GEO-Flag: Detecting and Measuring GEO-Optimized Web Content

Junjie Chu; Ye Leng; Mingjie Li; Yun Shen; Xinyue Shen; Yang Zhang

cs.LGAug 17, 2026

GEO-Flag: Detecting and Measuring GEO-Optimized Web Content

Authors: Junjie Chu, Ye Leng, Mingjie Li, Yun Shen, Xinyue Shen, Yang Zhang

Organizations: CISPA Helmholtz Center for Information Security · HPE · University of Waterloo

Abstract

Generative Engine Optimization (GEO) modifies web content to increase its likelihood of being selected and cited by generative search engines. This can give strategically optimized pages visibility disproportionate to their authority or relevance and even make weak or false information appear well supported. Unlike conventional search, generative search synthesizes information into direct answers rather than presenting competing sources, which can further amplify these risks, as assessing source provenance and authority requires additional user interaction. Despite these concerns, systematic methods for detecting GEO-optimized webpages remain underexplored. We introduce GEOFlagBench, a benchmark of 3,200 web content instances spanning 400 queries, four domains, and eight GEO optimizer families, and use it to systematically evaluate existing GEO detection methods. Although the strongest baseline achieves an aggregate F1 of 0.880, method-level and authorship-conditioned evaluations reveal substantial weaknesses and potential reliance on authorship-related shortcuts. We therefore propose Intervention-Paired Training (IPT), which supervises detector responses to GEO interventions and non-GEO AI polishing; on ModernBERT, IPT improves F1 from 0.862 to 0.944 and worst-group accuracy from 0.725 to 0.883. We develop a GEO-gated Agent system for auditing the Source Tier and verifiability of Citation URLs in detected GEO pages. Finally, we deploy the complete pipeline on released Google Search and Gemini-grounded retrieval results for 1,000 real-user queries. Across 10,095 available pages, we estimate an overall GEO prevalence of 8.90%, reaching 16.36% among pages modified in 2026. Our results establish a foundation for systematically detecting, auditing, and measuring GEO in real-world search ecosystems.

Figures & tables

Figure 1: Illustration of how generative search can amplify risks from GEO-optimized or strategically constructed content. Traditional search exposes multiple competing sources and their provenance, whereas generative search synthesizes information into a single answer with less visible source context.

Figure 2: Overview of dataset construction and measurement of the existing GEO detection methods.

Fine-tuned Models
Method	Acc.	F1
ModernBERT (1K)	0.842	0.864
ModernBERT (8K)	0.839	0.862
Qwen3-0.6B (SFT)	0.778	0.833
Feature engineering + classical classifiers
TF-IDF char (2-4) + LR	0.848	0.878

Table 1: Overall GEO flagging results on the fixed test set of 360 non-GEO and 602 GEO instances. The last block calibrates each native score with one-dimensional logistic regression on the training split.

Fine-tuned models
Method	Method-Level GEO Recall			Authorship-Conditioned Diagnostics
	PMA $\uparrow$	AutoGEO-Light $\uparrow$	Human $\uparrow$	Worst-Group Acc. $\uparrow$	$\Delta$ FPR $\downarrow$	$\Delta$ TPR $\downarrow$
ModernBERT-base (1K)	0.566	0.423	0.426	0.725	0.271	0.121
ModernBERT-base (8K)	0.513	0.346	0.444	0.725	0.263	0.117
Qwen3-0.6B (SFT)	0.934	0.654	0.463	0.325	0.413	0.105
Feature engineering + classical classifiers

Table 2: Method-level recall and authorship-conditioned diagnostics. Arrows indicate the preferred direction.

Selected baselines
	Overall Performance		Shortcut Diagnostics
Method	Acc.	F1	WGA $\uparrow$	$\Delta$ FPR $\downarrow$	$\Delta$ TPR $\downarrow$
ModernBERT (1K)	0.842	0.864	0.725	0.271	0.121
ModernBERT (8K)	0.839	0.862	0.725	0.263	0.117
Qwen Zero-shot	0.627	0.770	0.008	0.000	0.006
Qwen SFT	0.778	0.833	0.325	0.413	0.105

Table 3: Comparison of selected GEO detectors and our proposed methods. WGA denotes worst-group accuracy, while

\Delta

FPR and

\Delta

TPR measure absolute error-rate gaps between AI- and human-authored groups.

Method	Acc.	Macro F1
TF-IDF Character 2–4 with LR	0.730	0.612
TF-IDF Word 1–2 with LR	0.710	0.562
Ghostbuster features, recalibrated	0.545	0.286
Structural features with XGBoost	0.648	0.573
GPT-2 perplexity features with LR	0.497	0.226
Gemini-3.5-flash	0.500	0.315

Table 4: Results on the seven-class attribution task.

Figure 3: Overview of the Two-Phase Audit.

Figure 4: Deterministic mapping from URL source tier and accessibility level to citation URL verifiability.

Agent Model	URL Source Tier	Citation URL Verifiability
GLM 5.2	84.75 / 84.02	83.00 / 83.20
Kimi K3	78.46 / 76.43	76.65 / 76.78
Qwen 3.6 35B-A3B	77.37 / 75.69	76.10 / 76.54
GPT 5.6 Luna	76.77 / 75.03	75.32 / 75.50
Claude Haiku 4.5	73.93 / 71.39	72.60 / 72.50
Gemini 3.5 Flash	62.07 / 58.10	62.31 / 63.05

Table 5: Conditional performance on 1,653 citation occurrences from gold-labeled GEO instances correctly detected by the GEO gate. Each cell reports accuracy / macro F1 (%).

Setting	Google Search	Gemini	Unique Union	Gemini $-$ Google	95% CI
Page-level estimate	441/5,421 (8.14%)	599/6,590 (9.09%)	898/10,095 (8.90%)	0.95 pp	N/A
Paired-query macro ( $n=965$ )	7.91%	9.34%	N/A	1.43 pp	[0.46, 2.41] pp

Table 6: GEO estimates and comparisons between retrieval channels. An example is available in Figure 8 in Appendix E .

Panel of Figure 5 — Figure 5: GEO prevalence by declared dateModified year (2023–2026). Panel (a) reports detection rates for Google Search, Gemini, and their unique union; Panel (b) partitions union GEO detections into three mutually exclusive exposure groups. Pages without a parseable dateModified are omitted: 8,119 union pages (682 GEO; 8.40%), 4,563 Google pages (355; 7.78%), and 5,153 Gemini pages (434; 8.42%).

Domain	Pages	GEO	GEO Rate
en.wikipedia.org	613	0	0.00%
youtube.com	434	19	4.38%
my.clevelandclinic.org	106	0	0.00%
webmd.com	78	0	0.00%
healthline.com	73	0	0.00%
medicalnewstoday.com	61	2	3.28%

Table 7: Largest domains in the unique-page union.

Panel of Figure 6 — Figure 6: Citation URL labels for 6,663 occurrences in the unique-page union. Bars show shares, with occurrence counts above them. The two panels are separate marginal distributions and do not imply one-to-one category mappings.

Page and Citation Volume
Metric	Google Search	Gemini
Detected GEO pages	441	599
GEO pages with citations	236	335
GEO pages with citations (% of GEO pages)	53.51%	55.93%
Citation occurrences	2,162	5,272
Citations per detected GEO page	4.90	8.80

Table 8: Page and citation URL statistics by retrieval channel. The channels overlap in 142 GEO pages, including 82 cited pages and 771 citation occurrences. Thus, the unique union contains 898 GEO pages and 6,663 citation occurrences.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Family	Instances	Seeds	Optimization Procedure	Variants and Construction Details
GEO Strategy Pool [ 1 , 36 , 5 ]	400	200 human, 200 AI	Samples 3–13 strategies and applies them jointly in one cohesive rewrite. The pool contains 13 strategies covering fluency, lexical diversity, authoritative style, quotations, citations, simpler language, technical terms, search keywords, statistics, content improvement, an llms.txt -style summary, reader questions, and diverse perspectives.	Executor(s): Claude Haiku 4.5; Kimi K2.5; Gemini 3 Flash Preview; GPT-4o. Each processes 50 human and 50 AI seeds. Combines nine GEO strategies with two strategies from C-SEO and two adapted from E-GEO. The E-GEO prompts are adapted from product descriptions to general web articles.
AutoGEO [ 47 ]	400	200 human, 200 AI	Applies learned AutoGEO preference rules at three intervention intensities. For each seed type, 50 instances use Light, 100 use Medium, and 50 use Full.	Executor(s): Gemini 3.1 Pro Preview for all instances. Light applies 3 rules, requests limited additions, and requires at least 80% word overlap. Medium applies 6 rules and targets 50–70% overlap. Full preserves the AutoGEO API prompt and applies all 12 learned rules. AutoGEO Mini is excluded.
PMA [ 31 ]	200	100 human, 100 AI	Implements three benchmark variants of the Preference Manipulation Attack. Inject places source-prioritization instructions before and after the unchanged seed. Persuade integrates authority claims, social proof, and superlative language into the instance. Combo applies Persuade followed by Inject.	Executor(s): GPT-4o for Persuade and Combo on human seeds; Claude Sonnet 4.6 for Persuade and Combo on AI seeds. Inject requires no LLM. For each seed type, we construct 25 Inject, 25 Persuade, and 50 Combo instances.
RAID G-SEO [ 10 ]	200	100 human, 100 AI	Uses our prompt-level implementation of the role-augmented intent pipeline. Four LLM calls extract claims and evidence, infer queries for Student, Professional, Researcher, and Decision-maker roles, construct an intent-aligned content plan, and rewrite the instance.	Executor(s): GLM-5.1 for 199 instances; GLM-5 through Together AI for one AI-seed instance as a fallback. The fallback is used only for one AI-seed output.
Meta-Optimization [ 5 ]	200	100 human, 100 AI	Samples 4–6 strategies from the 13-strategy pool, generates an initial rewrite, asks the same model to evaluate it, and revises the instance based on that evaluation. A third rewrite is requested when the intermediate optimization rating is below 7/10.	Executor(s): GPT-4o for 100 human seeds; Claude Sonnet 4.6 for 100 AI seeds. All retained human-seed outputs complete two rewrite rounds. For AI seeds, 4 outputs retain one round, 79 retain two rounds, and 17 retain three rounds.
Stealthy GEO Strategy Pool	200	100 human, 100 AI	Uses the same strategy-sampling procedure as GEO Strategy Pool, with an additional instruction to avoid formulaic structure, excessive optimization markers, and unnatural authority signals.	Executor(s): Claude Haiku 4.5; Kimi K2.5; Gemini 3 Flash Preview; GPT-4o. Each processes 25 human and 25 AI seeds. The final revision replaces the original Claude Sonnet 4.6 executor with GPT-4o.

Appendix

Table 9: Construction of the eight GEO optimizer families. Seed counts denote the numbers of human-written and AI-generated non-GEO instances used for each family. GEO labels are determined by recorded optimization interventions rather than textual style or detector predictions. We assign 200 instances to each family and 400 each to GEO Strategy Pool and AutoGEO, yielding 2,000 GEO and 1,200 non-GEO instances overall. The larger quotas reflect their broader internal design spaces: GEO Strategy Pool varies strategy combinations, executor models, and seed authorship, while AutoGEO varies intervention intensity and seed authorship. The remaining families use narrower, fixed, robustness-oriented, or more expensive construction procedures and retain the 200-instance quota.

Provenance	Non-GEO	GEO	Total
Human	400	1,050	1,450
Human + AI Polished	400	0	400
AI	400	950	1,350
Total	1,200	2,000	3,200

Appendix

Table 10: Composition of GEOFlagBench by instance provenance and optimization.

Optimizer Family	Human Seed	AI Seed	Median Word-Overlap
GEO Strategy Pool	200	200	0.56
AutoGEO	200	200	0.71
PMA	100	100	0.99
RAID G-SEO	100	100	0.58
Meta-Optimization	100	100	0.55
Stealthy GEO-SP	100	100	0.55

Appendix

Table 11: GEO optimizer families and their seed composition.

$\beta$	F1 $\uparrow$	Accuracy $\uparrow$	$\Delta$ FPR $\downarrow$	Worst-Group Acc. $\uparrow$
0.5	0.931	0.918	0.025	0.857
1	0.944	0.931	0.108	0.883
2	0.942	0.929	0.146	0.850
4	0.941	0.928	0.150	0.842

Appendix

Table 12: Sensitivity of IPT to the loss weight

\beta

. Higher F1, accuracy, and worst-group accuracy are better, while lower

\Delta

FPR is better.

Fine-tuned Models
Detector	AutoGEO				GEO Strategy Pool
	Full ( $n=28$ )	Light ( $n=26$ )	Medium ( $n=62$ )	Medium-Stealthy ( $n=72$ )	Standard ( $n=118$ )	Stealthy ( $n=52$ )
ModernBERT (1K)	1.000	0.423	0.919	0.833	0.890	0.865
ModernBERT (8K)	1.000	0.346	0.919	0.819	0.941	0.846
Qwen3-0.6B (SFT)	1.000	0.654	0.887	0.847	0.966	0.923
Feature engineering + classical classifiers

Appendix

Table 13: Complete method-level GEO recall on the fixed test set. Each entry reports recall within one GEO optimization variant, and the sample count below each column header is the corresponding test-set size. The PMA result in Table 2 aggregates Combo, Inject, and Persuade (

n=76

); this table reports the three variants separately.

Method	Non-GEO	AutoGEO	Pool	PMA	RAID	Meta	Human
TF-IDF Character 2–4 with LR	0.944	0.691	0.876	0.421	0.242	0.542	0.167
TF-IDF Word 1–2 with LR	0.975	0.511	0.900	0.645	0.182	0.438	0.019
Ghostbuster features, recalibrated	0.942	0.229	0.729	0.000	0.242	0.000	0.037
Structural features with XGBoost	0.769	0.739	0.582	0.066	0.636	0.667	0.537
GPT-2 perplexity features with LR	0.858	0.271	0.688	0.000	0.015	0.000	0.000
Gemini-3.5-flash	0.825	0.479	0.153	0.789	0.030	0.021	0.093

Appendix

Table 14: Per-Class Recall for All Seven-Class Attribution.

Method	Non-GEO	AutoGEO	Pool	PMA	RAID	Meta	Human
TF-IDF Character 2–4 with LR	0.679	0.681	0.797	1.000	1.000	1.000	1.000
TF-IDF Word 1–2 with LR	0.654	0.632	0.805	1.000	1.000	1.000	1.000
Ghostbuster features, recalibrated	0.575	0.434	0.539	0.000	0.390	0.000	1.000
Structural features with XGBoost	0.647	0.702	0.688	0.227	0.792	0.711	0.403
GPT-2 perplexity features with LR	0.526	0.370	0.515	0.000	0.333	0.000	0.000
Gemini-3.5-flash	0.692	0.287	0.310	0.556	0.400	0.125	0.357

Appendix

Table 15: Per-Class Precision for All Seven-Class Attribution.

Tier	Publisher Class	Assignment Rule	Policy Indicators
C1	Primary or strongly accountable authority	The publisher is the primary institutional source, a peer-reviewed research venue, or an organization with strong expert review, corrections, and editorial accountability.	Primary authority; government or intergovernmental body; peer-reviewed research; strong editorial accountability.
C2	Accountable secondary or curated source	The publisher provides identifiable secondary editorial or community-curated material with meaningful review signals, but is not the primary authority for the claim.	Professional secondary editorial process; named authors and disclosures; aggregation of primary sources; community-curated reference.
C3	Limited-accountability or user-contributed source	Publication is substantially open-contributor, user-generated, advocacy-driven, promotional, anonymous, or lacks stable editorial accountability. This tier does not imply that a specific claim is false.	Open-contributor platform; user-generated content; limited editorial accountability; advocacy or promotion; anonymous or unverifiable authorship.

Appendix

Table 16: Definition of the URL source tier metric.

Accessibility Level	Definition	Retrieval Outcomes
Directly accessible	The citation URL resolves successfully, and its destination content can be directly retrieved and inspected.	LIVE
Restricted or archived	The cited source can be established, but its content cannot be directly retrieved because access is restricted or only an archived copy is available.	BLOCKED , ARCHIVED_ONLY
Unavailable or unresolved	The cited content cannot be retrieved, or its availability cannot be established at retrieval time.	HTTP_404 , DOMAIN_NXDOMAIN , TIMEOUT

Appendix

Table 17: Definition of the three citation URL accessibility levels.

Channel	Queries	URLs	Pages	Coverage
Google Search	1,000	7,856	5,421	69.00%
Gemini-Grounded	979	8,591	6,590	76.71%
Unique Union	1,000	13,985	10,095	72.18%

Appendix

Table 18: Page retrieval coverage by channel.

Analysis Unit	Google Search	Gemini	Unique Union
Citation occurrences	2,162	5,272	6,663
Distinct Citation URLs	1,443	2,647	3,551

Appendix

Table 19: Occurrence-level and distinct-URL-level citation counts.

Figure 7: Data flow and analysis units in the real-world web audit. Search channels return Page URLs, whose contents are fetched and passed to the GEO detector. For detector-positive pages, the parser extracts citation URLs from the page content. These extracted citation URLs, rather than the original Page URLs, are then audited for URL source tier and citation URL verifiability. The displayed union, page, and citation counts use the unique union; channel-specific counts are explicitly named.

Agent Model	Time	Estimated Cost
Gemini 3.5 Flash	21.47 min	$5.81
Claude Haiku 4.5	25.91 min	$3.79
GPT 5.6 Luna	28.78 min	$3.17
GLM 5.2	29.92 min	$3.72
Kimi K3	101.76 min	$12.36
Qwen 3.6 35B-A3B	101.86 min	$2.28

Appendix

Table 20: Time and estimated inference cost for the citation audit under the evaluated serving configurations.

	Unique Union			Google Search		Gemini
Period	Pages	GEO	Rate	Pages	Rate	Pages	Rate
2023	165	4	2.42%	65	3.08%	124	2.42%
2024	299	21	7.02%	107	7.48%	243	7.41%
2025	578	74	12.80%	247	10.93%	422	13.51%
2026	642	105	16.36%	318	13.52%	434	18.20%
Missing	8,119	682	8.40%	4,563	7.78%	5,153	8.42%

Appendix

Table 21: Detailed GEO detection results by declared dateModified .

Final Outcome	URLs	Share
Persistent HTTP 403	2,082	53.52%
Robots policy unavailable or denied	811	20.85%
Navigation or network failure	226	5.81%
Insufficient or nonmeaningful content	225	5.78%
Missing or removed page	203	5.22%
Authentication or payment required	163	4.19%

Appendix

Table 22: Final reasons for unavailable page content.

Platform	Original Webpage Content	Strong GEO Signals
YouTube	Title: Think CVTs Don’t Last? Here Are 15 Reliable Cars That Do Description: “15 Cars With CVTs That Actually Last \| The Most Reliable CVTs Ever Made” “Many drivers believe every continuously variable transmission is a disaster waiting to happen—but that’s not true. In this video, we highlight 15 cars with CVTs that actually last, backed by real-world reliability. From Toyota and Honda to Subaru and even some Nissan models, these vehicles prove not all CVTs are junk.” [...] “Are CVTs really that bad? The truth is, while some fail early with slipping belts, high repair costs, and short lifespans, others are shockingly durable—lasting well beyond 150,000–200,000 miles.” “We’ll break down: The most reliable CVT cars you can buy today; Which model years to look for (and which to avoid); How CVTs compare to traditional automatics; Simple maintenance tips (like CVT fluid changes) that make a big difference.” [...] Chapter excerpts: “Honda CR-V: 200K Miles and Still Smooth”; “Toyota Camry Hybrid: e-CVT Bulletproof Design”; “Toyota RAV4 Hybrid: The 250K-Mile Workhorse”; “Toyota Prius: Taxi Fleet Proven Reliability.”	The page covers multiple closely related informational intents, including reliable CVT models, model-year selection, transmission lifespan, maintenance, and comparisons with traditional automatics. It also contains dense entity–attribute associations : individual car models are paired with explicit reliability or longevity claims, such as “200K Miles” and “250K-Mile Workhorse.” These concise claims are easy for generative engines to extract and reuse. Moreover, the title, description, and chapter headings repeatedly provide direct, answer-like statements for likely user queries, including “most reliable CVTs,” “cars you can buy today,” and “which model years to look for.” Overall, the page combines broad query coverage with explicit and easily extractable claims, exhibiting strong GEO-style signals.
Amazon	Title: Total by Verizon $60 No-Contract Single-Device Monthly Plan Unlimited Talk, Text & Data+20 GB Hotspot About this item: “Get unlimited talk, text & data (1) plus 20 GB of hotspot data (3) and$ 10 International Calling Credit (7) and enjoy coverage on Verizon 5G Ultra-Wideband (2) with the Total by Verizon Unlimited+ Plan.” “Stay in touch with your people abroad with international talk & text to 5 countries of your choice (4), and call home on your travels with international roaming in Canada & Mexico (6). Screen and automatically block incoming spam calls with Total Spam Filter.” “Continue, upgrade, or stop service easily at any time with a monthly single device plan. Disney Premium+ (No Ads) on us (5).” [...] Product Description: “Go beyond the norm and get a premium wireless experience for less with Total by Verizon’s Unlimited+ Plan: Unlimited talk, text & data (1) monthly plan. Save on the data you crave while exploring without limits on Verizon 5G Ultra Wideband (2). Seize every day with great perks including 20GB of hotspot data (3), international talk & text to five countries of your choice (4), and Disney Premium+ (No Ads) on us (5).” [...] “(3) Use up to 20GB of non-sharable data per line for hotspot usage.” “(6) Unlimited talk and text to the US, Mexico and Canada and unlimited data when traveling in Mexico and Canada.”	The page presents a large number of explicit product–attribute associations , including price, unlimited talk/text/data, 20 GB hotspot data, 5G access, international calling, roaming, spam filtering, and bundled Disney Premium+ access. These attributes are expressed in short, self-contained statements and are repeated across the title, “About this item,” and product description. This makes the page highly suitable for direct extraction when answering specific product questions. The numbered explanations further provide fine-grained factual details , such as hotspot limits, geographic coverage, and roaming conditions. These statements can directly support queries such as how much hotspot data the plan includes or whether it works in Canada and Mexico. Overall, the page has high information density, structured attribute coverage, and many concise answer-ready statements, which together constitute strong GEO-style signals.

Appendix

Table 23: Examples of webpages with strong GEO signals. Due to copyright and space constraints, we show only representative excerpts from the original webpage content; omitted text is indicated by [...] . We then analyze the GEO-related signals exhibited by these excerpts.

Panel of Figure 8 — Figure 8: Paired-query example from the real-world audit. GEO rates are calculated over successfully retrieved usable pages.

Generative Engine Optimization

Generative Engine Optimization studies how to make web content visible, cited, and accurately represented in AI-generated search answers.

See all 40 papers

Aug 29, 2026

Agent2UCB: Agentic System for Generative Engine Optimization

Large language model driven search engines such as Google AI Overviews and Perplexity have created new opportunities for Generative Engine Optimization (GEO) the practice of refining content to increase its likelihood of being cited or summarized by generative systems. We demonstrate Agent2UCB, an agentic GEO system that autonomously improves content visibility through customized, feedback-driven optimization. For each content item, the system evaluates nine GEO strategies, identifies the most effective method, and accelerates selection using a bandit-based Agent2UCB policy that integrates LLM priors with online reward signals. To monitor side effects, the system also provides a lightweight, text-only SEO readiness evaluation covering readability, topical coverage, and EEAT-style credibility. Experiments on GEO-Bench show consistent visibility gains while preserving SEO quality. The demo allows users to choose the websites of interest, observe the optimization workflow, and compare GEO/SEO outcomes across methods.

Sheldon Yu, Rui Wang, Tong Yu +4

UC San Diego La Jolla, CA, USA · Adobe Research San Jose, CA, USA

Generative Engine Optimization Large Language Model-Guided Optimization LLM Agents

Ask PDF

Sep 2, 2026

When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.

Haozhang Li, Yangguang Shao, Xinjie Lin +3

University of the Chinese Academy of Sciences · Zhongguancun Laboratory

Generative Engine Optimization RAG Security RAG Robustness Learning to Rank

Ask PDF

Mar 10, 2026

Diagnosing and Repairing Citation Failures in Generative Engine Optimization

Generative Engine Optimization (GEO) aims to improve content visibility in AI-generated responses. However, existing methods measure contribution-how much a document influences a response-rather than citation, the mechanism that actually drives traffic back to creators. Also, these methods apply generic rewriting rules uniformly, failing to diagnose why individual document are not cited. This paper introduces a diagnostic approach to GEO that asks why a document fails to be cited and intervenes accordingly. We develop a unified framework comprising: (1) the first taxonomy of citation failure modes spanning different stages of a citation pipeline; (2) AgentGEO, an agentic system that diagnoses failures using this taxonomy, selects targeted repairs from a corresponding tool library, and iterates until citation is achieved; and (3) a document-centric benchmark evaluating whether optimizations generalize across held-out queries. AgentGEO achieves over 40% relative improvement in citation rates while modifying only 5% of content, compared to 25% for baselines. Our analysis reveals that generic optimization can harm long-tail content and some documents face challenges that optimization alone cannot fully address-findings with implications for equitable visibility in AI-mediated information access.

Zhihua Tian, Yuhan Chen, Yao Tang +2

Virginia Tech · Zhejiang University

Generative Engine Optimization Generative AI Evaluation

Ask PDF

Abstract

Generative Engine Optimization

Explore similar work

Agent2UCB: Agentic System for Generative Engine Optimization

When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

Diagnosing and Repairing Citation Failures in Generative Engine Optimization