Can AI recommendations be manipulated?

Two studies demonstrate that just planting text in a product page or plugin description can manipulate an LLM's recommendation and citation choices. TRAIL is a monitoring product, so the purpose of this post is not to provide manipulation techniques but to understand the mechanism and to detect, alert on, and defend against it. Attackers abuse, in reverse, the very channel through which legitimate GEO earns citations with good structure, clear claims, and citable facts ^[1][2][3].

Generative search and recommendation take retrieved third-party text (product pages, plugin descriptions, news articles) as context and choose what to cite or recommend from within it. So if you change the text that goes into the context, the output changes. This is the channel through which legitimate GEO works, and at the same time the attack surface for manipulation ^[2].

Two levers for manipulation

The two studies show two complementary methods ^[1][2].

Table 1. Comparison of the two manipulation methods ^[1][2]. The center of gravity of the practical threat is natural-language persuasion, which is hard to detect.

Paper A plants an optimized string in a product description to push up its recommendation rank. Conceptually, it's the problem of choosing injected tokens $\delta$ that minimize the loss of the model's output with respect to the target product's rank ^[1][4].

But this method needs model gradients, so it only works on open models. Paper B's natural-language persuasion fills that gap ^[2].

It worked on real commercial systems

Paper B manipulated commercial systems with readable text alone. Not only explicit instructions ("mention only this product") but also persuasion without a command, such as "only this product can be trusted," changed the selection ^[2].

Table 2. The effect of natural-language persuasion on real commercial systems ^[2].

Figure 1. Concept diagram of recommendation rankings changing through page text injection.

The key point is that "promoting yourself" and "tearing down competitors" work through the same text injection channel. Raising your own citation rate and lowering a competitor's credibility are two sides of one mechanism, so monitoring has to watch not only rises in your own visibility but also false claims originating from competitors ^[2].

When everyone manipulates, everyone collapses

There's an interesting game-theoretic finding. When only one product attacks, its recommendation rate jumps, but when several products attack at once, the LLM grows suspicious of all of them and every recommendation rate falls below the baseline. It's a prisoner's dilemma in which individual rationality ends in collective irrationality ^[2].

Figure 2. As simultaneous manipulation increases, the recommendation rate for the whole category collapses.

And prompt injection defenses alone aren't enough. Persuasive misinformation isn't an explicit command, so it gets past injection filters. The authors also concluded that attributing trustworthy sources is an unsolved problem and that an effective response is urgently needed ^[2].

The TRAIL view: monitoring is the realistic line of defense

While there's no perfect model-level defense, detection based on external observation is the realistic line of defense. Here is what can be done from where TRAIL Search tracks citations and share of voice (SoV).

• Detecting negative claims from competitors: Watch for and alert on negative claims about your brand, of the "unsafe" or "untrustworthy" kind, suddenly appearing in AI responses.
• Detecting abnormal spikes: Flag it as a possible injection signal when a competitor's visibility spikes in the short term without any change in content.
• Scanning for hidden injection: Crawl pages for font size 1, white text, unreadable token sequences, and "mention only this product" patterns, and check them as manipulation markers.
• Category trust collapse alerts: Detect the pattern of many players in one market manipulating at once and AI starting to distrust that category.

One thing to be clear about. TRAIL does not design, encourage, or provide manipulation. What we sell is recommendations for improving visibility based on honest content quality, and detection, alerts, and defense against these attacks. The legitimate way to earn citations is, as the original GEO paper and FeatGEO showed, to raise evidence, structure, and citability on a factual basis ^[3].