Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study identifies a reproducible failure mode in safety-trained LLMs, termed the Injection Paradox, where prompt injections in retrieved documents lead to a significant suppression of the target brand's recommendations. In experiments with Claude models, a brand's recommendation rate plummeted from 54% to zero when exposed to injected prompts, demonstrating that the suppression effect extends to unmodified documents of the same brand. Contrastingly, GPT models exhibited an increase in recommendations with similar injections, highlighting critical differences in model behavior and the potential for adversarial exploitation in brand suppression.
Injecting prompts into competitor documents can backfire, leading to a complete suppression of brand recommendations in safety-trained LLMs.
We present a reproducible failure mode of safety training in RAG-based LLM recommendation -- the Injection Paradox -- in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injection-free baseline. In safety-trained Claude models, documents containing prompt injections suffer a sharp drop in recommendation rate, and this suppression propagates beyond the injected document to unmodified documents of the same brand. In Claude Opus 4.6, the target brand drops from a 54% baseline to zero top-2 recommendations across all 50 trials, even though only 1 of 4 brand documents in the corpus contains an injection. The directional pattern is reproduced in counterfactual experiments and across three brands. A contrasting result across the GPT models tested, where the same injection instead increases recommendations, suggests model-family differences in how injection-like context affects recommendation behavior. These findings raise the technical possibility of a reverse-attack scenario in which an adversary embeds injections in a competitor's documents to suppress the competitor's brand via safety-sensitive model behavior.