When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

Haozhang Li; Yangguang Shao; Xinjie Lin; Zhong Guan; Mi Zhou; Junzheng Shi

cs.CRSep 2, 2026

When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

Authors: Haozhang Li, Yangguang Shao, Xinjie Lin, Zhong Guan, Mi Zhou, Junzheng Shi

Organizations: University of the Chinese Academy of Sciences · Zhongguancun Laboratory

Abstract

This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.

Figures & tables

Figure 1: Overview of generative search and malicious GEO manipulation, where an attacker optimizes a selected document to increase its citation exposure and influence on the generated answer.

Figure 2: Overview of GEO Defender. The upper panel contrasts the standard pipeline with defended inference: Shield Reranker demotes GEO attack documents before top- $k$ evidence selection, and the fixed TFSG experience library guides the target LLM to reduce residual attack influence while retaining benign evidence. The lower panel summarizes defense construction. Shield Reranker learns benign-over-attack ranking preferences. TFSG contrasts defense failures and successes to iteratively optimize the external experience library without updating the target LLM parameters.

	Non-Defense			PPL-Filter			Static Safety Prompt			GEO Defender (Ours)
Target LLM	ASR $\downarrow$	ASI $\downarrow$	BER $\uparrow$	ASR $\downarrow$	ASI $\downarrow$	BER $\uparrow$	ASR $\downarrow$	ASI $\downarrow$	BER $\uparrow$	ASR $\downarrow$	ASI $\downarrow$	BER $\uparrow$
Closed-source LLMs
GPT-5.5	45.45	31.13	89.66	43.67	29.42	87.44	36.36	20.86	71.67	5.03	3.13	86.68
Claude Opus 4.8	52.92	38.72	88.75	53.08	39.81	88.03	48.38	34.86	87.91	5.52	3.08	105.25
Open-source LLMs
DeepSeek-V4-Pro	49.35	33.32	86.16	48.86	33.48	86.12	49.03	33.00	84.78	5.19	2.88	87.19

Table 1: End-to-end comparison of Non-Defense, PPL-Filter, Static Safety Prompt, and GEO Defender on GEO-DefenseBench across five target LLMs. ASR and ASI measure attack success and semantic influence, respectively, while BER measures the use of benign evidence relative to the clean-reference condition. Lower ASR and ASI and higher BER indicate better performance.

Figure 3: Generalization across seven GEO methods and five target LLMs. Panel (a) reports Attack Defense Success (

100\%-\mathrm{ASR}

), Panel (b) reports Attack Influence Reduction, computed as the relative ASI reduction from Non-Defense. Solid and dashed lines denote seen and unseen GEO methods, respectively. Higher values indicate stronger defense.

Figure 4: Cross-model transferability of TFSG experience libraries. Rows denote the source LLM used to construct the library, and columns denote the target LLM to which it is applied. Panels (a) and (b) report ASR and ASI, respectively; lower values indicate stronger defense.

Figure 5: ASR and ASI across TFSG experience-library optimization epochs for five target LLMs.

Method	ASR $\downarrow$	ASI $\downarrow$	BER $\uparrow$
Non-Defense	45.45	31.13	89.66
Shield Reranker only	10.06	6.57	98.79
TFSG only	10.39	5.28	77.99
GEO Defender	5.03	3.13	86.68

Table 2: Module ablation of GEO Defender on GPT-5.5. Shield Reranker only uses standard generation, whereas TFSG only retains the base reranker.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Setting
Base reranker	Qwen3-Reranker-0.6B
Parameter-efficient adaptation	LoRA
LoRA rank / scaling / dropout	$16$ / $32$ / $0.05$
LoRA target modules	query, key, value, and output projections; gate, up, and down projections
Quantized loading	4-bit
Internal construction split	80% optimization / 20% monitoring

Appendix

Table A.1: Shield Reranker optimization configuration.

Field	Meaning
rule_id	Stable identifier used for attribution and updates.
rule_type	One of attack_pattern , fp_guard , decision_boundary , or coverage_policy .
description	Concise natural-language source-use principle.
trigger_signals	Visible signals supporting cautious or restrictive source use.
benign_counter_signals	Visible counter-evidence that protects benign sources from over-filtering.
apply_when , avoid_when	Applicability conditions and explicit boundaries.

Appendix

Table A.2: Fields of an experience-library entry.

Epoch	Input library	Cases	Output library
0	Empty state	–	$\mathcal{E}_{0}=\varnothing$
1	$\mathcal{E}_{0}$	6 controlled contrast cases	$\mathcal{E}_{1}$
2	$\mathcal{E}_{1}$	10 cases	$\mathcal{E}_{2}$
3	$\mathcal{E}_{2}$	10 cases	$\mathcal{E}_{3}$
4	$\mathcal{E}_{3}$	10 cases	$\mathcal{E}_{4}=\mathcal{E}_{T}$

Appendix

Table A.3: TFSG construction schedule. “Cases” denotes newly processed construction instances at each update.

Split	Query groups	GEO methods	Attack-injected instances
Construction	12	3	36
Test	88	7	616
Total	100	7	652

Appendix

Table B.1: Composition of GEO-DefenseBench.

Statistic	Value
Test instances	616
Attack documents in the base-reranker Top-5	345
Attack documents flagged by PPL	15
Attack documents in the PPL-Filter Top-5	341
Attack documents removed from the Top-5	8
Attack documents newly introduced into the Top-5	4

Appendix

Table B.2: PPL-Filter diagnostics on the complete test set.

Target LLM	Mean change	95% CI	Comparable or better (%)	Better (%)
GPT-5.5	$-0.12$	$[-0.21,-0.03]$	74.03	15.26
Claude Opus 4.8	$-0.01$	$[-0.10,0.08]$	76.62	23.05
DeepSeek-V4-Pro	$+0.08$	$[-0.02,0.18]$	76.79	32.63
Kimi K2.7 Code	$-0.05$	$[-0.13,0.03]$	70.45	24.84
GLM-5.2	$+0.06$	$[-0.03,0.15]$	76.46	30.36
Macro average	$-0.01$	–	74.87	25.23

Appendix

Table C.1: Pairwise answer-quality comparison with matched clean-reference answers. Mean change is measured on a

[-2,2]

scale after orienting each comparison toward GEO Defender; zero denotes comparable quality. The final two columns report the percentages of defended answers judged comparable or better and strictly better, respectively.

Generative Engine Optimization

Generative Engine Optimization studies how to make web content visible, cited, and accurately represented in AI-generated search answers.

See all 40 papers

GEO-Flag: Detecting and Measuring GEO-Optimized Web Content
Aug 17, 2026Junjie Chu, Ye Leng, Mingjie Li +3Generative Engine Optimization IR Evaluation
CISPA Helmholtz Center for Information Security · HPE · University of Waterloo
GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization
May 27, 2026Ojas Nimase, Zhe Chen, Yue Zhao +1Generative Engine Optimization Adversarial Attacks
University of Southern California · Arizona State University
SCI-Defense: Detecting Persuasion-Structured Manipulation of LLM-Based Ranking in Generative Engines
May 21, 2026Xucheng Yu, Haibo Jin, Huimin Zeng +1LLM Reranking Adversarial Example Detection
Siebel School of Computing and Data Science, University of Illinois Urbana-Champaign · School of Information Sciences, University of Illinois Urbana-Champaign · Amazon

Aug 17, 2026J/K move · Enter open · S save

GEO-Flag: Detecting and Measuring GEO-Optimized Web Content

Junjie Chu, Ye Leng, Mingjie Li, Yun Shen+2

CISPA Helmholtz Center for Information Security · HPE · University of Waterloo

Generative Engine Optimization IR Evaluation

Open paper AskPDF arXiv

Generative Engine Optimization (GEO) modifies web content to increase its likelihood of being selected and cited by generative search engines. This can give strategically optimized pages visibility disproportionate to their authority or relevance and even make weak or false information appear well supported. Unlike conventional search, generative search synthesizes information into direct answers rather than presenting competing sources, which can further amplify these risks, as assessing source provenance and authority requires additional user interaction. Despite these concerns, systematic methods for detecting GEO-optimized webpages remain underexplored. We introduce GEOFlagBench, a benchmark of 3,200 web content instances spanning 400 queries, four domains, and eight GEO optimizer families, and use it to systematically evaluate existing GEO detection methods. Although the strongest baseline achieves an aggregate F1 of 0.880, method-level and authorship-conditioned evaluations reveal substantial weaknesses and potential reliance on authorship-related shortcuts. We therefore propose Intervention-Paired Training (IPT), which supervises detector responses to GEO interventions and non-GEO AI polishing; on ModernBERT, IPT improves F1 from 0.862 to 0.944 and worst-group accuracy from 0.725 to 0.883. We develop a GEO-gated Agent system for auditing the Source Tier and verifiability of Citation URLs in detected GEO pages. Finally, we deploy the complete pipeline on released Google Search and Gemini-grounded retrieval results for 1,000 real-user queries. Across 10,095 available pages, we estimate an overall GEO prevalence of 8.90%, reaching 16.36% among pages modified in 2026. Our results establish a foundation for systematically detecting, auditing, and measuring GEO in real-world search ecosystems.

Abstract

Generative Engine Optimization

Explore similar work

GEO-Flag: Detecting and Measuring GEO-Optimized Web Content

GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization

SCI-Defense: Detecting Persuasion-Structured Manipulation of LLM-Based Ranking in Generative Engines