Overview
The Hanover Institute for Public Policy presents itself as a neutral think tank publishing data-driven reports on Israel and Palestine. In reality, it is a fabricated entity created on behalf of the Israeli Government Advertising Agency and operated by Piro Inc, a firm that openly markets ‘AI Story Optimization’ — content engineered to influence how large language models evaluate and reproduce information.
In under two weeks, the Hanover Institute published at least 100 reports. Each is byline-free, structured with footnotes and tables of contents, and written in a tone calibrated to appear credible to LLM retrieval systems. This is not incidental — Piro’s own website states it ‘authors content engineered for how LLMs evaluate credibility.’
This is one of the most clearly documented state-linked LLM poisoning operations to date.
Technical Analysis
The attack surface here is the retrieval and training pipeline of publicly accessible LLMs, particularly those using RAG (Retrieval-Augmented Generation) architectures. LLMs like Claude and Gemini draw on indexed web content to answer factual queries. By publishing high-volume, structurally credible content targeting specific question patterns — ‘What caused the displacement of Palestinians in 1948?’, ‘Is the IDF the world’s most moral army?’ — the Hanover Institute attempts to seed LLM knowledge bases with pro-Israeli framings.
The operation exhibits several hallmarks of adversarial retrieval manipulation:
- Volume: 100+ articles in ~10 days saturates keyword-relevant index space
- Structure mimicry: Footnotes, tables of contents, and neutral tone are specifically chosen to match LLM credibility heuristics
- Question-lead formatting: Reports open with natural-language questions that mirror likely chatbot query patterns, increasing retrieval relevance
- Cross-linking: Reports frequently cite the same studies, creating synthetic citation networks that inflate apparent evidential weight
The technique is industry-termed ‘LLM poisoning’ and maps directly to RAG poisoning and training data manipulation attack vectors.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| ATLAS | AML.T0070 – RAG Poisoning | Content designed to surface in LLM retrieval queries |
| ATLAS | AML.T0059 – Erode Dataset Integrity | High-volume injection of adversarially framed content |
| ATLAS | AML.T0067 – LLM Trusted Output Manipulation | Mimics structural trust signals (footnotes, neutrality) |
| OWASP | LLM03 – Training Data Poisoning | Web-crawled content enters model fine-tuning or RLHF pipelines |
| OWASP | LLM09 – Overreliance | End users trust chatbot outputs derived from poisoned sources |
Impact Assessment
The immediate risk falls on consumers of LLM-generated information on politically sensitive topics, particularly around the Israel-Palestine conflict. Chatbots that retrieve from open web indexes may surface Hanover Institute content as authoritative. Secondary risk affects AI developers: if this content is crawled into training corpora, model-level bias on these topics becomes persistent and harder to audit.
NewsGuard analyst Alice Lee confirmed the sites appear designed to reach U.S. audiences via both search and AI chatbot channels, indicating a dual-vector influence strategy.
Mitigation & Recommendations
- Source provenance scoring: RAG pipelines should weight content from established, editorially accountable sources higher than recently created, byline-free domains
- Velocity detection: Flag domains publishing high article volumes in short windows for elevated scrutiny before indexing
- Adversarial content audits: LLM developers should periodically audit retrieval outputs on geopolitically sensitive topics for coordinated framing patterns
- Transparency tooling: Chatbots should expose retrieved source URLs to end users to enable independent verification
- Dataset provenance tracking: Training data pipelines should log domain registration dates and publication velocity as risk signals