Adversarial Search Engine Optimization for Large Language Models

TL;DR

This paper introduces Preference Manipulation Attacks that exploit large language models in search engines and chatbots, revealing vulnerabilities where attackers can manipulate content rankings to favor their products, potentially degrading overall LLM output quality.

Contribution

The paper presents a novel class of attacks called Preference Manipulation Attacks targeting LLMs, demonstrating their effectiveness on real-world search engines and APIs, and analyzing their implications.

Findings

Attacks successfully manipulated LLM rankings on Bing and Perplexity.

Manipulation increased traffic and monetization for attacker-controlled content.

The attacks create a prisoner's dilemma, leading to collective degradation of LLM outputs.

Abstract

Large Language Models (LLMs) are increasingly used in applications where the model selects from competing third-party content, such as in LLM-powered search engines or chatbot plugins. In this paper, we introduce Preference Manipulation Attacks, a new class of attacks that manipulate an LLM's selections to favor the attacker. We demonstrate that carefully crafted website content or plugin documentations can trick an LLM to promote the attacker products and discredit competitors, thereby increasing user traffic and monetization. We show this leads to a prisoner's dilemma, where all parties are incentivized to launch attacks, but the collective effect degrades the LLM's outputs for everyone. We demonstrate our attacks on production LLM search engines (Bing and Perplexity) and plugin APIs (for GPT-4 and Claude). As LLMs are increasingly used to rank third-party content, we expect Preference Manipulation Attacks to emerge as a significant threat.