GEO Spam & Manipulation
Quick facts
- Industry-standard term?
- The umbrella is ours; every technique under it has a standard name: preference manipulation attack, adversarial SEO, RAG poisoning, or indirect prompt injection.
- Named in engine policy?
- Yes. Since 2026-05-15, Google's spam policies have explicitly covered 'attempting to manipulate generative AI responses in Google Search.'
- How little poisoning is needed
- GASLITE demonstrated concept-level retrieval attacks across nine dense retrievers with poisoning rates as low as 0.0001% of the corpus.
- What happens with two attackers
- PoisonArena found that strategies effective against a single attacker degraded markedly under competition, sometimes producing outright performance inversions.
- Where current activity occurs
- The two attack surfaces most often observed in the 2026 field evidence are third-party user-generated content and the assistant's client channel. Neither is on your website.
1. What counts as manipulation and what the research calls it
GEO spam and manipulation is the deliberate use of techniques whose effect on an AI answer comes from exploiting how retrieval or ranking works, rather than from making the content more useful to the person who asked.
The distinction rests on observable behavior rather than a moral judgment. Google’s Search spam policies, as revised in May 2026, define spam as “techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” The definition has two independent tests: deceiving users or manipulating the system. Either is sufficient.
“GEO spam” is an umbrella term used by practitioners, not an established term of art. Each underlying technique already has a recognized name, and those names are the best way to find the relevant research.
| How the umbrella term is used | Established term | Source of the name |
|---|---|---|
| Steering an LLM’s choice among competing sources | Preference Manipulation Attack (PMA) | Nestaas, Debenedetti & Tramèr 2024 |
| Adversarial text that lifts a document’s rank | Adversarial SEO / ranking manipulation | Pfrommer et al. 2024; Ben-Tov & Sharif 2025 |
| Hostile passages inserted into the retrieval corpus | RAG poisoning, formally Data and Model Poisoning / Vector and Embedding Weaknesses | OWASP Top 10 for LLM Applications LLM04, LLM08 |
| Instructions smuggled inside retrieved content | Indirect prompt injection | OWASP LLM01 |
| Language used in platform policy | ”Attempting to manipulate generative AI responses” | Google Search spam policies |
2. The four attack surfaces
Discussions of manipulation often assume that publishers alter their own pages. In the 2026 field evidence, however, that is the least commonly used surface.
| Surface | Who controls it | What enters | Where it acts | Evidence |
|---|---|---|---|---|
| Your own pages | You | Adversarial suffixes, strategic text sequences, hidden instructions | Grounding and synthesis | Kumar & Lakkaraju; Tang et al.; Nestaas et al. |
| The retrieval corpus | No single party | Passages engineered to rank for an entire concept | Retrieval | Ben-Tov & Sharif; Chen et al. |
| Third-party UGC | The platform | Planted comments, seeded threads, edited wiki pages | Retrieval and citation selection | Zhang, Triedman & Shmatikov; Reddit’s own enforcement data |
| The assistant’s client channel | The user | Hidden prompts carried in share links and “summarize with AI” buttons | The assistant’s memory, before retrieval begins | Microsoft Defender research |
The last two surfaces never touch your website. A crawl, schema validator, or robots.txt setting cannot detect them. In the four-step answer loop, the first two surfaces act during retrieval and grounding, the third acts during citation selection, and the fourth acts before the loop begins.
3. What the published attacks actually do
The adversarial literature now forms a coherent body of evidence rather than a series of isolated experiments. The techniques differ, but each study reports both a mechanism and an observed result. Full implementation details could make the attacks reproducible, so only the mechanism and observed result are summarized.
| Technique | Mechanism | Demonstrated against | Headline result |
|---|---|---|---|
| Preference manipulation attack (Nestaas et al.) | Content placed on a website or in plugin documentation prompts the model to promote the attacker and discredit competitors. | Bing and Perplexity in production, along with the GPT-4 and Claude plugin APIs | The approach succeeded, and the authors found that it creates a prisoner’s dilemma (§5). |
| Strategic text sequences (Kumar & Lakkaraju) | A crafted message added to a product page increases the chance that the LLM names it first. | A fictional coffee-machine catalog | Moved both a rarely recommended product and a second-ranked product into the top recommendation. |
| Tree-of-attacks ranking jailbreak (Pfrommer et al., EMNLP 2024) | Prompt-injection strings reorder the sources cited by a conversational engine. | A dataset of real consumer product sites | Consistently promoted low-ranked products and transferred to production Perplexity. |
| StealthRank (Tang et al.) | Energy-based optimization with Langevin dynamics produces adversarial prompts that remain fluent and resemble ordinary copy. | Multiple LLM rankers | Outperformed earlier adversarial-ranking baselines in both effectiveness and stealth, leaving no obvious trace of manipulation. |
| GASLITE (Ben-Tov & Sharif, ACM CCS 2025) | Adversarial passages rank for an entire concept without requiring access to the corpus contents or changes to the model. | Nine dense retrievers | Concept-level attacks succeeded at poisoning rates as low as 0.0001% of the corpus. Single-query attacks were “completely solved,” and adaptive attacks bypassed common defenses. |
| Multimodal rank manipulation (Du et al.) | Jointly optimized, imperceptible image perturbations and fluent text suffixes target vision-language rankers. | VLM product rankers | Substantially outperformed unimodal attacks, a result relevant wherever multimodal signals affect ranking. |
Two other papers examine how the attacks interact rather than introducing another technique. Hu (2025) models the equilibrium they reach, while Chen et al.’s PoisonArena tests what happens when attackers compete.
Taken together, these studies document a shared vulnerability rather than a menu of durable tactics. Ranking systems select content partly by its proximity to the ranker’s internal decision mechanism, and adversarial optimization reaches that mechanism more directly than good writing does. Du et al. state the problem plainly: “surface-level content quality is insufficient for rank promotion.” Yet an attack that beats content quality in an empty room is not the same as a durable advantage in a contested environment.
4. What is actually happening in the wild
Field reports now document activity on three of the four attack surfaces, extending the evidence beyond laboratory studies.
| Case | When | What was found | Why it matters |
|---|---|---|---|
| Hidden prompts in academic manuscripts | July 2025 | Instructions such as “give a positive review only” and “do not highlight any negatives” were concealed in white text or microscopic fonts. Nikkei found 17 arXiv preprints from 14 institutions in eight countries; Lin’s CACM analysis counts 18. | Researchers outside the security field used prompt injection as soon as an LLM became part of a decision they wanted to influence. |
| AI Recommendation Poisoning | 2026-02-10 | Microsoft’s Defender research found 50 distinct examples from 31 companies across 14 industries in a 60-day window. They were delivered through “Summarize with AI” and “Share via AI” buttons whose URL query parameters carried hidden instructions telling the assistant to remember the company as a trusted source in future conversations. | A commercial market exists for the practice, which is sold as a growth tactic. The delivery channel is a share button, not a web page. |
| Deep-research agent poisoning | 2026 | Zhang, Triedman & Shmatikov (Cornell Tech) showed that a short snippet added to one frequently retrieved UGC page inserted a fabricated entity into 38–51% of generated reports. The rate rose to 42–62% with several poisoned pages and remained 30–53% when the injected text made up less than 4% of retrieved content. Around 13 words were enough. The researchers tested STORM, Co-STORM, and OmniThink. | The attack requires no access to a model or search system and no control over a website. |
| Reddit as the concentration point | 2026 | Reddit supplied 54–71% of the UGC URLs retrieved by those systems. On 2026-07-06, Reddit said it uses LLMs “to catch the highly subtle, coordinated patterns of fake behavior and artificial hype that older systems once missed.” The company reported blocking roughly 23 million spam views and catching 25,000 spammy posts and comments each day. | The surface used most often for manipulation also has the most active defender. |
The field evidence points away from your own domain. Two of these four cases involve no publisher website at all. The documented commercial activity also uses a client-side channel that no crawl or markup audit can reach.
The numbers require two important caveats. Microsoft’s finding is a vendor security disclosure with no independent replication, while Reddit’s figures are self-reported platform statistics. They provide evidence that both the market and the enforcement activity exist, but they are weak measures of scale.
5. Why the advantage does not hold
Four independent results, produced with four different methods, point in the same direction.
| Result | Method | What it shows |
|---|---|---|
| Prisoner’s dilemma (Nestaas et al.) | Attack demonstration plus incentive analysis | Every party has an incentive to attack, but the collective effect degrades the engine’s output for everyone, including the attacker’s own retrieval environment. |
| Repeated-game equilibrium (Hu 2025) | An infinitely repeated prisoner’s dilemma involving attack cost, discount rate, success probability, and trigger strategies | Cooperation remains sustainable above identifiable thresholds. Counterintuitively, reducing attack success probability can itself encourage attacks under some conditions. |
| Competition collapse (Chen et al., PoisonArena, KDD 2026) | A multi-adversary RAG-poisoning benchmark with an explicit competitive-effectiveness metric | Strategies that succeed against a single attacker “degrade markedly under competition,” with outright performance inversions. The study also shows that single-attacker success rate and F1 are inadequate metrics. |
| Optimization collapse (Puerto et al., C-SEO Bench) | The same question applied to legitimate conversational-SEO rewrites | Many rewrites become ineffective or counterproductive once more than one author pursues them. |
Related GEO evidence shows the same pattern. Aggarwal et al. found that Keyword Stuffing did not increase visibility and could reduce it. The reported headline lift also fell from up to ~40% on an internal harness to up to ~22% on a live engine (paper summary), a gap consistent with trust filtering on the live system.
Single-attacker lift is an upper bound measured in an empty room. Every number in §3 was produced with one adversary present. In both studies that added a second adversary, the measured gains declined.
The conclusion is not that these techniques never work. Several have demonstrably worked against production systems. The evidence instead shows that their measured gains are contested and temporary, while policy penalties do not share those limits. The same need for honest qualification applies to content freshness. Relevance, rather than credibility styling, dominates which of two competing sources a model prefers (Wan et al.). An adversarial suffix cannot preserve that advantage once another source is also being optimized.
6. How engines and platforms respond
6.1 Policy
Google is the only major engine with an explicit, dated, written position. The policy is recent enough that most published GEO advice predates it. On 2026-05-15, the introduction to Google’s spam policies was rewritten:
| Wording | |
|---|---|
| Before | ”Spam refers to techniques used to deceive users or manipulate our Search systems into ranking content highly.” |
| After | ”Spam refers to techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” |
The sixteen named policy categories already cover most of the behavior described in §3 and §4 under terms that predate generative search: hidden text and link abuse (the academic white-text case), cloaking, scaled content abuse, site reputation abuse, link spam, and user-generated spam. Google did not create a separate policy for AI-answer manipulation. It brought the behavior under its existing spam policies, subjecting AI Overviews and AI Mode to the same demotion or removal policies as ranking spam.
The connection between that policy change and the next spam update remains an inference. Google’s June 2026 spam update began on 2026-06-24 and ran for about two days, according to the Search Status Dashboard. Industry commentary widely described it as the first enforcement wave under the new wording, but Google did not characterize it that way. The dashboard names no targeted tactic, and Google has not said whether it enforces generative-AI manipulation through SpamBrain, a dedicated system, or manual action. Only the dates and the policy change are established facts.
As of July 2026, OpenAI, Anthropic, and Perplexity publish no policy that names AI-answer manipulation. Their documented approaches instead rely on source-side authority signals rather than rules for individual tactics, as AI content detection explains.
6.2 Technical defense
- Google runs a layered program against indirect prompt injection in Gemini and Workspace. It names five layers, including injection classifiers, security thought reinforcement, markdown sanitization and URL redaction, and a user-confirmation framework (see Google Security, June 2025). The program explicitly assumes that some injections will succeed. Its goal is to make attacks easier to identify or more expensive to run, not to prevent every attempt.
- Microsoft ships cross-prompt-injection protections in Copilot and, in its own disclosure, recommends that users review and clear stored assistant memories.
- Platforms also defend at the UGC layer. Reddit’s LLM-based detection of coordinated behavior is the visible example.
- Retrieval-layer defenses studied in the literature include source filtering and output-based detection; GASLITE’s adaptive attacks bypassed common defenses. Published defenses reduce the risk but do not eliminate it.
- OWASP’s Top 10 for LLM Applications provides a shared vocabulary for security teams: LLM01 Prompt Injection, LLM04 Data and Model Poisoning, and LLM08 Vector and Embedding Weaknesses. LLM08 is OWASP’s first dedicated treatment of RAG and embedding-store risk.
Publishers cannot observe any of these defenses directly. There is no manipulation score, no “your brand was targeted” report, and no appeal channel. Any practical response must account for that lack of visibility.
7. The line between optimization and manipulation
Three practical tests help distinguish optimization from manipulation.
The reader test. Is the text written for a person to read? White text, zero-size fonts, invisible suffixes, adversarial token strings, and instructions addressed to “the AI” all fail this test. Google’s policy list has covered such behavior under existing categories for two decades.
The mechanism test. Does the technique work because the content became more useful to the person asking, or because it directly reaches a ranking mechanism? This test applies Du et al.’s finding that surface quality and proximity to the mechanism are different things.
The disclosure test. Would you describe the tactic plainly to the engine’s spam team and to the client whose brand it promotes? This is the weakest test as evidence but often the most reliable in practice.
| Practice | Why it gets confused with the other side | Which side | On what grounds |
|---|---|---|---|
| Writing an answer-shaped opening paragraph | It can look like formatting for machines. | Optimization | It makes the passage more useful to the person asking. See writing for AI citation. |
| Publishing original data because AI engines cite statistics | The motive is explicitly visibility. | Optimization | The data is real, and motive does not affect the reader or mechanism tests. |
Adding corroborating sameAs references to an author’s markup | Structured data is text intended for machines. | Optimization | It becomes an unsupported claim and a policy violation only when the body does not support it. See schema for AI. |
Advancing dateModified with no substantive change | It can look like routine maintenance. | Manipulation | The stated date asserts something the content does not support. See content freshness. |
| Seeding a forum thread with an undisclosed brand affiliation | It resembles ordinary community participation. | Manipulation | It fails the disclosure test and matches behavior that platforms actively detect. |
| Paying for placement in a “best X” listicle on a high-authority domain | It resembles ordinary PR or sponsorship. | Manipulation in most forms | Existing policy defines this as site reputation abuse. |
| A share link whose prompt parameter tells the assistant to remember you as authoritative | It is presented as a convenience feature. | Manipulation | It fails all three tests, as illustrated by the Microsoft case in §4. |
| Adversarial suffixes, strategic text sequences, stealth-optimized prompts | They are sometimes described as “AI-readable copy.” | Manipulation | They unambiguously fail the mechanism test. |
The boundary does not depend on taste. The tests ask neither which tool you used nor what you intended. They ask whether the effect survives disclosure. Legitimate optimization continues to work after you explain it. Manipulation stops working or attracts a penalty once it is visible.
8. What practitioners can do
Based on the 2026 evidence, most practitioners are more likely to be targeted or caught in someone else’s campaign than to run one themselves.
Monitor the surfaces you do not control. The third and fourth surfaces in §2 are invisible to every site-side audit, which makes monitoring especially valuable. Track how your brand appears in AI answers for category queries, which competitor entities appear beside it without a credible source, and where users discuss the category on third-party platforms. Brand mention tracking and AI citation tracking explain the process. GEO metrics defines the measurements, while brand mentions explains why third-party sources can carry citation weight.
Audit your own injection vectors. Review user-generated content on your domain that an engine may retrieve as yours. Check share or “summarize” links that pass free text to an assistant through URL parameters. Inspect third-party content on your subdomains or subfolders, where site reputation abuse creates a policy risk for you rather than the partner. Also audit any surface where a contributor’s text can reach a model without review. These checks belong in a standard GEO audit.
Know what a poisoned answer looks like. The Cornell and Microsoft research suggests three warning signs: an unfamiliar entity described as “emerging” or “increasingly popular” despite having no established footprint; a recommendation supported by only one user-generated thread; or an assistant calling a vendor authoritative when nobody in the session made that claim. The first reverses the usual entity recognition problem.
Understand the available recourse. Google accepts spam reports, and its policies now explicitly cover AI-answer manipulation. Platforms accept reports about inauthentic UGC. Other engines provide no published complaint channel for this issue, and none reports whether you were targeted. In practice, the available remedy is to outperform the planted source on the signals engines weigh.
| Your intent | Relevant guide |
|---|---|
| Find out whether I am being cited or displaced | AI citation tracking |
| Watch third-party surfaces for planted mentions | Brand mention tracking |
| Audit my own site for injection vectors | GEO audit |
| Understand what gets down-weighted when nobody is attacking | AI content detection |
| Earn the position instead of taking it | Citability · E-E-A-T |
| Understand how manipulation relates to GEO | Generative Engine Optimization |
References
Platform and standards documentation, current as of July 2026:
- Google Search Central: Spam Policies for Google Web Search · Search Status Dashboard, ranking updates history
- Google: Mitigating prompt injection attacks with a layered defense strategy (2025-06-13)
- Microsoft Security: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning (2026-02-10)
- OWASP GenAI Security Project: Top 10 for LLM Applications (2025)
- Reddit, Inc.: How We’re Keeping Reddit Real and Safe in the AI Era (2026-07-06)
Adversarial research:
- Nestaas, F., Debenedetti, E., & Tramèr, F. (2024). Adversarial Search Engine Optimization for Large Language Models. arXiv:2406.18382
- Pfrommer, S., Bai, Y., Gautam, T., & Sojoudi, S. (2024). Ranking Manipulation for Conversational Search Engines. EMNLP 2024 Main. arXiv:2406.03589
- Kumar, A., & Lakkaraju, H. (2024). Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981
- Tang, Y., Fan, Y., Yu, C., Yang, T., Zhao, Y., & Hu, X. (2025). StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization. arXiv:2504.05804
- Ben-Tov, M., & Sharif, M. (2025). GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search. ACM CCS 2025. arXiv:2412.20953
- Du, Y., Yu, C., Xu, H., Wang, Z., Zhao, Y., & Hu, X. (2026). Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers. arXiv:2601.12263
- Hu, X. (2025). Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines. arXiv:2501.00745
- Chen, L., et al. (2025). PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation. KDD 2026. arXiv:2505.12574
- Zhang, T., Triedman, H., & Shmatikov, V. (2026). Deep-Research Agents Can Be Poisoned via User-Generated Content. arXiv:2605.24245
- Lin, Z. (2026). Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review. Communications of the ACM 69(7), 53–56. arXiv:2507.06185
Context and counter-evidence:
- Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., & Deshpande, A. (2024). GEO: Generative Engine Optimization. KDD ‘24. arXiv:2311.09735 · ACM DL · paper summary
- Wan, A., Wallace, E., & Klein, D. (2024). What Evidence Do Language Models Find Convincing? ACL 2024 Main. arXiv:2402.11782 · paper summary
- Puerto, H., Gubri, M., Green, C., Oh, S. J., & Yun, S. (2025). C-SEO Bench: Does Conversational SEO Work? NeurIPS ‘25 Datasets & Benchmarks. arXiv:2506.11097
- Nikkei Asia: ‘Positive review only’: Researchers hide AI prompts in papers (2025-07-01)
- Search Engine Land: Google updates Search spam policies to clarify it applies to generative AI responses (2026-05-15) · A 13-word edit can steer what deep-research AI agents recommend
Frequently asked questions
Should I worry that a competitor is planting content about my brand on Reddit?
Is trying to get my brand into AI answers itself spam?
I allow comments and user profiles on my site. Can that be used against me?
Do the techniques in the adversarial papers actually work?
If I think I have been targeted, who do I complain to?
See also
Sources
Primary
- Spam Policies for Google Web Search · Google Search Central
- Google Search Status Dashboard — ranking updates history · Google
- Mitigating prompt injection attacks with a layered defense strategy · Google · 2025-06-13
- Manipulating AI memory for profit: The rise of AI Recommendation Poisoning · Microsoft Security Blog · 2026-02-10
- OWASP Top 10 for LLM Applications (2025) · OWASP GenAI Security Project
- How We're Keeping Reddit Real and Safe in the AI Era · Reddit, Inc. · 2026-07-06
- Adversarial Search Engine Optimization for Large Language Models (Nestaas et al. 2024) · arXiv / ETH Zürich · 2024-06-26
- Ranking Manipulation for Conversational Search Engines (Pfrommer et al., EMNLP 2024) · arXiv / EMNLP 2024 Main · 2024-06-05
- Manipulating Large Language Models to Increase Product Visibility (Kumar & Lakkaraju 2024) · arXiv / Harvard · 2024-04-11
- StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization (Tang et al. 2025) · arXiv · 2025-04-08
- GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search (Ben-Tov & Sharif, ACM CCS 2025) · arXiv / ACM CCS 2025 · 2024-12-30
- Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers (Du et al. 2026) · arXiv · 2026-01-20
- Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines (Hu 2025) · arXiv · 2025-01-01
- PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation (Chen et al., KDD 2026) · arXiv / ACM SIGKDD 2026 · 2025-05-18
- Deep-Research Agents Can Be Poisoned via User-Generated Content (Zhang, Triedman & Shmatikov 2026) · arXiv / Cornell Tech · 2026-05-28
- GEO: Generative Engine Optimization (Aggarwal et al., KDD '24) · arXiv · 2024-06-28
- GEO: Generative Engine Optimization (KDD '24 Proceedings) · ACM SIGKDD · 2024-08-25
- What Evidence Do Language Models Find Convincing? (Wan et al., ACL 2024) · arXiv / ACL 2024 Main · 2024-02-19
Secondary
- Google updates Search spam policies to clarify it applies to generative AI responses · Search Engine Land
- Reddit is using LLMs to solve a problem LLMs largely created · TechCrunch
- A 13-word edit can steer what deep-research AI agents recommend · Search Engine Land
- Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review (Lin 2026) · arXiv / Communications of the ACM 69(7)
- 'Positive review only': Researchers hide AI prompts in papers · Nikkei Asia
- C-SEO Bench: Does Conversational SEO Work? (Puerto et al., NeurIPS '25 D&B) · arXiv / NeurIPS '25 D&B