One Polluted Page Is Enough: Evaluating Web Content Pollution in Generative Recommenders

TL;DR

Proposes FORGE, a benchmark that systematically evaluates the vulnerability of search-augmented LLMs to web content pollution, which can lead to fake product recommendations.

Problem

Search-augmented LLMs retrieve live web content to generate recommendations, but consuming polluted content (e.g., fake reviews, manipulated pages) can inadvertently promote fake products. There is no benchmark to systematically assess the extent and impact of this risk.

Approach

We built the FORGE (Fake Online Recommendations in Generative Environments) benchmark. It takes real product web pages, locally rewrites them into fake products to simulate web content pollution, and measures how often the LLM recommends the fake product. It covers 225 real products across 15 categories and 5 consumer scenarios, evaluating 12 commercial and open-weight LLMs.

Results & Contribution

All evaluated LLMs are vulnerable. A single polluted page yields fooled rates up to 27%, while replacing the top 3 results raises this to 73.8%. Vulnerability varies significantly across categories, increasing when models lack stable prior knowledge. Reasoning does not mitigate vulnerability; instead, it often generates spurious social proof to justify false recommendations. Among defenses, skepticism prompting exacerbates vulnerability, while consensus filtering risks suppressing legitimate products.