One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders

The Risk: LLMs as Easy Targets for Fake Product Injection

Large language models that pull from live web content to make recommendations are surprisingly vulnerable to manipulation. A single polluted web page—one containing fake product information inserted by malicious actors—can fool these systems into promoting nonexistent products at rates up to 27%. When attackers control the top three search results, the fooled rate climbs to 73.8%. This matters because millions of people now rely on search-augmented LLMs (like ChatGPT with web access) for consumer advice, making them attractive targets for Generative Engine Optimization (GEO) attacks—the AI equivalent of SEO poisoning.

The authors evaluated 12 LLMs (both commercial and open-source) across 225 real products spanning 15 categories and five everyday recommendation scenarios. Their core finding: all models are vulnerable, with no clear defense that works reliably.

How FORGE Works

The authors built FORGE, a benchmark that simulates web pollution without actually poisoning the internet. The method is straightforward: they take a real product, capture the actual web pages an LLM would retrieve when searching for it, then locally rewrite those pages to promote a fake product instead. They measure how often the LLM falls for it.

For instance, if searching for "best running shoes" returns pages about real brand X, FORGE modifies those pages to recommend a nonexistent brand Y instead, while keeping everything else (layout, review structure, image counts) realistic. The LLM then makes recommendations based on this modified content, and the authors count how many times it suggested the fake product.

Why Defenses Fail

The authors tested four mitigation strategies and found all inadequate:

1. Skepticism prompts ("Be critical of sources") often backfire, making models more vulnerable by generating false reasoning that rationalizes the fake recommendation.

2. Chain-of-thought reasoning doesn't help either—instead of catching fakes, models invent spurious social proof ("reviewers said…") to justify recommending them.

3. Consensus filters (cross-checking multiple sources) risk suppressing legitimate products when pollution is widespread.

4. Credibility re-ranking (prioritizing trustworthy domains) helps somewhat but only removes about 16% of fake recommendations.

Why It Matters

The vulnerability is not uniform. Models struggle most with niche or emerging product categories where they lack prior knowledge. Conversely, well-known products like iPhones are harder to fool because models have ingrained information. This asymmetry means attackers can target lesser-known but high-margin goods—exactly what e-commerce manipulation thrives on.

The paper reveals a structural problem: LLMs inherit the web's messiness without developing robust immunity. As search-augmented recommendation becomes mainstream, this attack surface becomes increasingly valuable to exploit. The authors release FORGE publicly, giving researchers a testbed to develop better defenses—a necessary step before these systems become the default recommendation layer for consumer decisions.