GEO Spam & Manipulation

1. What counts as manipulation and what the research calls it

GEO spam and manipulation is the deliberate use of techniques whose effect on an AI answer comes from exploiting how retrieval or ranking works, rather than from making the content more useful to the person who asked.

The distinction rests on observable behavior rather than a moral judgment. Google’s Search spam policies, as revised in May 2026, define spam as “techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.” The definition has two independent tests: deceiving users or manipulating the system. Either is sufficient.

“GEO spam” is an umbrella term used by practitioners, not an established term of art. Each underlying technique already has a recognized name, and those names are the best way to find the relevant research.

2. The four attack surfaces

Discussions of manipulation often assume that publishers alter their own pages. In the 2026 field evidence, however, that is the least commonly used surface.

The last two surfaces never touch your website. A crawl, schema validator, or robots.txt setting cannot detect them. In the four-step answer loop, the first two surfaces act during retrieval and grounding, the third acts during citation selection, and the fourth acts before the loop begins.

3. What the published attacks actually do

The adversarial literature now forms a coherent body of evidence rather than a series of isolated experiments. The techniques differ, but each study reports both a mechanism and an observed result. Full implementation details could make the attacks reproducible, so only the mechanism and observed result are summarized.

Two other papers examine how the attacks interact rather than introducing another technique. Hu (2025) models the equilibrium they reach, while Chen et al.’s PoisonArena tests what happens when attackers compete.

Taken together, these studies document a shared vulnerability rather than a menu of durable tactics. Ranking systems select content partly by its proximity to the ranker’s internal decision mechanism, and adversarial optimization reaches that mechanism more directly than good writing does. Du et al. state the problem plainly: “surface-level content quality is insufficient for rank promotion.” Yet an attack that beats content quality in an empty room is not the same as a durable advantage in a contested environment.

4. What is actually happening in the wild

Field reports now document activity on three of the four attack surfaces, extending the evidence beyond laboratory studies.

The field evidence points away from your own domain. Two of these four cases involve no publisher website at all. The documented commercial activity also uses a client-side channel that no crawl or markup audit can reach.

The numbers require two important caveats. Microsoft’s finding is a vendor security disclosure with no independent replication, while Reddit’s figures are self-reported platform statistics. They provide evidence that both the market and the enforcement activity exist, but they are weak measures of scale.

5. Why the advantage does not hold

Four independent results, produced with four different methods, point in the same direction.

Related GEO evidence shows the same pattern. Aggarwal et al. found that Keyword Stuffing did not increase visibility and could reduce it. The reported headline lift also fell from up to ~40% on an internal harness to up to ~22% on a live engine (paper summary), a gap consistent with trust filtering on the live system.

Single-attacker lift is an upper bound measured in an empty room. Every number in §3 was produced with one adversary present. In both studies that added a second adversary, the measured gains declined.

The conclusion is not that these techniques never work. Several have demonstrably worked against production systems. The evidence instead shows that their measured gains are contested and temporary, while policy penalties do not share those limits. The same need for honest qualification applies to content freshness. Relevance, rather than credibility styling, dominates which of two competing sources a model prefers (Wan et al.). An adversarial suffix cannot preserve that advantage once another source is also being optimized.

6. How engines and platforms respond

6.1 Policy

Google is the only major engine with an explicit, dated, written position. The policy is recent enough that most published GEO advice predates it. On 2026-05-15, the introduction to Google’s spam policies was rewritten:

The sixteen named policy categories already cover most of the behavior described in §3 and §4 under terms that predate generative search: hidden text and link abuse (the academic white-text case), cloaking, scaled content abuse, site reputation abuse, link spam, and user-generated spam. Google did not create a separate policy for AI-answer manipulation. It brought the behavior under its existing spam policies, subjecting AI Overviews and AI Mode to the same demotion or removal policies as ranking spam.

The connection between that policy change and the next spam update remains an inference. Google’s June 2026 spam update began on 2026-06-24 and ran for about two days, according to the Search Status Dashboard. Industry commentary widely described it as the first enforcement wave under the new wording, but Google did not characterize it that way. The dashboard names no targeted tactic, and Google has not said whether it enforces generative-AI manipulation through SpamBrain, a dedicated system, or manual action. Only the dates and the policy change are established facts.

As of July 2026, OpenAI, Anthropic, and Perplexity publish no policy that names AI-answer manipulation. Their documented approaches instead rely on source-side authority signals rather than rules for individual tactics, as AI content detection explains.

6.2 Technical defense

• Google runs a layered program against indirect prompt injection in Gemini and Workspace. It names five layers, including injection classifiers, security thought reinforcement, markdown sanitization and URL redaction, and a user-confirmation framework (see Google Security, June 2025). The program explicitly assumes that some injections will succeed. Its goal is to make attacks easier to identify or more expensive to run, not to prevent every attempt.
• Microsoft ships cross-prompt-injection protections in Copilot and, in its own disclosure, recommends that users review and clear stored assistant memories.
• Platforms also defend at the UGC layer. Reddit’s LLM-based detection of coordinated behavior is the visible example.
• Retrieval-layer defenses studied in the literature include source filtering and output-based detection; GASLITE’s adaptive attacks bypassed common defenses. Published defenses reduce the risk but do not eliminate it.
• OWASP’s Top 10 for LLM Applications provides a shared vocabulary for security teams: LLM01 Prompt Injection, LLM04 Data and Model Poisoning, and LLM08 Vector and Embedding Weaknesses. LLM08 is OWASP’s first dedicated treatment of RAG and embedding-store risk.

Publishers cannot observe any of these defenses directly. There is no manipulation score, no “your brand was targeted” report, and no appeal channel. Any practical response must account for that lack of visibility.

7. The line between optimization and manipulation

Three practical tests help distinguish optimization from manipulation.

The reader test. Is the text written for a person to read? White text, zero-size fonts, invisible suffixes, adversarial token strings, and instructions addressed to “the AI” all fail this test. Google’s policy list has covered such behavior under existing categories for two decades.

The mechanism test. Does the technique work because the content became more useful to the person asking, or because it directly reaches a ranking mechanism? This test applies Du et al.’s finding that surface quality and proximity to the mechanism are different things.

The disclosure test. Would you describe the tactic plainly to the engine’s spam team and to the client whose brand it promotes? This is the weakest test as evidence but often the most reliable in practice.

The boundary does not depend on taste. The tests ask neither which tool you used nor what you intended. They ask whether the effect survives disclosure. Legitimate optimization continues to work after you explain it. Manipulation stops working or attracts a penalty once it is visible.

8. What practitioners can do

Based on the 2026 evidence, most practitioners are more likely to be targeted or caught in someone else’s campaign than to run one themselves.

Monitor the surfaces you do not control. The third and fourth surfaces in §2 are invisible to every site-side audit, which makes monitoring especially valuable. Track how your brand appears in AI answers for category queries, which competitor entities appear beside it without a credible source, and where users discuss the category on third-party platforms. Brand mention tracking and AI citation tracking explain the process. GEO metrics defines the measurements, while brand mentions explains why third-party sources can carry citation weight.

Audit your own injection vectors. Review user-generated content on your domain that an engine may retrieve as yours. Check share or “summarize” links that pass free text to an assistant through URL parameters. Inspect third-party content on your subdomains or subfolders, where site reputation abuse creates a policy risk for you rather than the partner. Also audit any surface where a contributor’s text can reach a model without review. These checks belong in a standard GEO audit.

Know what a poisoned answer looks like. The Cornell and Microsoft research suggests three warning signs: an unfamiliar entity described as “emerging” or “increasingly popular” despite having no established footprint; a recommendation supported by only one user-generated thread; or an assistant calling a vendor authoritative when nobody in the session made that claim. The first reverses the usual entity recognition problem.

Understand the available recourse. Google accepts spam reports, and its policies now explicitly cover AI-answer manipulation. Platforms accept reports about inauthentic UGC. Other engines provide no published complaint channel for this issue, and none reports whether you were targeted. In practice, the available remedy is to outperform the planted source on the signals engines weigh.

References

Platform and standards documentation, current as of July 2026:

• Google Search Central: Spam Policies for Google Web Search · Search Status Dashboard, ranking updates history
• Google: Mitigating prompt injection attacks with a layered defense strategy (2025-06-13)
• Microsoft Security: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning (2026-02-10)
• OWASP GenAI Security Project: Top 10 for LLM Applications (2025)
• Reddit, Inc.: How We’re Keeping Reddit Real and Safe in the AI Era (2026-07-06)

Adversarial research:

• Nestaas, F., Debenedetti, E., & Tramèr, F. (2024). Adversarial Search Engine Optimization for Large Language Models. arXiv:2406.18382
• Pfrommer, S., Bai, Y., Gautam, T., & Sojoudi, S. (2024). Ranking Manipulation for Conversational Search Engines. EMNLP 2024 Main. arXiv:2406.03589
• Kumar, A., & Lakkaraju, H. (2024). Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981
• Tang, Y., Fan, Y., Yu, C., Yang, T., Zhao, Y., & Hu, X. (2025). StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization. arXiv:2504.05804
• Ben-Tov, M., & Sharif, M. (2025). GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search. ACM CCS 2025. arXiv:2412.20953
• Du, Y., Yu, C., Xu, H., Wang, Z., Zhao, Y., & Hu, X. (2026). Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankers. arXiv:2601.12263
• Hu, X. (2025). Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines. arXiv:2501.00745
• Chen, L., et al. (2025). PoisonArena: Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation. KDD 2026. arXiv:2505.12574
• Zhang, T., Triedman, H., & Shmatikov, V. (2026). Deep-Research Agents Can Be Poisoned via User-Generated Content. arXiv:2605.24245
• Lin, Z. (2026). Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review. Communications of the ACM 69(7), 53–56. arXiv:2507.06185

Context and counter-evidence:

• Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., & Deshpande, A. (2024). GEO: Generative Engine Optimization. KDD ‘24. arXiv:2311.09735 · ACM DL · paper summary
• Wan, A., Wallace, E., & Klein, D. (2024). What Evidence Do Language Models Find Convincing? ACL 2024 Main. arXiv:2402.11782 · paper summary
• Puerto, H., Gubri, M., Green, C., Oh, S. J., & Yun, S. (2025). C-SEO Bench: Does Conversational SEO Work? NeurIPS ‘25 Datasets & Benchmarks. arXiv:2506.11097
• Nikkei Asia: ‘Positive review only’: Researchers hide AI prompts in papers (2025-07-01)
• Search Engine Land: Google updates Search spam policies to clarify it applies to generative AI responses (2026-05-15) · A 13-word edit can steer what deep-research AI agents recommend