Citation Wars: The GEO Playbook Is Now the Attack Model
A CMU paper simulates what happens when everyone optimizes for AI citations: quality falls and filters fail. A second benchmark shows safety guardrails missing GEO-injected misinformation, and a third paper now cuts GEO's success rate from 50% to 6% — by treating the rewrite itself as the attack.
Updated · Published
Frequently asked questions
What are citation wars in AI search?
Citation wars are the escalating cycle between content suppliers optimizing for AI citations and platforms defending against that optimization. A 2026 preprint from Carnegie Mellon and UC San Diego shows the cycle can settle into what the authors call an inert stationary outcome, where "useful content is not induced, suspicious content is weakly penalized, and further platform updates have little effect."
Does adding statistics still help you get cited by AI?
It depends on whether the statistics are checkable. Adding statistics comes from the KDD 2024 GEO paper, which reported that its methods could boost visibility by up to 40%. The 2026 mechanism-design paper reimplements that same method as one of five GEO attackers it defends against, and the defense it proposes credits added claims only when they are supported by the original document. Sourced numbers survive that test; decorative ones are exactly what it filters.
Can platforms detect GEO manipulation with keyword filters?
Not well. The paper tested a keyword scrub that applied a regex filter over 24 GEO-style phrases and found its effectiveness "remains close to zero." Two other classical defenses, prompt-based suspicion labels and hard rejection of suspicious documents, also underperformed the reward-based mechanism the authors propose.
Do AI safety guardrails catch GEO-injected misinformation?
Barely. Counter-GEO-Bench, a September 2026 benchmark from researchers at Tsinghua University and the University of Hong Kong accepted to EMNLP 2026, paired 247 human-verified queries with GEO rewrites carrying targeted false claims and measured a 55.7% undefended attack success rate averaged across three victim models. Granite Guardian, Llama Guard 3, and NeMo's self-check fact-checking reduced that by at most 5.7% relative. The authors' diagnosis: safety guardrails target policy violations, and GEO misinformation passes through them as fluent informational content. A lightweight detector trained on the attack classes themselves cut attack success by 47.6% relative with answer quality unchanged.
What is negative GEO?
Negative GEO is one of the eight information-distorting attack classes in the Counter-GEO-Bench taxonomy: content optimized to win retrieval while contrasting against legitimate competing information to suppress it — a page built to reach the answer and undermine a true alternative, such as a competitor. In the benchmark, distorting attacks succeeded undefended more than half the time and deployed general-purpose guardrails barely reduced them, which makes monitoring what answers actually say about your brand the only detection layer you currently control.
What is VCR in generative engine optimization?
VCR stands for verifiable-content rewards, a platform mechanism proposed in the paper "Mechanism Design for Generative Engines." Instead of only penalizing suspicious rewrites, the platform also credits rewrites in proportion to the factual claims, numerical details, and named citations they surface that are supported by the original document. Across three benchmarks it beat the strongest baseline defense by an average of 12.1 percentage points on the authors' combined defense-and-utility score.
Does GEO optimization make content worse?
Under repeated competition in this simulation, yes. Running five rounds of optimization on an e-commerce benchmark drove both rewrite quality and answer utility below the reference condition where no optimization happened, with "accumulated unsupported claims and fabricated details, turning initially mild edits into citation-seeking rewrites." This is a simulated result on small models, not a measurement of the live web.
Can platforms actually defend against GEO manipulation now?
In research settings, yes — and the strongest result so far doesn't check facts at all. GEO Defender, a September 2026 preprint from the University of the Chinese Academy of Sciences, cut the average success rate of seven published GEO methods from 50.32% to 6.20% across five target LLMs, while retaining 94.12% of benign evidence and moving answer quality by 0.01. It works by demoting documents that carry the statistical signature of a GEO rewrite at the reranking stage, before the model ever reads them. The attacks it defends against are factually consistent with the original pages — which means the defense draws no line between manipulation and 'honest' optimization. The rewrite is the thing it demotes.
Should I stop doing answer engine optimization?
No. Nothing in the research argues against clear structure, direct answers, or accurate specifics, and the proposed defense actively rewards adding substantiated detail. What it questions is the subset of the playbook that treats added numbers and citation-flavoured phrasing as decoration, which is the part platforms have an incentive to neutralize.
Every answer engine optimization checklist tells you to add statistics, add citations, add quotations. A preprint posted on 11 August 2026 takes that advice, implements it as an attacker, and asks what happens when everyone runs it and the platform fights back. The answer, across five rounds of simulated competition, is that document quality and answer quality both end up below where they started. Chen Xu and Chenyan Xiong of Carnegie Mellon and Zitian Guo of UC San Diego call the pattern citation wars.
Key takeaways
The tactics are the attack model now. One of the five GEO attackers the paper defends against is "Statistics Addition," which adds quantitative claims following the KDD 2024 GEO paper that popularised the tactic.
Repeated optimization degrades the thing it optimizes. Five rounds on an e-commerce benchmark left "rewrite quality and answer utility both fall below the no-exploitation reference," with unsupported claims and fabricated details accumulating along the way.
Filtering does not save the platform. A keyword scrub over 24 GEO-style phrases was close to useless, and the equilibrium the authors identify is an inert one where nobody is punished and nobody improves.
The defense that worked pays for verifiability. VCR credits added claims, numbers, and named citations that the original document supports, beating the strongest baseline by an average of 12.1 percentage points.
That is the practitioner takeaway, and it is not "stop adding statistics." It is that a sourced number and an invented one are about to stop being the same move.
Added 3 September: independent confirmation, with the stakes raised. Counter-GEO-Bench pairs the same GEO optimization with injected false claims and finds the claims landing in answers 55.7% of the time undefended — and off-the-shelf safety guardrails cutting that by at most 5.7% relative. Generic filters keep failing; a detector trained on what GEO manipulation specifically does cut it by 47.6%.
Added 6 September: a third group closes the loop. GEO Defender cuts the average success rate of seven published GEO methods — the KDD 2024 original among them — from 50.32% to 6.20%, keeping 94.12% of benign evidence. The attacks it neutralizes are factually consistent with the source pages. There is no misinformation to catch; the optimization signature itself is what gets demoted.
Caveats are large: simulation, small models, LLM-judged quality, no production engine involved. Read it as a direction of travel, not a measurement.
The paper models AI search as two parties with one shared currency. Content suppliers want citations, because citations are how a generative engine allocates attention and attribution. The platform wants answers that are trustworthy. Both are pulling on the same document.
Formally it is a repeated Stackelberg game with partial monitoring: the platform moves first by setting a policy, suppliers respond by rewriting, and neither side sees the other's private state. Practically it is a description of a market anyone doing generative engine optimization already lives in. The abstract states the tension without hedging: "content providers are incentivized to optimize for model citation, while platforms must preserve answer quality and trustworthy attribution."
The experiments run on three benchmarks — an e-commerce set, GEO-Bench, and Researchy-GEO — each pairing a query with five candidate documents. One document gets rewritten by an attacker; the engine then answers and cites.
Here is the part worth sitting with. The five attackers the paper defends against are not adversarial exotica. They are the published GEO literature.
Attacker
What it does
AutoGEO
The default attacker used throughout the experiments
RAID
Extracts engine-preference rules from contrastive role-conditioned answers
IF-GEO
Performs influence-based GEO
SAGEO
Performs structure-aware GEO via prompt programming
Statistics Addition
"Adds quantitative claims following the original paper"
That last row cites Aggarwal and colleagues' GEO: Generative Engine Optimization, the KDD 2024 paper that reported visibility boosts of up to 40% and gave the field both its name and its benchmark. Two years on, in a paper that uses that same benchmark, the method is a baseline attack to be neutralized.
Nothing about this makes the original research dishonest, and the KDD paper is still the best empirical grounding the field has. But the asymmetry is instructive: the tactic that a marketing checklist reads as "best practice" is the thing a platform researcher reads as "the thing to detect." If you are running the 2024 playbook in 2026, you are running the thing being modelled against.
The core simulation runs five rounds. Suppliers rewrite, the platform adapts, suppliers rewrite again. The trajectory is the finding: rewrite quality and answer utility both drop below the no-exploitation reference, and the mechanism is visible in the intermediate rounds — the paper describes "accumulated unsupported claims and fabricated details, turning initially mild edits into citation-seeking rewrites."
Round one is a page with a few more numbers in it. Round five is a page making claims nobody can check.
Then the theory explains why it stalls there rather than correcting. The authors identify conditions under which the system reaches a local stationary point where the first-order utility change is roughly zero, and spell out what that state looks like: "useful content is not induced, suspicious content is weakly penalized, and further platform updates have little effect." A stalemate where the extra effort has bought nobody anything, and the content is worse than the version that existed before the competition started.
This is a familiar shape. It is what happened to on-page SEO in the exact-match-anchor era, and the resolution then was not that publishers restrained themselves. The platform changed what it paid for.
The instinct is that a platform just detects the pattern and drops it. The paper tests three classical defenses and finds the naive versions weak.
Defense
Mechanism
Result
Prompt defense
Attaches suspicion labels, softly reorders documents, adds a system-prompt warning
Beaten by VCR
Hard reject
Removes suspicious documents above a threshold
Beaten by VCR
Keyword scrub
Regex filter over 24 GEO-style phrases
Effectiveness "remains close to zero"
The keyword scrub result is the one to carry. Stylistic tells are cheap to route around, and a filter aimed at them catches last season's phrasing while the rewrite that matters walks through. Anyone hoping their competitor's obviously optimized copy will get algorithmically punished should downgrade that expectation.
The paper's scoring makes the tradeoff explicit. Its headline metric, Net, adds two quantities: the share of the attacker's advantage a defense strips away, and what that defense does to welfare relative to the reference condition. Hard rejection can score well on the first and badly on the second, because throwing out documents throws out real information along with the manipulation. A defense has to be judged on what it costs the answer, not just on what it blocks.
VCR — verifiable-content rewards — inverts the design. Rather than only punishing suspicious rewrites, the platform credits them. The credit a rewrite earns scales with a count of the "factual claims, numerical details, or named citations present in the rewrite and supported by the original document," up to a cap.
Read that qualifier twice, because it is the whole idea. Not claims present. Claims present and supported. A number you can trace back to something real earns credit; a number that appeared during optimization earns nothing. Across three benchmarks and three engines, VCR posted the largest Net score every time, with an average advantage of 12.1 percentage points over whichever baseline was strongest in each setting, and it also produced the highest scores on the direct document-quality dimensions the authors measure — clarity, depth, insight, and factuality.
For anyone doing answer engine optimization, that is a more useful signal than another ranking factor. It splits a piece of advice that has always been treated as one thing:
The tactic
Under a verifiability mechanism
Adding a statistic you can source or produced yourself
Rewarded — this is precisely what the mechanism counts
Adding a statistic because a checklist said statistics get cited
Filtered — nothing supports it, so it earns no credit
Adding a named citation to a real document
Rewarded
Adding citation-flavoured phrasing without a referent
Filtered
The advice "add statistics" survives. The version of it that treats numbers as decoration does not. That distinction is already worth acting on for a separate reason: fabricated specifics on your own pages can be lifted verbatim into an answer and attributed to you, which is a liability rather than an optimization.
Added 3 September 2026. The keyword-scrub result now has independent confirmation from a second group, on the version of the attack with the most at stake. Counter-GEO-Bench, by Bing Zheng and Wenming Yang of Tsinghua's Shenzhen International Graduate School with Zongyao Zhao of the University of Hong Kong — accepted to EMNLP 2026 — asks what happens when a GEO rewrite doesn't just decorate but lies. The authors built 247 human-verified queries from GEO-Bench pairs and produced two rewrites of each source: an information-preserving one (clearer structure, authoritative phrasing, citation hooks, facts intact) and an information-distorting one — the same optimization strength plus a targeted false claim injected in at least three places with varied phrasing.
Undefended, the false claim was asserted in the answer 55.7% of the time (95% CI: 53.1–58.2), averaged across three open-weight victim models. With the standard safety guardrails in front, almost nothing changed: Granite Guardian cut attack success by 1.7 percentage points (not statistically significant), Llama Guard 3 by 3.2 points — statistically real, "operationally negligible" in the authors' words — and NeMo's self-check fact-checking rail blocked 98.4% of one model's outputs whether or not anything was wrong with them. The abstract's summary is "at most 5.7% relative," and the diagnosis fits the CMU finding exactly: "Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content."
The taxonomy of eight distorting attack classes reads like the GEO checklist with its intent inverted: fake institutional authority, fabricated citations to nonexistent studies, fake freshness markers ("temporal poison"), AI-extractable formatting around a false claim ("structured hijack"), fabricated ratings and testimonials ("review flood"), and — the one aimed squarely at brands — negative GEO, content that contrasts against legitimate competing information to suppress it. Review flood was the most successful class undefended, at 62.8%. Every class is a distorted twin of something a checklist sells as best practice, which is this post's thesis restated as a threat model.
The defense pattern repeats too. As with VCR, the generic mechanism failed and the targeted one worked: the paper's baseline detector, C-GEO Guard — a 184-million-parameter encoder trained to recognize the eight attack classes by similarity — cut attack success by 47.6% relative (26.5 points absolute) with answer quality unchanged, 4.48 defended against 4.49 undefended on the paper's five-point scale. Two independent groups, one shape: defenses aimed at what GEO manipulation specifically does can work, and defenses aimed at generic badness don't. The gap in the targeted defense is instructive as well — structured hijack, the attack that hides inside extractable formatting, was the hardest class to catch, at a 22% relative reduction against 60% for the easiest. Manipulation that looks like structure survives longest.
The usual discipline applies. This is 247 English-only queries; the victims are open-weight models, not the production engines running undisclosed guardrails of their own; the attacks come from a fixed taxonomy with no detector-aware adversary; and the distortions were themselves written by an LLM. What it establishes is narrower and still uncomfortable: the defense layer actually deployed in front of today's open models does not distinguish an optimized page that informs from an optimized page that deceives.
For a brand, the exposed surface is the negative-GEO and review-flood end of that taxonomy. A page optimized into retrieval that undermines your product or fabricates satisfaction numbers for a competitor reads to current guardrails as ordinary informational content, and in this benchmark's setting more than half of such attempts reached the answer. It is the adversarial version of the manufactured-source problem we covered last week, and the countermeasure available to you is the same, because the platform-side one is not deployed: record what the answers in your category actually say, so a false claim about you is something you catch in days rather than discover in a lost deal.
Added 6 September 2026. Three days after Counter-GEO-Bench, a third group — Haozhang Li and colleagues at the University of the Chinese Academy of Sciences — published the strongest platform-side result yet, and it lands somewhere more uncomfortable for the playbook than either paper before it. GEO Defender evaluated seven published GEO methods against five target LLMs and cut their average attack success rate from 50.32% to 6.20%, while retaining 94.12% of benign-evidence use and moving the average answer-quality score by 0.01. The attacker roster overlaps heavily with the CMU paper's — AutoGEO, IF-GEO, RAID — and includes the original KDD 2024 GEO method. The tactic that founded the field is now, literally, training data for a demotion model.
The design premise is the part to sit with. The paper opens from the observation that GEO-rewritten documents "remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective," and that the features they amplify "equally characterize high-quality benign content." So the defense gives up on catching lies — there are none to catch — and instead learns the preference signature of a GEO rewrite. A small adapter over a frozen reranker learns to demote documents that look rewritten-for-retrieval relative to their benign neighbors, before the answering model ever reads them; a second, training-free stage distills those outcomes into natural-language guidance for how the model uses sources. No fine-tuning of the target LLM is required, which is exactly the property that makes a design like this cheap for a platform to bolt on.
Notice what this dissolves: the line the previous two papers left standing. VCR distinguished supported claims from decorative ones; Counter-GEO-Bench distinguished information-preserving rewrites from information-distorting ones. GEO Defender draws no such line. In its threat model, the factually consistent, structure-improved, statistics-added rewrite — the one every checklist calls best practice and this post's earlier sections call the defensible version — is the attack, and demoting it is the success condition. The 94.12% benign-evidence retention means the collateral damage to ordinary pages is small; it does not mean optimized-but-honest pages are spared. They are the target class.
The usual discipline, again. This is a preprint from a single group; the 616-instance benchmark is built by the defenders themselves; the threat model assumes the attacker controls only the rewrite, not retrieval or generation; and no production engine has announced anything resembling it. A reranker demoting GEO signatures at scale would also face a moving target this paper doesn't test — a rewriter trained against the defense. What three papers in four weeks do establish, from three independent directions, is that platform-side interest in neutralizing GEO is real, tractable in research settings, and aimed at the signature of optimization rather than at falsehood. If that direction holds, the safe ground is not "optimize honestly." It is to publish pages whose value survives the rewrite being stripped away — original data, first-party facts, substance a demotion model has no incentive to bury because burying it makes the answer worse.
The provenance deserves the same scrutiny the finding does.
This is a preprint, not peer-reviewed work, posted two days before this article. The authors state their own limits plainly: "the theory analyzes a local quadratic surrogate and the experiments use a finite interaction horizon; neither establishes a global equilibrium," and they note that "LLM-based claim counting and rule matching can err." A local stationary point in a five-round simulation is not proof that the live web is heading somewhere specific.
The models are also small. The primary engine is gemini-2.5-flash-lite, with gpt-4o-mini and claude-haiku-4-5 as alternates, and the platform-side components run on gpt-4o-mini at temperature zero. Those are not the systems buyers are asking about your category, and quality here is scored by an LLM rubric rather than by people.
Most importantly, VCR is a proposal. No platform has announced anything like it. What the paper establishes is that a reward-for-verifiability design outperforms penalty-only designs in simulation — which is an argument about where a rational platform's incentives point, not an announcement about where any engine is today.
That still leaves it more actionable than most of what gets written about GEO, because the direction is the same one the rest of the evidence points in. Our own study of citation volatility found the set of domains cited for a prompt turning over 60–70% day to day, which is what a contested surface with no stable advantage looks like from the outside. A tactic that everyone can run is not an advantage for long.
Audit your numbers for provenance, not for presence. Go through your top pages and mark each statistic as sourced, self-generated, or neither. The third bucket is the one carrying risk, and it is usually larger than people expect on pages that were optimized rather than written.
Make your own data the thing you add. A figure you produced is checkable, is yours, and is hard for a competitor to copy. It also forces attribution, which is the fix for the ghost citation problem of being cited without being named.
Read AI-assisted rewrites for invented detail. The failure mode in the simulation is exactly the failure mode of a model asked to make a page more citable: confident specifics that trace to nothing.
Stop expecting structure to be an edge. Extractable formatting is table stakes and behaves like it. Keep doing it because it helps readers and retrieval; do not budget for it as a differentiator.
Measure what the answers say, not just whether you appeared. A citation count cannot distinguish a page that earned its place from one that got there by asserting something untrue about your product.
The useful frame is not that GEO is dead. It is that GEO has entered the phase every optimization discipline reaches once the platform starts paying attention: the tactics that are purely extractive get priced out, and the ones that happen to produce something real get kept. The research now names the difference precisely enough to act on — claims supported by the underlying document, versus claims that merely appear in it.
Aeonav is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces and records the full answer text alongside every mention, citation, and competitor named beside you. Because the raw answers are yours to query, you can check what an engine actually said about your brand rather than inferring it from a citation count — which is the measurement this paper's failure mode calls for.