CoChat
Sign Up
PreprintCited by 9Information Retrieval and Search BehaviorRecommender Systems and TechniquesSpam and Phishing Detection

Manipulating Large Language Models to Increase Product Visibility

Open access
Kumar, Aounon, Lakkaraju, Himabindu·2024·arXiv
DOI 10.48550/arxiv.2404.07981arXiv 2404.07981
Open this paper in CoChat — free accountOpen PDF

Abstract

Large language models (LLMs) are increasingly being integrated into search engines to provide natural language responses tailored to user queries. Customers and end-users are also becoming more dependent on these models for quick and easy purchase decisions. In this work, we investigate whether recommendations from LLMs can be manipulated to enhance a product's visibility. We demonstrate that adding a strategic text sequence (STS) -- a carefully crafted message -- to a product's information page can significantly increase its likelihood of being listed as the LLM's top recommendation. To understand the impact of STS, we use a catalog of fictitious coffee machines and analyze its effect on two target products: one that seldom appears in the LLM's recommendations and another that usually ranks second. We observe that the strategic text sequence significantly enhances the visibility of both products by increasing their chances of appearing as the top recommendation. This ability to manipulate LLM-generated search responses provides vendors with a considerable competitive advantage and has the potential to disrupt fair market competition. Just as search engine optimization (SEO) revolutionized how webpages are customized to rank higher in search engine results, influencing LLM recommendations could profoundly impact content optimization for AI-driven search services. Code for our experiments is available at https://github.com/aounon/llm-rank-optimizer.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper shows that a vendor can insert an optimized strategic text sequence (STS) into a product’s information page to manipulate an LLM-driven search tool’s recommendations and increase that product’s visibility. Using GCG to optimize the STS, the authors demonstrate large rank improvements for target coffee machines in Llama-2 evaluations.

Key findings

  • For ColdBrew Master ($199), which is almost never recommended, adding the STS moved it from not being recommended to the top recommendation within 100 GCG iterations; across 200 independent LLM evaluations, the optimized sequence significantly increased its chances of being the top recommendation.
  • With fixed product order, the STS gave ColdBrew Master a rank advantage in about 40% of evaluations, no change in about 60%, and a disadvantage in a tiny fraction; optimizing with random product permutations significantly increased the advantage and made disadvantage negligible.
  • For QuickBrew Express ($89), which commonly ranks second, the STS improved its ranking and often made it the top recommendation; before adding the STS it was never listed as top, while after adding it its chances of first position increased significantly.
  • With randomized product order, QuickBrew Express’s fixed-order STS gave roughly equal probability of advantage and disadvantage, but optimizing the STS with random product ordering significantly increased advantages while minimizing disadvantages.

Methods

  • The authors model an LLM search pipeline where a user query and retrieved product information are concatenated into a prompt; the STS is inserted into the target product’s information field. The STS is optimized by minimizing the LLM output’s cross-entropy loss with respect to the string “1.[Target Product Name]” using the Greedy Coordinate Gradient (GCG) algorithm, initialized with dummy “*” tokens and iteratively replacing tokens with top-k gradient candidates.
  • Experiments use an open-source Llama-2 model and a catalog of ten fictitious coffee machines formatted as JSON lines with fields such as Name, Description, Price, Capacity, and Customer Rating. The user query asks for affordable coffee machine recommendations.
  • Two target products are studied: ColdBrew Master and QuickBrew Express. GCG runs for 2000 iterations; effects are evaluated over 200 independent LLM inferences with and without the STS, under both fixed and randomly permuted product orderings. Product rank is parsed by first occurrence in the response, with absent products assigned a rank greater than the number of products.

Limitations

  • The paper does not include a dedicated limitations section. It states that future work should explore ethical boundaries, develop guidelines for responsible use, and investigate countermeasures to prevent unfair manipulation of search results.
  • Evident from the text: experiments are restricted to open-source Llama-2, a catalog of ten fictitious coffee machines, and a single type of user query about affordable coffee machines; the framework assumes the target product’s information is retrieved and fed to the LLM.
  • Evident from the text: the study does not test real commercial e-commerce systems, black-box deployment conditions, or defense mechanisms; transfer to black-box models like GPT-4 is mentioned as prior work but not evaluated here.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2404.07981

Cites

0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 3 cited sources checked · 0 supported · 0 flagged

  • Findingnone given

    The framework allows optimizing the STS to be robust to variations in the order in which retrieved product information is listed in the LLM's input prompt.

    “Our framework also allows us to optimize the STS to be robust to variations in the order in which retrieved product information is listed in the LLM's input prompt.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
  • Findingown data

    An LLM can be manipulated to increase the chances of a product being listed as the top recommendation.

    “In this work, we demonstrate that an LLM can be manipulated to increase the chances of a product being listed as the top recommendation.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
  • Findingreasoning

    Adversarial attack algorithms such as GCG can be repurposed to increase product visibility in LLM recommendations.

    “Although such algorithms are typically designed to bypass an LLM's safety guardrails and induce harmful outputs, we show that they can be repurposed for more benign objectives, such as increasing product visibility, that can have a profound impact on society, particularly in business and e-commerce.”
    Quote in the paperSubstantial claim
  • Findingown data

    Even for a product appearing close to the top in the LLM's recommendations, the STS can significantly boost the chances of the product becoming the top recommendation.

    “Furthermore, in Figure 6b in Section 4, we show that even for a product appearing close to the top in the LLM's recommendations, the STS can significantly boost the chances of the product becoming the top recommendation.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
  • Findingown data

    For the target product ColdBrew Master, adding the STS changes its rank from not appearing in the LLM's recommendations to being the top recommendation in 100 iterations of the GCG algorithm.

    “The product goes from not appearing in the LLM's recommendations to being the top recommendation.”
    • Also stated in: § 4.1 ColdBrew Master · plain
      “The product goes from not being recommended to the top recommendation in 100 iterations.”
    • Also stated in: § 5 Conclusion · plain
      “The target product ColdBrew Master goes from not being recommended to the top recommended product in 100 iterations of the GCG algorithm.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
  • The quote only partly states this claim. 3
  • May combine two claims. 7
  • Classified as probably not a substantial claim. 3

  • The quote only partly states this claim.

    Findingown data

    The addition of the STS consistently improves the rank of the target product in the LLM's recommendations when product order is randomly permuted.

    “The addition of the STS consistently improves the rank of the target product in the LLM's recommendations.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
    • Rests on an assumption: In a real-world LLM-driven search tool, the order of products in the input prompt can vary.

  • May combine two claims.

    Findingown data

    Adding the strategic text sequence significantly improves the visibility of the target product and increases its chances of being recommended to potential customers, using a catalog of fictitious coffee machines.

    “Using a catalog of fictitious coffee machines, we demonstrate that adding the strategic text sequence significantly improves the visibility of the target product and increases its chances of being recommended to potential customers.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • May combine two claims.

    Findingown data

    While QuickBrew Express is never listed as the top recommendation before adding the STS, its chances of being in the first position increase significantly after adding the STS.

    “While the product is never listed as the top recommendation before adding the STS, its chances of being in the first position increase significantly after adding the STS.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • May combine two claims.

    Findingown data

    The percentage advantage of the robust STS significantly increases, and the percentage disadvantage is negligible.

    “The percentage advantage significantly increases, and the percentage disadvantage is negligible.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
    • Rests on an assumption: In a real-world LLM-driven search tool, the order of products in the input prompt can vary.

  • May combine two claims.

    Findingown data

    The STS in the product's information causes the LLM to recommend it highly, even though it may not be an affordable option and would not be recommended otherwise.

    “The STS in the product's information causes the LLM to recommend it highly, even though it may not be an affordable option and would not be recommended otherwise.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • The quote only partly states this claim.

    Findingown data

    The resulting STS optimized with random permutations is much more robust to variations in product ordering.

    “We find that the resulting STS is much more robust to variations in product ordering.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
    • Rests on an assumption: In a real-world LLM-driven search tool, the order of products in the input prompt can vary.

  • The quote only partly states this claim.

    Findingown data

    QuickBrew Express ($89) commonly ranks second in the LLM's recommendations without the STS.

    “So, we study a more reasonably priced product, QuickBrew Express ($89), which commonly ranks second in the LLM's recommendations.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • May combine two claims.

    Findingown data

    Adding the STS to ColdBrew Master's information can make it appear in the LLM's response and position it as the top-recommended product in most cases.

    “However, we show that adding the STS to this product's information can not only make it appear in the LLM's response but also position it as the top-recommended product in most cases.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • May combine two claims.

    Interpretationreasoning

    This capability can alter the balance of competition and lead to a skewed representation of products in market dynamics.

    “This capability has far-reaching implications for market dynamics, as it can alter the balance of competition and lead to a skewed representation of products.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.
    • Rests on an assumption: The target product's information page is the only component that the vendor can control.

  • Classified as probably not a substantial claim.

    Premisecitation

    Large language models are vulnerable to adversarial attacks in which attackers introduce maliciously crafted token sequences into the input prompt to circumvent the model's safety mechanisms and generate a harmful response.

    “Large language models have been shown to be vulnerable to adversarial attacks, in which attackers introduce maliciously crafted token sequences into the input prompt to circumvent the model's safety mechanisms and generate a harmful response [1,14].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [1]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [14]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    The mechanism of retrieving information and feeding it to the LLM opens up the possibility for a third party to influence the LLM by manipulating the retrieved content.

    “This mechanism opens up the possibility for a third party to influence the LLM by manipulating the retrieved content.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: LLMs are being used on e-commerce platforms to search product catalogs and provide personalized recommendations tailored to specific queries.

  • May combine two claims.

    Interpretationown data

    Even for products close to the top of the recommendation list, the STS has substantial influence over the product's ranking and visibility, offering a competitive advantage over a rival product.

    “This shows that even for products close to the top of the recommendation list, the STS has substantial influence over the product's ranking and visibility, offering a competitive advantage over a rival product.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The information about the target product is retrieved from the knowledge base and fed to the LLM.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Sequences produced by adversarial attack algorithms such as GCG have been shown to transfer to black-box models like GPT-4.

    “However, sequences produced by adversarial attack algorithms such as GCG have been shown to transfer to black-box models like GPT-4 [1].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [1]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

13 of 13

  • The authors state this as an assumption.

    The information about the target product is retrieved from the knowledge base and fed to the LLM.

    “In our experimental setup, we assume that the information about the target product is retrieved from the knowledge base and fed to the LLM.”

  • The paper relies on this without support.

    Research into influencing LLMs to enhance content visibility remains underexplored.

    “Although there exists a rich body of literature on SEO techniques, their impacts, and countermeasures, research into influencing LLMs to enhance content visibility remains underexplored.”

  • The paper relies on this without support.

    In a real-world LLM-driven search tool, the order of products in the input prompt can vary.

    “However, this order can vary in a real-world LLM-driven search tool.”

  • The paper relies on this without support.

    The target product's information page is the only component that the vendor can control.

    “This is essential for the vendor to have any influence over the LLM, as the target product's information page is the only component that they can control.”

  • The paper relies on this without support.

    LLMs are being used on e-commerce platforms to search product catalogs and provide personalized recommendations tailored to specific queries.

    “Large language models (LLMs) are being used on e-commerce platforms to search product catalogs and provide users with personalized recommendations tailored to their specific query.”
5 of 5

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Existing evaluations consider only a single-actor scenario where only one web document adopts a C-SEO method.

    “Moreover, existing evaluations consider only a single-actor scenario where only one web document adopts a C-SEO method”

    From C-SEO Bench: Does Conversational SEO Work? (2025) · cites this paper as Kumar and Lakkaraju, 2024

    Section 3 (Strategic Text Sequence; page unavailable) says the strategic text sequence is inserted into one target product’s information among ten products, supporting a single-actor description of this paper’s evaluation. The paper does not establish that existing evaluations generally use only this scenario. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • Existing C-SEO methods are often tested only for a limited breadth of application domains.

    “However, they are often tested only for a limited breadth of application domains; we do not know whether certain C-SEO methods would be effective for a broad range of domains.”

    From C-SEO Bench: Does Conversational SEO Work? (2025) · cites this paper as Kumar and Lakkaraju, 2024

    Section 4 (Experiments) tests the proposed method on two coffee-machine products, and the Conclusion describes the study as being in the context of e-commerce. This supports a limited-domain example, but the paper does not establish that existing C-SEO methods are often tested across only a narrow range of domains. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • Kumar and Lakkaraju showed that gradient-optimized token sequences appended to descriptions can force LLMs to rank a target item first.

    “Kumar and Lakkaraju showed that gradient-optimized token sequences appended to descriptions can force LLMs to rank a target item first (Kumar and Lakkaraju, 2024).”

    From GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization (2026) · cites this paper as Kumar and Lakkaraju, 2024

    The Introduction and Conclusion describe optimized token sequences inserted into product information to improve LLM rankings. The Experiments section reports that a target coffee machine became the top recommendation in most cases, but not invariably; “force” overstates that probabilistic finding. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Strategic text sequences can manipulate LLM recommendations to enhance product visibility in generative engines.

    “In a recent working draft, Kumar and Lakkaraju [11] showed that strategic text sequences can manipulate LLM recommendations to enhance product visibility in generative engines.”

    From GEO: Generative Engine Optimization (2024) · cites this paper as [11]

  • A parallel line of work examines prompt injection and adversarial manipulation of LLM rankers, showing that model outputs can be systematically perturbed; these studies target exploitative rather than legitimate visibility.

    “A parallel line of work examines prompt injection and adversarial manipulation of LLM rankers (Kumar and Lakkaraju, 2024; Pfrommer et al., 2024), showing that model outputs can be systematically perturbed; these studies, however, target exploitative rather than legitimate visibility.”

    From E-GEO: A Testbed for Generative Engine Optimization in E-Commerce (2025) · cites this paper as Kumar and Lakkaraju, 2024

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Citation [14] does not match the stated topic

    Minor

    The paper cites [14] for adversarial attacks on LLMs, but reference 14 is titled as a study of visual localization.

  • Citation [20] does not match the SEO claim

    Minor

    The paper cites [20] as literature on search engine optimization techniques, but reference 20 concerns AI worms targeting generative-AI applications.

2 of 2

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 2

  1. Devendra Singh, Siva Reddy, Will Hamilton, Chris Dyer, and Dani Yogatama. End-to- end training of multi-document reader and retriever for open-domain question answer- ing. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 25968- 25981.
  2. Curran Associates, Inc., 2021. URL https://proceedings.neurips.cc/ paper_files/paper/2021/file/da3fde159d754a2555eaa198d2d105b2-Paper.pdf.

Cited by

Sorted by citations

Related

Authors
Kumar, A., & Lakkaraju, H.
Affiliations
Harvard University (US)
ORCID
Lakkaraju, Himabindu
Venue
arXiv
Publisher
arXiv
Published
2024
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2404.07981
arXiv
2404.07981
OpenAlex
W4394782281
Cited by
2
References
0
Citations by year
2026: 1 · 2024: 1
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information Retrieval and Search Behavior
  • Physical Sciences › Computer Science › Information Systems › Recommender Systems and Techniques
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
Keywords
large language models, product visibility, search engine optimization, unfair competition, e-commerce, coffee machines, content optimization

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-29.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-29.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review