PaperlayerView exact revision on arXiv

Source-linked AI summary

Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization

Bing Zheng, Zongyao Zhao, Wenming Yang

arXiv:2609.02316v1cs.IRcs.CLcs.CR

TL;DR

GEO can make targeted misinformation appear as fluent informational content that generative search systems retrieve and synthesize, while existing controlled defense benchmarks are absent. The paper introduces Counter-GEO-Bench with paired rewrites and evaluates defenses across three victim LLMs. Off-the-shelf guardrails provide limited protection, whereas C-GEO Guard substantially reduces attacks with near-zero utility loss.

  • Problem

    No existing benchmark evaluates defenses against GEO-optimized misinformation under controlled conditions with paired utility measurements.

  • Method

    Counter-GEO-Bench pairs 247 human-verified queries with information-preserving and information-distorting rewrites and evaluates defenses across three victim LLMs.

  • Results

    C-GEO Guard reduces ASR by 47.6% relative with near-zero utility loss, while off-the-shelf defenses reduce ASR by no more than 3.2 percentage points.

  • Takeaways & Limitations

    The results show that GEO misinformation is poorly handled by standard guardrails but tractable with a lightweight contrastive chunk-level detector.

  • Takeaways & Limitations

    The evaluation covers 247 English queries and three open-weight LLMs, excluding proprietary models and commercial end-to-end products.

Abstract

from arXiv · show

Generative engine optimization (GEO) enables content producers to increase the visibility of their web pages in generative search engines, but the same techniques can deliver targeted misinformation when adversaries publish ordinary-looking GEO-optimized documents that victim large language models (LLMs) retrieve and synthesize into distorted answers. No existing benchmark evaluates defenses against this threat under controlled conditions. Therefore, we present Counter-GEO-Bench, a defense benchmark that pairs 247 human-verified, quality-gated queries with information-preserving and information-distorting GEO rewrites, and evaluates defenses on attack success rate (ASR), false positive rate, and answer quality across three victim LLMs. Under Counter-GEO-Bench, three off-the-shelf defenses (Granite Guardian, Llama Guard 3, and NeMo Self-Check Fact-Checking) reduce ASR by at most 5.7% relative, while Granite Guardian's reduction is not statistically significant. Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content. To this end, a lightweight benchmark baseline, C-GEO Guard, is proposed, reducing ASR by 47.6% relative with near-zero utility loss, which proves threat tractable.

1 Introduction

GEO techniques can turn ordinary-looking web documents into vehicles for targeted misinformation that generative search systems retrieve and synthesize. Counter-GEO-Bench addresses the lack of controlled defenses evaluation, showing weak off-the-shelf protection but substantial gains from C-GEO Guard.

  • GEO-optimized documents can embed targeted false claims in fluent, topical prose that enters retrieval pipelines and is synthesized into trustworthy-looking LLM answers.
  • No existing benchmark evaluates defenses against GEO-optimized misinformation after retrieval under controlled conditions with paired utility measurements.
  • Counter-GEO-Bench provides 247 human-verified queries with paired information-preserving and information-distorting rewrites, evaluated across three victim LLMs.
  • No baseline defense reduces ASR by more than 3.2 percentage points; Granite Guardian’s reduction is not statistically significant, while NeMo Self-Check blocks clean queries while passing misinformation.
  • C-GEO Guard reduces ASR by 47.6% relative with near-zero utility loss, demonstrating that the threat is tractable.

2 Related Work

Prior work establishes GEO visibility attacks, retrieval poisoning, safety guardrails, and security benchmarks, but does not provide a focused defense benchmark for information-distorting GEO. Counter-GEO-Bench builds on GEO-Bench to evaluate this threat with paired utility measurements and a reusable defense harness.

  • Generative Engine Optimization: GEO uses structural and stylistic optimization to increase visibility in LLM-generated answers, while neural rankers can exhibit exploitable positional biases.
  • Generative Engine Optimization: Traditional black-hat SEO is largely blocked at retrieval, but LLM-oriented tactics can still reach the summarization stage.
  • Retrieval-Augmented Generation Poisoning: Retrieval-poisoning studies show that adversarial documents and injected content can manipulate retrievers, rerankers, relevance judges, and RAG outputs.
  • Safety Guardrails: Selected guardrails target harm criteria, safety-taxonomy violations, or answer grounding rather than fluent factual distortion in retrieved documents.
  • Security Benchmarks: Existing security benchmarks cover automated red-teaming, prompt injection, adversarial queries, unsafe search summaries, and adversarial factoid questions.

3 Benchmark Design

The benchmark pairs realistic information-preserving and information-distorting rewrites within a controlled retrieval-to-synthesis harness. It measures attack success, false positives, accuracy, and answer quality while distinguishing chunk-level defenses from answer-level checking.

  • Threat Model: The threat model assumes a black-box attacker controls GEO-optimized web content while the user query remains benign and the downstream search pipeline remains uncontrolled.
  • Benchmark Construction: The construction process rewrites one target source into information-preserving and information-distorting conditions while leaving the other sources unchanged.
  • Benchmark Construction: The paired design isolates misinformation effects from GEO visibility effects because both rewrites derive from the same source and query.
  • Quality Gates: A geometric-mean quality score combines embedding similarity, length deviation, perplexity ratio, and judged naturalness; the joint pass rate is 25.0%.Only rewrites with Q ≥0.65 enter the benchmark, reducing the chance that templatelike text inflates attack results.
  • Human Verification: Human verification removes three defective cases from 250 quality-gated queries, producing N=247 benchmark instances.
  • Generative Search Harness: The harness chunks five sources, retrieves with hybrid BM25 and dense search, reranks candidates, and generates citation-mandatory answers with a victim LLM.
  • Evaluation Metrics: ASR scores whether answers assert the false claim, FPR measures incorrect filtering or refusals on clean and IP conditions, and accuracy scores correctness on clean and IP answers.
  • Defense Configurations: Granite Guardian, Llama Guard 3, and C-GEO Guard filter retrieved chunks, whereas NeMo Self-Check Fact-Checking checks generated answers as an output rail.

4 Defense Methods

The benchmark compares three off-the-shelf guardrails with C-GEO Guard, a lightweight detector designed specifically for information-distorting GEO rewrites. C-GEO Guard uses chunk embeddings, class centroids, contrastive training, and a similarity threshold to distinguish manipulated text from legitimate optimization and clean content.

  • Off-the-shelf guardrails: Granite Guardian, Llama Guard 3, and NeMo Self-Check provide off-the-shelf defenses against information-distorting GEO.Granite Guardian and Llama Guard 3 filter retrieved chunks, whereas NeMo checks the victim model’s generated answer against retrieved evidence.
  • C-GEO Guard: C-GEO Guard is a lightweight chunk-level detector trained to distinguish information-distorting rewrites from paired information-preserving rewrites and clean text.Its purpose is to make the benchmark actionable by providing a GEO-aware reference defense.
  • Architecture: C-GEO Guard builds 768-dimensional L2-normalized chunk embeddings with a 184M-parameter DeBERTa-v3-base encoder and computes one prototype centroid for each attack class.Multi-label documents contribute chunks to every assigned class centroid.
  • Detection rule: At inference, a candidate chunk is blocked when its maximum cosine similarity to any attack-class centroid reaches the threshold τ.The score is score(e) = max_k e^T c_k.
  • Training: Contrastive training treats information-distorting chunks as positives and paired information-preserving, borderline, and clean chunks as negatives.The training pool includes 293 positive documents after holding out 10% of the assembled positives for threshold calibration.

5 Experiments

The controlled evaluation measures attack success, answer quality, false positives, and accuracy across shared defense conditions and three victim models. Off-the-shelf guardrails remain near the undefended baseline, while C-GEO Guard substantially reduces attack success with stable answer quality and transfers to GPT 5.5 rewrites.

  • Evaluation design: The evaluation uses a shared 247-query harness across three victim models, varying only the defense intervention.ASR is measured on information-distorting inputs, while false positives and accuracy are measured on clean and information-preserving inputs.
  • Baseline: The undefended pipeline reaches 55.7% average ASR across three victim models.The 95% confidence interval is [53.1, 58.2], meaning more than half of quality-gated attacks shift answers toward the targeted false claim.
  • Off-the-shelf results: Off-the-shelf guardrails reduce average ASR by at most 3.2 percentage points, with Granite Guardian’s 1.7-point reduction not statistically significant.Llama Guard 3’s 3.2-point reduction is significant but operationally negligible; NeMo exhibits condition-dependent refusal behavior and is excluded for Llama-4 because it blocks 98.4% of clean outputs.
  • C-GEO Guard results: C-GEO Guard reduces average ASR by 47.6% relative, or 26.5 percentage points absolute, with p<0.001.On Llama-4, ASR falls from 54.7% to 27.5%, a 49.7% relative reduction.
  • Utility and intervention: C-GEO-defended answers average 4.48 on the 1–5 quality scale versus 4.49 undefended.C-GEO Guard blocks 10.3% of information-distorting chunks while flagging 2.3% of clean chunks and 2.2% of information-preserving chunks.
  • Cross-rewriter transfer: On GPT 5.5 rewrites, C-GEO Guard reduces ASR from 55.7% to 22.1%, a 60.4% relative reduction.The experiment uses a fixed threshold selected on the original calibration set and Qwen-3.5 as the victim; IP accuracy decreases from 86.8% to 82.6%.

6 Analysis

Additional tests examine transfer to an independently written attack template and expose model disagreement, defense amplification, and self-checking failures. C-GEO Guard detects manipulation beyond the original template, but its reduction is smaller under weaker attack constraints.

  • Independent-template transfer: Under an independently written GPT 5.5 template, C-GEO Guard achieves a 32.0% relative ASR reduction, or 16.2 percentage points.Under the original Sonnet template, the reduction is 47.4%; IP accuracy improves by 1.3 percentage points with the independent template.
  • Independent-template transfer: The smaller reduction under the independent template may reflect weaker attack constraints, including no requirement to repeat the false claim at least three times.The results suggest the detector recognizes manipulation patterns beyond the original template structure.
  • Cross-model variation: Only 17.2% of queries produce full-success attacks across all three victims, while 55.2% show model disagreement.The paired clean, information-preserving, and information-distorting design exposes failure modes that attack-only or single-model evaluations would miss.
  • Defense amplification: On Llama-4, removing clean chunks that contradict the false claim eliminates cross-source disagreement and strengthens the attack.This behavior shows how a safety-taxonomy filter can amplify a topically legitimate misinformation attack.
  • Anticorrelated self-checking: NeMo blocks 12 clean queries but only 8 information-distorting queries on Qwen, while blocking 98.4% of all queries on Llama-4.Without paired conditions, its 0.4% Llama-4 ASR would appear effective despite near-total refusal.
  • Quality relationship: Undefended answers with ASR =1.0 score 4.29 on the quality composite, compared with 4.70 for answers with ASR =0.0.The paper suggests that false-claim commitment narrows responses and suppresses balanced hedging.
  • Quality relationship: On Llama-4, 40 fully flipped queries gain +0.70 relevance, +0.70 completeness, and +0.58 clarity after C-GEO Guard changes ASR from 1.0 to 0.0.Residual attacks that remain at ASR =1.0 have lower quality than blocked attacks, scoring 3.97 versus 4.47.

7 Discussion

The reusable construction pipeline separates malicious GEO manipulation from benign optimization and supports local defense-data generation. Residual attacks remain difficult when rewrites closely resemble ordinary source documents.

  • Construction pipeline as a reusable resource: C-GEO Guard reuses information-preserving rewrites as hard negatives and quality-gated information-distorting rewrites as positives.This training design separates malicious GEO manipulation from benign optimization on the same source material.
  • Construction pipeline as a reusable resource: 48% relative ASR reduction on the main benchmark and 60.4% on GPT 5.5 rewrites suggest the detector signal is not limited to Sonnet wording.
  • Residual attacks and future directions: Twenty-five queries achieve ASR =1.0 across all three models and all non-C-GEO defenses.These residual cases occur despite quality-gated rewrites designed to resemble ordinary source documents.
  • Residual attacks and future directions: C-GEO Guard catches 36–40% of the residual attacks per model, leaving cases for stronger defenses such as provenance filtering or external fact verification.

8 Conclusion

The paper introduces Counter-GEO-Bench to evaluate defenses against information-distorting GEO and finds that standard guardrails are insufficient. C-GEO Guard makes the threat tractable by reducing attack success without measurable utility loss and transferring to a held-out rewriter.

  • 8 Conclusion: Counter-GEO-Bench evaluates information-distorting GEO defenses across three victim LLMs, with off-the-shelf guardrails reducing ASR by no more than 3.2 pp.
  • 8 Conclusion: Granite Guardian’s ASR reduction is not statistically significant, showing that safety-taxonomy filters and same-context entailment checks are insufficient for GEO misinformation.
  • 8 Conclusion: 48% relative ASR reduction, or 27 pp absolute, without measurable utility loss demonstrates that the threat is tractable with a lightweight contrastive chunk-level detector.
  • 8 Conclusion: 60.4% relative ASR reduction on a held-out rewriter indicates transfer beyond the original rewriting setting.

Limitations

The evaluation is limited in scale, model coverage, and attack adaptivity. Its English-only benchmark, open-weight victims, single-document threat model, and fixed taxonomy constrain the scope of the conclusions.

  • Scale and scope: The 247-query English-only set detects the 27 pp ASR gap but may underpower smaller contrasts and excludes multilingual and domain-specific evaluations.
  • Scale and scope: The threat model assumes single-document control, while coordinated multidocument attacks remain unstudied and may raise ASR further.
  • Victim model coverage: The study evaluates three open-weight LLMs but excludes proprietary APIs and end-to-end commercial products, so it makes no product-level claims.
  • Adaptive and open-set attacks: Open-set attacks beyond the eight-class taxonomy and detector-aware attacks are not studied; manual editing, style transfer, or detector-aware prompting could weaken C-GEO Guard’s signal.

Ethics Statement

The ethics statement governs the release of misinformation-containing benchmark materials through gated defensive-research access. It defines separate information-preserving and information-distorting rewrite contracts and quality-gates benchmark inclusion.

  • Release and responsible use: The benchmark and trained guard weights are released through gated Hugging Face repositories for defensive research and evaluation, while the code uses the Apache License 2.0.
  • Release and responsible use: Released false claims are language-model-generated and do not represent the authors’ advice or views; original source documents are excluded.
  • Rewrite contracts: Information-preserving rewrites may restructure and clarify source material but cannot alter factual claims, names, dates, numbers, quotations, or relationships.
  • Rewrite contracts: Information-distorting rewrites must fabricate authorities, citations, statistics, or related signals and place the target false claim in at least three varied locations.
  • Quality control: The quality gate combines embedding similarity, length deviation, perplexity ratio, and LLM-judged naturalness, admitting rewrites only when Q ≥0.65.
  • Query coverage: The 247 evaluation queries cover 17 inherited content categories, with medicine/health, law/legal, and entertainment most represented.

D Judge Validation

The evaluation validates judge agreement and shows that off-the-shelf guardrails provide limited or misleading protection, whereas C-GEO Guard substantially reduces attack success with modest utility costs.

  • Judge validation: κ=0.778 Fleiss’ agreement indicates substantial consistency across the two human annotators and Opus judge.Human–human agreement was κ=0.727, while Opus–human agreement was κ=0.739 and 0.869.
  • Judge validation: All rater disagreements were adjacent rubric levels, with no 0.0-versus-1.0 reversals.This means weighted agreement differences reflected partial-versus-neighboring judgments rather than failures being confused with full attack success.
  • Off-the-shelf defenses: 98.4% clean-query blocking makes NeMo’s low Llama-4 ASR a refusal artifact rather than effective attack filtering.On Qwen, NeMo blocks 3.24% of ID queries but 4.86% of clean queries, indicating anticorrelation with attack presence.
  • Quality-gate sensitivity: C-GEO Guard’s relative reduction remains within 58–61% across quality thresholds, indicating robustness to quality-gate selection.Higher-quality rewrites strengthen undefended attacks, but the defense’s relative effectiveness remains stable.
Loading 2609.02316v1…