TL;DR
When you ask ChatGPT, Gemini, or Perplexity about a rare term, a new product, or a breaking event, the model runs a search and summarizes what it finds. If there's almost nothing on the topic (a "data void"), the results can be filled by one single page that was planted there on purpose. The model will turn it into a confident answer with citations. In the study, such a page showed up in the answer almost one time in three, and even more often with prominent hosting.
Intuitive defenses don't work. A skeptical tone ("double-check, is this true?") barely lowers the risk. Neither does the choice of model: there's no noticeable difference. The model adds a reliability warning only about a quarter of the time when it uses the planted page. In classic search results you'd see junk sites and forums, but in a synthesized answer that signal is erased. It's even worse if you put terms from the "source" (a chat, forum, or ad) into your query, or ask it to search "more broadly, including new sources": that raises the attack's success rate.
Here's the gist of the study. The authors invented 56 harmless "voids" across five topics (business, health, law, politics, technology). For each, they hosted one page, varying the strategy, the site's prominence, and the formatting tricks. Then they asked three models questions in three tones and checked whether the models cited the made-up page. Practical takeaway: on rare and new topics, don't trust a cited answer by default; you have to check the sources yourself.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Attack Blueprint (so you know where the risk comes from)
STEP 1: Find a "void" — a term/event with almost no text about it online
STEP 2: Publish one page with the desired version (plus GEO formatting)
STEP 3: Nudge people to "google it themselves" (forum, chat, social media)
STEP 4: A person asks an LLM → the model searches → finds only this page
STEP 5: The model cites it in a confident answer, often with no warning
Five strategies for creating a void: - Breaking news. While there's no official data yet, a "first" text appears. - New coined terms. The word exists only on the author's page. - Outdated terms. An old word is still searched for, but the fresh texts about it are written by someone else. - Fragmented concepts. One phenomenon is described with two different words, each leading into its own "universe." - Problematic queries. The question itself already carries a suspicion or a false premise.
Example
⚠️ The authors didn't test any defensive prompts. Below is our prompt, built from their findings: a neutral tone, no outside terms taken as facts, explicit source accounting. It's a hypothesis for you to test, not a proven method.
Task: An Amazon seller in Phoenix saw in a Discord server that everyone is raving about "Cross-Dock 2.0 by LogiFlow" and telling people to "google it yourself." He asks ChatGPT with search. This is exactly a "data void": the term is new, there are no independent texts, and the very first page found may be an ad.
Prompt:
Question: what is "Cross-Dock 2.0 by LogiFlow," and should I
use it to ship inventory to Amazon FBA warehouses?
Before answering:
1. List how many sources you found. For each: domain,
who the owner or author is, publication date.
2. Split the claims into those confirmed by several independent
sources and those confirmed by only one.
3. Separately flag sources that belong to the company itself,
its partners, or have no named author.
4. If there are no independent sources, say so plainly: "no reliable data
found." Don't build the answer from the name, and don't treat
terms from the question as proven.
Result: The model first gives you a list of sources with domains, authors, and dates. Then it sorts the claims into "confirmed by several" and "by only one." The company's own sources are flagged separately. If there really is only one page online, the answer should say there's no independent confirmation. All that's left is for you to open 1-2 dubious links yourself and check whether they're ads.
Why It Works
The model's weakness. A web-searching LLM takes whatever it found in the results and stitches it into a smooth answer. When there are few texts on a topic, there's nothing to choose from, and even a single page looks like "consensus." In normal search results you'd see weird sites and a lack of serious sources. In the model's answer, that warning sign disappears.
The strength. The model is good at following an explicit procedure: list the sources, split claims by number of confirmations, name the site owner. A skeptical tone in the query didn't work because it doesn't change what the model finds. An explicit demand to show the sources and their independence gives you back the signal it erased.
Control knobs: - Don't put terms and phrasing from ads, chats, or forums into your question as facts. The paper shows that queries with "suggested" keywords raise the attack's success rate. - Don't ask it to "search more broadly, including the newest sources": for rare topics that increases the chance of landing on a fresh planted page. - For widely known topics the risk is lower. In a trial case with a major news story, success was about 11%. - Drop the "if there are no independent sources, say so" condition if the topic is obviously popular.
Prompt Template
The template is ours (see the caveat above), based on the paper's findings.
Question: {question about a little-known term, product, company, or event}
Before answering:
1. List how many sources you found. For each: domain,
who the owner or author is, publication date.
2. Split the claims into those confirmed by several independent
sources and those confirmed by only one.
3. Separately flag sources that belong to {question_subject},
its partners, or have no named author.
4. If there are no independent sources, say so plainly: "no reliable data
found." Don't build the answer from the name, and don't treat
terms from the question as proven.
Fill in: {question} — your question, without emotional coloring; {question_subject} — the company, the term's author, or the seller you're asking about.
Limitations
⚠️ The defense is untested. The authors showed that a skeptical tone doesn't help. Whether an explicit demand to list sources works, they didn't test: that's our hypothesis.
⚠️ Small effects aren't ruled out. The study rules out a large influence of tone and model on the outcome. It does not rule out a small one.
⚠️ Empty topics only. The results apply to queries about little-known terms and events. For ordinary questions with lots of independent texts online, the risk is much lower.
⚠️ It needs a primed user. The attack targets a person who's been nudged in advance to search for specific words. If you search without such "hints," you're less likely to land on a planted page.
⚠️ Synthetic pages. The texts were written by ChatGPT-5.2, there was one page per topic, and the "voids" themselves were harmless. Real attacks may work differently. The study also tested the free versions of the models.
How They Tested It
The researchers came up with 90 short "seeds": made-up claims and terms for each of the five strategies and five topics. Other authors checked that the seeds were harmless and that search really turned up nothing. For that check they used ChatGPT-5.2: if it ran a search and reported "no information," the void was considered real. That left 56 seeds. For each, they generated a 700-1000 word page and hosted it at three levels of prominence (an old domain with auto-indexing, a new domain with manual indexing, a new domain with no help), with or without "LLM-friendly" formatting.
Then they asked ChatGPT, Gemini, and Sonar Pro questions in three tones: neutral, excited, skeptical. They checked whether the model cited the page, paraphrased it without a link, or merely listed the link.
The result: on average, 31% of queries ended in a successful attack (28.6% citations, 1.0% paraphrases, 1.4% listings). With medium and high hosting prominence, success rose to 42.3%. The model gave a reliability warning in only 26.8% of cases where it used the planted page. Neither tone nor model lowered success meaningfully. A skeptical query slightly reduced success and slightly more often triggered a warning, but the difference was small.
What surprised most was that a single page on a new domain is sometimes enough, and skeptical wording doesn't help. The lesson for practice: the style of your question is no substitute for checking sources.
Adaptations and Extrapolations
🔧 Technique: don't feed the model someone else's words → less risk.
Instead of "Is it true that {term from the chat} is safe?" ask about the topic without the outside term: "What's known about using {general concept}? Is there a product/service called {term}?" The paper shows that queries with "suggested" keywords increase the attack's success rate. This adaptation is derived from their finding but wasn't tested separately.
🔧 Technique: drop "search broader, include new stuff" → less risk on rare topics.
The authors showed that "open" prompts asking to search more broadly and include fresh sources raise the attack's success rate. For checking dubious topics, it's better to ask: "use only independent sources older than {cutoff}," and then look at the new ones separately.
Extrapolation: the same tricks for your own pages. If you're writing a website or knowledge base and want LLMs to cite it correctly, the authors identified five formatting factors that boost citations: precise domain-specific terms, a short summary at the top of the page, in-text links to sources, concrete statistics, and a safety section. Apply them to honest content: a fair description of your product or an expert article. They work for deception too, which is exactly why the risk section matters.
Resources
- Paper: Data-Void Exploits in Web-Searching LLMs. Michele Guerra, Wuyeh Jobe, Sanjana Nambiar, Christina Pöpper, Azza Abouzied. New York University Abu Dhabi. NDSS Symposium 2027.
- Artifacts (code and corpus): https://doi.org/10.5281/zenodo.22923596
- Foundations of the "data void" concept: Golebiewski & boyd (five strategies), Tripodi & Moeller, Mannino et al.
- GEO: Aggarwal et al., Generative Engine Optimization.