---
title: "Citation Wars: The GEO Playbook Is Now the Attack Model"
description: "A CMU paper simulates what happens when everyone optimizes for AI citations: quality falls and filters fail. A second benchmark shows safety guardrails missing GEO-injected misinformation, and a third paper now cuts GEO's success rate from 50% to 6% — by treating the rewrite itself as the attack."
canonical: https://www.aeonav.fivecoder.com/blog/citation-wars
updated: "2026-09-06"
---

# Citation Wars: The GEO Playbook Is Now the Attack Model (/blog/citation-wars)

**Every answer engine optimization checklist tells you to add statistics, add citations, add quotations. A preprint posted on 11 August 2026 takes that advice, implements it as an attacker, and asks what happens when everyone runs it and the platform fights back.** The answer, across five rounds of simulated competition, is that document quality and answer quality both end up below where they started. Chen Xu and Chenyan Xiong of Carnegie Mellon and Zitian Guo of UC San Diego call the pattern [citation wars](https://arxiv.org/abs/2608.11390).

**Key takeaways**

- The tactics are the attack model now. One of the five GEO attackers the paper defends against is "Statistics Addition," which adds quantitative claims following the [KDD 2024 GEO paper](https://arxiv.org/abs/2311.09735) that popularised the tactic.
- Repeated optimization degrades the thing it optimizes. Five rounds on an e-commerce benchmark left "rewrite quality and answer utility both fall below the no-exploitation reference," with unsupported claims and fabricated details accumulating along the way.
- Filtering does not save the platform. A keyword scrub over 24 GEO-style phrases was close to useless, and the equilibrium the authors identify is an inert one where nobody is punished and nobody improves.
- The defense that worked pays for verifiability. VCR credits added claims, numbers, and named citations *that the original document supports*, beating the strongest baseline by an average of 12.1 percentage points.
- That is the practitioner takeaway, and it is not "stop adding statistics." It is that a sourced number and an invented one are about to stop being the same move.
- *Added 3 September:* independent confirmation, with the stakes raised. [Counter-GEO-Bench](https://arxiv.org/abs/2609.02316) pairs the same GEO optimization with injected false claims and finds the claims landing in answers 55.7% of the time undefended — and off-the-shelf safety guardrails cutting that by at most 5.7% relative. Generic filters keep failing; a detector trained on what GEO manipulation specifically does cut it by 47.6%.
- *Added 6 September:* a third group closes the loop. [GEO Defender](https://arxiv.org/abs/2609.02964) cuts the average success rate of seven published GEO methods — the KDD 2024 original among them — from 50.32% to 6.20%, keeping 94.12% of benign evidence. The attacks it neutralizes are factually consistent with the source pages. There is no misinformation to catch; the optimization signature itself is what gets demoted.
- Caveats are large: simulation, small models, LLM-judged quality, no production engine involved. Read it as a direction of travel, not a measurement.

## The setup, in plain terms [#the-setup-in-plain-terms]

The paper models AI search as two parties with one shared currency. Content suppliers want citations, because citations are how a generative engine allocates attention and attribution. The platform wants answers that are trustworthy. Both are pulling on the same document.

Formally it is a repeated Stackelberg game with partial monitoring: the platform moves first by setting a policy, suppliers respond by rewriting, and neither side sees the other's private state. Practically it is a description of a market anyone doing [generative engine optimization](/generative-engine-optimization) already lives in. The abstract states the tension without hedging: "content providers are incentivized to optimize for model citation, while platforms must preserve answer quality and trustworthy attribution."

The experiments run on three benchmarks — an e-commerce set, GEO-Bench, and Researchy-GEO — each pairing a query with five candidate documents. One document gets rewritten by an attacker; the engine then answers and cites.

## The playbook, as the research now classifies it [#the-playbook-as-the-research-now-classifies-it]

Here is the part worth sitting with. The five attackers the paper defends against are not adversarial exotica. They are the published GEO literature.

| Attacker | What it does |
|---|---|
| **AutoGEO** | The default attacker used throughout the experiments |
| **RAID** | Extracts engine-preference rules from contrastive role-conditioned answers |
| **IF-GEO** | Performs influence-based GEO |
| **SAGEO** | Performs structure-aware GEO via prompt programming |
| **Statistics Addition** | "Adds quantitative claims following the original paper" |

That last row cites Aggarwal and colleagues' *GEO: Generative Engine Optimization*, the KDD 2024 paper that reported visibility boosts of up to 40% and gave the field both its name and its benchmark. Two years on, in a paper that uses that same benchmark, the method is a baseline attack to be neutralized.

Nothing about this makes the original research dishonest, and the KDD paper is still the best empirical grounding the field has. But the asymmetry is instructive: the tactic that a marketing checklist reads as "best practice" is the thing a platform researcher reads as "the thing to detect." If you are running the 2024 playbook in 2026, you are running the thing being modelled against.

## Everyone optimizing is worse than nobody optimizing [#everyone-optimizing-is-worse-than-nobody-optimizing]

The core simulation runs five rounds. Suppliers rewrite, the platform adapts, suppliers rewrite again. The trajectory is the finding: rewrite quality and answer utility both drop below the no-exploitation reference, and the mechanism is visible in the intermediate rounds — the paper describes "accumulated unsupported claims and fabricated details, turning initially mild edits into citation-seeking rewrites."

Round one is a page with a few more numbers in it. Round five is a page making claims nobody can check.

Then the theory explains why it stalls there rather than correcting. The authors identify conditions under which the system reaches a local stationary point where the first-order utility change is roughly zero, and spell out what that state looks like: "useful content is not induced, suspicious content is weakly penalized, and further platform updates have little effect." A stalemate where the extra effort has bought nobody anything, and the content is worse than the version that existed before the competition started.

This is a familiar shape. It is what happened to on-page SEO in the exact-match-anchor era, and the resolution then was not that publishers restrained themselves. The platform changed what it paid for.

## Why filtering the phrases does not work [#why-filtering-the-phrases-does-not-work]

The instinct is that a platform just detects the pattern and drops it. The paper tests three classical defenses and finds the naive versions weak.

| Defense | Mechanism | Result |
|---|---|---|
| **Prompt defense** | Attaches suspicion labels, softly reorders documents, adds a system-prompt warning | Beaten by VCR |
| **Hard reject** | Removes suspicious documents above a threshold | Beaten by VCR |
| **Keyword scrub** | Regex filter over 24 GEO-style phrases | Effectiveness "remains close to zero" |

The keyword scrub result is the one to carry. Stylistic tells are cheap to route around, and a filter aimed at them catches last season's phrasing while the rewrite that matters walks through. Anyone hoping their competitor's obviously optimized copy will get algorithmically punished should downgrade that expectation.

The paper's scoring makes the tradeoff explicit. Its headline metric, Net, adds two quantities: the share of the attacker's advantage a defense strips away, and what that defense does to welfare relative to the reference condition. Hard rejection can score well on the first and badly on the second, because throwing out documents throws out real information along with the manipulation. A defense has to be judged on what it costs the answer, not just on what it blocks.

## The defense that worked pays for checkable substance [#the-defense-that-worked-pays-for-checkable-substance]

VCR — verifiable-content rewards — inverts the design. Rather than only punishing suspicious rewrites, the platform credits them. The credit a rewrite earns scales with a count of the "factual claims, numerical details, or named citations present in the rewrite and supported by the original document," up to a cap.

Read that qualifier twice, because it is the whole idea. Not claims present. Claims present *and supported*. A number you can trace back to something real earns credit; a number that appeared during optimization earns nothing. Across three benchmarks and three engines, VCR posted the largest Net score every time, with an average advantage of 12.1 percentage points over whichever baseline was strongest in each setting, and it also produced the highest scores on the direct document-quality dimensions the authors measure — clarity, depth, insight, and factuality.

For anyone doing [answer engine optimization](/answer-engine-optimization), that is a more useful signal than another ranking factor. It splits a piece of advice that has always been treated as one thing:

| The tactic | Under a verifiability mechanism |
|---|---|
| Adding a statistic you can source or produced yourself | Rewarded — this is precisely what the mechanism counts |
| Adding a statistic because a checklist said statistics get cited | Filtered — nothing supports it, so it earns no credit |
| Adding a named citation to a real document | Rewarded |
| Adding citation-flavoured phrasing without a referent | Filtered |

The advice "add statistics" survives. The version of it that treats numbers as decoration does not. That distinction is already worth acting on for a separate reason: fabricated specifics on your own pages can be lifted verbatim into an answer and attributed to you, which is a liability rather than an optimization.

## The misinformation variant walks through today's guardrails [#the-misinformation-variant-walks-through-todays-guardrails]

*Added 3 September 2026.* The keyword-scrub result now has independent confirmation from a second group, on the version of the attack with the most at stake. [Counter-GEO-Bench](https://arxiv.org/abs/2609.02316), by Bing Zheng and Wenming Yang of Tsinghua's Shenzhen International Graduate School with Zongyao Zhao of the University of Hong Kong — accepted to EMNLP 2026 — asks what happens when a GEO rewrite doesn't just decorate but lies. The authors built 247 human-verified queries from GEO-Bench pairs and produced two rewrites of each source: an information-preserving one (clearer structure, authoritative phrasing, citation hooks, facts intact) and an information-distorting one — the same optimization strength plus a targeted false claim injected in at least three places with varied phrasing.

Undefended, the false claim was asserted in the answer 55.7% of the time (95% CI: 53.1–58.2), averaged across three open-weight victim models. With the standard safety guardrails in front, almost nothing changed: Granite Guardian cut attack success by 1.7 percentage points (not statistically significant), Llama Guard 3 by 3.2 points — statistically real, "operationally negligible" in the authors' words — and NeMo's self-check fact-checking rail blocked 98.4% of one model's outputs whether or not anything was wrong with them. The abstract's summary is "at most 5.7% relative," and the diagnosis fits the CMU finding exactly: "Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content."

The taxonomy of eight distorting attack classes reads like the GEO checklist with its intent inverted: fake institutional authority, fabricated citations to nonexistent studies, fake freshness markers ("temporal poison"), AI-extractable formatting around a false claim ("structured hijack"), fabricated ratings and testimonials ("review flood"), and — the one aimed squarely at brands — negative GEO, content that contrasts against legitimate competing information to suppress it. Review flood was the most successful class undefended, at 62.8%. Every class is a distorted twin of something a checklist sells as best practice, which is this post's thesis restated as a threat model.

The defense pattern repeats too. As with VCR, the generic mechanism failed and the targeted one worked: the paper's baseline detector, C-GEO Guard — a 184-million-parameter encoder trained to recognize the eight attack classes by similarity — cut attack success by 47.6% relative (26.5 points absolute) with answer quality unchanged, 4.48 defended against 4.49 undefended on the paper's five-point scale. Two independent groups, one shape: defenses aimed at what GEO manipulation specifically does can work, and defenses aimed at generic badness don't. The gap in the targeted defense is instructive as well — structured hijack, the attack that hides inside extractable formatting, was the hardest class to catch, at a 22% relative reduction against 60% for the easiest. Manipulation that looks like structure survives longest.

The usual discipline applies. This is 247 English-only queries; the victims are open-weight models, not the production engines running undisclosed guardrails of their own; the attacks come from a fixed taxonomy with no detector-aware adversary; and the distortions were themselves written by an LLM. What it establishes is narrower and still uncomfortable: the defense layer actually deployed in front of today's open models does not distinguish an optimized page that informs from an optimized page that deceives.

For a brand, the exposed surface is the negative-GEO and review-flood end of that taxonomy. A page optimized into retrieval that undermines your product or fabricates satisfaction numbers for a competitor reads to current guardrails as ordinary informational content, and in this benchmark's setting more than half of such attempts reached the answer. It is the adversarial version of the [manufactured-source problem](/blog/can-you-trust-ai-citations) we covered last week, and the countermeasure available to you is the same, because the platform-side one is not deployed: record what the answers in your category actually say, so a false claim about you is something you catch in days rather than discover in a lost deal.

## The defense that works doesn't check your facts [#the-defense-that-works-doesnt-check-your-facts]

*Added 6 September 2026.* Three days after Counter-GEO-Bench, a third group — Haozhang Li and colleagues at the University of the Chinese Academy of Sciences — published the strongest platform-side result yet, and it lands somewhere more uncomfortable for the playbook than either paper before it. [GEO Defender](https://arxiv.org/abs/2609.02964) evaluated seven published GEO methods against five target LLMs and cut their average attack success rate from 50.32% to 6.20%, while retaining 94.12% of benign-evidence use and moving the average answer-quality score by 0.01. The attacker roster overlaps heavily with the CMU paper's — AutoGEO, IF-GEO, RAID — and includes the original KDD 2024 GEO method. The tactic that founded the field is now, literally, training data for a demotion model.

The design premise is the part to sit with. The paper opens from the observation that GEO-rewritten documents "remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective," and that the features they amplify "equally characterize high-quality benign content." So the defense gives up on catching lies — there are none to catch — and instead learns the *preference signature* of a GEO rewrite. A small adapter over a frozen reranker learns to demote documents that look rewritten-for-retrieval relative to their benign neighbors, before the answering model ever reads them; a second, training-free stage distills those outcomes into natural-language guidance for how the model uses sources. No fine-tuning of the target LLM is required, which is exactly the property that makes a design like this cheap for a platform to bolt on.

Notice what this dissolves: the line the previous two papers left standing. VCR distinguished supported claims from decorative ones; Counter-GEO-Bench distinguished information-preserving rewrites from information-distorting ones. GEO Defender draws no such line. In its threat model, the factually consistent, structure-improved, statistics-added rewrite — the one every checklist calls best practice and this post's earlier sections call the defensible version — *is* the attack, and demoting it is the success condition. The 94.12% benign-evidence retention means the collateral damage to ordinary pages is small; it does not mean optimized-but-honest pages are spared. They are the target class.

The usual discipline, again. This is a preprint from a single group; the 616-instance benchmark is built by the defenders themselves; the threat model assumes the attacker controls only the rewrite, not retrieval or generation; and no production engine has announced anything resembling it. A reranker demoting GEO signatures at scale would also face a moving target this paper doesn't test — a rewriter trained against the defense. What three papers in four weeks do establish, from three independent directions, is that platform-side interest in neutralizing GEO is real, tractable in research settings, and aimed at the signature of optimization rather than at falsehood. If that direction holds, the safe ground is not "optimize honestly." It is to publish pages whose value survives the rewrite being stripped away — original data, first-party facts, substance a demotion model has no incentive to bury because burying it makes the answer worse.

## What this does not show [#what-this-does-not-show]

The provenance deserves the same scrutiny the finding does.

This is a preprint, not peer-reviewed work, posted two days before this article. The authors state their own limits plainly: "the theory analyzes a local quadratic surrogate and the experiments use a finite interaction horizon; neither establishes a global equilibrium," and they note that "LLM-based claim counting and rule matching can err." A local stationary point in a five-round simulation is not proof that the live web is heading somewhere specific.

The models are also small. The primary engine is gemini-2.5-flash-lite, with gpt-4o-mini and claude-haiku-4-5 as alternates, and the platform-side components run on gpt-4o-mini at temperature zero. Those are not the systems buyers are asking about your category, and quality here is scored by an LLM rubric rather than by people.

Most importantly, VCR is a proposal. No platform has announced anything like it. What the paper establishes is that a reward-for-verifiability design outperforms penalty-only designs in simulation — which is an argument about where a rational platform's incentives point, not an announcement about where any engine is today.

That still leaves it more actionable than most of what gets written about GEO, because the direction is the same one the rest of the evidence points in. Our own study of [citation volatility](/blog/citation-volatility) found the set of domains cited for a prompt turning over 60–70% day to day, which is what a contested surface with no stable advantage looks like from the outside. A tactic that everyone can run is not an advantage for long.

## What to do on Monday [#what-to-do-on-monday]

1. **Audit your numbers for provenance, not for presence.** Go through your top pages and mark each statistic as sourced, self-generated, or neither. The third bucket is the one carrying risk, and it is usually larger than people expect on pages that were optimized rather than written.
2. **Make your own data the thing you add.** A figure you produced is checkable, is yours, and is hard for a competitor to copy. It also forces attribution, which is the fix for the [ghost citation](/blog/ghost-citations) problem of being cited without being named.
3. **Read AI-assisted rewrites for invented detail.** The failure mode in the simulation is exactly the failure mode of a model asked to make a page more citable: confident specifics that trace to nothing.
4. **Stop expecting structure to be an edge.** Extractable formatting is table stakes and behaves like it. Keep doing it because it helps readers and retrieval; do not budget for it as a differentiator.
5. **Measure what the answers say, not just whether you appeared.** A citation count cannot distinguish a page that earned its place from one that got there by asserting something untrue about your product.

## Where this leaves the playbook [#where-this-leaves-the-playbook]

The useful frame is not that GEO is dead. It is that GEO has entered the phase every optimization discipline reaches once the platform starts paying attention: the tactics that are purely extractive get priced out, and the ones that happen to produce something real get kept. The research now names the difference precisely enough to act on — claims supported by the underlying document, versus claims that merely appear in it.

[Aeonav](https://aeonav.fivecoder.com/) is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces and records the full answer text alongside every mention, citation, and competitor named beside you. Because the raw answers are yours to query, you can check what an engine actually said about your brand rather than inferring it from a citation count — which is the measurement this paper's failure mode calls for.

For the fundamentals, start with [what AI citations are](/blog/ai-citations) and [where they come from](/blog/where-ai-citations-come-from). For the adjacent research, see [what happens to GEO tactics under competition](/blog/do-geo-tactics-stop-working) and [whether the sources AI cites check out](/blog/can-you-trust-ai-citations). For the practice, see the [AEO guide](/answer-engine-optimization) and [how to track your brand in AI search](/answer-engine-optimization). For the vocabulary, the [AI search glossary](/glossary).