Counter‑GEO‑Bench is a new defense benchmark that tests how well systems can resist misinformation generated by generative engine optimization (GEO). It contains 247 human‑verified queries paired with both information‑preserving and information‑distorting GEO rewrites, and evaluates defenses on attack success rate, false positives, and answer quality across three large language models. Existing off‑the‑shelf defenses reduce attack success by at most 5.7%, while a lightweight baseline, C‑GEO Guard, cuts it by 47.6% with minimal loss of utility.
The paper introduces GEO Defender, a two‑stage defense system designed to protect generative search engines from malicious Generative Engine Optimization (GEO) attacks that rewrite web documents to manipulate generated answers. GEO Defender comprises a Shield Reranker, which learns a defensive residual to demote GEO‑rewritten documents while maintaining relevance, and a Training‑Free Shield Generation component that creates a natural‑language library guiding the target LLM’s source usage during inference. Experiments on both closed‑source and open‑source large language models show that GEO Defender dramatically lowers attack success rates from 50.32% to 6.20%, preserves over 94% of benign evidence usage, and maintains answer quality while generalizing to unseen attacks.
By Haozhang Li, Yangguang Shao, Xinjie Lin, Zhong Guan, Mi Zhou, Junzheng Shi
arXiv:2605. 29107v2 Announce Type: replace-cross Abstract: Large language models (LLMs) increasingly rank products, documents, and recommendations for user queries, which makes manipulating these rankings a growing concern for fairness and information integrity.
By Ojas Nimase, Zhe Chen, Gengpei Qi, Yue Zhao, Xiyang Hu
arXiv:2608. 16824v1 Announce Type: new Abstract: Generative Engine Optimization (GEO) modifies web content to increase its likelihood of being selected and cited by generative search engines.
By Junjie Chu, Ye Leng, Mingjie Li, Yun Shen, Xinyue Shen, Yang Zhang
arXiv:2609.07559v1 Announce Type: new
Abstract: How do you validate a cheap, deterministic proxy for an oracle that is expensive, rate-limited, and non-stationary? We present a protocol built on adve...
By Elisha Bajemon, Andre-Louis Rochet
arXiv:2607. 26339v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence.
By Pushkal Kumar, Tucker Nielson, Tanish Kolhe, Shubham Zala, Vincent Li
The paper evaluates TypeSafe AI’s Jev safety judge against GPT and GLM judges and local classifiers using a controlled adversarial test harness. Jev shows strong robustness on rule‑based tasks like input moderation, with minimal bypasses, but performs less well on judgment‑based tasks such as phishing detection, where it misses a higher proportion of phishing emails and is more prone to false positives. The study highlights Jev’s speed advantage and varying resilience depending on task type.
By Xiang Li, Aichun Huang, Mingming Zhang, Zheli Liu
arXiv:2406.00083v3 Announce Type: replace-cross
Abstract: Retrieval-Augmented Generation (RAG) enhances Large Language Models (LLMs) by retrieving relevant information from external knowledge bases t...
By Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, Qian Lou
arXiv:2603. 00801v2 Announce Type: replace Abstract: Language agents increasingly act as web-enabled systems that search, browse, and synthesize information from diverse sources.
By Shrey Shah, Levent Ozgur
arXiv:2607. 20730v1 Announce Type: cross Abstract: Large language models increasingly use search tools to retrieve up-to-date information, introducing a new attack surface in which retrieved documents can be manipulated.
By Zhaoqi Wang, Zijian Zhang, Xiaomei Yuan, Pengtao Kou, Jiamou Liu, Zhen Li, Liehuang Zhu
Safety benchmarks for large language models often assess the risk of a user query, although the outcome of question answering depends on whether the response violates a policy. This distinction is cri...
arXiv:2608. 28389v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers.
By Jaewon Jung, Haizhong Zheng, Hongsun Jang, Jaeyong Song, Beidi Chen, Jinho Lee