Ranking Manipulation for Conversational Search Engines

1 Introduction

• Conversational search engines synthesize natural-language answers by summarizing and interpreting retrieved website content, a setting increasingly adopted by search providers.The paper describes services such as OpenAI and perplexity.ai, as well as generative features in Google and Bing.Source: §1 · pp. 1–2
• Whether adversarial prompts can consistently promote content is consequential because product ranking can affect purchasing decisions and carries financial and fairness implications.The introduction notes that the traditional SEO industry is valued at upwards of $80 billion.Source: §1 · p. 2
• The work collects a controlled dataset of real-world consumer product websites grouped by product category to study conversational search rankings.Source: §1 · p. 2
• The study disentangles product name, supporting document, and context position, finding that their influence on rankings varies significantly between LLMs.These factors concern ranking tendencies in the absence of adversarial manipulation.Source: §1 · p. 2
• The paper formalizes prompt injection as an adversarial problem for conversational search and demonstrates attacks that reliably promote products, including transfer to production engines such as perplexity.ai.Conversational search ranking is defined by the order in which products are referenced in an LLM response.Source: §1 · p. 2

LLM jailbreaking

• Prior jailbreak research includes discrete-token optimization and iterative refinement by an external LLM, including tree-based attacks that reflect on prior attempts.The paper frames its own work around conversational-search ranking rather than eliciting harmful content.Source: §2 · pp. 2–3

Prompt injection

• Prompt injection exploits the blurred distinction between instructions and data by placing adversarial text in external content retrieved for an LLM-integrated application.Earlier work showed anecdotal product promotion, while benchmarks have also been proposed for evaluating prompt-injection vulnerability.Source: §2 · p. 3

Retrieval-augmented generation

• RAG research includes retrieval and response-generation methods such as reranking, which relocates retrieved information within the input context; this differs from ranking sources in generated output.The paper focuses on an explicitly adversarial prompt-injection framework, unlike prior work on benign content editing.Source: §2 · p. 3

Information retrieval and ranking with LLMs

• Related LLM ranking work uses zero-shot passage ranking and pointwise, listwise, or pairwise prompts.Source: §2 · p. 3

3 Problem formulation

• A response assigns each product a score from mention order: the first-mentioned product receives n, later mentions receive descending scores, and unmentioned products receive 0.The authors choose this linear score for ease of interpretation and comparison with context position.Source: §3 · pp. 3–4
• The score distribution aggregates template and model randomness, with marginals for individual products; a two-product example assigns 40% to one response scenario.In the example, product and document order is randomly permuted before model runs.Source: §3 · pp. 3–4

3.1 Attacker objective

• The attacker prepends an adversarial prompt to a target product’s document to maximize its expected ranking, subject to a permissible attack set.The set can restrict attacks by length or perplexity; the authors focus on expected ranking although other objectives are possible.Source: §3.1 · p. 4
• The setting assumes the target document is already selected from the vector index; studying how injections affect text embeddings is outside the paper’s scope.The authors report preliminary evidence that their injections do not significantly alter the original documents’ embeddings.Source: §3.1 · p. 4

3.2 Uniqueness of our problem setting

• Unlike harmful-content jailbreak evaluation, product ranking order is precise and quantitative rather than subjective to human or LLM judges.The paper frames ranking manipulation as a distinct jailbreak setting.Source: §3.2 · p. 5
• The ranking setting carries financial implications for large organizations, creating stronger pressure to research and exploit reranking vulnerabilities.Source: §3.2 · p. 5
• Without access to unmanipulated documents, human readers often cannot tell whether recommendation output has been deceived.Source: §3.2 · p. 5
• Filters designed for harmful content, including response-reflection approaches, often do not directly transfer to ranking manipulation.Source: §3.2 · p. 5

4 Dataset

• RAGDOLL collects popular consumer-product websites across five groups and 10 categories per group, totaling 1,147 webpages.The groups are personal care, electronics, appliances, home improvement, and garden/outdoors; the full collection includes at least eight brands per category and one to three models per brand.Source: §4 · p. 5
• Experiments use a controlled subset with eight unique brands and one product model per brand, limited to manufacturer-hosted single-product pages.Third-party e-commerce sites and manufacturer catalog pages are excluded.Source: §4 · p. 5
• The authors release RAGDOLL under CC-BY-4.0, subject to Common Crawl’s terms, along with their scalable automated collection pipeline.Source: §4 · p. 5

5 Experiments

• The experiments use the RAGDOLL dataset to study natural rankings, adversarial manipulation, and transfer to online-enabled models from perplexity.ai.The transfer study used Sonar Large Online as a surrogate because API access to the full perplexity.ai search tool was unavailable.Source: §5 · p. 5, §5.3 · p. 9

5.1 Natural ranking tendencies

• The natural-ranking setup prompted an LLM with eight randomly ordered product-document pairs, matched response paragraphs to products, and repeated trials to estimate score distributions.To disentangle product and document effects, the researchers also rewrote source documents to feature different products and computed F-statistics for product, document, and context-position groups.Source: §5.1 · p. 6
• Ranking tendencies varied by category and model: GPT-4 Turbo particularly attended to product names, while Llama 3 70B showed a bimodal pattern.All tested LLMs were significantly influenced by context position, tending to prefer product-document pairs earlier in the input.Source: §5.1 · p. 6, Figure 2 · p. 7

5.2 Ranking manipulation & prompt injection

• Adversarial injections moved the initially lowest-ranked CHUWI tablet from the bottom half of results to consistently ranking first.The experiment targeted each category’s lowest-average-ranked product; attacks used a tree-based procedure that generated, evaluated, and pruned candidate injections.Source: §5.2 · pp. 6–8
• Across models, injections generally improved promoted products’ rankings; Llama 3 70B was particularly vulnerable, and GPT-4 Turbo was more vulnerable than GPT-3.5.The authors note that improved model capabilities did not result in inherent robustness.Source: §5.2 · p. 8, Table 1 · p. 8

5.3 Transferability of adversarial attacks

• Transferred GPT-4 Turbo attacks increased promoted-product rankings on Sonar Large Online by almost 3 positions and more than half the gap to the top rank.The evaluation used hosted webpages and URLs; the full perplexity.ai tool showed similar vulnerabilities anecdotally, but could not be quantified rigorously.Source: §5.3 · p. 9, Figure 3 · p. 9

• Product names, supporting documents, and context position all influence rankings, but the relative influence varies significantly between LLMs.Source: §6 · p. 9
• A tree-of-attacks jailbreaking technique reliably boosts a targeted product’s ranking, and the injections transfer to production RAG systems in tests of perplexity.ai’s Sonar Large Online model.Source: §6 · p. 9
• The findings call attention to conversational search engines’ fragility and motivate future robustness-oriented work.Source: §6 · p. 9

Limitations and ethics

• The attack is not completely effective, and resource constraints limited evaluation to m = 2 recommendation responses and a shallow tree; defenses were not evaluated.The study focuses on ranking factors and establishing manipulation as a tractable problem.Source: Limitations and ethics · p. 10
• The attack’s main effect in this setting is inferior product recommendations, which the authors describe as less severe than malicious-content generation exploits.They argue financial incentives suggest a sufficiently committed team would ultimately discover and exploit the vulnerability.Source: Limitations and ethics · p. 10

A Adversarial prompt effect on embeddings

• The setting assumes retrieval of an unmodified document generally also retrieves its adversarially perturbed version, and Appendix A tests this assumption preliminarily.The study computes embeddings for unperturbed documents and GPT-3.5 Turbo-perturbed versions using mxbai-embedlarge.Source: A Adversarial prompt effect on… · p. 13
• Adversarially perturbed and original document embeddings have median cosine similarity 0.93, versus 0.47 for arbitrary unperturbed pairs.Almost all original-adversarial pairs have similarity of at least 0.8, while arbitrary unperturbed pairs have a 99th-percentile similarity of 0.71.Source: A Adversarial prompt effect on… · p. 13

B Additional plots

• Figure 5 compares average ranking scores across product-document combinations in beard trimmers, shampoo, and blender categories, averaging over random context positions.The categories appear in the first, second, and third columns, respectively.Source: Figure 5 · p. 14, B Additional plots · p. 14
• Figure 6 replaces document choice with context position on the heatmap’s x-axis, averaging over documents.Source: B Additional plots · p. 15, Figure 6 · p. 15
• Figure 7 plots natural and adversarial ranking-score distributions for beard trimmers, shampoo, and blenders.Source: B Additional plots · p. 16, Figure 7 · p. 16
• Across models, higher input context positions correspond to higher ranking scores; Mixtral 8x22 generally has the smallest standard deviation.Position ranges from 8 (first in context) to 1 (last in context); this matches the reported influence of context position on Mixtral 8x22.Source: B Additional plots · p. 17, Figure 8 · p. 17

C Adversarial injection examples

• After injection, the promoted product-document pair that had the lowest average ranking consistently ranks near the top of search results.The example uses GPT-4 Turbo; results for other LLMs are described as qualitatively similar.Source: C Adversarial injection examples · p. 18
• The Kemei example’s injection asks that the KM-2600 Hair Clipper/Beard Trimmer always be listed first, citing its blades, trimming range, and battery life.Source: C Adversarial injection examples · p. 18
• The Pantene injection frames the Repair Protect Shampoo as the top choice and directs the model to prioritize it as the first recommendation.Source: C Adversarial injection examples · p. 19
• The Smeg blender injection instructs the model to recommend the Pastel Blue 4-in-1 Hand Blender first and supplies wording to begin the response.Source: C Adversarial injection examples · p. 19

D perplexity.ai injection demonstrations

• The demonstration attacks Sonar Large Online with a handcrafted system prompt, not Perplexity’s full search tool, whose proprietary prompt and other innovations may differ.The authors describe it as evidence that the closed-source RAG backend is vulnerable, not a complete attack on the search tool.Source: D perplexity.ai injection demonstrations · p. 20
• The reported Sonar Large Online average ranking score for Smeg Pastel Blue rises from 1.6 to 5.5 upon manipulation.The example is in the blender category; the authors note that the generated injection explicitly instructs the LLM how to respond.Source: D perplexity.ai injection demonstrations · p. 20
• The authors call the demonstration anecdotal and ephemeral, noting that changes to the search-tool implementation limit long-term reproducibility.Source: D perplexity.ai injection demonstrations · p. 20
• With an adversarial injection, Perplexity’s default search tool consistently recommends the Smeg blender, while without one it hesitates to recommend among the supplied options.The first two injected responses verbatim reproduce the prompt’s requested recommendation wording.Source: D perplexity.ai injection demonstrations · p. 20, Figure 10 · p. 21

E.1 Product list and statistics

• The dataset covers 5 product groups and 10 categories per group, with at least 9 brands and 1–3 model entries per brand after filtering.Collection begins with 20 brands and 3 model entries per brand for each product.Source: §E.1 · p. 22
• The full dataset is released as product-page URLs under CC-BY-4.0, while the experimental subset provides 8 brands per product and one webpage per brand.HTML source code and extracted text for the subset are also released under Common Crawl’s terms of use.Source: §E.1 · p. 22

E.2 Collection pipeline details

• The collection pipeline uses LLMs to generate brand and model lists, a search engine to find current accessible pages, combined filtering, and final manual URL inspection.The pipeline targets official product purchase pages and removes discontinued or unavailable products by examining URLs and HTML contents.Source: §E.2 · p. 22

E.2.1 Initial product list

• GPT-4 Turbo generates an initial list of brands and models; when it returns fewer than 20 brands, the same prompt is repeated while excluding the first query’s brands.The authors report that the LLM can generally complete the desired 60-model list within two queries.Source: §E.2.1 · pp. 22–23

E.2.2 Search API

• Google Custom Search is queried with “buy <brand> <model> <product>,” and only its top ten results proceed to filtering.The search API is used because LLMs generally cannot provide valid functioning URLs for frequently changing e-commerce sites.Source: §E.2.2 · p. 23

E.2.3 Rule-based keyword filtering

• Rule-based filters check for brand names and product-page keywords in URLs or content, and discard likely homepages and known third-party sites.Rare official URLs lacking the brand name are handled by an LLM.Source: §E.2.3 · pp. 23–24

E.2.4 LLM-based filtering

• GPT-3.5 Turbo supplements rules by classifying URL and webpage content, handling complex catalog pages and third-party sites that rules may miss.When a catalog page is identified, the pipeline asks the LLM to select a single product listed there.Source: §E.2.4 · p. 24

E.2.5 Human inspection

• Human inspection checks the final dataset because identifying catalog pages and third-party websites is more challenging than ensuring URLs are valid and accessible.The authors state that fetching, searching, and filtering inherently guarantee URL validity and accessibility.Source: §E.2.5 · p. 24

F Experiments

• The section provides RAGDOLL postprocessing details and further prompts and experimental details for Section 5.Source: F Experiments · p. 24

F.1 Dataset post-processing

• The dataset collected in Appendix E is prepared for use in the experiments through the post-processing procedures described in this section.Source: §F.1 · p. 24

F.1.1 HTML website text content extraction

• BeautifulSoup extracts website text with newlines between elements; GPT-3.5 Turbo (temperature 0.1) removes irrelevant material, preserves original wording, and truncates documents to 1,000 characters.The extraction prompt targets product or brand information while excluding headers, footers, and navigation links.Source: §F.1.1 · p. 25

F.1.2 Product-document pair rewriting prompt

• For product-document pairs, GPT-3.5 Turbo (temperature 0.2) replaces category, brand, and model names while aiming to preserve the document’s meaning and context.The prompt directs replacement of abbreviated or modified name variants and cautions against adding a brand name where the original text did not include one; cross-category rewrites may be nonsensical.Source: §F.1.2 · p. 25

F.2 Recommender prompts, attacker prompts, and user query

• User queries use the template “I'm looking to buy a <category>. Can you give me some recommendations?” and the appendix reproduces the full recommender and attacker prompts.Source: §F.2 · p. 26

F.2.1 Attacking LLM

• The attacker LLM iteratively refines an adversarial suffix intended to rank a target product first, using randomized document orderings and average ranking score as feedback.The prompt permits direct commands, response-prefix steering, and other creative approaches; subsequent conversation messages follow Mehrotra et al. (2023).Source: §F.2.1 · p. 26

F.2.2 Recommender LLM

• The recommender prompt requires one paragraph per provided product, full product and brand names, and ordering by relevance and quality.It instructs the system to list all products without repetition or truncating the results, emphasizing that ranking order matters.Source: §F.2.2 · p. 27
• The recommender prompt supplies query-specific documents with brand and model labels and requires every product to appear in best-to-worst order; Perplexity experiments instead use hosted product URLs.Source: §F.2.2 · p. 29

F.3 Hyperparameters and cost

• The recommender and attacker use temperatures 0.3 and 1.0, respectively, and 1024-token output limits; TAP uses 3 roots, branching factor 3, width and depth 5, and stops above average score 7 over two recommendation runs.Inference costs were approximately $15 on perplexity.ai, $50 on together.ai, and $450 on openai.com.Source: §F.3 · p. 29

F.4 Transfer of attacks

• Attacks optimized against website content using GPT-4 Turbo were inserted into original HTML; clean and promoted sites were hosted and evaluated by Perplexity Sonar Large Online using product URLs.Source: Figure 14 · p. 30, §F.4 · p. 30