The paper introduces FORGE, a benchmark that rewrites real product pages into fake ones to test how often search‑augmented large language models (LLMs) recommend these polluted items. Across 12 commercial and open‑weight LLMs, a single polluted page can lead to up to 27% of recommendations being fake, rising to 73.8% when the top‑3 replacements are used. The study finds that reasoning does not help and existing defenses—skepticism prompts, consensus filters, and credibility re‑ranking—are largely ineffective.
arXiv:2606. 13610v1 Announce Type: cross Abstract: Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content.
arXiv:2606. 28356v1 Announce Type: cross Abstract: Generative Engine Optimization (GEO) lets content owners rewrite web content to increase their visibility in generative systems.
arXiv:2609.06027v1 Announce Type: cross Abstract: Search-augmented LLM agents are increasingly used for consumer decisions, making them vulnerable to Generative Engine Optimization (GEO) poisoning. E...
arXiv:2606. 09204v1 Announce Type: new Abstract: We present a reproducible failure mode of safety training in RAG-based LLM recommendation -- the Injection Paradox -- in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injection-free baseline.
The paper introduces GEO Defender, a two‑stage defense system designed to protect generative search engines from malicious Generative Engine Optimization (GEO) attacks that rewrite web documents to manipulate generated answers. GEO Defender comprises a Shield Reranker, which learns a defensive residual to demote GEO‑rewritten documents while maintaining relevance, and a Training‑Free Shield Generation component that creates a natural‑language library guiding the target LLM’s source usage during inference. Experiments on both closed‑source and open‑source large language models show that GEO Defender dramatically lowers attack success rates from 50.32% to 6.20%, preserves over 94% of benign evidence usage, and maintains answer quality while generalizing to unseen attacks.
arXiv:2606. 16100v1 Announce Type: cross Abstract: As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models.
Counter‑GEO‑Bench is a new benchmark that evaluates how well defenses can stop large language models from producing misinformation when faced with generative engine‑optimized (GEO) content. It contains 247 human‑verified queries paired with both information‑preserving and information‑distorting GEO rewrites, and measures attack success rate, false positives, and answer quality across three victim LLMs. The study shows that existing off‑the‑shelf defenses reduce attack success by at most 5.7 %, while a lightweight baseline called C‑GEO Guard cuts success by 47.6 % with minimal loss of utility.
arXiv:2606. 17443v1 Announce Type: new Abstract: Large language models (LLMs) are becoming a major way for consumers to find products, but we do not yet understand how brands compete in this new channel.
Counter‑GEO‑Bench is a new defense benchmark that tests how well systems can resist misinformation generated by generative engine optimization (GEO). It contains 247 human‑verified queries paired with both information‑preserving and information‑distorting GEO rewrites, and evaluates defenses on attack success rate, false positives, and answer quality across three large language models. Existing off‑the‑shelf defenses reduce attack success by at most 5.7%, while a lightweight baseline, C‑GEO Guard, cuts it by 47.6% with minimal loss of utility.
arXiv:2609.07559v1 Announce Type: new Abstract: How do you validate a cheap, deterministic proxy for an oracle that is expensive, rate-limited, and non-stationary? We present a protocol built on adve...
arXiv:2603. 00801v2 Announce Type: replace Abstract: Language agents increasingly act as web-enabled systems that search, browse, and synthesize information from diverse sources.
arXiv:2607. 15267v1 Announce Type: new Abstract: Poisoning pretraining data can introduce harmful behaviors to LMs that are difficult to detect and mitigate.