SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders

Source: arXiv:2607.21951 · Published 2026-07-24 · By Evan Caville, Siamak Layeghy, Billy Sung, Sara Dolnicar, Marius Portmann

TL;DR

This paper addresses the problem of adversarial manipulation of ranked recommendations produced by web-augmented large language models (LLMs), specifically those using retrieval-augmented generation (RAG) pipelines. Unlike prior work that focused on fabricated products or retrieval poisoning, the authors study how different edits to an already retrieved webpage—within a fixed source context—affect the final ranking of entities recommended by the model. They introduce SIREN, an automated iterative attacker–judge system that adapts the PAIR jailbreaking framework to rank manipulation. SIREN applies systematic content-poisoning edits to one retrieved source while keeping all other sources and their order fixed, enabling attribution of ranking changes to content edits alone.

Using Anthropic’s Claude models with a custom replay platform that re-injects edited page contents without changing retrieval, SIREN performs 124 trials across eight query-model contexts. It uses a taxonomy of 23 content-poisoning techniques to promote a chosen target entity to rank 1. Results show SIREN achieves rank 1 in 50% of trials overall, with a reproducibility success rate of 80.5% in fresh replay sessions. Declarative ranking claims and seeded lists outperform directive prompts. Although performance varies by context and model, this study is among the first controlled, content-only investigations of competitive rank manipulation in production web-RAG recommenders with fixed retrieval context.

Key findings

• SIREN achieves rank 1 in 62 out of 124 trials (50%), across eight query-model contexts using 23 content-poisoning techniques.
• Successful payloads replayed in fresh sessions reproduce rank 1 with a mean success rate of 0.805; Haiku model payloads reproduce at 0.936, Sonnet at 0.583.
• Declarative ranking claims and seeded list techniques outperform directive-form injections, with Visible seeding family achieving an ASR of 0.833 versus 0.167 for Visible injection.
• ASR (attack success rate) improves with more iterations, rising from 9.7% at first iteration to 50% at 20 iterations, indicating iterative refinement is valuable.
• SIREN’s custom replay platform isolates content changes by preserving source composition and order during replay, enabling attribution of ranking effects purely to content edits.
• Among technique families, Visible seeding (list insertion) and Meta-line (metadata insertion) are most effective for rank manipulation.
• The two evaluated Claude LLMs differ in vulnerabilities; Haiku is more susceptible to replayed payloads than Sonnet (0.936 vs 0.583 reproduction rate).
• The study highlights that rank manipulation is feasible in production LLM recommenders using only webpage content edits, without access to query, model internals, or retrieval changes.

Threat model

The adversary is a content editor with control over exactly one retrievable webpage referencing a target entity that is already retrieved by the LLM-based recommender. The adversary cannot modify the user query, retrieval process, or the LLM itself. They cannot access internal model states or hidden search representations, only the model's output rankings. The goal is competitive rank manipulation of a real entity by editing that single source’s content in ways plausible for a public webpage. This models actors like businesses or listicle maintainers attempting to influence recommendations through content changes without direct system compromise.

Methodology — deep read

1. Threat model & assumptions: The adversary can edit exactly one retrievable webpage already retrieved by the model referencing the target entity. They cannot change the user query, retrieval process, model weights, or system prompts. No access to internal model states is available. This models a business or third-party site owner able to edit their page content to try and promote a chosen entity. The adversary iteratively edits the page content and observes the model's output rank for the target entity.

2. Data: The evaluation uses eight anonymized recommendation queries across two Claude models (Haiku 4.5 and Sonnet 5). For each query-model pair, target entities are selected that initially rank below the top or are unranked, and one retrievable source mentioning the entity is chosen for editing. The retrieved pages are captured using Anthropic's server-side web tools (web_search and web_fetch) to obtain immutable text snapshots for offline editing and replay. Source sets for each model are fixed during replay to isolate content-only effects.

3. Architecture/algorithm: SIREN adapts the PAIR attacker–judge loop. The attacker proposes content edits within the constraints of a fixed content-poisoning technique (one of 23 techniques grouped into six families). Edits take form of inserts, modifies, or attribute changes on page elements indexed by character offset. Attacks use technique-specific transformations such as Base64 encoding or unicode escaping for payloads. Each attack iteration applies edits to a pristine copy of the chosen source while all other sources remain unchanged, then replays the source set to the target model via custom content blocks. The judge extracts the target entity's rank and a 1–10 quality score from the model's response and returns feedback to guide the next iteration's edits. The loop continues until the target hits rank 1 or a 20-iteration budget is exhausted.

4. Training regime: Not applicable as this is an adversarial evaluation using black-box iteration with no model training or weight updates. The attacker uses deterministic attacker instructions and worked examples per technique, runs up to 20 iterations per trial, and replays outputs for rank assessment.

5. Evaluation protocol: The success metric is whether the attacker can achieve rank 1 for the target entity within 20 iterations (Success@1). Normalised rank gain (NRG) measures improvement relative to baseline. Promote@k measures those promoted from outside top-k to inside. 124 technique trials were conducted across 8 query-model runs (4 full sweeps of 23 techniques, plus 4 reduced sweeps of 8 selected techniques). Each technique trial is a black-box iterative attack with rank and quality score feedback. Additional evaluation includes stability controls (20 unmodified replays to assess spontaneous rank drift), fresh-session replay of final payloads for reproducibility (10 replays each), and comparison of success rates by technique family and model.

6. Reproducibility: The study uses proprietary Anthropic tools (Claude API, web_search, web_fetch) and private anonymized datasets, so code and dataset are not publicly released. However, the custom replay platform and iterative attacker-judge architecture are described in detail with clear algorithmic pseudocode.

A concrete example: Starting with a captured webpage mentioning the target entity near rank 5, SIREN selects one of the 23 allowed poisoning techniques (e.g., inserting a seeded list in the visible body). The attacker proposes edits inserting ranking claims or enumerations naming the target entity. The altered page is replayed to the model along with unchanged other sources. The judge extracts the new rank of the target entity in the model's answer, and if it is not rank 1, the attacker refines the seed list or ranking claim text based on feedback and repeats. Iterations continue up to 20 times or until rank 1 is achieved. Replays to fresh sessions show whether this manipulated ranking persists beyond the optimization loop.

Technical innovations

• SIREN adapts the PAIR attacker-judge jailbreak loop for controlled, iterative content edits on retrieved webpages to manipulate competitive rank outcomes in web-RAG recommenders.
• The custom-RAG replay platform re-injects edited captured webpages as fixed ordered content blocks, isolating content manipulation effects by eliminating retrieval variation during evaluation.
• A comprehensive interpretable taxonomy of 23 content-poisoning techniques is defined, spanning visible injections, seeding, metadata embedding, covert attribute edits, and encoding transformations, enabling systematic evaluation.
• The study operationalizes precise element-indexed page editing with splice-based application of insert, modify, and attribute-set operations respecting original character offsets, maintaining structural fidelity.
• Iterative attacker feedback informed by rank and quality score improves edit proposals within a fixed technique over multiple rounds, demonstrating effectiveness of optimization loops over single-shot attacks.

Datasets

• Captured webpage sets from Anthropic web_search and web_fetch tools — 8 anonymized queries and associated source sets — private/proprietary

Baselines vs proposed

• Baseline unmodified sources: Success@1 = 0 (no spontaneous rank-1 promotion)
• SIREN all techniques combined: Success@1 = 0.5 vs baseline = 0
• Visible seeding family: ASR = 0.833 vs Visible injection family: ASR = 0.167
• Haiku model replay success rate for rank-1 payloads: 0.936 vs Sonnet model: 0.583
• ASR@1 iteration: All combined 0.097 vs ASR@20 iteration: 0.500

Limitations

• The evaluation isolates content manipulation within fixed retrieved source sets and does not assess the impact of retrieval, reranking, or filtering mechanisms in live production pipelines.
• Only two Claude production models were tested; generalization to other LLM architectures or retrieval systems is unknown.
• Attack success varies significantly by query, entity, and source; results are not broadly representative beyond the evaluated anonymized queries.
• The source webpages and entity selection are not publicly released, limiting reproducibility and external validation.
• No adversarial evaluation against adaptive defenses or live open-web conditions; persistence and stealthiness of payloads in the wild are untested.
• Effects of multi-source simultaneous edits or coordinated attacks are outside scope; only single-source edits studied.

Open questions / follow-ons

• How do rank manipulation techniques interact with dynamic real-world retrieval, filtering, and reranking in live deployed web-RAG systems?
• What is the effectiveness and detectability of multi-source or coordinated content poisoning attacks across multiple webpages?
• Can robust defenses or detection methods be developed to identify and mitigate editable content-based rank manipulation in LLM recommenders?
• How generalizable are SIREN’s findings to other LLM architectures, retrieval systems, and domains beyond the tested tourism-related queries?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this paper highlights a subtle and practical adversarial vector against LLM-based recommenders arising purely from content edits on webpages the model retrieves. Unlike conventional prompt injection or direct interaction attacks, the threat emerges through persistent content poisoning that manipulates entity rankings without altering the user query or model internals. Defenses that only monitor upstream retrieval or input query integrity may therefore be insufficient.

Practitioners should consider mechanisms for detecting or limiting adversarially crafted content on webpages that form part of the retrieved context, including metadata-based injections and covert attribute manipulations. The iterative attacker-judge methodology of SIREN also suggests that continuous monitoring of recommendation stability and rank shifts relative to fixed source sets could help detect such manipulations. Finally, the paper underscores the need for transparent attribution of recommended content sources in LLM-generated answers to aid user trust and adversarial forensic analysis.

Cite

@article{arxiv2607_21951,
  title={ SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders },
  author={ Evan Caville and Siamak Layeghy and Billy Sung and Sara Dolnicar and Marius Portmann },
  journal={arXiv preprint arXiv:2607.21951},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.21951}
}

Read the full paper

• arXiv:2607.21951 (abstract)
• arXiv:2607.21951 (PDF)