PaperlayerView exact revision on arXiv

Source-linked AI summary

From Public Posts to AI-Search Citations: Measuring the Fragility of AI Search

Qi Liu, Geng Hong, Xinyang Zhang, Pei Chen, Yutong Li, Min Yang

arXiv:2610.11932v1cs.CR

TL;DR

AI-search platforms select sources before users see synthesized answers, but citation selection and changing web content make publication-to-citation paths difficult to measure. This paper maps citations and publication barriers, then tests controlled posts and a commercial GEO workflow; ordinary posts entered citations, and one purchase yielded a production citation.

  • Problem

    Platforms disclose little about citation selection, and changing citations amid vast web content make later answer changes difficult to attribute to new posts.

    Source: §I · p. 1

  • Method

    The study maps citations and publication barriers across platforms, then uses marker-controlled posts and a GEO purchase to trace citation uptake.

    Source: §I · p. 2, 2) Metrics · p. 8

  • Results

    8 of 10 measured platforms cited fabricated content within seven days; one $14 GEO purchase produced a production-platform citation within one hour.

    Source: §I · p. 2

  • Takeaways & Limitations

    Citation security can be treated as a publication-supply-chain problem, with audits of cited-page provenance, publication path, and citation latency.

    Source: §VIII · pp. 13–14

    Live-web measurements do not establish a general conversion rule between low- and high-preference post volume because indexing time, platform delay, prior exposure, and untested combinations affect results.

    Source: C. Limitations · p. 13

Abstract

from arXiv · show

As more users ask AI systems for information, AI-search platforms are becoming a common gateway to web information. Unlike traditional search, which maps keywords to ranked pages, AI search retrieves pages, filters sources, selects citations, and generates answers before users see sources. This selection layer may amplify source bias and turn source choice into a security question. If a platform repeatedly cites domains where new users can publish posts easily, ordinary publication on those domains can become an indirect path into AI-search citations and answer text. Measuring this path is hard: platforms reveal little about citation selection, citations change over time, and the web contains so much background content that later answer changes are hard to attribute to our posts. We present a measurement framework for identifying and measuring this low-barrier publication path, combining cross-platform citation mapping, publication-barrier testing, and marker-controlled publication experiments. Across 10 AI-search platforms, we analyze 17,211 citation instances over 6,356 unique source domains and find: (1) citations concentrate in platform-specific sources, with top-20 domains capturing 20.5--70.8% of per-platform citations, and 15 of 22 tested publication platforms tied to cited source domains had low or medium barriers for both account setup and posting; (2) in our experiments, ordinary publication on preferred platforms changed what entered AI-search outputs: 8 of 10 platforms cited a fabricated concept within seven days, and one high-preference-platform article had greater citation impact than over 20 matched low-preference posts; and (3) this path is commercially available: a $14 GEO purchase produced 13 public posts, and one AI-search platform cited GEO-posted content with our designed markers within one hour.

I. INTRODUCTION

AI-search platforms select and synthesize sources before users see them, making citation selection a security surface. This paper measures whether ordinary publication on low-barrier, frequently cited platforms can carry content into AI-search citations and answers.

A. AI-Search Pipeline

  • AI-search platforms retrieve and filter candidate pages, select sources, and generate cited answers rather than returning only a ranked list of links.The paper studies built-in consumer search experiences, not offline chat-only model behavior.Source: §I · p. 1

I. INTRODUCTION

  • The study asks whether frequently cited domains offer low-barrier publication access, whether targeted posts affect answers, and whether this path appears in commercial practice.The web’s scale and platform-specific crawl, indexing, and citation timing complicate attribution and can make a single post-publication snapshot misleading.Source: §I · p. 2
  • 8 of 10 measured platforms cited fabricated content within seven days, and one $14 GEO purchase produced a production citation within one hour.The purchase was one confirmed workflow, not an estimate of market-wide success rates.Source: §I · p. 2

B. Related Work

  • Prior work examines citation reliability, source allocation, and answer use, while this study tests whether ordinary publishers can reach frequently cited domains.Related work on wording or relevance manipulation and post-retrieval attacks leaves the upstream publication-access question open.Source: B. Related Work · pp. 2–3
  • The measured exposure path uses ordinary public-platform publishing, not retrieval-index writes or adversarial instructions, and does not claim reliable manipulation of arbitrary answers.The paper distinguishes this route from attacker-controlled sites and malicious URLs studied in other production settings.Source: B. Related Work · p. 3

III. MEASUREMENT SCOPE AND INFRASTRUCTURE

The measurement scope is a public publisher using ordinary platform accounts and posting workflows, without privileged access to AI-search systems. The paper describes tools for mapping citations and tracking controlled posts, then frames RQ1 around citation concentration and publication access.

A. Publisher Capability Model

  • The publisher model limits capability to ordinary registration and policy-consistent posting, excluding access to retrieval indices, model weights, reranking logic, or training data.Experiments use the minimal tier: manual account registration and standard posting without automated engagement amplification.Source: A. Publisher Capability Model · p. 3

B. Measurement Infrastructure

  • AICITEMONITOR maps queried citations to source domains, while INFLUENCETRACKER publishes marked posts and monitors citations, marker appearances, and timestamps.The tools support citation-preference measurement and controlled longitudinal publication experiments.Source: B. Measurement Infrastructure · p. 4

IV. RQ1: CHARACTERIZING CITATION PREFERENCES AND PUBLICATION ACCESS

  • RQ1 measures source-domain frequency and top-domain concentration alongside account requirements, review latency, posting limits, and deletion risk.The paper defines citation preference as an observable citation distribution, not factual accuracy or internal trust; a citation–governance gap occurs when frequent citations meet low publication barriers.Source: §IV · p. 4
  • Table I presents AI-search platforms’ citation statistics in the RQ1 dataset.The supplied caption identifies the table’s scope but does not provide its individual values.Source: Table I · p. 4

A. Question Set Design and Data Collection

The study uses a balanced query panel to map citation sources across AI-search platforms. Citations are concentrated and platform-specific, with source patterns differing across language ecosystems and ownership relationships.

A. Question Set Design and Data Collection

  • The query panel balances four evidence-seeking categories and approximately balances Chinese- and English-language queries; queries were run once per platform in fresh conversations.The authors note that the panel is controlled and realistic but is not claimed to match real traffic.Source: A. Question Set Design and Data… · pp. 4–5

B. Citation Source Analysis

  • Top-20 domains captured 20.5% of DeepSeek citations and 70.8% of Wenxin citations, with concentration persisting across query categories.Top-20 shares ranged from 25.6% for Kimi–News to 85.8% for Wenxin–Technical.Source: B. Citation Source Analysis · p. 5, Figure 2 · p. 5
  • Top-20 source-domain overlap was sparse, with mean Jaccard overlap of 0.201; most platforms cited many domains rarely or never cited elsewhere.The authors conclude that citation risk and low-barrier publication paths should be checked per platform, while shared domains merit attention across citation pools.Source: B. Citation Source Analysis · p. 5
  • Chinese platforms rarely cited the selected English-web sources, while CSDN and Sohu appeared across many platforms and Baijiahao appeared only on Wenxin.Reddit ranked first on Google AI and Grok, and YouTube ranked first on Perplexity.Source: B. Citation Source Analysis · p. 6, Figure 4 · p. 6
  • Wenxin cited Baidu-owned domains in 24.4% of citations, 13.7× baseline; Doubao cited ByteDance-owned domains in 25.9%, 13.5× baseline.Yuanbao cited Tencent-owned domains in 14.2% of citations, 6.3× baseline.Source: B. Citation Source Analysis · p. 6

C. Citation–Governance Gap

Frequently cited sources often correspond to publication platforms that are accessible to new accounts, though easy account setup does not ensure unrestricted posting. The paper then frames controlled tests of whether publication choices affect citations and answer-text markers.

C. Citation–Governance Gap

  • Barrier-testing targets were selected using citation volume and the number of AI-search platforms citing each domain, across 288 domains with at least five citations.Reddit had 572 citations on 4 platforms, while SMZDM had 268 citations across all 10 platforms.Source: C. Citation–Governance Gap · p. 6, Figure 5 · p. 6
  • Among top-10 cited domains, 6–10 offered new accounts a publishing channel; among top-20 domains, 8–19 did.The respective means were 8.2 and 12.7 publishable domains.Source: C. Citation–Governance Gap · p. 6
  • Many high-volume or broadly cited sources mapped to platforms with low or medium account barriers and fast review, but easy account setup did not mean easy posting.Some platforms imposed posting caps, stronger account checks, shadowban or automation-flag risk, or community-level deletion risk.Source: C. Citation–Governance Gap · p. 7

V. RQ2: TARGETED PUBLICATION IN AI SEARCH

  • RQ2 tests whether publication-platform choice, content volume, and time affect explicit URL citations and publication-specific markers in answer text.These signals measure citation and marker appearance, not factual correctness or persuasion; the experiments include baseline, temporal, platform-preference, and volume tests.Source: §V · pp. 7–8
  • The baseline results are reported by platform and topic type, using post-first-citation rates with Wilson 95% confidence intervals.The denominator begins on the first day a platform cites published content and continues afterward.Source: §V · p. 7, Table III · p. 7

A. Methodology

The experiments use four topic types and staged query ladders to vary prior coverage, commercial intent, and platform preference. Publication-specific markers and response-level citation and marker rates support attribution and measurement.

1) Topics and Query Protocol:

  • Four topic types distinguish fabricated concepts, opinions, fabricated products, and low-competition topics, with query ladders tailored to each type.Types I–III support baseline and temporal experiments; Type IV supports matched platform-preference comparisons, while the volume experiment uses matched Type I topics.Source: 1) Topics and Query Protocol · p. 8
  • Prior presence is assessed with PKD, using the topic for fabricated concepts and products and publication-specific markers for opinions and low-competition topics.Type IV is excluded from the baseline because its paired, conflicting posts would mix baseline visibility with platform-preference comparison.Source: 1) Topics and Query Protocol · p. 8
  • Marker-controlled articles follow a consistent template, and marker appearance is treated as attributable only when markers were absent from pre-publication AI responses and web-search checks.The articles are drafted with ChatGPT and manually edited; longitudinal queries use the same prompts in a daily window where platform controls permit disabling memory or history.Source: 1) Topics and Query Protocol · p. 8

2) Metrics:

  • Cite rate measures responses citing a published URL, while marker appearance rate measures responses whose generated text contains a publication-specific marker, with or without citation.Marker candidates are reviewed for side-specific attribution; unresolved disagreements count as no marker appearance.Source: 2) Metrics · p. 8

B. Initial Targeted-Publication Experiment

Targeted publication was followed by citations and marker appearances, but the signals varied by topic, platform, and time. Matched comparisons found earlier signals on high-preference platforms, while deletion did not immediately clear citations.

B. Initial Targeted-Publication Experiment

  • After first citation, the fabricated-concept topic had 62.9% CR and 32.2% MAR, compared with 18.8% and 3.5% for opinion and 36.4% and 4.7% for product topics.These rates condition on the first observed citation and are not directly comparable to unconditional full-window rates; across the full seven days, CR was 17.5% and MAR was 7.5%.Source: B. Initial Targeted-Publication… · p. 9
  • Across 10 additional fabricated topics, 9/10 produced at least one citation or marker signal, with aggregate CR 32.4% and MAR 28.8%.The authors note that topic identity, competition, and query intent vary together, so the topic contrasts do not isolate a single cause.Source: B. Initial Targeted-Publication… · p. 9

C. Temporal Dynamics

  • In the 15-day run, citation timing varied by platform and topic, and deleting articles after Day 11 reduced citations without immediately clearing them.Doubao continued citing deleted fabricated-concept content on Days 12–15; the authors describe cached pages, delayed index refresh, or stale retrieval state as consistent explanations.Source: C. Temporal Dynamics · pp. 9–10, Figure 6 · p. 10

D. Citation-Preference Platform Experiment

  • Across five matched pairs, high-preference platforms produced the first citation or marker signal in every first round; the best low-preference case required 20 posts.Self-hosted WordPress received no citation within one week even after 40 posts; the thresholds are per-topic, not a general conversion rule.Source: D. Citation-Preference Platform… · p. 10

E. Content Volume

The content-volume experiment found higher aggregate citation counts at greater publication volumes, though the between-topic design limits causal interpretation. The paper also examines advertised GEO services and traces one purchased workflow, whose scope is an n=1 case study.

E. Content Volume

  • Aggregated citation instances rose from 24 at one Sohu post to 128 at 20 posts, a 5.3× increase for a 20× increase in publication volume.Returns were sublinear and platform-dependent; because each volume level used a different topic, the increase is an association rather than an isolated causal effect.Source: E. Content Volume · pp. 10–11, Figure 7 · p. 11

VI. RQ3: GEO SERVICES IN THE WILD

  • The RQ3 study surveys advertised GEO services and traces one purchase from payment through public posting to AI-search citation and marker appearance.The purchase provides direct attribution for one provider–topic–platform chain, not success rates across providers, topics, or platforms.Source: §VI · p. 11, B. GEO Purchase: An n=1 Case Study · p. 11

A. GEO Industry Landscape

  • Among 13 surveyed GEO providers, 12 advertised AI-answer monitoring, 11 content production or rewriting, 7 platform targeting, and 3 multi-platform seeding.These are provider-reported market signals, not independently verified effectiveness measurements.Source: A. GEO Industry Landscape · p. 11

B. GEO Purchase: An n=1 Case Study

1) Attribution Design and Vendor Engagement:

2) Publication and Verification:

  • The researchers independently opened each delivered page and counted a verified signal only when an answer cited a vendor-posted URL and contained an embedded marker.Four target platforms corresponded to source domains with strong RQ1 citation preference; Yidianzixun was an additional vendor-selected channel.Source: 2) Publication and Verification · p. 11

3) Account Infrastructure and AI-Search Citation:

A $14 GEO purchase yielded a verified chain from vendor publication to a Doubao citation containing designed markers, while the paper frames the broader exposure as a gap between publication control and AI-search citation selection. It also outlines detection signals and unevaluated defense considerations.

3) Account Infrastructure and AI-Search Citation:

  • Table IV maps surveyed GEO providers’ advertised seeding platforms and services, while Blue Focus and Zhendao are classified as GEO-adjacent, not confirmed providers.Its service columns cover monitoring, content production, multi-platform seeding, platform-specific strategy, and knowledge-base or structured-data injection.Source: Table IV · p. 12, 3) Account Infrastructure and… · p. 12
  • Within at most one hour, Doubao cited the vendor-published Sohu article and included the designed markers in this single purchase case.The markers were absent before purchase; the authors caution that this is not a platform-wide effect estimate.Source: Figure 8 · p. 12, 3) Account Infrastructure and… · p. 12

C. GEO Detection Remains Hard

  • Because ordinary pages expose cited URLs but usually not payment paths, account ownership, or publication intent, a single cited page cannot establish paid GEO.The authors describe concentration, low barriers, and timing patterns as review-prioritization signals rather than proof of intent.Source: C. GEO Detection Remains Hard · pp. 12–13
  • Prior activity across unrelated commercial verticals and abrupt topic shifts, synchronized posts, near-duplicates, or rapid citations are proposed as signals for review, not proof of GEO intent.The purchased posts were not published from newly created accounts.Source: 3) Account Infrastructure and… · pp. 11–12, C. GEO Detection Remains Hard · p. 13

A. Security Implications

  • The security issue is a control gap: publication platforms govern posting while AI-search systems select which published pages become user-visible citations.The paper identifies selected source domains reachable through low-barrier publication as an indirect path to the AI-search interface.Source: A. Security Implications · p. 13

B. Measurement-Derived Defense Suggestions

  • Suggested measures include source-domain diversity, provenance-aware reranking, temporal anomaly detection, and citation-context signals, but these defenses were not evaluated.Diversity may hurt narrow queries relying on specialized sources, and practical detection rates and false-positive rates remain unknown.Source: B. Measurement-Derived Defense… · p. 13

C. Limitations

The paper concludes that ordinary publication can provide an input path to AI-search answers, while several study boundaries constrain how broadly its measurements should be generalized. The experiments also used harm-avoidance safeguards and specified limits on topic selection.

C. Limitations

  • RQ2 does not establish a general conversion rule between low- and high-preference posts because indexing, platform delay, prior exposure, and untested topic–stance combinations affect live-web measurements.The reported platform-choice and volume effects apply under the measured conditions.Source: C. Limitations · p. 13
  • Most controlled topics used low-prior-presence or low-competition designs, although opinion topics with substantial prior coverage also received citations after targeted publication.Higher-competition commercial or policy topics may require different publication volume, account history, or engagement patterns.Source: C. Limitations · p. 13
  • RQ1 uses a designed query panel because private platform query logs are unavailable, and its prompt mix may differ from real-world usage.The panel spans factual lookup, comparison, recommendation, and opinion-oriented prompts for cross-platform comparison.Source: C. Limitations · p. 13
  • Exact rates and platform rankings come from one March–April 2026 campaign and may drift with platform updates.The authors distinguish these potentially drifting values from structural findings such as citation concentration and low or medium barriers on many cited domains.Source: C. Limitations · p. 13

VIII. CONCLUSION

  • Across 10 platforms, the paper concludes that citation-preferred publication can place content in citations and answer text, and that one GEO purchase packaged this path as a paid visibility service.The conclusion frames citation security as a publication-supply-chain problem involving page provenance, publication path, and citation latency.Source: §VIII · pp. 13–14

ETHICS CONSIDERATIONS

  • The authors designed publication-side experiments to follow platform policies to the best of their understanding, without claiming formal compliance review or platform endorsement.They refer to the Menlo Report and state that safeguards were implemented throughout the measurement pipeline.Source: ETHICS CONSIDERATIONS · p. 14

A. Generative AI Disclosure

  • Generative AI assisted with language editing, query wording, and drafting experimental articles, while authors retained responsibility for design, collection, labeling, analysis, and claims.Candidate query wording was manually reviewed, and AI-drafted articles were manually edited.Source: A. Generative AI Disclosure · p. 14

B. Topic Selection Principles

  • Experiments excluded high-stakes domains and focused on low-risk topics, using fictitious entities and publication-specific markers rather than evaluating persuasion or opinion shifts.Excluded areas included health, finance, politics, public safety, and content targeting vulnerable populations.Source: B. Topic Selection Principles · p. 14

C. Content Cleanup and Post-Experiment Remediation

Controlled posts were logged, deleted where possible, annotated when still editable, and checked for residual AI-answer exposure. GEO-published pages required a different best-effort cleanup, and the paper also reports disclosures, policy posture, and dual-use safeguards.

C. Content Cleanup and Post-Experiment Remediation

  • Controlled-publication posts were logged and deleted from accounts under the authors’ control within four weeks after each phase; editable residual posts received research disclaimers and were monitored for secondary spread.Follow-up queries assessed residual AI-answer exposure, not complete erasure from caches, mirrors, or third-party archives.Source: C. Content Cleanup and Post-Experiment… · p. 14
  • Because GEO-published pages were not on accounts the authors controlled, they made best-effort deletion requests and recorded whether delivered URLs remained publicly reachable.The RQ3 topic was fabricated and harmless; unconfirmed deletion was not treated as removal.Source: C. Content Cleanup and Post-Experiment… · p. 14

D. Responsible Disclosure

  • The authors completed responsible disclosure to all 10 AI-search platforms; six acknowledged receipt and said the findings and recommendations would inform future product optimization.Reports included concentration patterns, publication strategies, and defense recommendations.Source: D. Responsible Disclosure · pp. 14–15

E. Platform Terms and Policy Considerations

  • Measurements used public interfaces or official APIs, with queries below published API limits and no interface-bypassing scraping; controlled posts avoided impersonation, account farming, and purchased synthetic engagement.The authors describe policy consistency conservatively because platform rules vary and may change.Source: E. Platform Terms and Policy… · p. 15

F. Dual-Use Risk Assessment

  • The authors acknowledge potential malicious reuse of target identification and publication-effect measurements, and will not release operational templates or tooling that directly lower misuse barriers.Aggregate measurements and non-operational evaluation artifacts may be released after review.Source: F. Dual-Use Risk Assessment · p. 15

APPENDIX A RQ1 CATEGORY-STRATIFIED CONCENTRATION

The appendix describes category-stratified citation-concentration reporting, the RQ1 query panel, marker-based attribution in baseline and temporal experiments, and assigned publication volumes for content-volume topics.

APPENDIX B RQ1 QUERY LIST

  • The RQ1 query list contains 120 prompts, split evenly across product recommendation, news and current events, experience and opinion, and technical documentation.Each category contains 30 queries.Source: Appendix B · p. 16

A. Baseline and Temporal Topics

  • Baseline and temporal experiments share three topics and use publication-specific marker bundles to attribute later answer appearances, including for an opinion topic with substantial prior web discussion.The topics include a fabricated concept, an opinion question, and a fabricated product.Source: A. Baseline and Temporal Topics · pp. 16–17

APPENDIX A RQ1 CATEGORY-STRATIFIED CONCENTRATION

B. Content-Volume Topics

  • The content-volume experiment assigns six matched fabricated Type I topics publication volumes of 1, 2, 5, 10, 15, and 20 articles, attributing appearances through entity names and side-specific claims or identifiers.The listed topics are assigned those volumes in order.Source: B. Content-Volume Topics · p. 17

C. Citation-Preference Platform Topics (Anonymized)

The experiment paired conflicting marker bundles for five anonymized travel destinations to test citation preference across platforms. “High” and “low” describe platform citation preference, not factual reliability.

C. Citation-Preference Platform Topics (Anonymized)

  • The best low-preference case became visible only after 20 posts, while 40 matched posts on self-hosted WordPress remained uncited within a week.The low-preference platform had appeared only three times in baseline citations: Kimi cited it twice and Wenxin once.Source: C. Citation-Preference Platform Topics… · p. 18
  • For five real, low-competition destinations, each topic paired a high-preference bundle with conflicting low-preference markers.Exact place names were suppressed for ethics reasons, and the marker bundles were summarized rather than reproduced in full.Source: C. Citation-Preference Platform Topics… · p. 18
  • Bundles contrasted attractive travel hooks—such as low costs, distinctive sights, or photography—with concerns including pollution, safety risks, and restricted transport.The topics ranged from a polar-ruins cost test and survival-level travel guide to budget feasibility and an industrial-capital photography review.Source: C. Citation-Preference Platform Topics… · p. 18

D. Practical Success-Rate Replication

The replication tested whether posts about fabricated topics on preferred publication platforms appeared in AI-search outputs. Nine of ten topics succeeded during a seven-day measurement window, though the aroma storage box topic produced no citation or marker signal.

D. Practical Success-Rate Replication

  • The study tested 10 independent, low-risk fabricated topics, publishing one marker-controlled post per topic on Sohu, YouTube, and CSDN.Each topic received 210 responses from three queries to each of 10 platforms daily for seven days, for 2,100 responses total.Source: D. Practical Success-Rate Replication · p. 18
  • The fabricated topics covered varied profiles, including a photography project reporting 2,874 participants and 41,680 images, and a shop, show, snack, toy, and theme park.Other profiles included a 3-RMB soymilk shop, a bookstore, and an aroma storage box.Source: D. Practical Success-Rate Replication · p. 18
  • 9 of 10 fabricated topics succeeded; across 2,100 responses, 32.4% cited a published article and 28.8% contained a marker.Topics T7–T10 were first cited on Day 1 and T1–T5 on Day 2; DeepSeek cited none, while Doubao, Perplexity, and Yuanbao had the highest citation coverage.Source: D. Practical Success-Rate Replication · p. 18, Table VI · p. 18
  • The aroma storage box was the sole unsuccessful topic, with neither citations nor marker signals during the measurement window.Manual inspection suggested its name may have been misread or rewritten, so the intended published pages were not selected; its profile included 86.1% desktop trial satisfaction and 49 storage trials.Source: D. Practical Success-Rate Replication · p. 18
Loading 2610.11932v1…