mlsanityData to 7 Oct 2026

Adversarial Search Engine Optimization for Large Language Models

arXiv 2406.18382 ↗First posted 26 Jun 2024cs.CR cs.LGcited by 37

Not on the map. Why?

Abstract (arXiv)

Large Language Models (LLMs) are increasingly used in applications where the model selects from competing third-party content, such as in LLM-powered search engines or chatbot plugins. In this paper, we introduce Preference Manipulation Attacks, a new class of attacks that manipulate an LLM's selections to favor the attacker. We demonstrate that carefully crafted website content or plugin documentations can trick an LLM to promote the attacker products and discredit competitors, thereby increasing user traffic and monetization. We show this leads to a prisoner's dilemma, where all parties are incentivized to launch attacks, but the collective effect degrades the LLM's outputs for everyone. We demonstrate our attacks on production LLM search engines (Bing and Perplexity) and plugin APIs (for GPT-4 and Claude). As LLMs are increasingly used to rank third-party content, we expect Preference Manipulation Attacks to emerge as a significant threat.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Builds on 17 of its 47 references that are in the map. First posted on arXiv 26 Jun 2024.

Builds on

17 of 47 references.

References · 17

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  7. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  8. 2023Are aligned neural networks adversarially aligned?cited by 305
  9. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
  10. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  11. 2022Attributed Question Answering: Evaluation and Modeling for Attributed Large Language Modelscited by 108
  12. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 93
5 more
  1. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  2. 2024What Evidence Do Language Models Find Convincing?cited by 74
  3. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  4. 2024Manipulating Large Language Models to Increase Product Visibilitycited by 24
  5. 2023Unifying Corroborative and Contributive Attributions in Large Language Modelscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 18; 2026: 18.

37 papers.

Sort:

By area:

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 125
  2. 2025Firewalls to Secure Dynamic LLM Agentic Networkscited by 34
  3. 2025MPMA: Preference Manipulation Attack Against Model Context Protocolcited by 31
  4. 2025Adversarial Attacks on Robotic Vision Language Action Modelscited by 31
  5. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysiscited by 25
  6. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Searchcited by 17
  7. 2025Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Searchcited by 15
  8. 2025StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimizationcited by 10
  9. 2025C-SEO Bench: Does Conversational SEO Work?cited by 10
  10. 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agentscited by 5
  11. 2025Dynamics of Adversarial Attacks on Large Language Model-Based Search Enginescited by 5
  12. 2025SafeSearch: Automated Red-Teaming of LLM-Based Search Agentscited by 4
25 more
  1. 2026Deep-Research Agents Can Be Poisoned via User-Generated Contentcited by 4
  2. 2025Web-Browsing LLMs Can Access Social Media Profiles and Infer User Demographicscited by 3
  3. 2025CC-GSEO-Bench: A Content-Centric Benchmark for Measuring Source Influence in Generative Search Enginescited by 3
  4. 2025MaxShapley: Towards Incentive-compatible Generative Search with Fair Context Attributioncited by 3
  5. 2026Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankerscited by 3
  6. 2026Controlling Output Rankings in Generative Engines for LLM-based Searchcited by 3
  7. 2026Diagnosing and Repairing Citation Failures in Generative Engine Optimizationcited by 3
  8. 2026SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimizationcited by 3
  9. 2025Caption Injection for Optimization in Generative Search Enginecited by 2
  10. 2025Look-Ahead Reasoning on Learning Platformscited by 2
  11. 2026GEO-Flag: Detecting and Measuring GEO-Optimized Web Contentcited by 2
  12. 2025Incentive-Aligned Multi-Source LLM Summariescited by 1
  13. 2026Generative AI Advertising as a Problem of Trustworthy Commercial Interventioncited by 1
  14. 2026Evaluating Deep-Search Agents under Hierarchical Web Evidence Poisoningcited by 1
  15. 2025The Ranking Blind Spot: Decision Hijacking in LLM-based Text Rankingcited by 0
  16. 2025Cross-Modal Content Optimization for Steering Web Agent Preferencescited by 0
  17. 2026Tug-of-War within A Decade: Conflict Resolution in Vulnerability Analysis via Teacher-Guided Retrieval-Augmented Generationscited by 0
  18. 2026Agent-Facing Information Design in LLM Tool Registriescited by 0
  19. 2026The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injectioncited by 0
  20. 2026Position: Generative Engine Optimization Creates Underexamined Risks, Governance Must Target Concentration, Disclosure, and Academic Blind Spotscited by 0
  21. 2026One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenderscited by 0
  22. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denialcited by 0
  23. 2026Breadcrumbing Search Agentscited by 0
  24. 2026Reading Too Much into Context: Passive Exposure Can Steer LLM Decisionscited by 0
  25. 2026AX is the New AEOcited by 0