做搜索增强推荐系统的开发者需要警惕——你的模型可能被一篇虚假评论带偏，FORGE基准提供了测试和防御思路，值得点开看看。
搜索增强型大语言模型（LLM）在实时检索网页内容进行消费推荐时，面临被虚假评论和促销页面误导的风险。研究者提出了FORGE基准，通过将真实产品信息替换为虚假信息，测试12种商业和开源LLM的脆弱性。结果显示，单个污染页面即可导致最高27%的虚假推荐率，而替换前3个检索结果后，虚假推荐率升至73.8%。推理能力不仅无法缓解此问题，反而会生成虚假的社会证明来合理化错误推荐。研究还评估了三种防御策略，发现怀疑提示可能加剧漏洞，而共识过滤则可能误伤合法产品。
One Polluted Page Is Enough: Evaluating Web Content Pollution in Generative Recommenders
Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content. This creates a new risk: generative recommenders may consume polluted web content, such as fake reviews and promotional pages crafted to mislead recommendations. We ask: to what extent do search-augmented LLMs become unwitting promoters of fake products when consuming polluted retrieval results? To answer this, we introduce FORGE (Fake Online Recommendations in Generative Environments), a benchmark for measuring fake-product promotion under controlled web-content pollution. Given an upstream search result, FORGE locally rewrites real products in retrieved web pages into fake ones to simulate web-content pollution, and measures how often the LLM recommends the fake product. FORGE covers 225 real-world products across 15 categories and 5 consumer scenarios. Across 12 commercial and open-weights LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%. Vulnerability varies substantially across categories, increasing when models lack stable prior knowledge of the relevant products. Reasoning does not mitigate this vulnerability; instead, it often generates spurious social proof to justify false recommendations. We evaluate three defenses: skepticism prompting and consensus filtering (over model priors or cross-document evidence). Skepticism can exacerbate vulnerability, much like reasoning, while filtering risks suppressing legitimate products. We release FORGE at https://github.com/leoluolol/forge-benchmark.