基于发布者属性评估生成式搜索引擎的攻击面：政治领域的案例研究
Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains
中文总结 AI 辅助
本研究针对政治领域，提出评估框架与“内容注入屏障”指标，发现不同GSE攻击面有别、执政党攻击面更广、用户画像影响小，揭示了GSE的攻击面特征。
中文摘要 AI 辅助
我们从引用选择和个性化的角度，对政治领域中生成式搜索引擎（Generative Search Engines, GSEs）针对毒化攻击的攻击面进行了表征。GSEs利用大语言模型（Large Language Models, LLMs）将网络搜索、答案生成与用户偏好及背景相结合，在用户访问网络信息的过程中发挥着关键作用。由于任何人都能在网络上发布内容，GSEs易受毒化攻击影响，此类攻击会通过操纵引用内容来破坏可靠信息的传递。现有关于引用评估的研究主要关注答案对引用内容的忠实反映程度，但未考察捕捉GSEs针对毒化攻击的攻击面的两个关键方面：GSEs更倾向于引用哪些发布者，以及个性化如何影响引用行为。为填补这一空白，我们引入了一个评估框架，用于表征GSEs针对毒化攻击的攻击面。我们的贡献有两点：（1）提出了一种新的指标“内容注入屏障”，用于量化在给定发布者权威等级下，向网络注入任意内容的难度；（2）通过将用户画像嵌入GSEs，揭示了个性化如何影响引用行为。我们针对美国和日本政治领域的三大主流GSEs开展了实验，结果显示：（a）不同GSE模型的攻击面存在差异；（b）GSEs的网络搜索功能会塑造攻击面；（c）执政党比在野党拥有更广泛的攻击面；（d）用户画像对攻击面的影响较小。
英文摘要
We characterize the attack surface of generative search engines (GSEs) against poisoning attacks in the political domain, from the perspectives of citation selection and personalization. GSEs integrate web search and answer generation with user preferences and backgrounds using large language models (LLMs). They play a crucial role in how users access information on the web. Because anyone can publish content on the web, GSEs are vulnerable to poisoning attacks that manipulate citations to undermine reliable information delivery. Existing studies on citation evaluation focus on how faithfully answers reflect cited content. However, they leave unexamined the two critical aspects to capture the attack surface of GSEs against poisoning attacks: which publishers GSEs prefer to cite, and how personalization affects citation behavior. To fill this gap, we introduce an evaluation framework that characterizes the attack surface of GSEs against poisoning attacks. Our contributions are twofold: (1) we propose a novel metric, \emph{content-injection barrier}, which quantifies the difficulty of injecting arbitrary content onto the web with a given level of publisher authority; and (2) we reveal how personalization affects citation behavior by embedding user profiles into GSEs. We conduct experiments on three major GSEs in the political domain of the United States and Japan. Our results show that (a) the attack surface differs across GSE models; (b) the web search functionality of GSEs shapes the attack surface; (c) ruling parties have a broader attack surface than opposition parties; and (d) user profiles have little influence on the attack surface.
