When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

• URL: http://arxiv.org/abs/2609.02964v1
• Date: Wed, 02 Sep 2026 07:13:40 GMT
• Title: When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization
• Abstract summary: This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO)<n>Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization.<n>We propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM.
• Score: 3.9144095238039855
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.

Related papers

• Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization [48.93628521719709]
  Generative engine optimization (GEO) enables content producers to increase the visibility of their web pages in generative search engines.<n>The same techniques can deliver targeted misinformation when adversaries publish ordinary-looking GEO-optimized documents.<n>We present Counter-GEO-Bench, a defense benchmark that pairs 247 human-verified, quality-gated queries with information-preserving and information-distorting GEO rewrites.
  arXiv  Detail & Related papers  (2026-09-02T09:01:51Z)
• AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents [57.34566159148893]
  Indirect prompt injection (IPI) is a major security threat to LLM-powered agents.<n>We develop AutoDojo, an adaptive extension of AgentDojo that optimize IPI against a given defense.
  arXiv  Detail & Related papers  (2026-06-13T02:09:08Z)
• GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization [9.762893142689357]
  We present GEO-Bench, a benchmark that evaluates GEO ranking-manipulation attacks under one protocol.<n>It unifies black-box prompt-based attacks (TAP, Zero-Shot), white-box gradient-based attacks (STS, RAF, StealthRank), and ten white-hat C-SEO strategies.<n>We score every method on five datasets against a fixed open-weight ranker.
  arXiv  Detail & Related papers  (2026-05-27T21:10:43Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• Immunizing 3D Gaussian Generative Models Against Unauthorized Fine-Tuning via Attribute-Space Traps [54.68389949880821]
  We propose GaussLock, a framework to defend 3D generative models against fine-tuning attacks.<n>GassLock integrates authorized distillation with attribute-aware trap losses targeting position, scale, rotation, opacity, and color.<n>Experiments show that GaussLock effectively neutralizes unauthorized fine-tuning attacks.
  arXiv  Detail & Related papers  (2026-04-06T09:30:49Z)
• Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks [0.0]
  Large Language Models (LLMs) are increasingly employed as evaluators (LLM-as-a-Judge) for assessing the quality of machine-generated text.<n>This paper investigates the vulnerability of LLM-as-a-Judge architectures to prompt-injection attacks.
  arXiv  Detail & Related papers  (2025-05-19T16:51:12Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)
• TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation [31.231916859341865]
  TrustRAG is a framework that systematically filters malicious and irrelevant content before it is retrieved for generation.<n>TrustRAG delivers substantial improvements in retrieval accuracy, efficiency, and attack resistance.
  arXiv  Detail & Related papers  (2025-01-01T15:57:34Z)
• ShadowCode: Towards (Automatic) External Prompt Injection Attack against Code LLMs [56.46702494338318]
  This paper introduces a new attack paradigm: (automatic) external prompt injection against code-oriented large language models.<n>We propose ShadowCode, a simple yet effective method that automatically generates induced perturbations based on code simulation.<n>We evaluate our method across 13 distinct malicious objectives, generating 31 threat cases spanning three popular programming languages.
  arXiv  Detail & Related papers  (2024-07-12T10:59:32Z)
• Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation [44.74112207662136]
  Retrieval Augmented Generation (RAG) expands the capabilities of modern large language models (LLMs)<n>We propose a novel attack that allows an adversary to inject a single malicious document into a RAG system's knowledge base, and mount a backdoor poisoning attack.
  arXiv  Detail & Related papers  (2024-05-30T21:19:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.