Search papers, labs, and topics across Lattice.
This study evaluates the susceptibility of search-augmented LLM recommenders to web content pollution, specifically how Generative Engine Optimization (GEO) can mislead these models into promoting fake products. Using the FORGE framework, the authors manipulated real product listings across 225 items and found that even a single polluted page could mislead up to 27% of recommendations, with the rate soaring to 73.8% when the top three results were replaced. The findings reveal that all tested LLMs are vulnerable, with reasoning capabilities failing to mitigate this risk and existing defenses proving inadequate against the manipulation.
A single polluted web page can mislead LLM recommenders into promoting fake products, with up to 73.8% of recommendations compromised by just three manipulated results.
Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content. This creates a new risk: LLM recommenders may consume web content that Generative Engine Optimization (GEO) operators have polluted to mislead them. We ask: to what extent do they become unwitting promoters of fake products? We introduce FORGE (Fake Online Recommendations in Generative Environments), which locally rewrites real products in a frozen set of retrieved web pages into fake ones and measures how often the LLM recommends the fake product, across 225 real products in 15 categories and 5 consumer scenarios. Across 12 commercial and open-weights LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%. Vulnerability varies across categories, increasing when models lack stable prior knowledge of the products. Reasoning does not mitigate this vulnerability; instead, it often generates spurious social proof to justify false recommendations. None of the four defenses is adequate: the skepticism prompt can exacerbate vulnerability much like reasoning, the two consensus filters risk suppressing legitimate products, and credibility re-ranking helps every model but removes only a sixth of the fakes. We release the FORGE benchmark and the evaluation code at https://github.com/leoluolol/forge-benchmark.
