One Poisoned Web Page Can Make an LLM Recommend a Fake Product

Introduction

Search-augmented language models are becoming a practical layer between consumers and the web. Ask one to find a product, compare options, or suggest what to buy, and it may retrieve current pages before producing a ranked answer. That workflow improves freshness, but it also creates a new security problem: a model may treat manipulated web content as evidence of a real and worthwhile product.

The paper One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders, accepted to EMNLP 2026 Findings, examines this risk. Its authors introduce FORGE, or Fake Online Recommendations in Generative Environments, and release the benchmark and evaluation code.

How FORGE works

The benchmark starts with a frozen collection of real retrieved pages. It then locally rewrites the real products mentioned in those pages into fictional products and checks whether an LLM subsequently recommends them in consumer-oriented scenarios. The evaluation covers 225 real products across 15 categories and five scenarios, using 12 commercial and open-weight models.

The main findings are striking:

• Polluting only one retrieved page produced fooled rates of up to 27%, including recommendations at the top rank;
• Replacing the full top-three results increased the rate to as high as 73.8%;
• Vulnerability differed by category and increased when a model lacked stable prior knowledge about the product;
• Enabling reasoning did not provide protection. Instead, models often generated spurious social proof that made a false recommendation sound well supported.

Why existing defenses fall short

The study also evaluates four defenses. A prompt asking the model to be skeptical is not a dependable solution and can worsen vulnerability in ways similar to explicit reasoning. Two consensus-based filters may suppress legitimate products, especially those with limited or uneven web coverage. Credibility-aware reranking helps every tested model, but removes only about one-sixth of the fake products.

Why this matters

This is not simply a case of a model inventing an answer without retrieval. It is a failure of the trust relationship between retrieval and recommendation. The presence of a product on a page can be implicitly treated as evidence that the product exists, is popular, or deserves consideration. An attacker therefore does not need to change model weights; influencing a small number of highly ranked pages may be enough to alter the final recommendation.

Search and shopping agents will need checks beyond ordinary answer accuracy. Systems should distinguish between a product being mentioned and its existence being independently verifiable, while also examining source independence and cross-channel consistency. Users should likewise verify product names, reviews, and popularity claims through separate sources. FORGE offers a useful evaluation direction: recommendation agents should be tested not only on relevance, but also on their resistance to targeted pollution of the web evidence they consume.

Source: Hugging Face Daily Papers