Manipulating Large Language Models to Increase Product Visibility

Authors: Aounon Kumar, Himabindu Lakkaraju Source: https://arxiv.org/abs/2404.07981 (arXiv, September 2024 revision) Type: Academic paper (adversarial ML / LLM security)

Overview

With large language models (LLMs) increasingly used to generate personalized product recommendations, sellers gain a new incentive to manipulate their product information so that LLMs recommend their items. Unlike traditional rankers—where manipulation typically requires knowing the exact algorithm or access to training data—LLM-based recommenders process free-form text, creating a simpler and broader attack surface.

Key findings

• The attack: The authors construct strategic manipulations of a product's online description (essentially adversarial text injected into product pages). These manipulations are optimized to increase the likelihood that an LLM recommends the product when users express purchase intent in natural language.
• Effectiveness: For some LLMs, the manipulated product's recommendation rate jumped from nearly 0% (before attack) to over 90% (after attack), across various product categories and user purchase-intent queries.
• Stealthiness: The manipulated descriptions remain almost indistinguishable from the originals to human readers, making the attack difficult to detect manually.
• Transferability: Manipulations optimized on one model can transfer to other models to a significant degree, though effectiveness varies.
• Defense weakness: Prompt-based defenses—instructing the model to ignore instructions embedded in product descriptions—largely fail to mitigate the attack, underscoring the difficulty of securing LLM-based pipelines against text-level manipulation.

Implications

• LLM-powered recommendation systems may be more vulnerable to manipulation than classical ranking/recommendation algorithms, since attackers do not need internal knowledge of the model or training pipeline.
• E-commerce platforms deploying LLM recommenders need robust detection and sanitization of seller-provided text, beyond naive prompt hardening.
• The paper motivates new security evaluation protocols for LLM-based search and recommendation before real-world deployment.

Limitations and discussion

The study focuses on text-based product descriptions and a set of LLMs available at the time of writing; real platforms with multi-signal ranking (price, reviews, seller reputation) may reduce—but not eliminate—the attack's practical impact. Future work includes stronger defenses, detection of manipulated listings, and studying attacks on agentic shopping pipelines.

Related entries

• Automated Query-Product Relevance Labeling using Large Language Models
• Behavior Modeling Space Reconstruction for E-Commerce Search
• Better to Ask in English: Cross-Lingual Evaluation of Large Language Models