The Injection Paradox Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection

Jul 16, 2026

Upload by Aurora

A reproducible failure mode in RAG-based LLM recommendation systems is introduced as the “Injection Paradox,” where prompt injections embedded in retrieved documents backfire on the attacker by suppressing the target brand below the injection-free baseline. In safety-trained Claude models, injected documents cause sharp drops in recommendation rates, with suppression propagating to other unmodified documents of the same brand. In Claude Opus 4.6, the target brand falls from a 54% baseline to zero top-2 recommendations across 50 trials despite injections in only 1 of 4 brand documents. Contrasting GPT behavior shows increased recommendations under the same injection, pointing to model-family differences. Code, prompts, privacy-preserving per-trial outcomes, and aggregated results are released, enabling replication and mitigation research.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages18

Reading Time45 min

Introduction

Research motivation

Experimental design and scope

Key findings

The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection Hyunseok Paeng 1 arXiv :2606 .09204v2 [ cs .LG] 11 Jul 2026 Abstract We present a reproducible failure mode of safety training in RAG-based LLM recommendation, the Injection Paradox, in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injectionfree baseline. In safety-trained Claude models, documents containing prompt injections suffer a sharp drop in recommendation rate, and this suppression propagates beyond the injected document to unmodified documents of the same brand. In Claude Opus 4 .6, the target brand drops from a 54% baseline to zero top-2 recommendations across all 50 trials, even though only 1 of 4 brand documents in the corpus contains an injection. The directional pattern is reproduced in counterfactual experiments and across three brands. A contrasting result across the GPT models tested, where the same injection instead increases recommendations, suggests model-family differences in how injectionlike context affects recommendation behavior. These findings raise the technical possibility of a reverse-attack scenario in which an adversary embeds injections in a competitor’s documents to suppress the competitor’s brand via safety-sensitive model behavior. Code, prompts, privacy-preserving pertrial outcome records, and aggregate results are released.1 1 Independent Researcher. Correspondence to: Hyunseok Paeng <[peanghs@naver.com](peanghs@naver.com) >. Accepted at the ICML 2026 Workshop on Failure Modes in Agentic AI (FAGEN) . Non-archival. 1[https://github.com/peanghs/injection-paradox](https://github.com/peanghs/injection-paradox). See [docs/METHODOLOGY.md](docs/METHODOLOGY.md) for the aggregation protocol. 1. Introduction Large language model (LLM)-based recommendation systems are rapidly growing (Nawara & Kashef, 2025) . ChatGPT Search uses retrieved web search results to generate recommendations. In February 2026, Microsoft Security reported that 31 companies across 14 industries had attempted to bias AI-assistant recommendations by planting hidden instructions in clickable links and URL prompt parameters (“AI recommendation poisoning”) (Microsoft Defender Security Research Team, 2026) . In response, LLM providers have adopted safety training (a post-training alignment process that teaches models to refuse harmful or manipulative inputs), most notably OpenAI’s Reinforcement Learning from Human Feedback (RLHF)(Ouyang et al. , 2022) and Anthropic’s Constitutional AI (CAI) (Bai et al. , 2022) . Defenses against direct prompt hacking (jailbreaks) attempted through the user-facing chat interface have advanced considerably, with Anthropic’s Constitutional Classifiers achieving over 95% blocking rates in automated evaluations (Sharma et al. , 2025) . However, the interaction between safety training and indirect prompt injection (malicious instructions embedded in external documents and injected via RAG context) remains insufficiently studied. The risks of indirect prompt injection have been systematized in the context of LLM-integrated applications (Greshake et al. , 2023); adversarial search engine optimization targeting LLM-driven selection has been demonstrated on production systems (Nestaaset al. , 2025); and cognitive-bias-based manipulation of LLM recommendations (Filandrianos et al. , 2025) and adversarial-text-based RAG poisoning (Zou et al. , 2025) have been explored independently. Yet these studies do not address the interaction between safety training and injection, and to our knowledge no prior work has reported a phenomenon in which safety training itself produces novel side effects beyond its intended defensive function. Accordingly, this study investigates whether the injection defense afforded by safety training produces unintended side effects. We examine whether models, in the process of de

FAQs

What is the Injection Paradox described in the document?

The Injection Paradox is a reproducible failure mode where prompt injections embedded in retrieved documents backfire against the attacker, suppressing recommendations below the injection-free baseline. It is observed in safety-trained LLM recommenders using RAG context injection.

How do safety-trained Claude models respond when injected documents are retrieved?

Injected documents lead to a sharp drop in recommendation rate, and the suppression propagates to other unmodified documents of the same brand. The document reports severe effects in Claude Sonnet and especially Claude Opus.

What contrasting behavior is reported for GPT models under the same injection?

For the GPT models tested, the same prompt injection increases recommendations rather than suppressing them. This contrast is used to suggest differences between model families in how injection-like context affects recommendation behavior.

Jul 16, 2026

Upload by Aurora