The paper introduces FORGE, a benchmark that rewrites real product pages into fake ones to test how often search‑augmented large language models (LLMs) recommend these polluted items. Across 12 commercial and open‑weight LLMs, a single polluted page can lead to up to 27% of recommendations being fake, rising to 73.8% when the top‑3 replacements are used. The study finds that reasoning does not help and existing defenses—skepticism prompts, consensus filters, and credibility re‑ranking—are largely ineffective.
By Minghao Luo, Liang Chen
arXiv:2609.06027v1 Announce Type: cross
Abstract: Search-augmented LLM agents are increasingly used for consumer decisions, making them vulnerable to Generative Engine Optimization (GEO) poisoning. E...
By Zhongan Bi, Qiwen Wang, Jianrong Jiang, Jigang Ding, Wenwen Xiong, Changhua Meng, Xuanang Gao, Kepeng Lin, Changjiang Jiang, Yiang Chen, Huan Yao, Wei Wang, Zhenyu Ma, Wenhui Dong
arXiv:2606. 13610v1 Announce Type: cross Abstract: Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content.
By Minghao Luo, Liang Chen
The paper introduces GEO Defender, a two‑stage defense system designed to protect generative search engines from malicious Generative Engine Optimization (GEO) attacks that rewrite web documents to manipulate generated answers. GEO Defender comprises a Shield Reranker, which learns a defensive residual to demote GEO‑rewritten documents while maintaining relevance, and a Training‑Free Shield Generation component that creates a natural‑language library guiding the target LLM’s source usage during inference. Experiments on both closed‑source and open‑source large language models show that GEO Defender dramatically lowers attack success rates from 50.32% to 6.20%, preserves over 94% of benign evidence usage, and maintains answer quality while generalizing to unseen attacks.
By Haozhang Li, Yangguang Shao, Xinjie Lin, Zhong Guan, Mi Zhou, Junzheng Shi
Counter‑GEO‑Bench is a new benchmark that evaluates how well defenses can stop large language models from producing misinformation when faced with generative engine‑optimized (GEO) content. It contains 247 human‑verified queries paired with both information‑preserving and information‑distorting GEO rewrites, and measures attack success rate, false positives, and answer quality across three victim LLMs. The study shows that existing off‑the‑shelf defenses reduce attack success by at most 5.7 %, while a lightweight baseline called C‑GEO Guard cuts success by 47.6 % with minimal loss of utility.
By Bing Zheng, Zongyao Zhao, Wenming Yang
Counter‑GEO‑Bench is a new defense benchmark that tests how well systems can resist misinformation generated by generative engine optimization (GEO). It contains 247 human‑verified queries paired with both information‑preserving and information‑distorting GEO rewrites, and evaluates defenses on attack success rate, false positives, and answer quality across three large language models. Existing off‑the‑shelf defenses reduce attack success by at most 5.7%, while a lightweight baseline, C‑GEO Guard, cuts it by 47.6% with minimal loss of utility.
The paper investigates prompt injection attacks on Jev, a non‑generative decision model, using 510 reconstructed cases. It finds that malicious prompts can shift Jev’s action probabilities, though rarely cause it to choose the attacker’s target. Techniques such as override markers mitigate influence, while adaptive attacks that use score feedback roughly double the highest attacker‑target probability and increase success rates on new validation calls from 1.8% to 3.5%.
By Tiantong Wu, Wei Yang Bryan Lim
arXiv:2605. 29107v2 Announce Type: replace-cross Abstract: Large language models (LLMs) increasingly rank products, documents, and recommendations for user queries, which makes manipulating these rankings a growing concern for fairness and information integrity.
By Ojas Nimase, Zhe Chen, Gengpei Qi, Yue Zhao, Xiyang Hu
arXiv:2607. 08147v1 Announce Type: cross Abstract: Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the web's oldest attack surfaces.
By Corban Villa, Alp Eren Ozdarendeli, Sijun Tan, Raluca Ada Popa
arXiv:2609.09551v1 Announce Type: cross
Abstract: Recommender systems have become core infrastructure for modern online platforms, personalizing content at scale and strongly influencing what users s...
By Quoc Viet Nguyen, Trinh Pham, Viet Huynh, Hongzhi Yin, Quoc Viet Hung Nguyen, Bay Vo, Thanh Tam Nguyen
arXiv:2607. 20730v1 Announce Type: cross Abstract: Large language models increasingly use search tools to retrieve up-to-date information, introducing a new attack surface in which retrieved documents can be manipulated.
By Zhaoqi Wang, Zijian Zhang, Xiaomei Yuan, Pengtao Kou, Jiamou Liu, Zhen Li, Liehuang Zhu
arXiv:2608. 04565v1 Announce Type: cross Abstract: LLM-based search agents are widely used for information-seeking tasks, but their reliance on external tool returns introduces a critical security risk: web content retrieved during execution is untrusted, exposing agents to prompt injection and goal hijacking.
By Xuebin Li, Hanqing Zhao, Siyuan Liang, Kejiang Chen, Weiming Zhang, Dacheng Tao, Nenghai Yu