# When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

arXiv: https://arxiv.org/abs/2609.02964 · HTML: https://mlsanity.com/paper/2609.02964/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 36 references that are in the map.
- First posted on arXiv 2 Sep 2026.

## Builds on (most cited first, 23 of 23)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena](https://mlsanity.com/paper/2306.05685/) (2023)
- [Direct Preference Optimization: Your Language Model is Secretly a Reward Model](https://mlsanity.com/paper/2305.18290/) (2023)
- [Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Models](https://mlsanity.com/paper/2506.05176/) (2025)
- [Evaluating Verifiability in Generative Search Engines](https://mlsanity.com/paper/2304.09848/) (2023)
- [Certifiably Robust RAG against Retrieval Corruption](https://mlsanity.com/paper/2405.15556/) (2024)
- [ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning](https://mlsanity.com/paper/2503.22738/) (2025)
- [Training-Free Group Relative Policy Optimization](https://mlsanity.com/paper/2510.08191/) (2025)
- [Manipulating Large Language Models to Increase Product Visibility](https://mlsanity.com/paper/2404.07981/) (2024)
- [Ranking Manipulation for Conversational Search Engines](https://mlsanity.com/paper/2406.03589/) (2024)
- [SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents](https://mlsanity.com/paper/2510.10073/) (2025)
- [What Generative Search Engines Like and How to Optimize Web Content Cooperatively](https://mlsanity.com/paper/2510.11438/) (2025)
- [GRADA: Graph-based Reranking against Adversarial Documents Attack](https://mlsanity.com/paper/2505.07546/) (2025)
- [AgenticGEO: A Self-Evolving Agentic System for Generative Engine Optimization](https://mlsanity.com/paper/2603.20213/) (2026)
- [SAGEO Arena: A Realistic Environment for Evaluating Search-Augmented Generative Engine Optimization](https://mlsanity.com/paper/2602.12187/) (2026)
- [Structural Feature Engineering for Generative Engine Optimization: How Content Structure Shapes Citation Behavior](https://mlsanity.com/paper/2603.29979/) (2026)
- [From Experience to Skill: Multi-Agent Generative Engine Optimization via Reusable Strategy Learning](https://mlsanity.com/paper/2604.19516/) (2026)
- [IF-GEO: Conflict-Aware Instruction Fusion for Multi-Query Generative Engine Optimization](https://mlsanity.com/paper/2601.13938/) (2026)
- [Controlling Output Rankings in Generative Engines for LLM-based Search](https://mlsanity.com/paper/2602.03608/) (2026)
- [Diagnosing and Repairing Citation Failures in Generative Engine Optimization](https://mlsanity.com/paper/2603.09296/) (2026)
- [Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation](https://mlsanity.com/paper/2603.25500/) (2026)
- [SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimization](https://mlsanity.com/paper/2605.21948/) (2026)
- [Optimizing Visibility in Generative Engines: A Critical Survey of Generative Engine Optimization (2023-2026)](https://mlsanity.com/paper/2607.14035/) (2026)

## Built on by (most cited first, 1 of 1)

- [GroundedGEO: Auditing the Evidence Gap in Generative Search Rankings](https://mlsanity.com/paper/2609.25189/) (2026)

## Abstract (arXiv)

This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.