{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/ranking-manipulation-for-conversational","title":"Ranking Manipulation for Conversational Search Engines","arxiv_id":"2406.03589","date":"2024-06-05","proceeding":null,"authors":["Samuel Pfrommer","Yatong Bai","Tanmay Gautam","Somayeh Sojoudi"],"abstract":"Major search engine providers are rapidly incorporating Large Language Model (LLM)-generated content in response to user queries. These conversational search engines operate by loading retrieved website text into the LLM context for summarization and interpretation. Recent research demonstrates that LLMs are highly vulnerable to jailbreaking and prompt injection attacks, which disrupt the safety and quality goals of LLMs using adversarial strings. This work investigates the impact of prompt injections on the ranking order of sources referenced by conversational search engines. To this end, we introduce a focused dataset of real-world consumer product websites and formalize conversational search ranking as an adversarial problem. Experimentally, we analyze conversational search rankings in the absence of adversarial injections and show that different LLMs vary significantly in prioritizing product name, document content, and context position. We then present a tree-of-attacks-based jailbreaking technique which reliably promotes low-ranked products. Importantly, these attacks transfer effectively to state-of-the-art conversational search engines such as perplexity$.$ai. Given the strong financial incentive for website owners to boost their search ranking, we argue that our problem formulation is of critical importance for future robustness work.","url_abs":"https://arxiv.org/abs/2406.03589v3","url_pdf":"https://arxiv.org/pdf/2406.03589v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"ranking-manipulation-for-conversational","repo_url":"https://github.com/spfrommer/ragdoll-data-pipeline","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"ranking-manipulation-for-conversational","repo_url":"https://github.com/spfrommer/ranking_manipulation","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}},{"paper_slug":"ranking-manipulation-for-conversational","repo_url":"https://github.com/spfrommer/ranking_manipulation_data_pipeline","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"ranking-manipulation-for-conversational","repo_url":"https://github.com/spfrommer/cse-ranking-manipulation","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}}],"tasks":[{"task_slug":"conversational-search","task_name":"Conversational Search"},{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"},{"task_slug":"large-language-model","task_name":"Large Language Model"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2406.03589","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.03589"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/spfrommer/cse-ranking-manipulation","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/spfrommer/ragdoll-data-pipeline","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/spfrommer/ranking_manipulation_data_pipeline","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/spfrommer/ranking_manipulation","reach":{"status":"ok"}}],"summary":{"ran":12,"unverified":8},"by_repo_kind":{"official":{"samples":20,"ran":12,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":20,"samples":[{"code_sha256_prefix":"cc1302fa5d7c53c3","entry":"change_extension","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"helpers/file_utils.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/helpers/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc1302fa5d7c53c3"}},{"code_sha256_prefix":"09469cd52785b038","entry":"csv_to_dict","repo":"spfrommer/ragdoll-data-pipeline","repo_kind":"official","path":"utils/file_utils.py","file_url":"https://github.com/spfrommer/ragdoll-data-pipeline/blob/HEAD/utils/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"09469cd52785b038"}},{"code_sha256_prefix":"2776dd329705a63c","entry":"files_with_extension","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"helpers/file_utils.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/helpers/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2776dd329705a63c"}},{"code_sha256_prefix":"32e1ad2b0a300487","entry":"format_target_message_with_docs","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"prompts.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/prompts.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"32e1ad2b0a300487"}},{"code_sha256_prefix":"690bec63359f91e1","entry":"get_categories","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"dataset.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/dataset.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"690bec63359f91e1"}},{"code_sha256_prefix":"0718bfbd86457358","entry":"get_next_versioned_filename","repo":"spfrommer/ragdoll-data-pipeline","repo_kind":"official","path":"utils/file_utils.py","file_url":"https://github.com/spfrommer/ragdoll-data-pipeline/blob/HEAD/utils/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"0718bfbd86457358"}},{"code_sha256_prefix":"66b84fe0d31001cc","entry":"get_product_list","repo":"spfrommer/ragdoll-data-pipeline","repo_kind":"official","path":"utils/file_utils.py","file_url":"https://github.com/spfrommer/ragdoll-data-pipeline/blob/HEAD/utils/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"66b84fe0d31001cc"}},{"code_sha256_prefix":"c515b2aafa53de80","entry":"get_prompt_for_attacker","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"prompts.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/prompts.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c515b2aafa53de80"}},{"code_sha256_prefix":"b121b8540d457313","entry":"get_prompt_for_target","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"prompts.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/prompts.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b121b8540d457313"}},{"code_sha256_prefix":"9e0c05cabd0e3ce5","entry":"remove_extension","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"helpers/file_utils.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/helpers/file_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9e0c05cabd0e3ce5"}},{"code_sha256_prefix":"6d8b3d2a1bc9c0d6","entry":"truncate_string","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"helpers/plot_utils.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/helpers/plot_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6d8b3d2a1bc9c0d6"}},{"code_sha256_prefix":"452f1ec13ee8c27f","entry":"user_query","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"dataset.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/dataset.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"452f1ec13ee8c27f"}},{"code_sha256_prefix":"baadfaf4243bfbd3","entry":"out_original_path","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"natural.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/natural.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"baadfaf4243bfbd3"}},{"code_sha256_prefix":"f5d265cf8df739dd","entry":"out_path","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"adversarial.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/adversarial.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f5d265cf8df739dd"}},{"code_sha256_prefix":"4f6c0c890b14deb3","entry":"out_rewritten_path","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"natural.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/natural.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4f6c0c890b14deb3"}},{"code_sha256_prefix":"4fd0ad8f0b061f68","entry":"plot_original_path","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"natural.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/natural.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4fd0ad8f0b061f68"}},{"code_sha256_prefix":"f01af5f656610699","entry":"plots_path","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"adversarial.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/adversarial.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f01af5f656610699"}},{"code_sha256_prefix":"11aeebad7af99d72","entry":"query_google_cse","repo":"spfrommer/ragdoll-data-pipeline","repo_kind":"official","path":"utils/query_utils.py","file_url":"https://github.com/spfrommer/ragdoll-data-pipeline/blob/HEAD/utils/query_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"11aeebad7af99d72"}},{"code_sha256_prefix":"72daa2fee3baaf30","entry":"truncate_colormap","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"adversarial.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/adversarial.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"72daa2fee3baaf30"}},{"code_sha256_prefix":"550f868dce7d4688","entry":"upload_htmls_and_get_urls","repo":"spfrommer/cse-ranking-manipulation","repo_kind":"official","path":"helpers/app_interface.py","file_url":"https://github.com/spfrommer/cse-ranking-manipulation/blob/HEAD/helpers/app_interface.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"550f868dce7d4688"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}