Data-Void Exploits in Web-Searching LLMs

arXiv:2610.30365 · cs.CR, cs.HC, cs.IR · Submitted 2026-10-21 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Data-Void Exploits in Web-Searching LLMs".

Elias: Here's the gist of the paper. Web-searching Large Language Models (LLMs) are vulnerable to data-void exploits, where disinformers use LLMs' web search capabilities to retrieve and cite sparse, unverified content to manipulate responses.

Nadia: The gist Data-void exploits can succeed with only a single attacker-controlled webpage with compelling success rates given the diverse settings we studied.

Elias: How it works The core of the exploit involves a disinformer strategically creating content online that fills a data void, which is defined as when little or no content exists in an information ecosystem for a given set of search keywords or questions.

Nadia: The attacker can use one of five known strategies to construct and fill a data void with their narrative, host their content at varying levels of visibility from well-established, indexed domains to less established ones, and include generative-optimization engine features thought to boost citing by web-searching LLMs.

Title and authors: Nadia: So, moving into the actual mechanics of this threat, the paper summarizes how a disinformer actually sets up this exploit. It’s not just dropping random text online; it’s a targeted construction process > Page two <ref:2610.30365#pg1>.

Elias: They break down their attacker controls into three main levers: Data-void Strategy, Visibility of the hosted pages, and Generative Engine Optimization factors > Page one.

Priya: I'm curious about those GEO factors. Are those something we can actually control when we're just asking a simple question?

Nadia: Not directly in the prompt, no. But these are webpage-level choices that affect whether the AI uses or cites your content, and they found five specific factors that positively influence retrieval and citation > Page one.

Elias: Those factors include engineering disinforming keywords to be hard for search engines to spot, using brand new terms with no established definition, or exploiting old terms that have fallen out of common use > Page two <ref:2610.30365#pg1>.

Priya: That sounds like a deep dive into how people think about language online. So, if I'm trying to find something specific, am I essentially playing a game against the search engine itself?

Nadia: You are, because the strategy is designed to create a gap in the existing information ecosystem so that when the LLM searches for that topic, it has nowhere else reliable to look > Page one.

Elias: It’s about creating an informational vacuum and then making sure your content is perfectly positioned to fill that vacuum when the AI performs its search function > Page two <ref:2610.30365#pg1>.

Priya: So, the summary is really about how adversaries are using linguistic trickery combined with placement strategy to trick the LLM into trusting unverified sources > Page one.

Nadia: Right, and it shows this isn't just a general vulnerability; it’s tied to specific ways people write and search online > Page two <ref:2610.30365#pg1>.

Elias: And they show that this threat model looks at what happens after the content is found, looking at how the LLM decides whether to use, cite, or list your specific webpage content > Page three.

Priya: So what's the key thing we need to remember from this summary? It’s about anticipating that these LLMs are using their search tools in a way that can be manipulated if the input data is structured correctly > Page one.

Nadia: Precisely, and it shows how vulnerable we are when relying on synthesized answers instead of seeing the ranked list of links > Page one.

The paper's summary: Elias: Now let's talk about what the authors suggest we should do to fix this problem. They propose a few ways to improve defenses against these data-void exploits > Page three.

Nadia: One improvement is to focus on retrieval quality when searching for topics known to have data voids, which they suggest prioritizing high-quality, authoritative content when the LLM searches for those subjects > Page one.

Priya: That makes sense. So, if we know a topic is risky, we should probably be looking harder for reliable sources instead of just accepting whatever comes up > Page three.

Elias: Exactly. And they also suggest introducing uncertainty signals into the LLM responses when content is identified as coming from a single attacker-controlled source without any corroboration > Page three.

Nadia: That means if the AI pulls something from one source that isn't backed up by others, it should start using hedging language or warnings about unverified information > Page one.

Elias: And they also point towards prompt engineering strategies for users to use skeptical tones and avoid overly excited prompts when they are investigating sensitive topics > Page three.

Priya: So this is shifting the responsibility partly onto the user to be more critical of what they ask and how that influences the AI's output > Page three.

Nadia: It’s a layered approach, combining better content sourcing, uncertainty signals from the model, and nudging users toward skepticism > Page one.

Elias: It suggests that we need to look at how these factors interact—how the content visibility and the strategy combine to affect success rates > Page two <ref:2610.30365#pg1>.

Priya: And that's a lot of variables to track, but it’s important because it gives us a framework for thinking about defense against this kind of attack > Page three.

The paper's improvements: Nadia: So wrapping up the discussion on the "Data-Void Exploits in Web-Searching LLMs" paper, the main implication is that these vulnerabilities are real and depend heavily on how we structure information online > Page one.

Elias: It shows that relying on synthesized answers can be risky when there's a strategic gap in what's available for the search engine to find > Page two <ref:2610.30365#pg1>.

Priya: For me, it means we need systems that don't just blindly present answers but are aware of when the information they are using might be sparse or unverified > Page one.

Nadia: We have to think about how to build in detection for these exploits by monitoring queries, retrieved URLs, and what content the LLM actually uses > Page one.

Elias: It calls for a real look at scaling this problem across multiple domains and platforms so we can build defenses that don't just focus on one single page > Page three.

Priya: And ultimately, it shows that balancing defense against these kinds of attacks is going to be a tough challenge because the authors themselves admitted it is not easy to solve > Page one.

Nadia: That’s the essence of what we're hearing about this paper, "Data-Void Exploits in Web-Searching LLMs" > Page one.

Elias: We'll keep an eye on how they build those defenses in future work and see what comes next > Page three.

Conclusion: Nadia: So we’ve been talking about how data voids create an exploit surface when LLMs use web search, specifically in "Data-Void Exploits in Web-Searching LLMs."

Elias: Yeah, and the core idea is that disinformers can strategically create a gap online—a data void—and then position their content perfectly to fill it when the AI searches > Page one.

Priya: I’m still thinking about how much we should trust what the LLM pulls because if it’s just grabbing sparse stuff, that’s not reliable information > Page three.

Nadia: Exactly. The results show that attacker-controlled content appears in the LLM responses about thirty-one percent of the time across all conditions > Page one.

Elias: And when we look at visibility, that number jumps to forty-two point three percent for medium and high visibility pages > Page one.

Priya: That jump is what really tells you how much the placement of that content matters in terms of success rates > Page three.

Nadia: Right, and it’s interesting because low-visibility pages never succeeded at all, which shows how important that hosting strategy is > Page one.

Elias: The paper also points out that breaking news has the highest odds of success among the different data-void strategies > Page one.

Priya: That makes sense, timely stuff creates a bigger void for an AI to fill with unverified claims > Page three.

Nadia: So what this means for us is that we need creative ways to defend against these exploits because the problem isn't easy to solve > Page one.

Elias: It points toward better retrieval strategies, prioritizing high-quality sources when a topic is known to have those voids > Page three.

Priya: And maybe designing uncertainty signals into the LLM responses so it warns users when the content it’s citing is coming from just one place > Page one.

Nadia: That’s the direction for future work, looking at how these exploits scale across multiple pages and platforms > Page three.

Elias: We’ll need to figure out how to distinguish that strategically crafted disinformation from actual niche perspectives without dismissing legitimate content > Page two.

Priya: I think we should also keep looking at those topic-based watermarking schemes we discussed earlier, because that might give us a way to track the source of the data itself > Page one.

Nadia: Yeah, next time we’ll look at how those watermarks interact with these data void strategies > Page three.

Elias: We’ll keep digging into what these LLMs are actually doing when they perform their searches > Page one.

New York University Abu Dhabi

cs.CR, cs.HC, cs.IR

Submitted: 2026-10-21

Updated: 2026-10-21

Comments: Extended version of the paper to appear in the Network and Distributed System Security (NDSS) Symposium 2027. 23 pages

DOI: 10.14722/ndss.2027.232247

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 87/100

The gist: Web-searching Large Language Models (LLMs) are vulnerable to data-void exploits, where disinformers use LLMs' web search capabilities to retrieve and cite sparse, unverified content to manipulate

Key concepts

Data Void: A data void occurs when there is little or no existing content available online for a specific set of search keywords or questions. Attackers exploit these gaps by creating targeted content that appears authoritative, tricking LLMs into using it as a source because nothing else exists to contradict it.
Data-Void Strategies: Attackers use five main methods to create data voids: engineering confusing keywords, using terms with no established definitions, exploiting outdated language, fragmenting complex ideas into competing phrases, and using contentious or 'fraught' terms. These strategies are designed to make it hard for search engines and LLMs to detect the manipulation.
Visibility Levels: Attacks depend on how visible the attacker's content is online. Visibility ranges from High (like an old, established domain) to Medium (new but manually indexed) or Low (new and relying only on organic discovery). The study showed that medium and high visibility significantly increase the chance of a successful exploit.
Generative Engine Optimization (GEO): GEO refers to webpage-level choices that influence whether an LLM will use, cite, or list specific content. Five factors were identified as positively influencing retrieval and citation, meaning attackers can optimize their content presentation to maximize its influence over the LLM's search results.

Summary

Web-searching Large Language Models (LLMs) are vulnerable to data-void exploits, where disinformers use LLMs' web search capabilities to retrieve and cite sparse, unverified content to manipulate responses.

The gist

Data-void exploits can succeed with only a single attacker-controlled webpage with compelling success rates given the diverse settings we studied.

How it works

The core of the exploit involves a disinformer strategically creating content online that fills a data void, which is defined as when little or no content exists in an information ecosystem for a given set of search keywords or questions. The attacker can use one of five known strategies to construct and fill a data void with their narrative, host their content at varying levels of visibility from well-established, indexed domains to less established ones, and include generative-optimization engine features thought to boost citing by web-searching LLMs. These strategies include engineering disinforming keywords and content ecosystems that are difficult for search engines to detect or mitigate, strategically using new terms with no established definition, exploiting outdated terms that have fallen out of regular use, fragmenting concepts into competing linguistic framings, and disturbing queries with fraught terms.

Attacker Controls

The attacker controls three levers: Data-void Strategy, Visibility of the hosted pages, and Generative Engine Optimization (GEO) factors. The attacker can choose one of three visibility levels: High (e.g., an old domain), Medium (e.g., a new domain that is manually indexed), or Low (e.g., a new domain that relies on organic discovery). GEO factors capture webpage-level choices that may affect whether attacker-controlled content is used, cited, or listed by an LLM, and five specific factors were identified as positively influencing retrieval and citation.

User Controls and Mitigation

The user controls include prompt tone (skeptical, excited, or neutral) and model choice (ChatGPT, Gemini, or Sonar Pro). The study found that user-controlled factors do not substantially reduce success rates; while skeptical prompts slightly reduce success and slightly increase flagging or warnings in LLM responses, we find no evidence of large effects of prompt tone or model choice on success rates. However, prompt tone does show a significant effect on flagging, with skeptical prompts making flagging more likely (OR = 2.59) and neutral prompts making it less likely (OR = 0.42).

Experimental Findings

Across all conditions, attacker-content appears in LLM responses 31% of the time, and across medium- and high-visibility conditions, the success rate rises to 42.3%. The strongest effect among attacker-controlled factors is visibility, as medium- and high-visibility pages have much higher odds of exploit success (OR = 3.4 and OR = 17.5, respectively), while low-visibility pages never succeeded (Success rate of 0.0%). Furthermore, breaking news has the highest odds of success among the strategies (OR = 3.58), while problematic queries has the lowest (OR = 0.29).

Conclusion and Limitations

The results establish data voids as a practical inference-time attack surface for manipulating web-searching LLMs through strategically placed web content. The work calls for creative defenses against data-void exploits, while recognizing that the problem is not easy to solve. Future research should investigate how exploit success scales with coordinated campaigns spanning multiple pages, domains, or platforms and how to distinguish strategically crafted disinformation from niche perspectives without dismissing legitimate content.

Key Stats

- Overall 31% of the exploits succeeded.

- High + Med. 41 data voids 144 (39.0%) 5 (1.4%) 7 (1.9%) 42.3%.

- Low-visibility pages never succeeded.

Important Limitations

The study's methodology introduces risks, including the possibility that deployed content could be inadvertently encountered by external users or systems, and the findings may reveal techniques that could be misused to construct real-world data-void attacks. The statistical test limits suggest that balancing alone would not resolve the sensitivity to smaller effects, and scaling substantially beyond 56 data-voids is difficult due to the intense manual construction required for each realistic yet fictitious data void. The study also notes that user-controlled factors had little effect on exploit success, meaning we cannot offer users a simple mitigation strategy, such as choosing a different model or using a more skeptical tone. The work calls for creative defenses against data-void exploits, while recognizing that the problem is not easy to solve.

References

[1] F B Tripodi and P D Moeller, “Data voids and echo chambers: The transformative journey of search and its consequences,” NASIG Proceedings, vol. 39, 7 2025.

[2] M Mannino, J Garcia, R Hazim, A Abouzied, and P Papotti, “Data void exploits: Tracking & mitigation strategies,” in Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, ser. CIKM ’24, New York NY USA 2024, p. 1627–1637.

[3] M Golebiewski and D Boyd, “Data voids: Where missing data can easily be exploited,” Data & Society Research Institute, New York NY, Tech. Rep., Oct. 2019.

[4] M Alyukov, M Makhortykh, A Voronovici, and M Sydorova, “LLMs grooming or data voids? LLMpowered chatbot references to Kremlin disinformation reflect information gaps, not manipulation,” Harvard Kennedy School Misinformation Review, vol. 6, no. 5 2025.

[5] P Aggarwal, V Murahari, T Rajpurohit, A Kalyan, K Narasimhan, and A Deshpande, “GEO: Generative engine optimization,” arXiv preprint arXiv:2311.09735 2024.

[6] M Chen, X Wang, K Chen, and N Koudas, “Generative engine optimization: How to dominate AI search,” arXiv preprint arXiv:2509.08919 2025.

[7] P S Bagga, V F Farias, T Korkotashvili, T Peng, and Y Wu, “E-GEO: A testbed for generative engine optimization in e-commerce,” arXiv preprint arXiv:2511.20867 2025.

[8] F B Tripodi, The Propagandists’ Playbook: How Conservative Elites Manipulate Search and Threaten Democracy. New Haven, CT: Yale University Press, 2022.

[9] R E Robertson, E M Williams, K M Carley, and D Thiel, “Data voids and warning banners on google search,” arXiv preprint arXiv:2502.17542 2025.

[10] C Flores-Saviaga, S Feng, and S Savage, “Datavoidant: An ai system for addressing political data voids on social media,” Proc. ACM Hum.-Comput. Interact., vol. 6, no. CSCW2, Nov 2022.

[11] N F Liu, K Lin, J Hewitt, A Paranjape, M Bevilacqua, F Petroni, and P Liang, “Lost in the middle: How language models use long contexts,” Transactions of the Association for Computational Linguistics, vol. 12 pp. 157–173 2024.

Improvements for AI systems

Implement data-void detection mechanisms for LLMs by monitoring web search queries, retrieved URLs, cited content, and used content during response generation to identify reliance on sparse or unverified sources. This allows the system to flag responses that rely on attacker-controlled content in a used, cited, or listed manner.
Develop a defense against data-void exploits by prioritizing retrieval of high-quality, authoritative content when an LLM searches for information about topics known to have data voids, as suggested by the finding that GEO factors like accurate technical terms and statistics significantly increase retrieval and citation likelihood.
Introduce uncertainty signals into LLM responses, such as hedging language or warnings about unverified information, especially when content is identified as being from a single attacker-controlled source without corroboration. This aims to counteract the tendency of LLMs to present sparse information authoritatively.
Design prompt engineering strategies that encourage users to use skeptical tones and avoid overly excited prompts when investigating potentially sensitive or niche topics, as research showed that skeptical prompts are associated with lower odds of exploit success in many conditions.
Integrate mechanisms to analyze the impact of different attacker control levers, such as content visibility (high, medium, low) and data-void strategies (breaking news vs. strategic new terms), to inform risk assessment for information retrieval systems.

Abstract

Web-searching Large Language Models (LLMs) have changed how users seek online information: instead of sifting through ranked lists of links, users read synthesized answers. This shift creates a new LLM vulnerability: a data-void exploit. Disinformers publish their narratives in search spaces where relevant and reliable content is scarce, i.e. data voids, then rely on the LLM's web-search to retrieve and then use, cite, or list those pages in its responses to data-void seeking prompts. Unlike classical search, where users see ranking cues and competing results, LLMs can obscure when an answer relies on sparse, unverified, or adversarial sources. We study this threat by varying the user's prompt tone - skeptical, excited, or neutral - and LLM choice - ChatGPT, Gemini, or Sonar Pro - as well as three attacker controls. The attacker can use one of five known strategies to construct and fill a data void with their narrative, host their content at varying levels of visibility from well-established, indexed domains to less established ones, and include generative-optimization engine features thought to boost citing by web-searching LLMs. We find that data-void exploits can succeed with only a single attacker controlled page. Across all conditions, attacker-content appears in LLM responses 31% of the time. User controls offer limited protection: while skeptical prompts slightly reduce success and slightly increase flagging or warnings in LLM responses, we find no evidence of large effects of prompt tone or model choice on success rates, although smaller effects cannot be ruled out. Overall, our results establish data voids as a practical inference-time attack surface for manipulating web-searching LLMs through strategically placed web content and highlight the urgent need for defenses against such exploits.