SafeGEO: Understanding Generative Engine Optimization Risks in Recommendation Agents

• URL: http://arxiv.org/abs/2606.28356v1
• Date: Mon, 08 Jun 2026 22:40:08 GMT
• Title: SafeGEO: Understanding Generative Engine Optimization Risks in Recommendation Agents
• Abstract summary: We study whether recommendation agents preserve utility-aligned decisions when seller-controlled sources are rewritten for GEO.<n>We empirically show that GEO attacks can promote flawed target products.<n>Simple defenses, including defensive prompting and structured evidence checks, reduce harmful target promotion by up to 39.2%.
• Score: 13.658613657290166
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Generative Engine Optimization (GEO) lets content owners rewrite web content to increase their visibility in generative systems. In recommendation agents, this creates a risk that seller-controlled sources make flawed products appear better supported than they are. We study this risk by asking whether recommendation agents preserve utility-aligned decisions when seller-controlled sources are rewritten for GEO. To make this question measurable, we construct SafeGEO, an evaluation suite with 22 GEO attack variants across 600 recommendation cases. We empirically show that GEO attacks can promote flawed target products. On average, they increase the rate at which such flawed products enter the recommendation set by up to 83.2%. We further study whether agent-side design choices can mitigate this risk and show that simple defenses, including defensive prompting and structured evidence checks, reduce harmful target promotion by up to 39.2%. These gains are substantial but do not restore the no-GEO performance, showing that GEO remains a serious risk despite developer-side mitigation.

Related papers

• Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization [48.93628521719709]
  Generative engine optimization (GEO) enables content producers to increase the visibility of their web pages in generative search engines.<n>The same techniques can deliver targeted misinformation when adversaries publish ordinary-looking GEO-optimized documents.<n>We present Counter-GEO-Bench, a defense benchmark that pairs 247 human-verified, quality-gated queries with information-preserving and information-distorting GEO rewrites.
  arXiv  Detail & Related papers  (2026-09-02T09:01:51Z)
• When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization [3.9144095238039855]
  This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO)<n>Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization.<n>We propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM.
  arXiv  Detail & Related papers  (2026-09-02T07:13:40Z)
• GEO-Flag: Detecting and Measuring GEO-Optimized Web Content [21.05216177234399]
  Generative Engine Optimization (GEO) modifies web content to increase its likelihood of being selected and cited by generative search engines.<n>This can give strategically optimized pages visibility disproportionate to their authority or relevance and even make weak or false information appear well supported.<n>Despite these concerns, systematic methods for detecting GEO-optimized webpages remain underexplored.
  arXiv  Detail & Related papers  (2026-08-17T17:12:11Z)
• On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
  Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
  arXiv  Detail & Related papers  (2026-05-12T09:56:28Z)
• External Data Extraction Attacks against Retrieval-Augmented Large Language Models [70.47869786522782]
  RAG has emerged as a key paradigm for enhancing large language models (LLMs)<n>RAG introduces new risks of external data extraction attacks (EDEAs), where sensitive or copyrighted data in its knowledge base may be extracted verbatim.<n>We present the first comprehensive study to formalize EDEAs against retrieval-augmented LLMs.
  arXiv  Detail & Related papers  (2025-10-03T12:53:45Z)
• Privacy Risks of LLM-Empowered Recommender Systems: An Inversion Attack Perspective [8.243745783644359]
  Large language model (LLM) powered recommendation paradigm has been proposed to address the limitations of traditional recommender systems.<n>This study uncovers that LLM empowered recommender systems are vulnerable to reconstruction attacks that can expose both system and user privacy.
  arXiv  Detail & Related papers  (2025-07-20T05:03:02Z)
• WebGuard: Building a Generalizable Guardrail for Web Agents [59.31116061613742]
  WebGuard is the first dataset designed to support the assessment of web agent action risks.<n>It contains 4,939 human-annotated actions from 193 websites across 22 diverse domains.
  arXiv  Detail & Related papers  (2025-07-18T18:06:27Z)
• RiskRAG: A Data-Driven Solution for Improved AI Model Risk Reporting [4.375071270418409]
  Only 14% of model cards mention risks, out of which 96% copying content from a small set of cards, leading to a lack of actionable insights.<n>RiskRAG is a Retrieval Augmented Generation based risk reporting solution guided by five design requirements.<n>Drawing from 450K model cards and 600 real-world incidents, RiskRAG pre-populates contextualized risk reports.
  arXiv  Detail & Related papers  (2025-04-11T20:10:15Z)
• Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search [20.796363884152466]
  We conduct the first safety risk quantification on seven production AIPSEs.<n>Our findings reveal that AIPSEs frequently generate harmful content that contains malicious URLs.<n>We develop an agent-based defense with a GPT-4.1-based content refinement tool and a URL detector.
  arXiv  Detail & Related papers  (2025-02-07T14:15:46Z)
• Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks [45.07581174558107]
  Retrieval-Augmented Generation (RAG) systems have emerged as a promising solution to mitigate hallucinations.<n>RAG systems are vulnerable to adversarial poisoning attacks, where malicious passages injected into the retrieval corpus can mislead models into producing factually incorrect outputs.<n>We present a rigorously controlled empirical study of how RAG systems behave under such attacks and how their robustness can be improved.
  arXiv  Detail & Related papers  (2024-12-21T17:31:52Z)
• C-RAG: Certified Generation Risks for Retrieval-Augmented Language Models [57.10361282229501]
  We propose C-RAG, the first framework to certify generation risks for RAG models. Specifically, we provide conformal risk analysis for RAG models and certify an upper confidence bound of generation risks. We prove that RAG achieves a lower conformal generation risk than that of a single LLM when the quality of the retrieval model and transformer is non-trivial.
  arXiv  Detail & Related papers  (2024-02-05T16:46:16Z)
• Efficient Risk-Averse Reinforcement Learning [79.61412643761034]
  In risk-averse reinforcement learning (RL), the goal is to optimize some risk measure of the returns. We prove that under certain conditions this inevitably leads to a local-optimum barrier, and propose a soft risk mechanism to bypass it. We demonstrate improved risk aversion in maze navigation, autonomous driving, and resource allocation benchmarks.
  arXiv  Detail & Related papers  (2022-05-10T19:40:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.