A simple optimization trick can push chosen products into LLM-generated search recommendations: CORE achieves top-5 placement in 91% of tests across four major models on a 3,000-product benchmark, underscoring how generative search can systematically advantage or disadvantage sellers absent platform safeguards.

Main Finding

The paper demonstrates that in LLM-based search (generative engines) final recommendations remain highly dependent on upstream retrieval order, but that this ranking can be effectively and covertly manipulated in black-box settings by appending carefully optimized content to retrieved item records. Their method, CORE, achieves high promotion success rates across four production-capable LLMs (average PSR 91.4% @Top-5, 86.6% @Top-3, 80.3% @Top-1) on a large ProductBench benchmark, outperforming prior manipulation approaches while preserving natural fluency.

Key Points

• Problem & threat model: actors cannot change the LLM or retrieval pipeline; they can only edit textual attributes of items (title/description/reviews) visible to the LLM. Goal is to promote a target item into top-k of the LLM-produced ranked recommendation.
• CORE (Controlling Output Rankings in gEnerative Engines) optimizes appended content to steer the synthesizing LLM’s final ranking. It works in black-box settings.
• Two technical solution modes:
  • Shadow-model: fit a small shadow LLM (few-shot) to mimic the target synthesizing LLM and perform gradient-based optimization in embedding space; discrete reconstruction yields optimized text to attach to items.
  • Query-based: iterative generator–optimizer loop (black-box). A generator crafts reasoning/review-style drafts; the optimizer compares resulting LLM outputs to a target ranking and iteratively refines appended content until similarity threshold or budget.
• Three families of appended optimization content:
  • String-based: short tokens/strings (used with shadow-model gradients).
  • Reasoning-based: chain-of-thought-style rationales that mimic user reasoning about ranking choices.
  • Review-based: past-tense, review-like narratives resembling genuine buyer experience.
• Experimental results:
  • Evaluated on ProductBench (15 product categories × 200 products; candidate pools = Amazon top-10 per product).
  • Tested LLMs: GPT-4o, Gemini-2.5 Pro, Claude-4, Grok-3.
  • Baseline promotion from last-in-list was ~0% (LLM outputs follow retrieval order).
  • CORE (best strategy) achieved average PSR 91.4% @Top-5, 86.6% @Top-3, 80.3% @Top-1; reasoning vs review effectiveness was model-dependent (e.g., GPT-4o & Claude-4 favored reasoning; Gemini-2.5 & Grok-3 favored review-style).
  • Fluency retained (perplexity measured via GPT-2), making optimized content less conspicuous to simple detectors.
• CORE outperforms prior methods (white-box STS, prompt-injection TAP, stealth prompt SRP, optimization RAF) while operating under more realistic black-box constraints.
• Implementation highlights: shadow model used Llama-3.1-8B with 2000 optimization iterations; query-based loop uses the same LLM as generator/optimizer in main experiments; similarity threshold τ = 0.7.

Data & Methods

• ProductBench: new benchmark constructed from Amazon search:
  • 15 categories (see paper appendices), 200 products each.
  • For each product, collected top-10 Amazon search results to form candidate pools.
  • Scraped product pages (Selenium, rotating agents, cookie injection) and extracted attributes (title, price, ratings, descriptions, reviews) in structured JSONL via a YAML schema.
• Formalization:
  • Objective framed as maximizing probability that the synthesizing LLM outputs a target-ranked sequence placing the promoted item in top-k; loss = −log pθ(z(T') | q, I).
  • Optimization performed in continuous embedding space, iterative gradient updates + Gaussian noise; discrete decoding produces textual edits appended to items.
• Evaluation metrics:
  • Promotion Success Rate (PSR@k): fraction of trials where target appears in Top-k after optimization.
  • Perplexity (GPT-2) to measure linguistic naturalness of appended content.
• Models tested: GPT-4o, Gemini-2.5 Pro, Claude-4, Grok-3 (accessed via APIs).
• Baselines: multiple prior ranking-manipulation techniques reproduced/transferred for comparison.
• Ablations and implementation details (prompts, few-shot examples, prompt templates for reasoning/review strategies, API cost visuals) are in appendices.

Implications for AI Economics

• Visibility as an economic bottleneck
  • Generative engines shift the locus of visibility from ranked retrieval pages to the LLM’s synthesized list. That makes visibility (and therefore demand flows) more tightly controlled by the synthesis stage and susceptible to manipulation via content design.
  • Small sellers/independent creators are at elevated risk: even if retrieval returns them, their downstream chance of being recommended can be engineered down or up by content edits—implying distributional effects on market shares beyond traditional SEO.
• New market for Generative Engine Optimization (GEO) services
  • Analogous to SEO, there is likely to be emergent demand for firms that craft reasoning/review-style text to boost LLM recommendations (an arms race). CORE-style methods lower the technical bar by enabling black-box manipulation, expanding the addressable market for optimization services.
• Platform business model & monetization
  • Platforms and LLM providers face stronger incentives to commercialize placement (paid promotion, verified tags, or guaranteed ranking contracts) or to harden models against covert content-level manipulation—both of which affect competition and pricing.
  • If platforms monetize guaranteed visibility, the rent-extracting potential increases because visibility drives consumer choice more directly in generative outputs than in link lists.
• Competition, fairness, and market entry
  • The ability to reliably promote items via content tailoring can exacerbate incumbent advantages (those with resources to hire GEO services), raising entry costs for new firms and altering competitive equilibria.
  • Non-price competition (reviews, story-format copy) becomes strategically central, changing product marketing investments and possibly welfare outcomes.
• Consumer welfare and misinformation risks
  • Manipulation may reduce consumer surplus if recommendations become biased toward manipulable signals rather than true quality; however, legitimate uses (better structured content improving relevance) can improve utility. Welfare effects depend on prevalence, detectability, and platform countermeasures.
• Policy and regulation
  • Evidence from ProductBench-style auditing suggests regulators could measure how generative engines amplify or distort visibility. Policies might require transparency about optimization practices, disclosures for sponsored content, or fairness constraints on synthesized rankings.
  • Disclosure obligations for paid placement or synthetic review-generation services may be needed to protect consumers and competition.
• Incentives for defensive design & detection
  • LLM providers may need to (a) reduce sensitivity to appended review/reasoning artifacts, (b) adopt provenance-aware synthesis (tagging retrieved sources and weighting by verified signals), or (c) detect adversarial/review-like appended content—each has economic trade-offs (accuracy, developer cost, user experience).
• Research directions for AI economics
  • Model markets: incorporate GEO services into platform competition models—how does the ability to buy or craft content that alters downstream LLM recommendations affect equilibria?
  • Welfare quantification: measure consumer surplus changes under widespread manipulation vs. countermeasure regimes.
  • Auditing & measurement: ProductBench offers a replicable audit framework; economists can use it to test distributional impacts across product categories and seller types.
  • Regulation design: analyze optimal disclosure rules, anti-manipulation subsidies for small sellers, or constraints on synthetic content forms.
• Practical advice for stakeholders
  • Sellers: invest in high-quality, coherent review- and reasoning-style content on product pages, but be mindful of legal/ platform rules.
  • Platforms/LLM providers: monitor for manipulative appended content, consider provenance signaling, and evaluate trade-offs between robustness and explainability.
  • Policymakers: prioritize transparency requirements and support independent audits using benchmarks like ProductBench.

Short takeaway: CORE shows that generative engines can be steered via plausible, natural-looking edits to item text in realistic black-box settings, substantially changing which sellers get recommended. This capability reshapes visibility economics, creates new markets and strategic behaviors, and calls for measurement, platform-level defenses, and potentially regulatory attention to preserve fair competition and consumer welfare.