Adversarial Search Engine Optimization for Large Language Models

Fuente: arXiv
Salvato in:
Dettagli Bibliografici
Autori principali: Nestaas, Fredrik, Debenedetti, Edoardo, Tramèr, Florian
Natura: Preprint
Pubblicazione: 2024
Soggetti:
Accesso online:
Tags: Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
_version_ 1866909237908602880
author Nestaas, Fredrik
Debenedetti, Edoardo
Tramèr, Florian
author_facet Nestaas, Fredrik
Debenedetti, Edoardo
Tramèr, Florian
contents Large Language Models (LLMs) are increasingly used in applications where the model selects from competing third-party content, such as in LLM-powered search engines or chatbot plugins. In this paper, we introduce Preference Manipulation Attacks, a new class of attacks that manipulate an LLM's selections to favor the attacker. We demonstrate that carefully crafted website content or plugin documentations can trick an LLM to promote the attacker products and discredit competitors, thereby increasing user traffic and monetization. We show this leads to a prisoner's dilemma, where all parties are incentivized to launch attacks, but the collective effect degrades the LLM's outputs for everyone. We demonstrate our attacks on production LLM search engines (Bing and Perplexity) and plugin APIs (for GPT-4 and Claude). As LLMs are increasingly used to rank third-party content, we expect Preference Manipulation Attacks to emerge as a significant threat.
format Preprint
id arxiv_https___arxiv_org_abs_2406_18382
institution arXiv
publishDate 2024
record_format arxiv
spellingShingle Adversarial Search Engine Optimization for Large Language Models
Nestaas, Fredrik
Debenedetti, Edoardo
Tramèr, Florian
Cryptography and Security
Machine Learning
Large Language Models (LLMs) are increasingly used in applications where the model selects from competing third-party content, such as in LLM-powered search engines or chatbot plugins. In this paper, we introduce Preference Manipulation Attacks, a new class of attacks that manipulate an LLM's selections to favor the attacker. We demonstrate that carefully crafted website content or plugin documentations can trick an LLM to promote the attacker products and discredit competitors, thereby increasing user traffic and monetization. We show this leads to a prisoner's dilemma, where all parties are incentivized to launch attacks, but the collective effect degrades the LLM's outputs for everyone. We demonstrate our attacks on production LLM search engines (Bing and Perplexity) and plugin APIs (for GPT-4 and Claude). As LLMs are increasingly used to rank third-party content, we expect Preference Manipulation Attacks to emerge as a significant threat.
title Adversarial Search Engine Optimization for Large Language Models
topic Cryptography and Security
Machine Learning
url https://arxiv.org/abs/2406.18382