「一個受污染的頁面就已足夠：評估LLM推薦系統中的網頁內容污染」

摘要

搜尋增強的大語言模型（LLMs）透過檢索即時網路內容，日益成為日常消費推薦的中介。這帶來了一項新風險：LLM 推薦系統可能消費已被生成式引擎優化（Generative Engine Optimization, GEO）操作者污染、用以誤導系統的網路內容。我們探討的問題是：LLM 在多大程度上會不自覺地成為虛假產品的推銷者？我們提出 FORGE（Fake Online Recommendations in Generative Environments，生成環境中的虛假線上推薦）框架，將固定的檢索網頁集合中的真實產品局部改寫為虛假產品，並衡量 LLM 推薦該虛假產品的頻率；此評估涵蓋 15 個類別、225 個真實產品與 5 種消費情境。在 12 個商用與開放權重的 LLM 中，所有模型都存在此漏洞：單一受污染網頁即可造成高達 27% 的受騙率，而完整的前三名替換則將此比例提升至 73.8%。漏洞程度因類別而異，當模型缺乏對產品的穩定既有知識時，漏洞會增加。推理無法緩解此漏洞；相反地，推理往往會產生虛假的社會證明來為錯誤推薦辯護。四種防禦措施皆不足以應對：懷疑提示詞可能如同推理一樣加劇漏洞，兩種共識過濾器有壓抑合法產品的風險，而可信度重排序雖然對每個模型都有所幫助，但僅能移除六分之一的虛假產品。我們在 https://github.com/leoluolol/forge-benchmark 發布 FORGE 基準資料集與評估程式碼。

English

Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content. This creates a new risk: LLM recommenders may consume web content that Generative Engine Optimization (GEO) operators have polluted to mislead them. We ask: to what extent do they become unwitting promoters of fake products? We introduce FORGE (Fake Online Recommendations in Generative Environments), which locally rewrites real products in a frozen set of retrieved web pages into fake ones and measures how often the LLM recommends the fake product, across 225 real products in 15 categories and 5 consumer scenarios. Across 12 commercial and open-weights LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%. Vulnerability varies across categories, increasing when models lack stable prior knowledge of the products. Reasoning does not mitigate this vulnerability; instead, it often generates spurious social proof to justify false recommendations. None of the four defenses is adequate: the skepticism prompt can exacerbate vulnerability much like reasoning, the two consensus filters risk suppressing legitimate products, and credibility re-ranking helps every model but removes only a sixth of the fakes. We release the FORGE benchmark and the evaluation code at https://github.com/leoluolol/forge-benchmark.