SIREN attack tricks Claude models into ranking any entity #1 via webpage edits

Researchers from the University of Queensland have unveiled SIREN (Luring LLMs onto the Rocks), an automated attacker-judge system that exploits web-augmented LLMs used for recommendations. When an LLM like Claude answers a recommendation query by retrieving and reading live webpages, each retrieved page becomes a potential attack surface. SIREN adapts the PAIR jailbreaking loop to competitive rank manipulation: it captures webpages using Anthropic's web tools, then iteratively edits a retrieved source using a taxonomy of 23 content-poisoning techniques. Crucially, a custom RAG replay platform keeps the same source set unchanged, isolating ranking changes to content edits rather than retrieval differences.

Testing on two production Claude models across eight query-model contexts, SIREN reached rank-1 in 62 of 124 technique trials. The most effective payloads—declarative ranking claims and seeded lists—reproduced the result with a mean success rate of 0.805 in fresh sessions. Directive-form injections were less effective, though effectiveness varied by target model. This work highlights a troubling vulnerability: any public webpage fetched by an LLM-based recommender becomes a vector for adversarial rank manipulation. As web-augmented LLMs gain adoption in search and recommendation systems, SIREN demonstrates that even subtle, controlled edits to a single source can alter the model's output rankings, raising significant security and trust concerns.