---
language: en
title: "Recommendation poisoning"
description: "Recommendation poisoning attempts to bias choices through manipulated content. Third-party comparisons and rankings require clear criteria, sources, and interests."
canonical: "https://tropk.ai/en/resources/glossary/recommendation-poisoning"
last_modified: "2026-10-12T16:09:34.509Z"
---

# Recommendation poisoning

Reviewed on 2026-10-07.

## What it means

Recommendation poisoning is the deliberate manipulation of content or inputs to bias the options a system presents to a user. In the context of [AI search](/en/resources/glossary/ai-search), it may involve third-party lists and comparisons that favor a brand without a corresponding basis. The term describes an adversarial purpose; it does not prove that every recommendation different from what was expected results from manipulation.

## Why it matters for marketing

For marketing, monitoring comparisons helps distinguish transparent criteria, identified advertising, and misleading claims. A list may change your assessment without changing the product, or circulate in copies that appear to be independent sources. The team needs to verify the evidence behind the choice and the material’s interests, without assuming that appearing in a ranking guarantees preference from any model.

## A practical example

Imagine an association that finds a list of equipment recommending a model based on a nonexistent certification. The same rationale appears in several copies, and an [AI response](/en/resources/glossary/ai-response) uses it in a comparison. The team checks the certification registry, documents the false claim, and requests a substantiated correction. It does not count the copies as independent confirmations or declare the identity of an attacker proven.

## How to apply or verify

Keep versions of the comparison, criteria, authors, and disclosed commercial relationships. Check decisive attributes against verifiable sources and identify copies of the same material. When there is an AI response, check the passage and reference actually used. Request documented corrections and monitor new samples, keeping hypotheses, evidence, and results separate; do not respond to suspicion by creating false recommendations or reviews.

## Important distinctions

Disclosed sponsorship and substantiated opinion are not automatically poisoning. Incorrect data, editorial preference, and malicious instructions require separate assessments. Context-corruption studies demonstrate biased commercial responses under specific conditions, not universal effectiveness for public lists. The risk justifies checking sources and criteria, but does not turn disagreement or competition into proof of an attack.

## Sources and references

- [PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models](<https://arxiv.org/html/2402.07867v3>) — Wei Zou, Runpeng Geng, Binghui Wang e Jinyuan Jia
- [LLM01:2025 Prompt Injection](<https://genai.owasp.org/llmrisk/llm01-prompt-injection/>) — OWASP GenAI Security Project

## Continue a leitura

- [Retrieval poisoning](</en/resources/glossary/retrieval-poisoning>)
- [Indirect prompt injection](</en/resources/glossary/indirect-prompt-injection>)
- [Comparison page](</en/resources/glossary/comparison-page>)

## About the author

[Luiz Gardelin](</en/team/luiz-gardelin>)

Luiz Gardelin is the founder of Tropk.ai and works in GEO/AEO, product vision, strategy, and growth, helping brands understand and improve their presence in AI responses.

---

[All pages in Markdown](<https://tropk.ai/sitemap.md>)