PaperlayerView exact revision on arXiv

Source-linked AI summary

When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

Haozhang Li, Yangguang Shao, Xinjie Lin, Zhong Guan, Mi Zhou, Junzheng Shi

arXiv:2609.02964v1cs.CRcs.AI

TL;DR

Malicious GEO can manipulate citation-grounded answers while preserving factual content and exploiting features shared with benign documents. GEO Defender combines reranking and experience-guided generation; it reduces attack success while retaining benign evidence use and generalizes to unseen attacks.

  • Problem

    Malicious GEO preserves factual content while exploiting engine preferences and surface features also shared by benign documents, limiting defenses based on falsehoods or embedded instructions.

    Source: RAG Poisoning and Indirect Prompt… · p. 3

  • Method

    GEO Defender combines Shield Reranker, which demotes GEO documents, with TFSG, which uses an external natural-language experience library to guide source use without target-LLM parameter updates.

    Source: Introduction · p. 2

  • Results

    GEO Defender reduces average attack success rate from 50.32% to 6.20%, retains 94.12% of benign evidence use, and generalizes to unseen attacks from 36 construction instances.

    Source: Introduction · p. 2

  • Takeaways & Limitations

    The results show complementary effects of the two defense stages, generalization to unseen GEO methods, and cross-model experience transfer.

    Source: Conclusion · p. 7

    The threat model limits attackers to rewriting one candidate document without controlling retrieval, reranking, generation, or the target LLM.

    Source: Introduction · p. 2

Abstract

from arXiv · show

This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.

Introduction

Generative search makes evidence selection consequential, while malicious GEO can exploit engine preferences without falsifying content. GEO Defender protects both document selection and source use through two complementary stages.

Introduction

  • Generative search retrieves documents, reranks a compact evidence set, then synthesizes cited answers, making evidence-set admission a major determinant of document visibility.That selection pressure creates incentives to optimize web content, and GEO emerged in response.Source: Introduction · p. 1
  • GEO attacks can preserve factual content and exploit source preferences, leaving fact verification and perplexity filtering with little protection.The amplified features, such as statistics and citations, also characterize benign content, so filtering them can over-defend.Source: Introduction · pp. 1–2
  • The threat model lets an attacker rewrite one candidate document but not control retrieval, reranking, generation, or the target LLM; the defender leaves LLM parameters unchanged.The defense must also preserve benign evidence and answer quality while preventing attack documents from entering the evidence context and mitigating those that remain.Source: Introduction · p. 2
  • GEO Defender pairs Shield Reranker’s defensive correction over a frozen reranker with TFSG’s external experience library to regulate selection and source use.Shield Reranker demotes GEO attack documents while preserving benign ranking behavior; TFSG guides a black-box target LLM without parameter updates.Source: Introduction · p. 2
  • 50.32% to 6.20% average attack success rate; GEO Defender retains 94.12% of benign-evidence use, with negligible answer-quality change.It also generalizes to unseen attacks from 36 construction instances and supports experience transfer across target LLMs.Source: Introduction · p. 2

Related Work

Prior work studies GEO visibility optimization, manipulation of LLM-mediated search, and defenses against retrieval attacks. GEO Defender is positioned as a full-pipeline defense for factually faithful, preference-targeting attacks.

Generative Engine Optimization

  • GEO evolved from rewriting toward learned and agentic optimization, but resisting malicious use of these visibility methods remains open.Aggarwal et al. (2024) introduced GEO; later work includes preference modeling, intent-aware optimization, agentic search, and structural engineering.Source: Generative Engine Optimization · p. 2

Manipulation and Defense of LLM-Based Search

  • Search-manipulation studies show attacks across recommenders, source rankings, and production engines, while SCI-Defense detects manipulated candidates at only one attack-chain point.GEO Defender instead demotes attack documents at selection and regulates residual-document use during generation, with benign-evidence retention as an objective.Source: Manipulation and Defense of LLM-Based… · p. 2

RAG Poisoning and Indirect Prompt Injection

  • RAG defenses target falsehoods, injected instructions, or attacker-chosen answers, whereas GEO preserves facts and exploits engine presentation preferences.An effective defense must model those preferences while sparing benign documents that share attack-like surface features.Source: RAG Poisoning and Indirect Prompt… · pp. 2–3

GEO Defender

GEO Defender combines reranking and generation-stage defenses to reduce GEO attack influence while preserving useful benign evidence. Its reranker learns benign-over-attack preferences relative to a frozen base, while TFSG iteratively builds reusable source-use guidance without updating the target LLM.

Framework Overview

  • The two-stage framework demotes GEO attack documents before evidence selection, then guides the target LLM’s use of remaining evidence; the stages can operate independently or jointly.Shield Reranker acts at reranking, and TFSG acts at generation.Source: Framework Overview · p. 3

Shield Reranker

  • Shield Reranker attaches a lightweight LoRA adapter to a frozen base reranker and learns a defensive correction from a small set of construction instances.The base reranker is instantiated with Qwen3-Reranker-0.6B.Source: Shield Reranker · p. 3

Defense Preference Construction

  • Two preferences rank the original benign document and another relevant benign document above the same GEO-rewritten attack document.This extends attack demotion beyond the original–rewritten pair and preserves opportunities for other useful evidence to enter the top-k context.Source: Defense Preference Construction · p. 3

Residual Ranking Preference Optimization

  • Preference optimization increases the preferred benign document’s defensive residual relative to the attack document, while a benign-consistency constraint preserves relative ranking among benign documents.The residual measures ranking-probability change relative to the frozen base; positive values promote a document and negative values demote it.Source: Residual Ranking Preference Optimization · p. 3

Training-Free Shield Generation

  • TFSG regulates how the frozen target LLM assesses and uses evidence remaining in the top-k set, avoiding target-LLM parameter updates.Its external experience library evolves through outcome-relative feedback.Source: Training-Free Shield Generation · p. 4

Structured Experience Library

  • The experience library stores risk signals, benign counter-signals, applicability boundaries, source-use guidance, and lightweight outcome statistics.Its entries encode reusable source-use principles rather than query-specific descriptions of individual attack documents.Source: Structured Experience Library · p. 4

Outcome-Relative Experience Optimization

  • TFSG contrasts success cases, which avoid attack influence while retaining sufficient benign evidence, with failures involving residual attack, over-defense, or both.The Analyzer uses these contrasts to identify effective source-use behavior, missing risk patterns, and boundaries needing refinement.Source: Experience-Guided Generation · p. 5

Experience-Guided Generation.

  • An Analyzer proposes library revisions from contrasting outcomes, and a deterministic Controller checks their format, target entry, and operation validity before application.The Controller performs no semantic analysis and does not modify the target LLM; the resulting fixed library guides source assessment and evidence use at inference.Source: Experience-Guided Generation · p. 5

Experiments

Across seven GEO methods and five target LLMs, GEO Defender lowers attack success and influence while retaining benign evidence. Experiments also examine unseen attacks, cross-model transfer, optimization epochs, and component ablations.

Experimental Setup; Dataset

  • GEO-DefenseBench pairs top-10 benign candidate sets with variants replacing one selected document rewritten by each of seven GEO methods.Query-group splitting keeps related queries, original documents, and rewritten variants together; the construction set has 36 instances from three methods and the test set has 616 instances across seven methods.Source: Experimental Setup · p. 5, Dataset · p. 5

Target LLMs

  • Evaluation covers GPT-5.5, Claude Opus 4.8, DeepSeek-V4-Pro, Kimi K2.7 Code, and GLM-5.2.The first two are closed-source LLMs and the remaining three are open-source LLMs.Source: Dataset · p. 5, Target LLMs · p. 6

Main Results

  • 50.32% to 6.20% ASR and 35.95% to 3.89% ASI versus Non-Defense; average BER is 94.12% and answer quality falls by 0.01.PPL-Filter performs comparably to Non-Defense; Static Safety Prompt has average BER of 83.31%, versus 87.80% under Non-Defense.Source: Table 1 · p. 6, Main Results · p. 6

Baselines

  • Baselines are Non-Defense, PPL-Filter, and Static Safety Prompt; ASR and ASI measure attack use and influence, while BER tracks benign evidence use.BER is measured relative to a clean-reference answer generated with the Non-Defense pipeline.Source: Target LLMs · p. 6, Baselines · p. 6

GEO Method-wise Analysis

  • GEO Defender maintains broadly consistent performance on seen and unseen GEO methods, with substantial protection against all seven methods across five target LLMs.Performance on GEO and RAID-GSEO is comparable to seen methods, while GEO-SFE and IF-GEO show greater variation.Source: GEO Method-wise Analysis · p. 6, Figure 3 · p. 7

TFSG Transferability Analysis

  • Across source–target LLM pairs, transferred TFSG libraries yield 4.06%–9.09% ASR and 2.23%–5.40% ASI, well below corresponding Non-Defense results.The DeepSeek-V4-Pro library reduces Claude Opus 4.8’s ASR from 5.52% to 4.06% and ASI from 3.08% to 2.23%.Source: Figure 4 · p. 7, TFSG Transferability Analysis · p. 7

Experience Optimization Analysis

  • The first TFSG optimization epoch produces the largest ASR and ASI reductions; later updates are smaller and occasionally non-monotonic.Final libraries consistently outperform no-library configurations within only a few optimization epochs.Source: Figure 5 · p. 7, Experience Optimization Analysis · p. 7

Ablation Study

  • On GPT-5.5, the complete system achieves 5.03% ASR, 3.13% ASI, and 86.68% BER, while Shield Reranker and TFSG alone each reduce attack measures.Shield Reranker alone yields 10.06% ASR, 6.57% ASI, and 98.79% BER; TFSG alone yields 10.39% ASR and 5.28% ASI, with lower BER reflecting more conservative evidence use.Source: Table 2 · p. 7, Ablation Study · p. 7

Conclusion

GEO Defender combines reranking and generation defenses against malicious GEO without updating the target LLM. Across seven GEO methods and five target LLMs, it reduces attack effects while preserving benign evidence and answer quality.

Conclusion

  • Across seven GEO methods and five target LLMs, GEO Defender reduces attack success and semantic influence while preserving benign evidence and answer quality.The conclusion also reports generalization to unseen GEO methods, cross-model experience transfer, and complementary effects of the two defense stages.Source: Conclusion · p. 7
  • Shield Reranker demotes GEO attack documents, while TFSG uses an external experience library to regulate source use without updating the target LLM.Source: Conclusion · p. 7
  • The results establish generalization to unseen GEO methods, cross-model experience transfer, and complementary effects of the two defense stages.Source: Conclusion · p. 7

A Method Details

This section details how Shield Reranker learns preferences against GEO-rewritten documents and how TFSG builds, evolves, and applies an experience library to guide source use. It also covers construction-time diagnostics, controlled library updates, and non-defense and static-safety prompt baselines.

A.1.1 Construction Instances and Ranking Preferences

  • The reranker contrasts aligned original and GEO-rewritten documents, then uses another relevant benign document to ensure the attack is not the only dispreferred evidence.The two preferences reverse the rewrite’s ranking advantage and encourage other relevant benign evidence to outrank the attack.Source: §A.1.1 · p. 10

A.1.3 Optimization configuration

  • At inference, Shield Reranker scores ten candidates independently, sorts them, and passes the Top-5 documents to the target LLM.Only LoRA parameters are updated; the base-model weights remain frozen. The base model is Qwen3-Reranker-0.6B, whose scalar score is the final-token logit margin for a binary relevance judgment.Source: §A.1.3 · p. 10, §A.1.2 · p. 10

A.2.1 Experience representation

  • TFSG separates source reliability from answer citation: keep permits normal evidence, suspicious_keep limits a source to fallback or secondary use, and filter excludes it.A kept document need not be cited, so reliability judgments remain distinct from answer coverage.Source: §A.2.1 · p. 11, §A.3.1 · p. 13

A.2.2 Cold start and optimization schedule

  • TFSG bootstraps its library with six controlled contrast instances, then processes the remaining 30 of 36 construction instances in three batches of ten.The cold-start contrasts successful attack avoidance with over-defense and a keep-all control; attack labels and method names are withheld from the target-LLM input.Source: §A.2.2 · pp. 11–12, §A.3.3 · p. 15

A.2.3 Diagnostic Interfaces

  • During construction, TFSG gathers structured source decisions and evidence diagnostics, or for DeepSeek-V4-Pro retains its separately returned reasoning_content as diagnostic evidence.These model-provided diagnostics support library analysis but are not treated as faithful accounts of latent computation; the structured diagnostic prompt is used only during construction.Source: §A.2.3 · p. 12, §A.3.1 · p. 12, §A.3.2 · pp. 14–15

A.2.4 Outcome-relative feedback and update semantics

  • After each batch, the Analyzer contrasts successful defenses with residual-attack and over-defense cases, and a validating Controller applies incremental library updates.Updates aim to refine decision boundaries and balance attack-pattern rules, benign guards, and suspicious_keep rather than over-filtering or adding many narrow rules.Source: §A.2.4 · p. 12, §A.3.4 · p. 17

A.2.5 Experience-Guided Inference

  • At test time, the fixed experience library accompanies the query and Shield Reranker’s Top-5 documents in a single target-LLM generation call, with no construction-time analysis or updates.For DeepSeek-V4-Pro, reasoning content is retained during construction to analyze citation-success and citation-failure cases; it is not an additional test-time generation step.Source: §A.2.5 · p. 12, §A.3.5 · p. 18

A.3.5 Batch-Level Evolution from Reasoning Content

  • Library updates use reasoning traces as source-selection evidence, favor modifying or merging general rules, and add false-positive guards only when benign evidence supports them.Rules should guide citation choice without forcing unnecessary source removal.Source: §A.3.5 · pp. 18–19

A.3.6 Experience-Guided Inference Prompt

  • After library optimization, inference uses a fixed experience library and returns only the cited answer, while construction retains reasoning_content as diagnostic evidence for library updates.The construction and inference prompts are textually identical, but their API outputs are used differently.Source: §A.3.6 · p. 20, Experience-Guided Inference Prompt · p. 21

Experience-Guided Inference Prompt

  • Before citation, the inference prompt assigns each source a separate reliability decision: keep, suspicious_keep, or filter, without requiring reliable sources to be cited.Suspicious sources are normally not used unless needed to support the answer; decisions must rely only on search-result text and the experience library.Source: Experience-Guided Inference Prompt · p. 20

A.3.7 Non-Defense Prompt

  • The non-defense baseline uses a standard answer-generation template that requests concise, supported answers with inline citations and returns JSON containing the answer.It supplies the query and search results without the experience-library guidance.Source: §A.3.7 · p. 21

A.3.8 Static Safety Prompt

  • The static-safety prompt adds guidance to scrutinize manipulative presentation, seek corroboration, avoid sole reliance on suspicious results, and not favor polished or comprehensive wording alone.The assessment is not to be mentioned in the final answer.Source: §A.3.8 · p. 21

B Experimental Details

The experiments use query-group-based construction and splitting, with hidden attack metadata excluded from target-LLM prompts. Clean references measure benign-evidence retention and answer-quality change but do not guide inference.

B.1.1 Instance construction

  • The benchmark samples 100 query groups from GEO-Bench and creates seven attack-injected instances per query, each containing one rewritten document and nine benign documents.Table B.1 is identified as the composition of GEO-DefenseBench; its caption alone does not establish further composition details.Source: §B.1.1 · pp. 21–22, Table B.1 · p. 22

B.1.1 Instance construction; B.1.2 Leakage control

  • The test set combines three seen and four construction-unseen GEO methods, while query-group splitting keeps each query, original list, source, and rewrites within one split.This prevents queries or original documents from appearing across construction and test sets, including construction-source rewrites.Source: §B.1.1 · p. 22, §B.1.2 · p. 22

B.1.2 Leakage control

  • Target-LLM prompts omit attack labels, method names, source/target identities, and split information, retaining hidden attack metadata only for construction feedback and evaluation.Source: §B.1.2 · p. 22

B.1.3 Clean-reference condition

  • Matched clean instances provide references for measuring benign-evidence retention and answer-quality change, but those answers do not guide GEO Defender at inference.Source: §B.1.3 · p. 22

B.2 Implementation and Evaluation Protocol

Evaluation uses five target LLMs with controlled inputs and decoding settings within each model. The protocol provides full document text without a character-level excerpt limit.

B.2 Implementation and Evaluation Protocol

  • The evaluation covers GPT-5.5, Claude Opus 4.8, DeepSeek-V4-Pro, Kimi K2.7 Code, and GLM-5.2.Source: §B.2.1 · p. 22
  • For each target LLM, methods share the same query and candidate-document text, document order after selection, and answer format.Source: §B.2.1 · p. 22
  • Evaluation provides full document text without a character-level excerpt limit and holds decoding settings fixed across conditions within each target LLM.Source: §B.2.1 · p. 22

B.2.2 PPL-Filter

PPL-Filter uses GPT-2 perplexity with a threshold calibrated on benign construction documents, then demotes flagged candidates while preserving the base-reranker order. It provides only a weak signal for detecting fact-preserving GEO rewrites and also flags many benign documents.

B.2.2 PPL-Filter

  • PPL-Filter scores documents with GPT-2 perplexity using a sliding-window evaluation and calibrates its threshold exclusively on 120 benign documents from 12 construction queries.Source: §B.2.2 · p. 22
  • Flagged candidates are placed after unflagged candidates without changing within-group base-reranker order, and the top five are selected, with deterministic fallback when fewer than five survive.Source: §B.2.2 · p. 22
  • Only 15 of 616 attack documents were flagged; filtering yielded a net reduction of four exposed attacks while flagging 252 benign documents.It removed eight attack documents but introduced four previously lower-ranked attacks after filtering.Source: §B.2.2 · p. 22, Table B.2 · p. 23

B.2.3 Metric definitions

The section defines attack success, attack-document influence, and benign-evidence retention as evaluation measures. Its supplied passages describe the ASI rubric and BER interpretation, while the ASR definition is only partially shown.

B.2.3 Metric definitions

  • ASR is defined over 616 test instances using each instance’s attack-document index and the set of documents cited by its generated answer.The supplied passage introduces these quantities but does not show the complete definition.Source: §B.2.3 · p. 23
  • ASI scores attack-document influence from 0 to 4, from no use or influence to an answer dominated by the document’s content or framing.The rubric emphasizes substantive influence, including support for central claims, multiple claims, distinctive details, or answer organization.Source: §B.2.3 · p. 23
  • BER compares the number of benign documents cited by a method with the corresponding count in the clean-reference answer; values above 100% do not by themselves imply higher answer quality.Source: §B.2.3 · p. 23

B.2.4 Answer-Quality Evaluation

Answer quality is evaluated by anonymous pairwise comparisons between GEO Defender answers and matched clean-reference answers. The protocol balances answer order and reports quality changes and comparison proportions with query-cluster bootstrap intervals.

B.2.4 Answer-Quality Evaluation

  • GEO Defender answers are compared with matched clean-reference answers on correctness, relevance, completeness, informativeness, clarity, and concision, while citation indices are ignored.Source: §B.2.4 · p. 24
  • The evaluation balances answer position at 308 Answer A and 308 Answer B comparisons per target LLM, then orients each score toward GEO Defender on a −2 to 2 scale.Zero denotes comparable quality, negative values indicate worse defended answers, and positive values indicate better defended answers.Source: §B.2.4 · p. 24
  • The study reports mean relative quality change and the shares judged comparable-or-better or better, with confidence intervals from 10,000 bootstrap resamples over 88 query clusters.Each resample keeps the seven GEO variants of a query together.Source: §B.2.4 · p. 24

C.1 Answer-Quality Evaluation

Pairwise evaluation finds nearly unchanged answer quality for GEO Defender relative to matched clean references. The accompanying transfer matrices organize attack-success and attack-influence results by source and target LLM.

C.1 Answer-Quality Evaluation

  • −0.01 macro-average change indicates defended answers are nearly indistinguishable in quality from clean references; 70.45%–76.79% are judged comparable or better.Except for GPT-5.5, confidence intervals include zero, providing no evidence of a systematic quality difference; overall, attack-success reductions accompany negligible average quality change.Source: §C.1 · p. 25, Table C.1 · p. 25

C.2 Complete Cross-Model Transfer Matrices

  • Transfer-matrix rows identify the experience-library source LLM and columns the target LLM; panels report ASR and ASI, with lower values indicating stronger defense.Diagonal entries represent each target LLM’s native library.Source: §C.2 · p. 25, Table C.2 · p. 25
Loading 2609.02964v1…