Manipulating Large Language Models to Increase Product Visibility

Forum topic · 小凯 · 2026-07-05

Summary

This arXiv paper (arXiv:2404.07981) by Aounon Kumar and Himabindu Lakkaraju (Harvard University) investigates strategic text manipulation attacks against large language models (LLMs) used as recommender systems. As LLM-powered assistants increasingly replace traditional search for product discovery, vendors have an incentive to craft product names that manipulate LLMs into recommending their items. The authors formalize this as an optimization problem: given a target product and query, find a modified product name that maximizes the probability the LLM recommends it, without altering the product's semantics so that human readers are not alerted. Using techniques adapted from jailbreaking and prompt injection, including greedy coordinate search and iterative refinement with an adversary LLM, they show that such manipulated names can substantially boost recommendation rates on open-source LLMs like Llama-2 and GPT-style models. The paper discusses defense challenges, including detection via semantic consistency checks, and highlights broader implications for the integrity of LLM-mediated commerce.

Manipulating Large Language Models to Increase Product Visibility

Overview

Authors: Aounon Kumar, Himabindu Lakkaraju (Harvard University)
Source: arXiv:2404.07981 (September 2024 revision)
Topic: Adversarial manipulation of LLM-based recommender systems

Key points

LLM-powered recommenders are displacing traditional search; visibility in LLM answers is becoming a competitive business concern, creating incentives for manipulation.
The paper formalizes an attack setting where a vendor modifies a product name so that a target LLM is more likely to recommend that product for a given query.
A key constraint: the modified name must preserve the product's semantics so human consumers cannot easily detect that manipulation has occurred.
The authors adapt techniques from jailbreaking and prompt injection — including greedy coordinate-based search and an LLM-based iterative optimization loop — to generate manipulated names.
Experiments on open-source models (e.g., Llama-2 family) show that manipulated product names significantly increase recommendation rates compared to unmodified names, demonstrating the practical feasibility of the attack.
The work discusses defenses (e.g., semantic consistency verification between product descriptions and names) and notes that reliably detecting such strategic manipulation remains an open problem.

Why it matters

It exposes a new attack surface unique to generative AI commerce: ranking manipulation no longer targets SEO crawlers but the LLM itself.
It connects adversarial NLP (jailbreaks, prompt injection) to concrete economic harms, motivating marketplace monitoring and LLM output auditing.
It raises evaluation questions for any system that uses LLMs for retrieval or recommendation: robustness against strategically crafted inputs must be measured alongside accuracy metrics.

Limitations

Experiments focus on relatively small, open-source models; proprietary frontier models may differ in susceptibility.
Attacks are query-specific and may not generalize across all user queries without further optimization.
Defenses proposed are preliminary; large-scale deployment countermeasures remain future work.

References

Original paper: https://arxiv.org/abs/2404.07981

Manipulating Large Language Models to Increase Product Visibility

Summary

Manipulating Large Language Models to Increase Product Visibility

Overview

Key points

Why it matters

Limitations

References

Tags