Search-augmented large language models are quietly taking over something very ordinary: helping people decide what to buy. Ask for "noise-cancelling headphones under $300" and the model runs a live search, then hands you an answer. FORGE, a new benchmark, measures exactly how far that pipeline can be corrupted — if someone builds a page specifically to fool the model, will the model turn around and push a fake product?
The paper, titled "One Polluted Page Is Enough," is by Minghao Luo and Liang Chen. A second version went up on August 24, and the work has been accepted to EMNLP 2026 Findings, with the benchmark and evaluation code released on GitHub.
27% and 73.8%
FORGE's method is straightforward: freeze a batch of real search-result pages, rewrite the genuine product mentioned on each page into a fake product that doesn't exist, then measure how often a model recommends that fake product anyway. The test spans 225 real products across 15 categories and five shopping scenarios, run against 12 commercial and open-weight models.
The finding: all 12 models failed, without exception. Polluting just one page in the results was enough to fool a model up to 27% of the time; swap all three top search results for polluted pages, and that number climbs to 73.8%.
The effect varies sharply by category. Where a model lacks a stable prior about a type of product, it's much easier to lead astray. That tracks — a model has a deep, built-in memory of what an iPhone is, but for a niche-brand dehumidifier, it has nothing to go on except whatever the page happens to say.
Turning on reasoning makes it worse
The paper's most counterintuitive finding: reasoning doesn't patch this vulnerability — it often manufactures fake social proof to justify the wrong recommendation instead. Once fooled, a reasoning model will actively construct a plausible-sounding case for the fake product, and the result reads even more convincingly than a normal recommendation would.
None of the four defenses tested worked well. Adding a suspicion-inducing prompt produced roughly the same effect as reasoning did — and sometimes widened the vulnerability. Two consensus-filtering approaches ended up suppressing legitimate products right along with the fake ones. Trustworthiness-based reranking helped every model to some degree, but it only cleared out about one-sixth of the fakes.
Each defense fails in its own way, but they share a pattern: all of them patch things at the text layer. Tell a model to be suspicious, and it turns that suspicion on legitimate products too. Consensus filtering assumes multiple pages should corroborate each other — but seeding three polluted pages is trivial for anyone doing this professionally. As long as the retrieval layer itself stays untouched, whatever you tune downstream is still arithmetic performed on the same poisoned inputs.
Another uncomfortable detail: the 12 models included both commercial closed-source systems and open-weight ones, and there was no meaningful gap between the two groups. The flaw traces back to one shared assumption — that a retrieved web page is trustworthy by default. Every product built on the RAG pattern rests on that assumption, and no amount of careful alignment work on top of it changes that.
The next stage of the SEO war
The authors group this kind of tactic under GEO — generative engine optimization, a play on search engine optimization. The logic is identical: SEO was about getting a page in front of human eyes; GEO is about getting a page into a model's context window. The difference is cost — one page is enough, and it doesn't even need to rank first.
For Chinese-language users, the exposure here is bigger than it might seem. Domestic AI search and AI shopping assistants have already largely adopted this "retrieve, then summarize" pipeline, and the content pool being retrieved from is already full of marketing pages built purely to rank. Do rough math: if polluting one page costs a few tens of yuan and the target product sells for over a thousand, there's little reason for anyone running a black-hat operation not to try it.
The one genuinely usable conclusion from the paper is that one-sixth figure — trustworthiness reranking works, but nowhere near enough. Moving forward means shifting the standard from "does the model trust this domain" to "how many independent sources back this specific claim." No product has built that into its pipeline yet.
Sources: arXiv paper "One Polluted Page Is Enough", CocoLoop, FORGE open-source repository, EMNLP 2026 Findings acceptance information; the 27% and 73.8% deception rates were checked against the paper's abstract, as were the scale figures of 225 products, 15 categories, and 12 models.