GEO Spam & Manipulation

1. What counts as manipulation, and what the field calls it

GEO spam and manipulation is the deliberate use of techniques whose effect on an AI answer comes from exploiting how retrieval or ranking works, rather than from making the content more useful to the person who asked.

That definition has a checkable anchor rather than a moral one. Google’s Search spam policies, as revised in May 2026, define spam as “techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” Two limbs — deceive users, or manipulate the system — and either alone is sufficient.

“GEO spam” is a practitioner umbrella, not a term of art. Every technique underneath it already has a name, and using those names is what makes the topic searchable in the literature.

2. The four attack surfaces

Manipulation is usually discussed as something a publisher does to their own pages. On the 2026 field evidence that is the least used surface.

The consequence is the organizing fact of this entry: the last two surfaces never touch your website. Nothing in a crawl, a schema validator, or a robots.txt setting sees them. Mapped onto the four steps of the answer loop, the first two surfaces act at retrieval and grounding, the third at citation selection, and the fourth before the loop starts at all.

3. What the published attacks actually do

The adversarial literature is now large enough to read as a body rather than a series of curiosities. What follows is mechanism and result — not method. Every result below was published with working code or reproducible detail that this entry deliberately does not restate.

Two further papers belong to this cluster but pay off as argument rather than technique: Hu (2025) on the equilibrium these attacks settle into, and Chen et al.’s PoisonArena on what happens when attackers collide. Both are §5.

Read together, the literature is not a menu. Its unifying finding is that ranking systems select on proximity to the ranker’s internal decision mechanism, and adversarial optimization reaches that mechanism more directly than good writing does. Du et al. state the uncomfortable version outright: “surface-level content quality is insufficient for rank promotion.” That is precisely why the competition results matter — an attack that beats content quality in an empty room is a different object from a durable advantage in a contested one.

4. What is actually happening in the wild

Three of the four surfaces now have field evidence, not just lab evidence.

The reading to take from this: the field evidence points away from your own domain. Two of these four cases involve no publisher website at all, and the one commercial market found operating in the wild runs through a client-side channel that no crawl or markup audit touches.

Two sourcing caveats belong with the numbers. The Microsoft finding is a vendor security disclosure with no independent replication, and Reddit’s figures are self-reported platform statistics. Both are solid as existence proofs — the market exists, the enforcement exists — and weak as magnitudes.

5. Why the advantage does not hold

Four independent results, from four different methods, converge on the same shape.

This lands on ground the site already holds. Aggarwal et al. found that Keyword Stuffing — the classic SEO reflex — did not raise visibility and could hurt, and their headline lift fell from up to ~40% on an internal harness to up to ~22% on a live engine (paper summary). The live-engine gap reads as trust filtering doing its job.

The load-bearing line: single-attacker lift is an upper bound measured in an empty room. Every number in §3 was produced with one adversary present. Both studies that added a second adversary watched the numbers fall.

One caveat has to survive the edit, for the same reason content freshness keeps its own: the argument here is not that these techniques never work. Several demonstrably do, against production systems. It is that the measured gain is contested, temporary, and asymmetric against a policy penalty that is neither. Relevance, not credibility styling, dominates which of two competing sources a model prefers (Wan et al.) — and relevance is not something an adversarial suffix can hold onto once someone else is optimizing too.

6. What the engines and platforms do about it

6.1 Policy

Google is the only major engine with an explicit, dated, written position, and it is recent enough that most published GEO advice predates it. On 2026-05-15 the spam-policy introduction was rewritten:

The practically useful observation is that the sixteen named policy categories already cover most of §3 and §4 under names that predate generative search: hidden text and link abuse (the academic white-text case), cloaking, scaled content abuse, site reputation abuse, link spam, and user-generated spam. AI-answer manipulation was not given a new policy — it was brought inside the old ones, which is what puts AI Overviews and AI Mode on the same demotion-or-removal footing as ranking spam.

One honesty note. Google’s June 2026 spam update rolled out starting 2026-06-24 and ran about two days, per the Search Status Dashboard, and industry commentary widely read it as the first enforcement wave under the new wording. Google said no such thing. The dashboard entry names no targeted tactic, and Google has not stated whether generative-AI manipulation is enforced through SpamBrain, a dedicated system, or manual action. The dates are fact; the enforcement linkage is inference.

OpenAI, Anthropic and Perplexity publish no policy naming AI-answer manipulation as of July 2026 — consistent with the position AI content detection records, that they route through source-side authority signals instead of a tactic rule.

6.2 Technical defense

• Google runs a layered program against indirect prompt injection in Gemini and Workspace, naming five layers including injection classifiers, security thought reinforcement, markdown sanitization and URL redaction, and a user-confirmation framework (see Google Security, June 2025). Its explicit design assumption is that some injections succeed — the goal is making attacks easier to identify or more expensive to run, not preventing them.
• Microsoft ships cross-prompt-injection protections in Copilot and, in its own disclosure, recommends the user-side mitigation of reviewing and clearing stored assistant memories.
• Platforms defend at the UGC layer — Reddit’s LLM-based coordinated-behavior detection is the visible example.
• Retrieval-layer defenses studied in the literature include source filtering and output-based detection; GASLITE’s adaptive attacks bypassed common defenses. The honest summary is that published defenses reduce but do not eliminate.
• OWASP’s Top 10 for LLM Applications supplies the vocabulary to hand a security team: LLM01 Prompt Injection, LLM04 Data and Model Poisoning, and LLM08 Vector and Embedding Weaknesses — the last being OWASP’s first dedicated treatment of RAG and embedding-store risk.

None of these produce a signal a publisher can see. There is no manipulation score, no “your brand was targeted” report, and no appeal surface. That asymmetry is the situation §8 has to work inside.

7. The line between optimization and manipulation

Three tests, each checkable, in ascending order of usefulness.

The reader test. Is this text written to be read by a person? White text, zero-size fonts, invisible suffixes, adversarial token strings, and instructions addressed to “the AI” all fail on inspection — and all of them already have a name in Google’s policy list that predates generative search by two decades.

The mechanism test. Does the technique work because the content became more useful to the asker, or because a ranking mechanism was reached directly? This is the operational form of Du et al.’s finding that surface quality and mechanism proximity are different things.

The disclosure test. Would you describe the tactic, unedited, to the engine’s spam team and to the client whose brand carries it? Weakest as evidence, most reliable in practice.

What makes the line stable rather than a matter of taste: the tests do not ask what tool you used or what you intended — they ask whether the effect survives being visible. An optimization works just as well after you explain it. A manipulation stops working, or gets penalized, the moment it is seen.

8. What to actually do

On the 2026 evidence, the realistic exposure for almost every reader is being targeted, or being collateral damage in someone else’s campaign — not deciding whether to run one.

Monitor the surfaces you do not control. This is the highest-value habit, because §2’s third and fourth surfaces are invisible to every site-side audit. Watch how your brand appears in AI answers for your own category queries, which competitor entities appear alongside you without a credible source, and where your category gets discussed on user-generated platforms. The tracking mechanics are in brand mention tracking and AI citation tracking; the measurement definitions are in GEO metrics, and brand mentions covers why third-party surfaces carry citation weight at all.

Audit your own injection vectors. A short list a publisher can act on: user-generated content on your domain that an engine will retrieve as yours; share or “summarize” links that pass free text into an assistant through URL parameters; third-party content published on your subdomains or subfolders, where site reputation abuse is your policy problem rather than the partner’s; any surface where a contributor’s text reaches a model unreviewed. This folds into an ordinary GEO audit.

Know what a poisoned answer looks like. Three recognition cues from the Cornell and Microsoft work: an unfamiliar entity described as “emerging” or “increasingly popular” with no established footprint — the entity recognition question asked in reverse; a recommendation whose only support is a single user-generated thread; an assistant asserting that a vendor is authoritative in a session where you never said so.

Recourse, honestly. Google accepts spam reports and its policies now name AI-answer manipulation. Platforms accept reports about inauthentic UGC. The other engines publish no complaint surface for this, and none of them will tell you that you were targeted. The realistic remedy is out-competing the planted source on the signals engines actually weigh.

References

Platform and standards documentation (as of 2026-07):

• Google Search Central — Spam Policies for Google Web Search · Search Status Dashboard, ranking updates history
• Google — Mitigating prompt injection attacks with a layered defense strategy (2025-06-13)
• Microsoft Security — Manipulating AI memory for profit: The rise of AI Recommendation Poisoning (2026-02-10)
• OWASP GenAI Security Project — Top 10 for LLM Applications (2025)
• Reddit, Inc. — How We’re Keeping Reddit Real and Safe in the AI Era (2026-07-06)

Adversarial research:

• Nestaas, F., Debenedetti, E., & Tramèr, F. (2024). Adversarial Search Engine Optimization for Large Language Models. arXiv:2406.18382
• Pfrommer, S., Bai, Y., Gautam, T., & Sojoudi, S. (2024). Ranking Manipulation for Conversational Search Engines. EMNLP 2024 Main. arXiv:2406.03589
• Kumar, A., & Lakkaraju, H. (2024). Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981
• Tang, Y., Fan, Y., Yu, C., Yang, T., Zhao, Y., & Hu, X. (2025). StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization. arXiv:2504.05804
• Ben-Tov, M., & Sharif, M. (2025). GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search. ACM CCS 2025. arXiv:2412.20953
• Du, Y., Yu, C., Xu, H., Wang, Z., Zhao, Y., & Hu, X. (2026). Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers. arXiv:2601.12263
• Hu, X. (2025). Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines. arXiv:2501.00745
• Chen, L., et al. (2025). PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation. KDD 2026. arXiv:2505.12574
• Zhang, T., Triedman, H., & Shmatikov, V. (2026). Deep-Research Agents Can Be Poisoned via User-Generated Content. arXiv:2605.24245
• Lin, Z. (2026). Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review. Communications of the ACM 69(7), 53–56. arXiv:2507.06185

Context and counter-evidence:

• Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., & Deshpande, A. (2024). GEO: Generative Engine Optimization. KDD ‘24. arXiv:2311.09735 · ACM DL · paper summary
• Wan, A., Wallace, E., & Klein, D. (2024). What Evidence Do Language Models Find Convincing? ACL 2024 Main. arXiv:2402.11782 · paper summary
• Puerto, H., Gubri, M., Green, C., Oh, S. J., & Yun, S. (2025). C-SEO Bench: Does Conversational SEO Work? NeurIPS ‘25 Datasets & Benchmarks. arXiv:2506.11097
• Nikkei Asia — ‘Positive review only’: Researchers hide AI prompts in papers (2025-07-01)
• Search Engine Land — Google updates Search spam policies to clarify it applies to generative AI responses (2026-05-15) · A 13-word edit can steer what deep-research AI agents recommend