{"id":"https://openalex.org/W7171416237","doi":"https://doi.org/10.48550/arxiv.2607.21951","title":"SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders","display_name":"SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders","publication_year":2026,"publication_date":"2026-07-24","ids":{"openalex":"https://openalex.org/W7171416237","doi":"https://doi.org/10.48550/arxiv.2607.21951"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.21951","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.21951","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.21951","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088219038","display_name":"Evan Caville","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Caville, Evan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147795863","display_name":"Spencer Kayser","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kayser, Spencer","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016369735","display_name":"Siamak Layeghy","orcid":"https://orcid.org/0000-0002-1229-2368"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Layeghy, Siamak","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073453851","display_name":"Billy Sung","orcid":"https://orcid.org/0000-0003-0028-6574"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sung, Billy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008535035","display_name":"Sara Dolni\u010dar","orcid":"https://orcid.org/0000-0001-5176-3161"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dolnicar, Sara","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5078468070","display_name":"Marius Portmann","orcid":"https://orcid.org/0000-0003-1852-3961"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Portmann, Marius","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.11540000140666962,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.11540000140666962,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.11020000278949738,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.09809999912977219,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ranking","display_name":"Ranking (information retrieval)","score":0.7351999878883362},{"id":"https://openalex.org/keywords/rank","display_name":"Rank (graph theory)","score":0.570900022983551},{"id":"https://openalex.org/keywords/siren","display_name":"Siren (mythology)","score":0.5465999841690063},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5428000092506409},{"id":"https://openalex.org/keywords/preference","display_name":"Preference","score":0.4918999969959259},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.48730000853538513},{"id":"https://openalex.org/keywords/web-page","display_name":"Web page","score":0.45419999957084656},{"id":"https://openalex.org/keywords/mean-reciprocal-rank","display_name":"Mean reciprocal rank","score":0.4374000132083893}],"concepts":[{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.7351999878883362},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.664900004863739},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.640500009059906},{"id":"https://openalex.org/C164226766","wikidata":"https://www.wikidata.org/wiki/Q7293202","display_name":"Rank (graph theory)","level":2,"score":0.570900022983551},{"id":"https://openalex.org/C160844653","wikidata":"https://www.wikidata.org/wiki/Q150986","display_name":"Siren (mythology)","level":2,"score":0.5465999841690063},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5428000092506409},{"id":"https://openalex.org/C2781249084","wikidata":"https://www.wikidata.org/wiki/Q908656","display_name":"Preference","level":2,"score":0.4918999969959259},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.48730000853538513},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.45419999957084656},{"id":"https://openalex.org/C44083865","wikidata":"https://www.wikidata.org/wiki/Q3853443","display_name":"Mean reciprocal rank","level":2,"score":0.4374000132083893},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4196000099182129},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4092000126838684},{"id":"https://openalex.org/C554936623","wikidata":"https://www.wikidata.org/wiki/Q199657","display_name":"Reading (process)","level":2,"score":0.37389999628067017},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.34850001335144043},{"id":"https://openalex.org/C86037889","wikidata":"https://www.wikidata.org/wiki/Q4330127","display_name":"Learning to rank","level":3,"score":0.3440999984741211},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3269999921321869},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.323199987411499},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3046000003814697},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.28459998965263367},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2703999876976013},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26930001378059387},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.25949999690055847}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.21951","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.21951","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.21951","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.21951","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/4","score":0.5955462455749512,"display_name":"Quality Education"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"This":[0],"paper":[1],"investigates":[2],"the":[3,7,70,75,94,103,144,148,154,163,205,215,232,239,243,251,263],"adversarial":[4],"manipulation":[5,258],"of":[6,105,135,182,212,234,245,255],"ranked":[8],"recommendations":[9],"produced":[10],"by":[11,24],"web-augmented":[12],"large":[13],"language":[14],"models":[15],"(LLMs).":[16],"When":[17],"an":[18,65,88,113,132],"LLM":[19],"answers":[20],"a":[21,33,40,107,128,208],"recommendation":[22],"query":[23],"retrieving":[25],"and":[26,35,52,118,221],"reading":[27],"live":[28],"webpages,":[29],"it":[30],"acts":[31],"as":[32],"recommender,":[34],"each":[36],"retrieved":[37,67,129],"page":[38,68],"becomes":[39],"potential":[41],"attack":[42],"surface.":[43],"Prior":[44],"work":[45],"has":[46],"examined":[47],"fabricated":[48],"products,":[49],"retrieval":[50],"poisoning,":[51],"rank":[53,100,257],"promotion.":[54],"However,":[55],"these":[56],"studies":[57,254],"do":[58],"not":[59],"compare":[60],"how":[61],"different":[62],"edits":[63,127],"to":[64,98,110,160,168],"already":[66],"change":[69],"model's":[71,155],"final":[72],"ranking":[73,156,219],"while":[74],"surrounding":[76],"source":[77,130,265],"set":[78],"remains":[79],"unchanged.":[80],"To":[81,242],"address":[82],"this":[83,235,248],"gap,":[84],"we":[85],"propose":[86],"SIREN,":[87],"automated":[89],"attacker--judge":[90],"method":[91],"that":[92,193],"adapts":[93],"PAIR":[95],"jailbreaking":[96],"loop":[97],"competitive":[99,256],"manipulation,":[101],"with":[102,207],"goal":[104],"moving":[106],"chosen":[108],"entity":[109],"rank~1":[111,179,195],"in":[112,147,153,162,170,180,199,259],"LLM-generated":[114],"recommendation.":[115],"SIREN":[116,177],"retrieves":[117],"captures":[119],"webpages":[120],"using":[121,131],"Anthropic's":[122],"web":[123],"tools,":[124],"then":[125,197],"iteratively":[126],"interpretable":[133],"taxonomy":[134],"23":[136],"content-poisoning":[137],"techniques.":[138],"The":[139,191],"custom-RAG":[140],"replay":[141],"platform":[142],"keeps":[143],"same":[145,149],"sources":[146],"order,":[150],"so":[151],"changes":[152,161],"can":[157],"be":[158],"linked":[159],"supplied":[164,264],"content":[165],"rather":[166],"than":[167,228],"differences":[169],"retrieval.":[171],"Across":[172,214],"two":[173],"production":[174,260],"Claude":[175],"models,":[176],"reaches":[178],"62":[181],"124":[183],"technique":[184],"trials":[185],"nested":[186],"within":[187],"eight":[188],"query--model":[189],"contexts.":[190],"payloads":[192],"reached":[194],"were":[196,224],"tested":[198],"fresh":[200],"sessions,":[201],"where":[202,262],"they":[203],"reproduced":[204],"result":[206],"mean":[209],"success":[210],"rate":[211],"0.805.":[213],"evaluated":[216],"settings,":[217],"declarative":[218],"claims":[220],"seeded":[222],"lists":[223],"generally":[225],"more":[226],"effective":[227],"directive-form":[229],"injections,":[230],"although":[231],"strength":[233],"difference":[236],"depended":[237],"on":[238],"target":[240],"model.":[241],"best":[244],"our":[246],"knowledge,":[247],"is":[249,267],"among":[250],"first":[252],"controlled":[253],"LLMs":[261],"context":[266],"kept":[268],"fixed.":[269]},"counts_by_year":[],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2026-07-28T00:00:00"}