aiqbench analysis
This research quantifies the susceptibility of LLM search agents to adversarial manipulation, revealing significant disparities in endorsement reliability across different model backends. By establishing SearchGEO as an evaluation framework, it highlights how deployment scaffolds can either mitigate or exacerbate attack success rates depending on the underlying architecture. These findings underscore that recommendation integrity under hostile web conditions must be treated as a fundamental metric for AI safety assessments rather than an afterthought.
How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation
arXiv:2606.16821v1 Announce Type: new Abstract: Large language model (LLM)-based search agents synthesize open-web content into actionable recommendations on behalf of users, creating a risk that attacker-published pages are transformed into endorsed claims. We introduce SearchGEO, a controlled evaluation framework for measuring endorsement corruption in LLM-based web-search agents, combining a web-evidence manipulation pipeline, a five-mode attack taxonomy, and multiple output-level metrics. We evaluate 13 LLM backends on 308 cases each. Results show that vulnerability patterns vary across backends: overall attack success rate (ASR) ranges from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, the strongest attack mode differs by model family, and the same deployment scaffold could amplify or decrease ASR on different backends. An auxiliary agent-skill probe, where endorsement becomes an install command, exposes a sharp split among otherwise robust backends: Claude over-rejects while GPT over-trusts. These findings argue for treating recommendation reliability under adversarial search content as a first-class dimension of backend safety evaluation.
Title:How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation
Abstract:Large language model (LLM)-based search agents synthesize open-web content into actionable recommendations on behalf of users, creating a risk that attacker-published pages are transformed into endorsed claims. We introduce SearchGEO, a controlled evaluation framework for measuring endorsement corruption in LLM-based web-search agents, combining a web-evidence manipulation pipeline, a five-mode attack taxonomy, and multiple output-level metrics. We evaluate 13 LLM backends on 308 cases each. Results show that vulnerability patterns vary across backends: overall attack success rate (ASR) ranges from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, the strongest attack mode differs by model family, and the same deployment scaffold could amplify or decrease ASR on different backends. An auxiliary agent-skill probe, where endorsement becomes an install command, exposes a sharp split among otherwise robust backends: Claude over-rejects while GPT over-trusts. These findings argue for treating recommendation reliability under adversarial search content as a first-class dimension of backend safety evaluation.
Computation and Language (cs.CL); Cryptography and Security (cs.CR); Computers and Society (cs.CY); Information Retrieval (cs.IR)
arXiv:2606.16821 [cs.CL]
(or arXiv:2606.16821v1 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2606.16821 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 270 words
Related coverage
The Customer Never Sees the Goal: Measuring and Detecting Vulnerability-Targeted Manipulation in LLM Assistants
arXiv · Nov 4, 2026
SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
arXiv · Sep 16, 2026
First Unified Benchmark Red-Teams VQE Adversarial Robustness
Quantum Zeitgeist · Jul 24, 2026
Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models
arXiv · Sep 1, 2026