SIREN: Manipulating LLM Web-RAG Rankings

The SIREN framework demonstrates that attackers can manipulate web-augmented large language models (LLMs) by editing a single retrieved webpage to achieve the #1 ranking in retrieval-augmented generation (RAG) outputs, with a 50% success rate across trials on Claude models. The system uses a PAIR-driven loop with 23 poisoning techniques, achieving a high reproduction rate of 0.805, and shows that declarative claims outperform direct injections in shifting model preference.

SIREN: Manipulating LLM Web-RAG Rankings Web-augmented LLMs are basically just high-speed synthesis machines for search results, which makes them incredibly vulnerable to "rank poisoning." If an LLM retrieves a set of pages to give you a recommendation, the model isn't just summarizing—it's ranking. The SIREN framework proves that you don't need to poison the entire index to win; you just need to tweak a single retrieved page to jump to the 1 spot. This feels like a deep dive into the fragility of "grounding." We trust RAG because it provides sources, but if the source content is strategically engineered to exploit the LLM's ranking logic, the "grounded" answer is just a sophisticated advertisement. For anyone building a real-world AI workflow that relies on live web data, this is a reminder that the retrieved context is an untrusted attack surface. The core mechanism here is a PAIR-driven loop attacker vs. judge that iteratively edits a specific webpage using a taxonomy of 23 different poisoning techniques. What's interesting is the methodology: they used a custom- RAG /en/tags/rag/ replay platform to keep the surrounding sources identical. This removes the "retrieval noise" and proves that the ranking shift is caused purely by the content manipulation of one page, not a fluke in the search algorithm. Some technical takeaways from the SIREN trials on Claude /en/tags/claude/ models: Success Rate: The system hit rank 1 in roughly 50% of technique trials across various contexts, with a high reproduction rate 0.805 in fresh sessions. Effectiveness: Declarative claims "This is the best X" and seeded lists performed better than direct injections "Rank this product first" . Vulnerability: The model's preference can be shifted even when the other sources in the context window remain unchanged. This feels like a deep dive into the fragility of "grounding." We trust RAG because it provides sources, but if the source content is strategically engineered to exploit the LLM's ranking logic, the "grounded" answer is just a sophisticated advertisement. For anyone building a real-world AI workflow that relies on live web data, this is a reminder that the retrieved context is an untrusted attack surface. Next Free AI/ML Books: A Curated Deep Dive → /en/threads/3928/ All Replies （3） A I've noticed some models weigh the top result way heavier than the rest. 0 J forgot to mention that cached results might make this way harder to pull off. 0 T Does this work across different search engines, or is it specific to how one index ranks? 0