FlagThis

Abstract

We present a reproducible failure mode of safety training in RAG-based LLM recommendationthe _Injection Paradox_ in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injection-free baseline.[1] In safetytrained Claude models, documents containing prompt injections suffer a sharp drop in recommendation rate, and this suppression propagates beyond the injected document to unmodified documents of the same brand. In Claude Opus 4.6, the target brand drops from a 54% baseline to zero top-2 recommendations across all 50 trials, even though only 1 of 4 brand documents in the corpus contains an injection. The directional pattern is reproduced in counterfactual experiments and across three brands. A contrasting result across the GPT models tested, where the same injection instead increases recommendations, suggests model-family differences in how injection-like context affects recommendation behavior. These findings raise the technical possibility of a reverseattack scenario in which an adversary embeds injections in a competitors documents to suppress the competitors brand via safetysensitive model behavior. All code, corpus, per-trial records, and reproduction scripts will be made publicly available to support reuse of this failure mode as a minimal operational benchmark.[2]