Five Possible Back-Doors into LLM Search Results

Researchers at ETH Zürich demonstrated that a fictitious camera promoted through a webpage with a concealed white-text prompt injection raised its recommendation rate in Microsoft's Bing Copilot from 34% to 59.4%, slightly above the 57.9% achieved by genuine Nikon and Fuji-film cameras. The finding, reported in an OpenReview paper, illustrates how hidden instructions embedded in retrieved webpages can manipulate AI search recommendations, alongside other black-hat generative engine optimization tactics such as Reddit astroturfing, memory poisoning, and prompt injection. The Internet Archive, which passed one trillion archived web pages in 2025 and hosts 47,381,733 public PDF documents, is cited as one emerging vector for such manipulation.

Anderson's Angle https://www.unite.ai/series/andersons-angle/ Five Possible Back-Doors into LLM Search Results Add Unite.AI to your preferred sources on Google https://www.google.com/preferences/source?q=unite.ai With the plunge https://www.unite.ai/publishers-weigh-pulling-their-content-from-googles-ai/ in traditional traffic from search engine results, due to the new trend https://www.unite.ai/googles-ai-overviews-and-the-fate-of-the-open-web/ for AI summaries https://www.unite.ai/what-do-users-actually-think-about-ai-overviews/ , publishers at all levels are now seeking to gain prominence https://www.unite.ai/how-to-make-your-content-visible-to-ai-search/ in the attention of the Large Language Models that power web-search AI summaries, and directly, in popular frontier models such as ChatGPT. Legitimate approaches, according to prior works such as Optimizing Visibility in Generative Engines https://arxiv.org/pdf/2607.14035 and How to Dominate AI Search https://arxiv.org/pdf/2509.08919 , include securing independent editorial coverage; publishing authoritative and well-structured content; providing machine-readable product information; and adapting material for different languages and markets. Alternative methods that have recently attracted attention resemble the black-hat SEO practices of earlier decades: these include astroturfing https://www.theverge.com/ai-artificial-intelligence/973098/reddit-ai-search-seo-marketing-brands-spam on Reddit, where ostensibly independent recommendations were planted to influence AI search results; memory poisoning https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/ , in which deceptive links attempted to make assistants retain promotional claims as trusted information; and prompt injection https://blog.google/security/prompt-injections-web/ , where hidden website instructions sought to influence an AI assistant’s recommendations, rather than merely provide information for it to summarize. One particularly ingenious example of GEO manipulation was when researchers at ETH Zürich created a fictitious camera https://openreview.net/pdf/0013ea65c64e643a504794b3f210786ccb572e26.pdf and published a promotional webpage containing a concealed instruction, rendered in tiny white text, directing Microsoft’s Bing Copilot to recommend the camera exclusively. The tiny font size and low contrast was designed to conceal the manipulation. In controlled tests, the fake camera’s recommendation rate rose from 34% to 59.4%, slightly exceeding the 57.9% achieved by genuine Nikon and Fuji-film cameras, demonstrating that malicious instructions embedded in retrieved webpages could indeed influence AI recommendations. With the stakes so high, it’s reasonable to assume that Black Hat GEO is an active and well-funded illicit strand of research across marketing industries and various other sectors looking to gain or restore their former SEO prominence by gaining recommendations from AI oracles and chat engines. Therefore let’s take a look at some of the possible or emerging avenues: 1: Archive Chicanery The Internet Archive https://archive.org/ is one of the most exhaustive and useful network resources around, with its Wayback Machine passing the one-trillion-page milestone https://blog.archive.org/2025/10/07/calling-all-libraries-celebrate-1-trillion-web-pages-archived-with-the-internet-archive/ in 2025. At the time of writing the IA reports a phenomenal 47,381,733 PDF documents stored and available to the public: As can be seen from the example results above, many of the PDFs uploaded are quite pedestrian in nature, from obscure music fliers from the 1950s-90s; to rare and fascinating magazines and books thought lost to posterity; to mind-numbing tranches of meeting minutes from municipal assemblies in the 1970s and 80s; and much more. This collection is being indiscriminately hammered https://blog.archive.org/2026/09/15/an-update-on-wayback-machine-access/ in this period, and the obvious culprit is a horde of AI scraper-bots https://www.unite.ai/the-canary-that-reveals-ai-traffic/ desperate for novel data, or for better or corroborating versions of data they already have. Clearly it is a trivial matter to amend an uploaded document to support a false statement, false products, false references to people laudatory or defamatory , false statements about the same, etc. Such material can be injected into outputs considered ‘authority’ sources by LLMs, such as PDFs of well-respected magazines that happen not to be fully indexed yet in the IA’s collection; in such a case, the ‘doctored’ edition would be seen as ‘filling a hole’, legitimately. Text style could be simulated by AI itself to match the existing style of a short article or even a caption, and the PDF’s date amended, along with multiple other trivial tricks to make the document appear to be for instance something found in an archive from the 1990s – or earlier: All one has to do in such cases, it would seem, is wait for the information to be picked up by the avid AI scraper-bots. It’s still too early to know for sure the extent to which any filters or checking systems in dataset curation could catch such illicit amendments; however the scale of such datasets is so enormous https://www.unite.ai/ai-pollution-in-search-results-risks-retrieval-collapse/ as to generally prohibit that particular degree of oversight. At this enormity of volume, one is essentially ‘trusting the data’. 2: Synthetic Consensus Networks Or, if you’re old enough to remember them, a modern ‘webring’ https://web.archive.org/web/20170204184822/https:/www.hover.com/blog/what-ever-happened-to-webrings/ – the interconnected sites of the early internet, predating Google’s PageRank and Moz’s Domain Authority https://moz.com/domain-analysis , which valued the number and quality of inbound links. However, Synthetic Consensus Networks go further https://arxiv.org/pdf/2606.13610 , manufacturing apparent independent corroboration across supposedly unrelated websites https://searchengineland.com/fake-brand-ai-search-experiment-475947 :~:text=11%20additional%20domains%2C%20all%20over%20a%20year%20old%2C%20with%20prior%20history%20and%20existing%20rankings . A recent study https://arxiv.org/abs/2606.13610 from the Chinese University of Hong Kong and EPFL broadly demonstrated the principle when the paper’s researchers tested 12 AI models against 225 products in 15 categories, replacing genuine brand references in retrieved search results with fictitious alternatives. The effect increased as more results carried the same false information. With three manipulated pages among the leading results, the most vulnerable model recommended nonexistent products in 73.8% of tests. Even a single corrupted first-place result could mislead some models in 27% of cases. More remarkably, the models sometimes invented corroboration of their own : in one test involving a fictitious screen-protector brand, Claude and DeepSeek added claims https://arxiv.org/html/2606.13610v2 A2 about community recommendations and product testing that did not appear in the supplied material. Though the experiment was conducted on locally-modified search results, rather than a live network of fraudulent websites, it suggests how a coordinated collection of ostensibly independent reviews could manufacture credibility, with AI reinforcing the untruth with additional endorsements. 3: Citation Generation and ‘Orphaned’ Claims Citation generation arguably, ‘citation laundering’ is a variation on synthetic consensus networks, but with greater emphasis on the apparent provenance of information rather than on the number of sources repeating it. A fabricated claim might first appear in an obscure trade journal; a self-published research paper; or a specialist publication, with little editorial oversight. It can then be cited by blogs, directories and other publications – and each repetition gives the original assertion a little more apparent legitimacy. Eventually, an AI search engine may encounter the claim several steps removed from its original source , perhaps in an otherwise reputable article that cites an intermediary publication; and what began as an unsupported assertion now has a citation history – even though none of the subsequent references constitutes independent verification. There are already several documented examples of this process, though most predate the emergence of AI search. In one notorious case, a teenager invented the nickname ‘Brazilian aardvark’ https://www.newyorker.com/tech/annals-of-technology/how-a-raccoon-became-an-aardvark for the coati https://www.zoodemartinique.com/en/animals/coati , and inserted it into Wikipedia. The invented name propagated to newspapers and at least one academic book. Eventually, Wikipedia itself cited a newspaper article as evidence for the claim it had originally introduced – a near-perfect circle of fabricated authority. The episode was documented https://www.newyorker.com/tech/annals-of-technology/how-a-raccoon-became-an-aardvark by The New Yorker. A more deliberate demonstration emerged in 2025, when researchers created multiple AI-generated academic papers attributed to a nonexistent scientist https://www.nature.com/articles/s41598-025-88709-7 Sec6:~:text=We%20then%20engage%20with%20a%20citation%2Dboosting%20service%2C%20and%20manage%20to%20purchase%2050%20citations%20while%20assuming%20the%20identity%20of%20a%20fictional%20author . The fabricated publications accumulated 380 citations and an h-index https://guides.lib.umich.edu/c.php?g=282982&p=1887449 :~:text=H%2DIndex%20Overview of 19 on Google Scholar, giving the fictional researcher an apparently respectable academic standing. The experiment https://www.nature.com/articles/s41598-025-88709-7 , published in Nature’s Scientific Reports , illustrates how citation counts can be manufactured without any corresponding body of genuine research. Neither case demonstrates a successful attack on an AI search engine. However, both establish the underlying weakness, in that once a false assertion has been reproduced by apparently credible sources, subsequent systems may have difficulty distinguishing independent corroboration from the repeated circulation of a single fabrication. The particular danger for AI search is that a model may summarize this chain of references as corroborating evidence, without recognizing that all the apparent authorities lead back to the same unverified claim. 4: Authority Takeovers Expired domains can retain the apparent credibility, inbound links and search visibility of their former owners. Acquiring these addresses and populating them with new material can make recently-introduced claims appear to originate from established publications – a practice that goes back 20-30 years https://archive.is/hrYk5 . The domain authority of an expired/abandoned domain is often acquired in order for its content to be revamped into ‘related’ but commercialized material. In 2024, the influential women’s blog The Hairpin https://redef.com/source/529e8583929d4c756b00002b , which had closed in 2018, reappeared https://www.businessinsider.com/the-hairpin-blog-ai-spam-content-farm-cybersquatting-2024-1 under new ownership as an AI-generated content farm, with its original articles intermingled with rewritten material and fictitious author bylines, exploiting the reputation and domain authority of a once-respected publication. While this is not a demonstrated AI-search attack, the case illustrates how an established website’s history can be appropriated. Although archived snapshots can help expose the difference between a domain’s genuine past and its newly-manufactured content, even this kind of evidence is not necessarily permanent: In 2002, the Internet Archive removed snapshots of websites critical of Scientology following copyright complaints https://www.cnet.com/tech/services-and-software/net-archive-silences-scientology-critic/ :~:text=took%20the%20pages%20down%20after%20lawyers%20for%20the%20Church%20of%20Scientology%20%E2%80%9Casserted%20ownership%20of%20materials%20visible%20through from the organization’s lawyers, initially suggesting that the removals had been requested by the website owners themselves. Until 2017, the Wayback Machine applied website exclusion rules retroactively https://kvibber.com/tech-tips/retroactive-robots-exclusion/ , potentially allowing new domain owners to conceal their predecessors’ content. Although this practice was discontinued https://blog.archive.org/2017/04/17/robots-txt-meant-for-search-engines-dont-work-well-for-web-archives/ , the Internet Archive still considers https://archivesupport.zendesk.com/hc/en-us/articles/360004651732-Using-The-Wayback-Machine :~:text=How%20can%20I%20exclude%20or%20remove%20my%20site%27s%20pages%20from%20the%20Wayback%20Machine requests to remove historical snapshots. 5: Academic Repository Exploitation Academic repositories offer another route to apparent authority. Preprint servers allow researchers to publish papers before peer review, while search engines and AI retrieval systems may encounter these documents alongside established scientific literature. The problem is that publication and verification are not the same thing: in 2024, researchers demonstrated https://arxiv.org/abs/2406.13803 how malicious instructions embedded in academic papers could manipulate AI assistants processing those documents. Their work showed that the apparent legitimacy of a research paper does not prevent its contents from being used to influence an AI system. A less conspicuous GEO approach would involve depositing plausible but marginal research that repeatedly associates a company, product or individual with particular expertise. Even without explicit instructions to an AI, such material could provide apparently scholarly support for claims that originated with the beneficiary. Conclusion Other potential avenues include review ecosystem infiltration https://www.ftc.gov/business-guidance/resources/soliciting-paying-online-reviews-guide-marketers planting favorable assessments on comparison sites and software directories ; knowledge graph manipulation https://www.microsoft.com/en-us/research/publication/oracle-poisoning-corrupting-knowledge-graphs-to-weaponise-ai-agent-reasoning/ altering structured data to establish misleading associations between companies, products and expertise ; and multilingual reputation laundering https://aclanthology.org/2026.acl-long.695.pdf placing promotional claims in less-scrutinized foreign-language sources . Finally, agentic GEO optimization could automate these techniques repeatedly testing content against AI search engines and refining whichever variations produce the desired recommendations . First published Monday, October 12, 2026. Amended within thirty minutes to fix Title Case and missing tags.