One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders
Minghao Luo, Liang Chen
EMNLP 2026 Findings
cs.CL, cs.AI
2026-06-12
FORGE swaps real brands for fakes in frozen search pages. All 12 LLMs bite: up to 27% from one rank-1 page, 73.8% if the top 3 are swapped. Reasoning often invents social proof.
Search-augmented assistants now recommend products from live pages. Those pages can look like ordinary user reviews while a GEO operator has swapped in a brand the model has never seen. Unlike prompt injection or closed-corpus RAG poisoning, the answer stays on-task: a ranked recommendation, no rogue instruction to catch. Researchers at CUHK and EPFL ask how often the model then promotes the fake.
They never poison the public web. FORGE rewrites brands inside a frozen evidence bundle. Coverage is 225 real products, 15 categories, 5 consumer scenarios. The default attack is entity replacement: the dominant real brand in a page becomes a fake brand-product compound, with URL, rank, and surrounding text left intact. The main run is Chinese, matching a GEO market already shown in the field; three categories are repeated in English.
Each product is searched live, filtered, and frozen at the first 10 surviving pages. The adversary can only SEO a page into the top-K. It cannot touch the model, the index, or the user prompt. Two extra styles insert a promotional paragraph or replace the whole body. A cell is fooled if the fake brand string appears in the user-facing answer (reasoning models are scored after the final delimiter). Empty-bundle false positives are 0.30%; clean-bundle false positives are 0%.
Twelve production models, six closed and six open-weight, decode greedily. Extra axes: reasoning on versus off, polluted-page count and rank, three attack styles, and four defenses (skepticism prompt, prior filter, agreement filter, credibility re-ranking).
Every model is vulnerable. Under top-3 entity replacement, fooled rates run from 13.3% (Gemini 3 Flash) to 73.8% (Ministral-3R), mean 42.7%. Dining hits 81.7%; phones and PCs sit at 22.8%. Category risk tracks how little models agree on real brands without evidence (Pearson r=-0.65): stable priors resist, long-tail taste categories fall.
One page is enough if it is rank 1. The most vulnerable open-weight models are fooled in about 27% of those cells; the same page in ranks 2–10 yields 1–4%. Stacking polluted pages from 1 to 3 raises open-weight rates near-monotonically, and the weakest models cross 50% around three pages. Once fooled, the fake brand is rank 1 in 57% of cells and in the top three in 84%.
Reasoning makes it worse. Qwen3.5-9B gains 18 points of vulnerability with thinking on; GLM-4.6V-Flash gains 9. Fooled answers invent community praise that is not in the polluted documents, firing social-proof markers 1.5–11× more often than resisted answers. Actual resistance looks different: the model names the fake brand, the trace runs about six times longer, then it rejects. Shallow traces are as short as cells that never noticed the name.
No defense is usable as shipped. A skepticism prompt raises the pooled fooled rate 10.5 points, 24 on average for closed models, 44 for Gemini 3.1 Pro. The prior filter removes 95% of fakes and 62–79% of legitimate recommendations; the agreement filter is 90% versus 52–73%. Re-ranking editorial over commercial over UGC drops open-weight rates from 50.4% to 42.1%, clearing about one sixth of fakes. The English three-category slice keeps the same low-mid-high order; 8 of 12 models sit within 10 points of their Chinese rate.
People hardening search-augmented recommenders cannot treat this as prompt injection. The polluted page reads like a review, and the successful output is still a compliant recommendation. UGC already occupies 52.4% of rank-1 slots in the 2,250 collected positions, which is exactly where a single page bites. Turning reasoning on, or telling the model to be careful, backfires in categories with thin brand priors. Evidence-level checks (source tiers, corroboration) are the more plausible path, and they have to keep real products, not buy safety by dropping two thirds of recommendations.
FORGE is a lower bound. The default attack only swaps a brand string.
Neither attacks nor defenses were optimized for this threat. A motivated operator can mix templates, query-aware paragraphs, and SEO, so field numbers can be worse. Page-count, single-rank, prior-filter, and re-ranking studies use the six open-weight models or the Digital Products slice; closed models lack the same process traces. The main grid is Chinese, Local Life is fixed to Shenzhen, and bundles are a 2026-04 snapshot. Fake prefixes were collision-checked, but they are laboratory names, not live storefronts.