Can language models be hijacked to hide covert advertising?

Most adversarial-attack research targets accuracy: degrade the model, induce wrong answers, jailbreak safety. Advertisement Embedding Attacks (AEA) name a different objective — information integrity. They stealthily inject promotional or malicious content (covert ads, propaganda, hate speech) into outputs while the response otherwise appears normal and accurate. Two low-cost vectors carry it: hijacking third-party service-distribution platforms to prepend adversarial prompts, and publishing backdoored open-source checkpoints fine-tuned with attacker data.

What makes AEA distinctive is the commercial incentive structure and the invisibility. Because accuracy is untouched, standard quality metrics and many safety filters miss it; the harm is the insertion of an interested party into ostensibly neutral output, mapped across five stakeholder victim groups. The proposed mitigation is a prompt-based self-inspection defense requiring no retraining — the model audits its own output for injected content.

This extends the vault's injection/poisoning cluster along a new axis. Where Can one compromised agent corrupt an entire multi-agent network? concerns behavioral bias and Can we defend RAG systems from corpus poisoning without retraining? concerns retrieval, AEA targets the commercial integrity of generation itself — and the authors warn it could become "as prevalent as web viruses," since the economic motive (paid placement) is durable in a way that pure sabotage is not.