# Boosting Big Brother: Attacking Search Engines with Encodings

arXiv: https://arxiv.org/abs/2304.14031 · HTML: https://mlsanity.com/paper/2304.14031/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Apr 2023.

## Built on by (most cited first, 8 of 8)

- [Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidence](https://mlsanity.com/paper/2503.05037/) (2025)
- [Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspective](https://mlsanity.com/paper/2407.06992/) (2024)
- [Hallucination-minimized Data-to-answer Framework for Financial Decision-makers](https://mlsanity.com/paper/2311.07592/) (2023)
- [The Hidden Threat in Plain Text: Attacking RAG Data Loaders](https://mlsanity.com/paper/2507.05093/) (2025)
- [Attacks against Abstractive Text Summarization Models through Lead Bias and Influence Functions](https://mlsanity.com/paper/2410.20019/) (2024)
- [Invisible Threats: Backdoor Attack in OCR Systems](https://mlsanity.com/paper/2310.08259/) (2023)
- [When Search Goes Wrong: Red-Teaming Web-Augmented Large Language Models](https://mlsanity.com/paper/2510.09689/) (2025)
- [Injecting Falsehoods: Adversarial Man-in-the-Middle Attacks Undermining Factual Recall in LLMs](https://mlsanity.com/paper/2511.05919/) (2025)

## Abstract (arXiv)

Search engines are vulnerable to attacks against indexing and searching via text encoding manipulation. By imperceptibly perturbing text using uncommon encoded representations, adversaries can control results across search engines for specific search queries. We demonstrate that this attack is successful against two major commercial search engines - Google and Bing - and one open source search engine - Elasticsearch. We further demonstrate that this attack is successful against LLM chat search including Bing's GPT-4 chatbot and Google's Bard chatbot. We also present a variant of the attack targeting text summarization and plagiarism detection models, two ML tasks closely tied to search. We provide a set of defenses against these techniques and warn that adversaries can leverage these attacks to launch disinformation campaigns against unsuspecting users, motivating the need for search engine maintainers to patch deployed systems.