"Data voids": one page trapped is enough to drag false information into the responses of ChatGPT, Gemini or Sonar Pro

By occupying topics where reliable information is scarce, an attacker sees its content taken over by AIs who search the Web in 31% of cases. A skeptical user tone does not protect much.

With conversational engines, the user no longer browses a list of ranked links but reads a synthesized response. Researchers, including Christina Pöpper, show that this change opens up a loophole: the exploitation of "data gaps". A disinformant publishes his story on a theme where relevant and reliable content is lacking, then waits for the model's web search to retrieve, cite or list its pages. Unlike a traditional engine, the assistant often masks the fact that its response is based on rare, unverified or even hostile sources.

The protocol

The team varied the tone of the question (skeptical, enthusiastic, or neutral), the model (ChatGPT, Gemini, Sonar Pro), and three levers of the attacker: five known strategies for creating and filling a void, more or less established and indexed hosting, and "generative engine optimization" techniques that are supposed to favor citations.

As a result, a single attacker-controlled page may be sufficient, and its content appears in 31% of responses under all conditions. Skeptical wording slightly reduces success and triggers slightly more warnings, but neither the tone nor the choice of model has a strong effect. The authors see it as a convenient attack surface at the time of inference and call for the development of defenses.