GEO Spam & Manipulation
Quick facts
- Industry-standard term?
- The umbrella is ours; every technique under it has a standard name — preference manipulation attack, adversarial SEO, RAG poisoning, indirect prompt injection
- Named in engine policy?
- Yes — since 2026-05-15 Google's spam policies explicitly cover 'attempting to manipulate generative AI responses in Google Search'
- How little poisoning it takes
- GASLITE achieved concept-level retrieval attacks at poisoning rates as low as 0.0001% of the corpus, across nine dense retrievers
- What happens with two attackers
- PoisonArena found strategies that succeed against a single attacker degrade markedly under competition, with outright performance inversions
- Where the live activity is
- The two most-used attack surfaces in 2026 field evidence — third-party user-generated content and the assistant's own client channel — are not on your website
1. What counts as manipulation, and what the field calls it
GEO spam and manipulation is the deliberate use of techniques whose effect on an AI answer comes from exploiting how retrieval or ranking works, rather than from making the content more useful to the person who asked.
That definition has a checkable anchor rather than a moral one. Google’s Search spam policies, as revised in May 2026, define spam as “techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” Two limbs — deceive users, or manipulate the system — and either alone is sufficient.
“GEO spam” is a practitioner umbrella, not a term of art. Every technique underneath it already has a name, and using those names is what makes the topic searchable in the literature.
| Umbrella term used here | What the field calls it | Where the name comes from |
|---|---|---|
| Steering an LLM’s choice among competing sources | Preference Manipulation Attack (PMA) | Nestaas, Debenedetti & Tramèr 2024 |
| Adversarial text that lifts a document’s rank | Adversarial SEO / ranking manipulation | Pfrommer et al. 2024; Ben-Tov & Sharif 2025 |
| Hostile passages inserted into the retrieval corpus | RAG poisoning, formally Data and Model Poisoning / Vector and Embedding Weaknesses | OWASP Top 10 for LLM Applications LLM04, LLM08 |
| Instructions smuggled inside retrieved content | Indirect prompt injection | OWASP LLM01 |
| The platform-side framing | ”Attempting to manipulate generative AI responses” | Google Search spam policies |
2. The four attack surfaces
Manipulation is usually discussed as something a publisher does to their own pages. On the 2026 field evidence that is the least used surface.
| Surface | Who controls it | What enters | Where it acts | Evidence |
|---|---|---|---|---|
| Your own pages | You | Adversarial suffixes, strategic text sequences, hidden instructions | Grounding and synthesis | Kumar & Lakkaraju; Tang et al.; Nestaas et al. |
| The retrieval corpus | Nobody in particular | Passages engineered to rank for a whole concept | Retrieval | Ben-Tov & Sharif; Chen et al. |
| Third-party UGC | The platform | Planted comments, seeded threads, edited wiki pages | Retrieval and citation selection | Zhang, Triedman & Shmatikov; Reddit’s own enforcement data |
| The assistant’s client channel | The user | Hidden prompts carried in share links and “summarize with AI” buttons | The assistant’s memory, before retrieval runs | Microsoft Defender research |
The consequence is the organizing fact of this entry: the last two surfaces never touch your website. Nothing in a crawl, a schema validator, or a robots.txt setting sees them. Mapped onto the four steps of the answer loop, the first two surfaces act at retrieval and grounding, the third at citation selection, and the fourth before the loop starts at all.
3. What the published attacks actually do
The adversarial literature is now large enough to read as a body rather than a series of curiosities. What follows is mechanism and result — not method. Every result below was published with working code or reproducible detail that this entry deliberately does not restate.
| Technique | Mechanism | Demonstrated against | Headline result |
|---|---|---|---|
| Preference manipulation attack (Nestaas et al.) | Crafted site or plugin-documentation content that gets the model to promote the attacker and discredit competitors | Production Bing and Perplexity; GPT-4 and Claude plugin APIs | Works — and the authors show it produces a prisoner’s dilemma (§5) |
| Strategic text sequences (Kumar & Lakkaraju) | A crafted message added to a product page raises the chance the LLM names it first | A fictional coffee-machine catalog | Lifted both a rarely-recommended and a second-ranked product to top recommendation |
| Tree-of-attacks ranking jailbreak (Pfrommer et al., EMNLP 2024) | Prompt-injection strings that reorder the sources a conversational engine cites | A dataset of real consumer product sites | Reliably promotes low-ranked products, and transfers to production Perplexity |
| StealthRank (Tang et al.) | Energy-based optimization with Langevin dynamics produces adversarial prompts that stay fluent and read as ordinary copy | Multiple LLM rankers | Beats prior adversarial-ranking baselines on effectiveness and stealth — the manipulation leaves no obvious trace |
| GASLITE (Ben-Tov & Sharif, ACM CCS 2025) | Adversarial passages that rank for an entire concept, requiring neither the corpus contents nor any model change | Nine dense retrievers | Concept-level attacks succeed at poisoning rates as low as 0.0001% of the corpus; single-query attacks “completely solved”; adaptive attacks bypass common defenses |
| Multimodal rank manipulation (Du et al.) | Jointly optimized imperceptible image perturbations plus fluent text suffixes against vision-language rankers | VLM product rankers | Substantially exceeds unimodal attacks — relevant wherever multimodal signals feed ranking |
Two further papers belong to this cluster but pay off as argument rather than technique: Hu (2025) on the equilibrium these attacks settle into, and Chen et al.’s PoisonArena on what happens when attackers collide. Both are §5.
Read together, the literature is not a menu. Its unifying finding is that ranking systems select on proximity to the ranker’s internal decision mechanism, and adversarial optimization reaches that mechanism more directly than good writing does. Du et al. state the uncomfortable version outright: “surface-level content quality is insufficient for rank promotion.” That is precisely why the competition results matter — an attack that beats content quality in an empty room is a different object from a durable advantage in a contested one.
4. What is actually happening in the wild
Three of the four surfaces now have field evidence, not just lab evidence.
| Case | When | What was found | Why it matters |
|---|---|---|---|
| Hidden prompts in academic manuscripts | July 2025 | Instructions such as “give a positive review only” and “do not highlight any negatives,” concealed in white text or microscopic fonts. Nikkei found 17 arXiv preprints from 14 institutions in eight countries; Lin’s CACM analysis counts 18 | Ordinary non-security actors will deploy prompt injection the moment an LLM sits in a decision path they care about |
| AI Recommendation Poisoning | 2026-02-10 | Microsoft’s Defender research found 50 distinct examples from 31 companies across 14 industries in a 60-day window, delivered through “Summarize with AI” and “Share via AI” buttons whose URL query parameters carry hidden instructions telling the assistant to remember the company as a trusted source in future conversations | A commercial market exists, it is sold as a growth tactic, and its delivery channel is a share button rather than a web page |
| Deep-research agent poisoning | 2026 | Zhang, Triedman & Shmatikov (Cornell Tech) showed a short appended snippet on one frequently-retrieved UGC page inserts a fabricated entity into 38–51% of generated reports, rising to 42–62% with several poisoned pages, and still 30–53% when the injected text is under 4% of retrieved content. Around 13 words was enough. Tested on STORM, Co-STORM and OmniThink | The attack needs no model access, no search access, and no website of your own |
| Reddit as the concentration point | 2026 | Reddit supplied 54–71% of the UGC URLs those systems retrieved. On 2026-07-06 Reddit said it uses LLMs “to catch the highly subtle, coordinated patterns of fake behavior and artificial hype that older systems once missed,” reporting roughly 23 million spam views blocked and 25,000 spammy posts and comments caught per day | The surface most used for manipulation is also the one with the most active defender |
The reading to take from this: the field evidence points away from your own domain. Two of these four cases involve no publisher website at all, and the one commercial market found operating in the wild runs through a client-side channel that no crawl or markup audit touches.
Two sourcing caveats belong with the numbers. The Microsoft finding is a vendor security disclosure with no independent replication, and Reddit’s figures are self-reported platform statistics. Both are solid as existence proofs — the market exists, the enforcement exists — and weak as magnitudes.
5. Why the advantage does not hold
Four independent results, from four different methods, converge on the same shape.
| Result | Method | What it shows |
|---|---|---|
| Prisoner’s dilemma (Nestaas et al.) | Attack demonstration plus incentive analysis | All parties are incentivized to attack, and the collective effect degrades the engine’s output for everyone — including the attacker’s own retrieval environment |
| Repeated-game equilibrium (Hu 2025) | Infinitely repeated prisoner’s dilemma over attack cost, discount rate, success probability and trigger strategies | Cooperation is sustainable above identifiable thresholds — and, counterintuitively, reducing attack success probability can itself incentivize attacks under some conditions |
| Competition collapse (Chen et al., PoisonArena, KDD 2026) | A multi-adversary RAG-poisoning benchmark with an explicit competitive-effectiveness metric | Strategies that succeed against a single attacker “degrade markedly under competition,” with outright performance inversions; single-attacker success rate and F1 are shown to be inadequate metrics |
| Optimization collapse (Puerto et al., C-SEO Bench) | The same question asked of legitimate conversational-SEO rewrites | Many become ineffective or counterproductive once more than one author chases them |
This lands on ground the site already holds. Aggarwal et al. found that Keyword Stuffing — the classic SEO reflex — did not raise visibility and could hurt, and their headline lift fell from up to ~40% on an internal harness to up to ~22% on a live engine (paper summary). The live-engine gap reads as trust filtering doing its job.
The load-bearing line: single-attacker lift is an upper bound measured in an empty room. Every number in §3 was produced with one adversary present. Both studies that added a second adversary watched the numbers fall.
One caveat has to survive the edit, for the same reason content freshness keeps its own: the argument here is not that these techniques never work. Several demonstrably do, against production systems. It is that the measured gain is contested, temporary, and asymmetric against a policy penalty that is neither. Relevance, not credibility styling, dominates which of two competing sources a model prefers (Wan et al.) — and relevance is not something an adversarial suffix can hold onto once someone else is optimizing too.
6. What the engines and platforms do about it
6.1 Policy
Google is the only major engine with an explicit, dated, written position, and it is recent enough that most published GEO advice predates it. On 2026-05-15 the spam-policy introduction was rewritten:
| Wording | |
|---|---|
| Before | ”Spam refers to techniques used to deceive users or manipulate our Search systems into ranking content highly.” |
| After | ”Spam refers to techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” |
The practically useful observation is that the sixteen named policy categories already cover most of §3 and §4 under names that predate generative search: hidden text and link abuse (the academic white-text case), cloaking, scaled content abuse, site reputation abuse, link spam, and user-generated spam. AI-answer manipulation was not given a new policy — it was brought inside the old ones, which is what puts AI Overviews and AI Mode on the same demotion-or-removal footing as ranking spam.
One honesty note. Google’s June 2026 spam update rolled out starting 2026-06-24 and ran about two days, per the Search Status Dashboard, and industry commentary widely read it as the first enforcement wave under the new wording. Google said no such thing. The dashboard entry names no targeted tactic, and Google has not stated whether generative-AI manipulation is enforced through SpamBrain, a dedicated system, or manual action. The dates are fact; the enforcement linkage is inference.
OpenAI, Anthropic and Perplexity publish no policy naming AI-answer manipulation as of July 2026 — consistent with the position AI content detection records, that they route through source-side authority signals instead of a tactic rule.
6.2 Technical defense
- Google runs a layered program against indirect prompt injection in Gemini and Workspace, naming five layers including injection classifiers, security thought reinforcement, markdown sanitization and URL redaction, and a user-confirmation framework (see Google Security, June 2025). Its explicit design assumption is that some injections succeed — the goal is making attacks easier to identify or more expensive to run, not preventing them.
- Microsoft ships cross-prompt-injection protections in Copilot and, in its own disclosure, recommends the user-side mitigation of reviewing and clearing stored assistant memories.
- Platforms defend at the UGC layer — Reddit’s LLM-based coordinated-behavior detection is the visible example.
- Retrieval-layer defenses studied in the literature include source filtering and output-based detection; GASLITE’s adaptive attacks bypassed common defenses. The honest summary is that published defenses reduce but do not eliminate.
- OWASP’s Top 10 for LLM Applications supplies the vocabulary to hand a security team: LLM01 Prompt Injection, LLM04 Data and Model Poisoning, and LLM08 Vector and Embedding Weaknesses — the last being OWASP’s first dedicated treatment of RAG and embedding-store risk.
None of these produce a signal a publisher can see. There is no manipulation score, no “your brand was targeted” report, and no appeal surface. That asymmetry is the situation §8 has to work inside.
7. The line between optimization and manipulation
Three tests, each checkable, in ascending order of usefulness.
The reader test. Is this text written to be read by a person? White text, zero-size fonts, invisible suffixes, adversarial token strings, and instructions addressed to “the AI” all fail on inspection — and all of them already have a name in Google’s policy list that predates generative search by two decades.
The mechanism test. Does the technique work because the content became more useful to the asker, or because a ranking mechanism was reached directly? This is the operational form of Du et al.’s finding that surface quality and mechanism proximity are different things.
The disclosure test. Would you describe the tactic, unedited, to the engine’s spam team and to the client whose brand carries it? Weakest as evidence, most reliable in practice.
| Practice | Why it gets confused with the other side | Which side | On what grounds |
|---|---|---|---|
| Writing an answer-shaped opening paragraph | Looks like formatting for machines | Optimization | It makes the passage more useful to the asker — see writing for AI citation |
| Publishing original data because AI engines cite statistics | The motive is explicitly visibility | Optimization | The data is real; motive is irrelevant to the reader and mechanism tests |
Marking up an author with sameAs corroboration | Structured data is machine-only text | Optimization | Becomes over-claim, and a policy violation, only when the body does not support it (schema for AI) |
Advancing dateModified with no substantive change | Feels like routine maintenance | Manipulation | The stated date asserts something the content does not support (content freshness) |
| Seeding a forum thread with an undisclosed brand affiliation | Reads as ordinary community participation | Manipulation | Fails the disclosure test outright, and is what platforms are actively detecting |
| Paying for placement in a “best X” listicle on a high-authority domain | Looks like ordinary PR or sponsorship | Manipulation in most forms | This is site reputation abuse under its existing name |
| A share link whose prompt parameter tells the assistant to remember you as authoritative | Presented as a convenience feature | Manipulation | Fails all three tests — the §4 Microsoft case |
| Adversarial suffixes, strategic text sequences, stealth-optimized prompts | Sometimes described as “AI-readable copy” | Manipulation | Mechanism test, unambiguously |
What makes the line stable rather than a matter of taste: the tests do not ask what tool you used or what you intended — they ask whether the effect survives being visible. An optimization works just as well after you explain it. A manipulation stops working, or gets penalized, the moment it is seen.
8. What to actually do
On the 2026 evidence, the realistic exposure for almost every reader is being targeted, or being collateral damage in someone else’s campaign — not deciding whether to run one.
Monitor the surfaces you do not control. This is the highest-value habit, because §2’s third and fourth surfaces are invisible to every site-side audit. Watch how your brand appears in AI answers for your own category queries, which competitor entities appear alongside you without a credible source, and where your category gets discussed on user-generated platforms. The tracking mechanics are in brand mention tracking and AI citation tracking; the measurement definitions are in GEO metrics, and brand mentions covers why third-party surfaces carry citation weight at all.
Audit your own injection vectors. A short list a publisher can act on: user-generated content on your domain that an engine will retrieve as yours; share or “summarize” links that pass free text into an assistant through URL parameters; third-party content published on your subdomains or subfolders, where site reputation abuse is your policy problem rather than the partner’s; any surface where a contributor’s text reaches a model unreviewed. This folds into an ordinary GEO audit.
Know what a poisoned answer looks like. Three recognition cues from the Cornell and Microsoft work: an unfamiliar entity described as “emerging” or “increasingly popular” with no established footprint — the entity recognition question asked in reverse; a recommendation whose only support is a single user-generated thread; an assistant asserting that a vendor is authoritative in a session where you never said so.
Recourse, honestly. Google accepts spam reports and its policies now name AI-answer manipulation. Platforms accept reports about inauthentic UGC. The other engines publish no complaint surface for this, and none of them will tell you that you were targeted. The realistic remedy is out-competing the planted source on the signals engines actually weigh.
| Your intent | First stop |
|---|---|
| Find out whether I am being cited or displaced | AI citation tracking |
| Watch third-party surfaces for planted mentions | Brand mention tracking |
| Audit my own site for injection vectors | GEO audit |
| Understand what gets down-weighted when nobody is attacking | AI content detection |
| Earn the position instead of taking it | Citability · E-E-A-T |
| See where this sits in the method | Generative Engine Optimization |
References
Platform and standards documentation (as of 2026-07):
- Google Search Central — Spam Policies for Google Web Search · Search Status Dashboard, ranking updates history
- Google — Mitigating prompt injection attacks with a layered defense strategy (2025-06-13)
- Microsoft Security — Manipulating AI memory for profit: The rise of AI Recommendation Poisoning (2026-02-10)
- OWASP GenAI Security Project — Top 10 for LLM Applications (2025)
- Reddit, Inc. — How We’re Keeping Reddit Real and Safe in the AI Era (2026-07-06)
Adversarial research:
- Nestaas, F., Debenedetti, E., & Tramèr, F. (2024). Adversarial Search Engine Optimization for Large Language Models. arXiv:2406.18382
- Pfrommer, S., Bai, Y., Gautam, T., & Sojoudi, S. (2024). Ranking Manipulation for Conversational Search Engines. EMNLP 2024 Main. arXiv:2406.03589
- Kumar, A., & Lakkaraju, H. (2024). Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981
- Tang, Y., Fan, Y., Yu, C., Yang, T., Zhao, Y., & Hu, X. (2025). StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization. arXiv:2504.05804
- Ben-Tov, M., & Sharif, M. (2025). GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search. ACM CCS 2025. arXiv:2412.20953
- Du, Y., Yu, C., Xu, H., Wang, Z., Zhao, Y., & Hu, X. (2026). Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers. arXiv:2601.12263
- Hu, X. (2025). Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines. arXiv:2501.00745
- Chen, L., et al. (2025). PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation. KDD 2026. arXiv:2505.12574
- Zhang, T., Triedman, H., & Shmatikov, V. (2026). Deep-Research Agents Can Be Poisoned via User-Generated Content. arXiv:2605.24245
- Lin, Z. (2026). Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review. Communications of the ACM 69(7), 53–56. arXiv:2507.06185
Context and counter-evidence:
- Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., & Deshpande, A. (2024). GEO: Generative Engine Optimization. KDD ‘24. arXiv:2311.09735 · ACM DL · paper summary
- Wan, A., Wallace, E., & Klein, D. (2024). What Evidence Do Language Models Find Convincing? ACL 2024 Main. arXiv:2402.11782 · paper summary
- Puerto, H., Gubri, M., Green, C., Oh, S. J., & Yun, S. (2025). C-SEO Bench: Does Conversational SEO Work? NeurIPS ‘25 Datasets & Benchmarks. arXiv:2506.11097
- Nikkei Asia — ‘Positive review only’: Researchers hide AI prompts in papers (2025-07-01)
- Search Engine Land — Google updates Search spam policies to clarify it applies to generative AI responses (2026-05-15) · A 13-word edit can steer what deep-research AI agents recommend
Frequently asked questions
Should I worry that a competitor is planting content about my brand on Reddit?
Is trying to get my brand into AI answers itself spam?
I allow comments and user profiles on my site. Can that be used against me?
Do the techniques in the adversarial papers actually work?
If I think I have been targeted, who do I complain to?
See also
Sources
Primary
- Spam Policies for Google Web Search · Google Search Central
- Google Search Status Dashboard — ranking updates history · Google
- Mitigating prompt injection attacks with a layered defense strategy · Google · 2025-06-13
- Manipulating AI memory for profit: The rise of AI Recommendation Poisoning · Microsoft Security Blog · 2026-02-10
- OWASP Top 10 for LLM Applications (2025) · OWASP GenAI Security Project
- How We're Keeping Reddit Real and Safe in the AI Era · Reddit, Inc. · 2026-07-06
- Adversarial Search Engine Optimization for Large Language Models (Nestaas et al. 2024) · arXiv / ETH Zürich · 2024-06-26
- Ranking Manipulation for Conversational Search Engines (Pfrommer et al., EMNLP 2024) · arXiv / EMNLP 2024 Main · 2024-06-05
- Manipulating Large Language Models to Increase Product Visibility (Kumar & Lakkaraju 2024) · arXiv / Harvard · 2024-04-11
- StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization (Tang et al. 2025) · arXiv · 2025-04-08
- GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search (Ben-Tov & Sharif, ACM CCS 2025) · arXiv / ACM CCS 2025 · 2024-12-30
- Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers (Du et al. 2026) · arXiv · 2026-01-20
- Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines (Hu 2025) · arXiv · 2025-01-01
- PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation (Chen et al., KDD 2026) · arXiv / ACM SIGKDD 2026 · 2025-05-18
- Deep-Research Agents Can Be Poisoned via User-Generated Content (Zhang, Triedman & Shmatikov 2026) · arXiv / Cornell Tech · 2026-05-28
- GEO: Generative Engine Optimization (Aggarwal et al., KDD '24) · arXiv · 2024-06-28
- GEO: Generative Engine Optimization (KDD '24 Proceedings) · ACM SIGKDD · 2024-08-25
- What Evidence Do Language Models Find Convincing? (Wan et al., ACL 2024) · arXiv / ACL 2024 Main · 2024-02-19
Secondary
- Google updates Search spam policies to clarify it applies to generative AI responses · Search Engine Land
- Reddit is using LLMs to solve a problem LLMs largely created · TechCrunch
- A 13-word edit can steer what deep-research AI agents recommend · Search Engine Land
- Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review (Lin 2026) · arXiv / Communications of the ACM 69(7)
- 'Positive review only': Researchers hide AI prompts in papers · Nikkei Asia
- C-SEO Bench: Does Conversational SEO Work? (Puerto et al., NeurIPS '25 D&B) · arXiv / NeurIPS '25 D&B