Citation Wars: The GEO Playbook Is Now the Attack Model

Every answer engine optimization checklist tells you to add statistics, add citations, add quotations. A preprint posted on 11 August 2026 takes that advice, implements it as an attacker, and asks what happens when everyone runs it and the platform fights back. The answer, across five rounds of simulated competition, is that document quality and answer quality both end up below where they started. Chen Xu and Chenyan Xiong of Carnegie Mellon and Zitian Guo of UC San Diego call the pattern citation wars.

Key takeaways

The paper models AI search as two parties with one shared currency. Content suppliers want citations, because citations are how a generative engine allocates attention and attribution. The platform wants answers that are trustworthy. Both are pulling on the same document.

Formally it is a repeated Stackelberg game with partial monitoring: the platform moves first by setting a policy, suppliers respond by rewriting, and neither side sees the other's private state. Practically it is a description of a market anyone doing generative engine optimization already lives in. The abstract states the tension without hedging: "content providers are incentivized to optimize for model citation, while platforms must preserve answer quality and trustworthy attribution."

The experiments run on three benchmarks — an e-commerce set, GEO-Bench, and Researchy-GEO — each pairing a query with five candidate documents. One document gets rewritten by an attacker; the engine then answers and cites.

Here is the part worth sitting with. The five attackers the paper defends against are not adversarial exotica. They are the published GEO literature.

That last row cites Aggarwal and colleagues' GEO: Generative Engine Optimization, the KDD 2024 paper that reported visibility boosts of up to 40% and gave the field both its name and its benchmark. Two years on, in a paper that uses that same benchmark, the method is a baseline attack to be neutralized.

Nothing about this makes the original research dishonest, and the KDD paper is still the best empirical grounding the field has. But the asymmetry is instructive: the tactic that a marketing checklist reads as "best practice" is the thing a platform researcher reads as "the thing to detect." If you are running the 2024 playbook in 2026, you are running the thing being modelled against.

The core simulation runs five rounds. Suppliers rewrite, the platform adapts, suppliers rewrite again. The trajectory is the finding: rewrite quality and answer utility both drop below the no-exploitation reference, and the mechanism is visible in the intermediate rounds — the paper describes "accumulated unsupported claims and fabricated details, turning initially mild edits into citation-seeking rewrites."

Round one is a page with a few more numbers in it. Round five is a page making claims nobody can check.

Then the theory explains why it stalls there rather than correcting. The authors identify conditions under which the system reaches a local stationary point where the first-order utility change is roughly zero, and spell out what that state looks like: "useful content is not induced, suspicious content is weakly penalized, and further platform updates have little effect." A stalemate where the extra effort has bought nobody anything, and the content is worse than the version that existed before the competition started.

This is a familiar shape. It is what happened to on-page SEO in the exact-match-anchor era, and the resolution then was not that publishers restrained themselves. The platform changed what it paid for.

The instinct is that a platform just detects the pattern and drops it. The paper tests three classical defenses and finds the naive versions weak.

The keyword scrub result is the one to carry. Stylistic tells are cheap to route around, and a filter aimed at them catches last season's phrasing while the rewrite that matters walks through. Anyone hoping their competitor's obviously optimized copy will get algorithmically punished should downgrade that expectation.

The paper's scoring makes the tradeoff explicit. Its headline metric, Net, adds two quantities: the share of the attacker's advantage a defense strips away, and what that defense does to welfare relative to the reference condition. Hard rejection can score well on the first and badly on the second, because throwing out documents throws out real information along with the manipulation. A defense has to be judged on what it costs the answer, not just on what it blocks.

VCR — verifiable-content rewards — inverts the design. Rather than only punishing suspicious rewrites, the platform credits them. The credit a rewrite earns scales with a count of the "factual claims, numerical details, or named citations present in the rewrite and supported by the original document," up to a cap.

Read that qualifier twice, because it is the whole idea. Not claims present. Claims present and supported. A number you can trace back to something real earns credit; a number that appeared during optimization earns nothing. Across three benchmarks and three engines, VCR posted the largest Net score every time, with an average advantage of 12.1 percentage points over whichever baseline was strongest in each setting, and it also produced the highest scores on the direct document-quality dimensions the authors measure — clarity, depth, insight, and factuality.

For anyone doing answer engine optimization, that is a more useful signal than another ranking factor. It splits a piece of advice that has always been treated as one thing:

The advice "add statistics" survives. The version of it that treats numbers as decoration does not. That distinction is already worth acting on for a separate reason: fabricated specifics on your own pages can be lifted verbatim into an answer and attributed to you, which is a liability rather than an optimization.

Added 3 September 2026. The keyword-scrub result now has independent confirmation from a second group, on the version of the attack with the most at stake. Counter-GEO-Bench, by Bing Zheng and Wenming Yang of Tsinghua's Shenzhen International Graduate School with Zongyao Zhao of the University of Hong Kong — accepted to EMNLP 2026 — asks what happens when a GEO rewrite doesn't just decorate but lies. The authors built 247 human-verified queries from GEO-Bench pairs and produced two rewrites of each source: an information-preserving one (clearer structure, authoritative phrasing, citation hooks, facts intact) and an information-distorting one — the same optimization strength plus a targeted false claim injected in at least three places with varied phrasing.

Undefended, the false claim was asserted in the answer 55.7% of the time (95% CI: 53.1–58.2), averaged across three open-weight victim models. With the standard safety guardrails in front, almost nothing changed: Granite Guardian cut attack success by 1.7 percentage points (not statistically significant), Llama Guard 3 by 3.2 points — statistically real, "operationally negligible" in the authors' words — and NeMo's self-check fact-checking rail blocked 98.4% of one model's outputs whether or not anything was wrong with them. The abstract's summary is "at most 5.7% relative," and the diagnosis fits the CMU finding exactly: "Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content."

The taxonomy of eight distorting attack classes reads like the GEO checklist with its intent inverted: fake institutional authority, fabricated citations to nonexistent studies, fake freshness markers ("temporal poison"), AI-extractable formatting around a false claim ("structured hijack"), fabricated ratings and testimonials ("review flood"), and — the one aimed squarely at brands — negative GEO, content that contrasts against legitimate competing information to suppress it. Review flood was the most successful class undefended, at 62.8%. Every class is a distorted twin of something a checklist sells as best practice, which is this post's thesis restated as a threat model.

The defense pattern repeats too. As with VCR, the generic mechanism failed and the targeted one worked: the paper's baseline detector, C-GEO Guard — a 184-million-parameter encoder trained to recognize the eight attack classes by similarity — cut attack success by 47.6% relative (26.5 points absolute) with answer quality unchanged, 4.48 defended against 4.49 undefended on the paper's five-point scale. Two independent groups, one shape: defenses aimed at what GEO manipulation specifically does can work, and defenses aimed at generic badness don't. The gap in the targeted defense is instructive as well — structured hijack, the attack that hides inside extractable formatting, was the hardest class to catch, at a 22% relative reduction against 60% for the easiest. Manipulation that looks like structure survives longest.

The usual discipline applies. This is 247 English-only queries; the victims are open-weight models, not the production engines running undisclosed guardrails of their own; the attacks come from a fixed taxonomy with no detector-aware adversary; and the distortions were themselves written by an LLM. What it establishes is narrower and still uncomfortable: the defense layer actually deployed in front of today's open models does not distinguish an optimized page that informs from an optimized page that deceives.

For a brand, the exposed surface is the negative-GEO and review-flood end of that taxonomy. A page optimized into retrieval that undermines your product or fabricates satisfaction numbers for a competitor reads to current guardrails as ordinary informational content, and in this benchmark's setting more than half of such attempts reached the answer. It is the adversarial version of the manufactured-source problem we covered last week, and the countermeasure available to you is the same, because the platform-side one is not deployed: record what the answers in your category actually say, so a false claim about you is something you catch in days rather than discover in a lost deal.

Added 6 September 2026. Three days after Counter-GEO-Bench, a third group — Haozhang Li and colleagues at the University of the Chinese Academy of Sciences — published the strongest platform-side result yet, and it lands somewhere more uncomfortable for the playbook than either paper before it. GEO Defender evaluated seven published GEO methods against five target LLMs and cut their average attack success rate from 50.32% to 6.20%, while retaining 94.12% of benign-evidence use and moving the average answer-quality score by 0.01. The attacker roster overlaps heavily with the CMU paper's — AutoGEO, IF-GEO, RAID — and includes the original KDD 2024 GEO method. The tactic that founded the field is now, literally, training data for a demotion model.

The design premise is the part to sit with. The paper opens from the observation that GEO-rewritten documents "remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective," and that the features they amplify "equally characterize high-quality benign content." So the defense gives up on catching lies — there are none to catch — and instead learns the preference signature of a GEO rewrite. A small adapter over a frozen reranker learns to demote documents that look rewritten-for-retrieval relative to their benign neighbors, before the answering model ever reads them; a second, training-free stage distills those outcomes into natural-language guidance for how the model uses sources. No fine-tuning of the target LLM is required, which is exactly the property that makes a design like this cheap for a platform to bolt on.

Notice what this dissolves: the line the previous two papers left standing. VCR distinguished supported claims from decorative ones; Counter-GEO-Bench distinguished information-preserving rewrites from information-distorting ones. GEO Defender draws no such line. In its threat model, the factually consistent, structure-improved, statistics-added rewrite — the one every checklist calls best practice and this post's earlier sections call the defensible version — is the attack, and demoting it is the success condition. The 94.12% benign-evidence retention means the collateral damage to ordinary pages is small; it does not mean optimized-but-honest pages are spared. They are the target class.

The usual discipline, again. This is a preprint from a single group; the 616-instance benchmark is built by the defenders themselves; the threat model assumes the attacker controls only the rewrite, not retrieval or generation; and no production engine has announced anything resembling it. A reranker demoting GEO signatures at scale would also face a moving target this paper doesn't test — a rewriter trained against the defense. What three papers in four weeks do establish, from three independent directions, is that platform-side interest in neutralizing GEO is real, tractable in research settings, and aimed at the signature of optimization rather than at falsehood. If that direction holds, the safe ground is not "optimize honestly." It is to publish pages whose value survives the rewrite being stripped away — original data, first-party facts, substance a demotion model has no incentive to bury because burying it makes the answer worse.

The provenance deserves the same scrutiny the finding does.

This is a preprint, not peer-reviewed work, posted two days before this article. The authors state their own limits plainly: "the theory analyzes a local quadratic surrogate and the experiments use a finite interaction horizon; neither establishes a global equilibrium," and they note that "LLM-based claim counting and rule matching can err." A local stationary point in a five-round simulation is not proof that the live web is heading somewhere specific.

The models are also small. The primary engine is gemini-2.5-flash-lite, with gpt-4o-mini and claude-haiku-4-5 as alternates, and the platform-side components run on gpt-4o-mini at temperature zero. Those are not the systems buyers are asking about your category, and quality here is scored by an LLM rubric rather than by people.

Most importantly, VCR is a proposal. No platform has announced anything like it. What the paper establishes is that a reward-for-verifiability design outperforms penalty-only designs in simulation — which is an argument about where a rational platform's incentives point, not an announcement about where any engine is today.

That still leaves it more actionable than most of what gets written about GEO, because the direction is the same one the rest of the evidence points in. Our own study of citation volatility found the set of domains cited for a prompt turning over 60–70% day to day, which is what a contested surface with no stable advantage looks like from the outside. A tactic that everyone can run is not an advantage for long.

The useful frame is not that GEO is dead. It is that GEO has entered the phase every optimization discipline reaches once the platform starts paying attention: the tactics that are purely extractive get priced out, and the ones that happen to produce something real get kept. The research now names the difference precisely enough to act on — claims supported by the underlying document, versus claims that merely appear in it.

Elmo is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces and records the full answer text alongside every mention, citation, and competitor named beside you. Because the raw answers are yours to query, you can check what an engine actually said about your brand rather than inferring it from a citation count — which is the measurement this paper's failure mode calls for.

For the fundamentals, start with what AI citations are and where they come from. For the adjacent research, see what happens to GEO tactics under competition and whether the sources AI cites check out. For the practice, see the AEO guide and how to track your brand in AI search. For the vocabulary, the AI search glossary.