Citation Wars: The GEO Playbook Is Now the Attack Model

Every answer engine optimization checklist tells you to add statistics, add citations, add quotations. A preprint posted on 11 August 2026 takes that advice, implements it as an attacker, and asks what happens when everyone runs it and the platform fights back. The answer, across five rounds of simulated competition, is that document quality and answer quality both end up below where they started. Chen Xu and Chenyan Xiong of Carnegie Mellon and Zitian Guo of UC San Diego call the pattern citation wars.

Key takeaways

The paper models AI search as two parties with one shared currency. Content suppliers want citations, because citations are how a generative engine allocates attention and attribution. The platform wants answers that are trustworthy. Both are pulling on the same document.

Formally it is a repeated Stackelberg game with partial monitoring: the platform moves first by setting a policy, suppliers respond by rewriting, and neither side sees the other's private state. Practically it is a description of a market anyone doing generative engine optimization already lives in. The abstract states the tension without hedging: "content providers are incentivized to optimize for model citation, while platforms must preserve answer quality and trustworthy attribution."

The experiments run on three benchmarks — an e-commerce set, GEO-Bench, and Researchy-GEO — each pairing a query with five candidate documents. One document gets rewritten by an attacker; the engine then answers and cites.

Here is the part worth sitting with. The five attackers the paper defends against are not adversarial exotica. They are the published GEO literature.

That last row cites Aggarwal and colleagues' GEO: Generative Engine Optimization, the KDD 2024 paper that reported visibility boosts of up to 40% and gave the field both its name and its benchmark. Two years on, in a paper that uses that same benchmark, the method is a baseline attack to be neutralized.

Nothing about this makes the original research dishonest, and the KDD paper is still the best empirical grounding the field has. But the asymmetry is instructive: the tactic that a marketing checklist reads as "best practice" is the thing a platform researcher reads as "the thing to detect." If you are running the 2024 playbook in 2026, you are running the thing being modelled against.

The core simulation runs five rounds. Suppliers rewrite, the platform adapts, suppliers rewrite again. The trajectory is the finding: rewrite quality and answer utility both drop below the no-exploitation reference, and the mechanism is visible in the intermediate rounds — the paper describes "accumulated unsupported claims and fabricated details, turning initially mild edits into citation-seeking rewrites."

Round one is a page with a few more numbers in it. Round five is a page making claims nobody can check.

Then the theory explains why it stalls there rather than correcting. The authors identify conditions under which the system reaches a local stationary point where the first-order utility change is roughly zero, and spell out what that state looks like: "useful content is not induced, suspicious content is weakly penalized, and further platform updates have little effect." A stalemate where the extra effort has bought nobody anything, and the content is worse than the version that existed before the competition started.

This is a familiar shape. It is what happened to on-page SEO in the exact-match-anchor era, and the resolution then was not that publishers restrained themselves. The platform changed what it paid for.

The instinct is that a platform just detects the pattern and drops it. The paper tests three classical defenses and finds the naive versions weak.

The keyword scrub result is the one to carry. Stylistic tells are cheap to route around, and a filter aimed at them catches last season's phrasing while the rewrite that matters walks through. Anyone hoping their competitor's obviously optimized copy will get algorithmically punished should downgrade that expectation.

The paper's scoring makes the tradeoff explicit. Its headline metric, Net, adds two quantities: the share of the attacker's advantage a defense strips away, and what that defense does to welfare relative to the reference condition. Hard rejection can score well on the first and badly on the second, because throwing out documents throws out real information along with the manipulation. A defense has to be judged on what it costs the answer, not just on what it blocks.

VCR — verifiable-content rewards — inverts the design. Rather than only punishing suspicious rewrites, the platform credits them. The credit a rewrite earns scales with a count of the "factual claims, numerical details, or named citations present in the rewrite and supported by the original document," up to a cap.

Read that qualifier twice, because it is the whole idea. Not claims present. Claims present and supported. A number you can trace back to something real earns credit; a number that appeared during optimization earns nothing. Across three benchmarks and three engines, VCR posted the largest Net score every time, with an average advantage of 12.1 percentage points over whichever baseline was strongest in each setting, and it also produced the highest scores on the direct document-quality dimensions the authors measure — clarity, depth, insight, and factuality.

For anyone doing answer engine optimization, that is a more useful signal than another ranking factor. It splits a piece of advice that has always been treated as one thing:

The advice "add statistics" survives. The version of it that treats numbers as decoration does not. That distinction is already worth acting on for a separate reason: fabricated specifics on your own pages can be lifted verbatim into an answer and attributed to you, which is a liability rather than an optimization.

The provenance deserves the same scrutiny the finding does.

This is a preprint, not peer-reviewed work, posted two days before this article. The authors state their own limits plainly: "the theory analyzes a local quadratic surrogate and the experiments use a finite interaction horizon; neither establishes a global equilibrium," and they note that "LLM-based claim counting and rule matching can err." A local stationary point in a five-round simulation is not proof that the live web is heading somewhere specific.

The models are also small. The primary engine is gemini-2.5-flash-lite, with gpt-4o-mini and claude-haiku-4-5 as alternates, and the platform-side components run on gpt-4o-mini at temperature zero. Those are not the systems buyers are asking about your category, and quality here is scored by an LLM rubric rather than by people.

Most importantly, VCR is a proposal. No platform has announced anything like it. What the paper establishes is that a reward-for-verifiability design outperforms penalty-only designs in simulation — which is an argument about where a rational platform's incentives point, not an announcement about where any engine is today.

That still leaves it more actionable than most of what gets written about GEO, because the direction is the same one the rest of the evidence points in. Our own study of citation volatility found the set of domains cited for a prompt turning over 60–70% day to day, which is what a contested surface with no stable advantage looks like from the outside. A tactic that everyone can run is not an advantage for long.

The useful frame is not that GEO is dead. It is that GEO has entered the phase every optimization discipline reaches once the platform starts paying attention: the tactics that are purely extractive get priced out, and the ones that happen to produce something real get kept. The research now names the difference precisely enough to act on — claims supported by the underlying document, versus claims that merely appear in it.

Elmo is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces and records the full answer text alongside every mention, citation, and competitor named beside you. Because the raw answers are yours to query, you can check what an engine actually said about your brand rather than inferring it from a citation count — which is the measurement this paper's failure mode calls for.

For the fundamentals, start with what AI citations are and where they come from. For the practice, see the AEO guide and how to track your brand in AI search. For the vocabulary, the AI search glossary.