Exposing Citation Vulnerabilities in Generative Engines
Not on the map. Why?
Abstract (arXiv)
We analyze answers generated by generative engines (GEs) from the perspectives of citation publishers and the content-injection barrier, defined as the difficulty for attackers to manipulate answers to user prompts by placing malicious content on the web. GEs integrate two functions: web search and answer generation that cites web pages using large language models. Because anyone can publish information on the web, GEs are vulnerable to poisoning attacks. Existing studies of citation evaluation focus on how faithfully answer content reflects cited sources, leaving unexamined which web sources should be selected as citations to defend against poisoning attacks. To fill this gap, we introduce evaluation criteria that assess poisoning threats using the citation information contained in answers. Our criteria classify the publisher attributes of citations to estimate the content-injection barrier thereby revealing the threat of poisoning attacks in current GEs. We conduct experiments in political domains in Japan and the United States (U.S.) using our criteria and show that citations from official party websites (primary sources) are approximately (25%)--(45%) in the U.S. and (60%)--(65%) in Japan, indicating that U.S. political answers are at higher risk of poisoning attacks. We also find that sources with low content-injection barriers are frequently cited yet are poorly reflected in answer content. To mitigate this threat, we discuss how publishers of primary sources can increase exposure of their web content in answers and show that well-known techniques are limited by language differences.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 37 of its 87 references that are in the map. First posted on arXiv 8 Oct 2025.
Builds on
37 of 87 references.
References · 37
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
- 2022Survey of Hallucination in Natural Language Generationcited by 2,075
- 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,745
- 2024A Survey on LLM-as-a-Judgecited by 1,423
- 2021BARTScore: Evaluating Generated Text as Text Generationcited by 722
- 2023Siren's Song in the AI Ocean: A Survey on Hallucination in Large Language Modelscited by 698
- 2023Bias and Fairness in Large Language Models: A Surveycited by 639
- 2023Enabling Large Language Models to Generate Text with Citationscited by 595
- 2019Evaluating the Factual Consistency of Abstractive Text Summarizationcited by 584
- 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
25 more
- 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 418
- 2024Benchmarking Retrieval-Augmented Generation for Medicinecited by 331
- 2023Evaluating Verifiability in Generative Search Enginescited by 303
- 2020FEQA: A Question Answering Evaluation Framework for Faithfulness Assessment in Abstractive Summarizationcited by 293
- 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
- 2023AlignScore: Evaluating Factual Consistency with a Unified Alignment Functioncited by 288
- 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 265
- 2021Internet-Augmented Dialogue Generationcited by 217
- 2024Certifiably Robust RAG against Retrieval Corruptioncited by 151
- 2022Rich Knowledge Sources Bring Complex Knowledge Conflicts: Recalibrating Models to Reflect Conflicting Evidencecited by 144
- 2022Internet-augmented language models through few-shot prompting for open-domain question answeringcited by 131
- 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 126
- 2023Almanac: Retrieval-Augmented Language Models for Clinical Medicinecited by 123
- 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 101
- 2023Factcheck-Bench: Fine-Grained Evaluation Benchmark for Automatic Fact-checkerscited by 87
- 2025Retrieval-Augmented Generation with Conflicting Evidencecited by 63
- 2023GEO: Generative Engine Optimizationcited by 56
- 2023Language Models Hallucinate, but May Excel at Fact Verificationcited by 37
- 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
- 2024Retrieval Helps or Hurts? A Deeper Dive into the Efficacy of Retrieval Augmentation to Language Modelscited by 19
- 2025CiteEval: Principle-Driven Citation Evaluation for Source Attributioncited by 19
- 2025Linguistic Nepotism: Trading-off Quality for Language Preference in Multilingual RAGcited by 7
- 2020Adversarial Examples for k-Nearest Neighbor Classifiers Based on Higher-Order Voronoi Diagramscited by 2
- 2025Conflicts in Texts: Data, Implications and Challengescited by 2
- 2024BanglaEmbed: Efficient Sentence Embedding Models for a Low-Resource Language Using Cross-Lingual Distillation Techniquescited by 1
Built on by
Citing papers per year: 2026: 2.
2 papers.