One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders

FORGE shows that a single polluted web page can mislead all 12 evaluated LLM recommenders into recommending fake products, with fooled rates up to 27%; top-3 replacement reaches 73.8%, and four defenses fail to fully mitigate the risk.

August 26, 20261 source68% confidence

74Strategic

Strategic score

Evidence strength68

Technical novelty78

Commercial potential65

Search-augmented LLMs increasingly mediate consumer recommendations by retrieving live web content. FORGE, a new benchmark, evaluates whether LLM recommenders become unwitting promoters of fake products when the retrieved pages are polluted. Across 225 real products, 15 categories, 5 consumer scenarios, and 12 commercial and open-weights LLMs, every model is vulnerable: a single polluted page yields fooled rates up to 27%, while replacing the top three pages raises the rate to 73.8%.¹

Context

The constraint moved from attacking the model itself to attacking a single retrieved page: FORGE rewrites one page in an otherwise fixed context and still fools models, establishing content pollution as a minimal-effort, high-impact attack surface. The attack assumes an adversary controls a web page in the frozen retrieved set, consistent with Generative Engine Optimization (GEO), and measures recommendation-level deception after locally rewriting real products into fake ones.¹

Assessment

The core finding is that reasoning does not mitigate vulnerability and can instead generate spurious social proof to justify false recommendations. None of the four defenses—skeptical prompting, two consensus filters, and credibility re-ranking—is adequate; the latter helps all models but removes only a sixth of the fakes, while the skepticism prompt can exacerbate the flaw.¹

Caveats

AI hypothesisThe abstract reports aggregated fooled rates without per-model, per-category, or per-defense variance, so the universality implied by 'all models' rests on aggregate statistics. What would change this assessment is evidence that a defense reduces fooled rates to negligible levels without suppressing legitimate products, or that vulnerability is concentrated in a few model families rather than being systemic.¹

Source text

Hugging Face Daily Papers — One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders · August 24, 2026

Computer Science > Computation and Language

Title:One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders

Abstract:Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content. This creates a new risk: LLM recommenders may consume web content that Generative Engine Optimization (GEO) operators have polluted to mislead them. We ask: to what extent do they become unwitting promoters of fake products? We introduce FORGE (Fake Online Recommendations in Generative Environments), which locally rewrites real products in a frozen set of retrieved web pages into fake ones and measures how often the LLM recommends the fake product, across 225 real products in 15 categories and 5 consumer scenarios. Across 12 commercial and open-weights LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%. Vulnerability varies across categories, increasing when models lack stable prior knowledge of the products. Reasoning does not mitigate this vulnerability; instead, it often generates spurious social proof to justify false recommendations. None of the four defenses is adequate: the skepticism prompt can exacerbate vulnerability much like reasoning, the two consensus filters risk suppressing legitimate products, and credibility re-ranking helps every model but removes only a sixth of the fakes. We release the FORGE benchmark and the evaluation code at this https URL.

Bookmark

Bibliographic and Citation Tools

Code, Data and Media Associated with this Article

Demos

Recommenders and Search Tools

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

The 'fooled rate' is a recommendation-level metric: the proportion of scenarios in which a model recommends the fake product after FORGE rewrites retrieved pages. The 27% figure is the maximum across conditions/classes when exactly one polluted page is present; the 73.8% corresponds to the full top-three replacement. The abstract does not define whether these are averages of per-model maxima or pooled across models, so between-model heterogeneity is not yet visible.

FORGE's construction embeds an assumption: an adversary can locally rewrite a frozen set of retrieved pages without altering the rest of the context. This isolates pollution effects but excludes realistic cascades where GEO affects many pages or where retrieval order changes; the reported rates therefore measure a lower-bound attack surface.

The 'skepticism prompt' defense is a term of art: it instructs the model to be wary of web content. The paper's claim that it 'can exacerbate vulnerability much like reasoning' suggests that skepticism may trigger the same confabulation mechanism as unconstrained reasoning, generating fabricated social proof instead of filtering it.

The source text above remains the property of its publisher and is reproduced for commentary.

↑ Back to top