arXiv: SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders

This paper, published on arXiv, presents a novel attack vector called SIREN that exploits how large language models (LLMs) are integrated with web-based retrieval-augmented generation (RAG) systems, particularly in recommender applications. The authors demonstrate that an adversary can manipulate the ranking and selection of retrieved content to subtly steer an LLM’s output toward a preferred outcome, effectively hijacking the recommendation process without altering the model itself. This is not a regulatory publication but a technical research finding that signals a new class of systemic risk for AI systems relying on external data sources.

The primary affected organizations are those deploying LLM-powered recommendation engines, search tools, or content curation systems in regulated sectors such as finance, healthcare, e-commerce, and media. Any entity using RAG architectures where user-facing outputs depend on dynamically retrieved web content should assess their exposure. Compliance teams in these sectors must now consider whether their AI systems are vulnerable to preference manipulation through poisoned or adversarially ranked retrieval results, which could lead to biased or harmful recommendations.

Compliance teams should immediately review their AI risk management frameworks to include this attack vector. Specifically, they should audit the data retrieval pipeline for integrity controls, implement monitoring for anomalous ranking patterns, and update their model risk assessments to account for indirect manipulation via external content. Given the EU AI Act’s emphasis on transparency and robustness for high-risk systems, this paper underscores the need for proactive testing against retrieval-layer attacks and for documenting mitigation measures in technical documentation.