A research assistant renders an attacker's page-declared byline and publisher in a source chip: what does glancing at it verify?

## What a source chip is actually made of A research assistant that answers from fetched web pages usually renders a small provenance strip beside each answer: a title, a publisher name, often a byline and a date, sometimes a favicon. Those values are not the product of the assistant judging who wrote the page. They are read off the page itself, from the title, author, publisher and date fields the document declares about itself in its markup and structured data, plus the host it was served from. That makes every field in the strip **content**. It is under the control of whoever wrote the page, in exactly the way the sentences in the body are. ## Why that matters once the writer is the attacker The construction in this leaf is the whole of it: the attacker publishes a page, writes a claim in it, and *also writes the provenance the interface will display beside that claim*. One author supplies the assertion and the evidence for it. A reader who glances at the chip and sees a familiar institution has performed a check whose entire input the attacker controlled. Get the direction of the claim right, because interviewers listen for it: | What the reader believes the chip shows | What it actually shows | | --- | --- | | A named institution stands behind the claim | Retrieved text carried that institution's name in a metadata field | | The assistant confirmed the source | The assistant rendered strings it read | | Someone published this | A page declared itself published by someone | The chip is faithful. The pipeline is not malfunctioning. Faithful rendering of a self-declared string is precisely the property being used. ## Why this is not a hallucination, and not injection either Two classifications get reached for and both are wrong here. - **Model invention.** If the assistant had produced a publisher name with nothing retrieved to support it, that would be the generation making something up. Here the name was in the fetched artefact; the model repeated a value that was really there. - **Prompt injection.** Injection turns the application's own instructions around using data it feeds the model, so there is a directive somewhere in the text. This construction contains no directive at all. Nothing tells the assistant to do anything. The planted page just carries a claim and a costume, and the pipeline does its ordinary job with both. Controls that look for instruction-shaped text have nothing to find. ## What the attacker is actually buying The payoff is **attribution**. The point is not to make the assistant misbehave; it is to fix a recognisable name to a sentence that name never said, so that a person who reads the answer forwards it onward under that name. In a consumer product where text is the only thing that leaves, that is the whole of the damage, and it lands on a third party who was never in the conversation and may never learn where the quote came from. That also explains the target selection. The construction only pays when the impersonated name is one the reader recognises without looking it up. An obscure publisher buys nothing, because there is no borrowed credibility to spend. ## Where it is weak Worth knowing even at a first encounter, because an interviewer will push here. The construction depends on the reader's check staying inside the attacker's artefact. Any move that leaves it - going to the institution's own site instead of following the chip, or asking whether they published such a thing - is outside the attacker's control and returns nothing. It also depends on the page remaining reachable; once it is pulled, the claim can still be circulating in screenshots and forwarded text while the artefact that produced it no longer exists. ## How to answer this in an interview Say where the fields come from, in one sentence, before saying anything else: they are declared by the fetched page. Then name the consequence: the attacker wrote the evidence as well as the claim, so checking the citation checks nothing they did not supply. Then separate this from invention and from injection. A candidate who reaches straight for 'the answer cites its source, so we can check it' has skipped the only step that matters.