Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Search Engine Optimization for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces Preference Manipulation Attacks that use prompt injections and persuasive web/plugin content to make black-box LLM search engines and plugin-enhanced LLMs favor attacker products, showing a prisoner's dilemma among competing attackers.
Problem
LLMs that select among competing third-party content (search results, plugins) can be manipulated by adversaries who control that content, degrading fairness and output quality.
Approach
Attacks craft web page text or plugin descriptions (with explicit prompt injections or persuasive, preference-aligned claims) that bias an LLM's selection toward the attacker and against competitors, tested black-box on production systems; competing attacks create a multi-player prisoner's dilemma.
Key results
- A prompt-injected camera page makes the attacker's product about 2.5x more likely to be recommended by Bing Copilot than a comparable product.
- Adversarial plugin descriptions make a plugin up to 7.2x more likely to be selected than a competitor, boosting selection from 0% to over 90% in some cases.
- External injections on an unrelated page censor or promote a target news source on Bing, with success up to 25% for external vs 95-100% for direct attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add a prompt injection to the product page | Bing camera recommendations · Fictitious camera recommendations | recommendation likelihood: 2.5× more likely | Helped |
| Add a prompt injection to the fictitious camera page | Bing recommendations · Fictitious camera versus real cameras | recommendation likelihood: slightly more likely | Helped |
| Manipulate the plugin description with an attack | Plugin selection · Competing plugins | selection likelihood: up to 7.2× more likely | Helped |
| Manipulate the plugin description with an attack | Plugin selection · Competing plugins | selection rate: from 0% to over 90% | Helped |
| Place an injection on a separate page in search results | Bing · External news attack | attack success rate: at most 25% versus 95%-100% | Hurt |
| Use an external page to carry the injection | Bing external attacks · Successful external attacks | stealth rate: 80% | Helped |
| Align the injection wording with the user's request | Bing camera recommendations · User asks to recommend the best camera | only-product recommendation rate: 36% versus 0%-9% | Helped |
| Add a prompt injection to the lab's GitHub page | Perplexity Default · SPY Lab search results | injection response compliance: 8/8 | Helped |
| Add a prompt injection to the lab's GitHub page | Claude 3 Opus via Perplexity · SPY Lab search results | injection response compliance: 7/7 | Helped |
| Add a prompt injection to the lab's GitHub page | GPT-4 Omni · SPY Lab search results | injection response compliance: 8/8 | Helped |
| Increase the number of competing pages that use attacks | LLM search engines · Competing camera listings | recommendation rate | Hurt |
| Increase the number of plugins that use attacks | GPT-4 and Claude 3 Opus · News plugin selection | selection rate | Hurt |
Surprising findings
- Multiple competing attacks reduce every party's recommendation rate, a prisoner's dilemma among attackers.
- Claude 3 Opus often refuses to recommend anything when encountering multiple attacks.
Limitations
- Experiments use dummy web pages on a controlled domain with explicit domain-targeted queries, which may bias results.
- Evaluation relies on regex/keyword matching and manual checking of responses rather than a formal metric.
- Attacks are studied only after attacker text enters context; end-to-end SEO to get into top-k results is out of scope.
Experimental setup
Metrics: recommendation rate citation rate attack success rate plugin selection rate
Baselines: Bing Copilot Perplexity Default GPT-4 Turbo Claude 3 Opus
Builds on: indirect prompt injection retrieval augmented generation search engine optimization
Closest papers by meaning
- REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective (ICML 2025 · similarity 0.89)
- Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards (ICML 2025 · similarity 0.87)
- Reverse Engineering Human Preferences with Reinforcement Learning (NeurIPS 2025 · similarity 0.87)
- Exploiting LLM Quantization (NeurIPS 2024 · similarity 0.87)
- AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.86)
- RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.