The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection

Technical Summary: The Injection Paradox

Problem Statement
The paper investigates a specific failure mode in Retrieval-Augmented Generation (RAG) systems where safety-trained Large Language Models (LLMs) exhibit unintended side effects when processing indirect prompt injections. While prior research has focused on how attackers use prompt injections to manipulate LLMs into promoting specific products, this study identifies the "Injection Paradox": in certain safety-trained models, prompt injections embedded in retrieved documents backfire against the attacker’s intent. Instead of promoting the target brand, the model suppresses recommendations for that brand below the baseline rate observed without any injection. This suppression is not limited to the injected document but propagates to other unmodified documents associated with the same brand.

Methodology
The authors simulate the generation stage of a RAG pipeline using a corpus of 40 documents across nine wireless earbud brands. The target brand, Edifier NeoBuds Pro 3, was selected due to its low brand recognition, making its recommendation contingent on corpus context rather than parametric knowledge.

• Threat Model: An attacker modifies only one document (2.5% of the corpus) to include a prompt injection. The attacker has no direct access to the LLM (black-box setting).
• Conditions: Three core conditions were tested:
  1. Baseline: Original corpus.
  2. Implicit: Persuasion triggers only (emotional exaggeration, temporal priming, false authority).
  3. Injection: A metadata-disguised prompt injection payload inserted into a single document.
  4. Combined: Injection payload plus document expansion and implicit triggers.
• Models: Seven models were evaluated: four from the GPT family (GPT-4o-mini, GPT-5-nano, GPT-5-mini, GPT-5.4) and three from the Claude family (Haiku 4.5, Sonnet 4.6, Opus 4.6).
• Metric: The primary metric was the top-2 recommendation hit rate for the target product. Statistical significance was assessed using Fisher’s exact test, 95% Wilson confidence intervals, and Cohen’s h.
• Counterfactuals: To test brand-level propagation, the authors conducted counterfactual experiments where the injected document was replaced with a document from a non-target brand (Sennheiser) to isolate the effect of the injection from the mere absence of the document.

Key Contributions

1. Identification of the Injection Paradox: The paper defines and demonstrates a phenomenon where safety training causes models to suppress recommendations for a brand when an injection is detected, rather than merely neutralizing the injection’s effect.
2. Brand-Level Suppression Propagation: The study shows that suppression cascades from the injected document to unmodified documents of the same brand, resulting in a "Worse-Than-Absent Effect" where the presence of an injection yields worse outcomes than the complete absence of the injected document.
3. Model-Family Divergence: The paper highlights a stark contrast between model families: Claude models (Sonnet/Opus) exhibit suppression, while GPT models exhibit promotion under the same injection conditions.
4. Operational Failure Mode Characterization: The authors frame the Injection Paradox as a reproducible failure mode with explicit activation boundaries, minimal reproduction requirements, and composable brand-level harm.

Results

• Primary Effect: In Claude Sonnet 4.6 and Opus 4.6, the injection condition caused a sharp drop in recommendation rates below the baseline (Sonnet: 26% → 8%, −18 pp; Opus: 54% → 8%, −46 pp). In contrast, GPT-4o-mini showed a promotion effect (17% → 40%, +23 pp). Claude Haiku 4.5 showed no significant change.
• Brand-Level Propagation: Counterfactual experiments confirmed that the suppression affected the entire brand. When the injected document was removed (3-doc baseline), the hit rate for Edifier was 28% (Opus) and 8% (Sonnet). With the injection present (Combined condition), the hit rate dropped to 0% (Opus) and 2% (Sonnet), demonstrating that the injection actively suppressed the remaining unmodified documents.
• Cross-Brand Replication: The suppression trend was replicated across three brands (Edifier, Apple, Galaxy), with the magnitude of suppression varying by brand but the directional pattern remaining consistent across the Claude family.
• Mitigation Limits: Four prompt-level defense variants (D1–D4) were tested. None restored the clean baseline. The most effective variant (D4, which provided objective specification anchors) left residual suppression (−18 pp on Opus, −4 pp on Sonnet). The mitigation effect was driven by providing explicit decision criteria rather than by defending against the injection itself.
• Mechanism: The suppression manifested as "silent demotion," where the target brand was replaced in the top-2 ranking by other in-corpus brands, rather than explicit safety refusals.

Significance and Claims
The paper claims that the Injection Paradox represents a technical possibility for a "reverse-attack" scenario, where an adversary could embed injections in a competitor’s documents to suppress the competitor’s brand via safety-sensitive model behavior. The authors emphasize that this is defensive security research reporting a side effect of safety training. They argue that current injection defenses may create new attack surfaces and call for safety research to study the side effects of defenses, particularly the unintended suppression of legitimate recommendations. The paper concludes that the phenomenon is a reproducible failure mode with measurable residual suppression that persists despite standard prompt-level mitigations.