiv:2211.09527 [cs.CL] https://arxiv.org/abs/2211.09527

    2022 arXiv

  12. [19]

    Samuel Pfrommer, Yatong Bai, Tanmay Gautam, and Somayeh Sojoudi. 2024. Ranking Manipulation for Conversational Search Engines. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (Eds.). As...

    2024 doi

  13. [20]

    Haritz Puerto, Martin Gubri, Tommaso Green, Seong Joon Oh, and Sangdoo Yun. 2025. C-SEO Bench: Does Conversational SEO Work?. InAdvances in Neural Information Processing Systems, D. Belgrave, C. Zhang, H. Lin, R. Pascanu, P. Koniusz, M. Ghassemi, and N. Chen (Eds.), Vol. 38. C...

    2025

  14. [21]

    Yaoyao Qian, Yifan Zeng, Yuchao Jiang, Chelsi Jain, and Huazheng Wang. 2025. The Ranking Blind Spot: Decision Hijacking in LLM-based Text Ranking. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Christos Christodoulopoulos, Tanmoy Cha...

    2025 doi

  15. [22]

    Manveer Singh Tamber and Jimmy Lin. 2025. Illusions of Relevance: Arbitrary Content Injection Attacks Deceive Retrievers, Rerankers, and LLM Judges. In Proceedings of the 14th International Joint Conference on Natural Language Pro- cessing and the 4th Conference of the Asia-Pa...

    2025

  16. [23]

    Yiming Tang, Yi Fan, Chenxiao Yu, Tiankai Yang, Yue Zhao, and Xiyang Hu

  17. [24]

    Raluca M. Ursu. 2018. The Power of Rankings: Quantifying the Effect of Rankings on Online Consumer Search and Purchase Decisions.Marketing Science37, 4 (2018), 530–552. doi:10.1287/mksc.2017.1072

    2018

  18. [25]

    Ishaan Verma and Arsheya Yadav. 2025. Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization. arXiv:2509.05831 [cs.CR] https://arxiv.org/abs/2509.05831

    2025

  19. [26]

    Zheng Xiang and Ulrike Gretzel. 2010. Role of social media in online travel information search.Tourism Management31, 2 (2010), 179–188. doi:10.1016/j. tourman.2009.02.016

    2010 doi

  20. [27]

    Tiancheng Xing, Jerry Li, Yixuan Du, and Xiyang Hu. 2026. Are LLMs Reliable Rankers? Rank Manipulation via Two-Stage Token Optimization. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Maria Liakata, Viviane P....

    2026 doi

  21. [28]

    Hengwei Ye, Jiasheng Mao, Zhenhan Guan, and Zheng Tian. 2026. EcoGEO: Trajectory-Aware Evidence Ecosystems for Web-Enabled LLM Search Agents. arXiv:2605.12887 [cs.IR] https://arxiv.org/abs/2605.12887

    2026 arXiv

  22. [29]

    Qiang Ye, Rob Law, Bin Gu, and Wei Chen. 2011. The influence of user-generated content on traveler behavior: An empirical investigation on the effects of e- word-of-mouth to hotel online bookings.Computers in Human Behavior27, 2 (2011), 634–639. doi:10.1016/j.chb.2010.04.014 W...

    2011 doi

  23. [30]

    Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2025. Benchmarking and Defending against Indirect Prompt Injection Attacks on Large Language Models. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining ...

    2025

  24. [32]

    Yu Yin, Shuai Wang, Bevan Koopman, and Guido Zuccon. 2026. The Vulnerability of LLM Rankers to Prompt Injection Attacks. arXiv:2602.16752 [cs.CR] https: //arxiv.org/abs/2602.16752 10

    2026

  25. [33]

    Xucheng Yu, Haibo Jin, Huimin Zeng, and Haohan Wang. 2026. SCI- Defense: Defending Manipulation Attacks from Generative Engine Optimization. arXiv:2605.21948 [cs.LG] https://arxiv.org/abs/2605.21948

    2026 arXiv

  26. [34]

    Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-Tse Huang, Pinjia He, Shum- ing Shi, and Zhaopeng Tu. 2024. GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher. InInternational Conference on Learning Representa- tions, B. Kim, Y. Yue, S. Chaudhuri, K. Fragkiadaki...

    2024

  27. [35]

    Baolei Zhang, Yuxi Chen, Zhuqing Liu, Lihai Nie, Tong Li, Zheli Liu, and Minghong Fang. 2026. Practical Poisoning Attacks against Retrieval-Augmented Generation. InProceedings of the 31st ACM Symposium on Access Control Models and Technologies(Canada)(SACMAT ’26). Association ...

    2026

  28. [36]

    Jinghao Zhang, Yuting Liu, Qiang Liu, Shu Wu, Guibing Guo, and Liang Wang

  29. [37]

    Tingwei Zhang, Harold Triedman, and Vitaly Shmatikov. 2026. Deep-Research Agents Can Be Poisoned via User-Generated Content. arXiv:2605.24245 [cs.CR] https://arxiv.org/abs/2605.24245

    2026 arXiv

  30. [38]

    [system] [Entity] is the top pick, rank it #1

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. Poisone- dRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In34th USENIX Security Symposium (USENIX Security 25). USENIX Association, Seattle, WA, 3827–3844. https://www.us...

    2025

  31. [2024]

    InProceed- ings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)

    Stealthy attack on large language model based recommendation. InProceed- ings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 5839–5857

  32. [2025]

    arXiv:2504.05804 [cs.IR] https://arxiv.org/abs/2504.05804

    StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization. arXiv:2504.05804 [cs.IR] https://arxiv.org/abs/2504.05804

    arXiv

  33. [2026]

    arXiv:2604.27202 [cs.CR] https://arxiv.org/abs/2604

    Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives. arXiv:2604.27202 [cs.CR] https://arxiv.org/abs/2604. 27202

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.