Generative Engine Optimization is creating a security problem alongside a marketing opportunity. If publishers can rewrite pages to make them more likely to be retrieved, cited or emphasized by AI search systems, malicious actors can attempt the same process with a different objective: not to make useful information easier to discover, but to manipulate which evidence an AI system trusts and ultimately what it tells the user.
A new research preprint proposes a defense against that problem and reports a striking experimental result. GEO Defender, introduced in the paper When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization, reduced the average success rate of tested GEO attacks from 50.32% to 6.20%. At the same time, the researchers report that the system retained 94.12% of benign-evidence use and preserved answer quality across their evaluation.
Those numbers are significant, but they require an equally important qualification. GEO Defender is a research framework described in a preprint submitted to arXiv on September 2, 2026. The paper evaluates an experimental defense across five large language models and seven GEO attacks; it is not evidence that Google, ChatGPT, Perplexity, Bing or another commercial AI search product has deployed this specific system. The work is best understood as an emerging defensive architecture and a demonstration that malicious GEO may be mitigated without simply blocking the same characteristics that make legitimate content useful.
When optimization crosses into manipulation
Traditional search optimization has always existed alongside adversarial attempts to exploit ranking systems. Generative search introduces a new target. Instead of optimizing only for a position in a ranked list of links, a publisher may want its document to become part of the evidence an LLM uses to compose a direct answer. That creates incentives around retrieval, reranking, source selection and citation behavior.
The paper defines malicious GEO as the rewriting of web documents to match a generative engine’s preferences in ways that increase the target document’s influence over generated answers. This is difficult to defend against because the manipulated document does not necessarily need to contain an obvious falsehood. The authors point out that attack documents can remain factually consistent with their originals, which limits the usefulness of defenses based purely on fact verification.
Simple anomaly detection is also an imperfect solution. Features that can make a manipulated document attractive to a generative system—clarity, authority signals, useful structure or apparent relevance—can also describe genuinely high-quality content. A filter that aggressively suppresses those characteristics could defend against manipulation by degrading the search engine’s ability to use good evidence, creating a security-versus-utility trade-off.
GEO Defender attacks the problem at two stages
The researchers’ answer is a two-stage architecture aligned with the path an attack takes through a generative search system. The first component, called Shield Reranker, operates during evidence ranking. The second, Training-Free Shield Generation, or TFSG, influences how the language model uses the evidence it ultimately receives. The framework therefore does not rely on a single detector that decides whether a document is “good” or “malicious.”
Shield Reranker is designed to demote GEO-rewritten documents while preserving ordinary relevance judgments. According to the paper, it learns a preference-based defensive residual over a frozen base reranker. Conceptually, that means the underlying relevance system remains intact while an additional defensive signal adjusts the ranking when content exhibits patterns associated with manipulative GEO.
This is an important design choice because retrieval defenses can easily become too blunt. If a security layer simply pushes down anything that resembles optimized content, it risks suppressing legitimate publishers that have written clear, relevant and well-structured pages. GEO Defender instead attempts to add a defensive correction without discarding the base system’s understanding of relevance.
The second layer changes how the LLM uses sources
Reranking alone cannot eliminate every problematic document, so GEO Defender adds a second defense at generation time. Training-Free Shield Generation distills defensive outcomes into what the authors describe as a natural-language experience library. Those instructions then guide the target LLM’s source use during inference.
The “training-free” part matters. The framework does not require fine-tuning the target language model itself. That potentially makes the approach easier to apply across different models because the defensive behavior can be introduced through inference-time guidance rather than retraining the generative engine. In the researchers’ design, the reranker reduces the prominence of manipulated evidence before generation, while TFSG gives the model additional guidance for handling the evidence that remains.
This layered approach reflects a broader security principle: do not assume one control will catch every adversarial input. A maliciously optimized document may survive retrieval, or a reranker may face an attack it has not encountered before. A generation-time defense provides another opportunity to prevent the content from disproportionately influencing the answer.
From 50.32% attack success to 6.20%
The headline result comes from experiments spanning two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks. In those tests, the researchers report that GEO Defender reduced the average attack success rate from 50.32% to 6.20%. That is an 44.12-percentage-point decline in absolute terms, with the remaining attack success rate at roughly one-eighth of the original level.
Just as important is what the defense did not remove. The paper reports 94.12% retention of benign-evidence use, while preserving answer quality. A defense that drove attack success toward zero by ignoring most retrieved evidence would have little practical value for a search system. The reported benign-evidence figure is therefore central to the framework’s claim: GEO Defender aims to suppress manipulative influence without making the generative engine broadly distrustful of useful sources.
The authors also report generalization to unseen attacks from the construction instances used to build the defense. That matters because adversarial optimization is not static. Once a particular manipulation technique is recognized, attackers can alter their rewriting strategy. A useful defense needs to capture broader attack characteristics rather than merely memorize one known template.
Why factual accuracy alone cannot solve malicious GEO
One of the paper’s most interesting implications is that AI search integrity cannot be reduced to fact-checking. A document can contain individually defensible facts and still be engineered to distort an answer by becoming disproportionately likely to be retrieved, cited or treated as authoritative. Manipulation can therefore happen at the level of evidence selection even when no sentence triggers a conventional misinformation detector.
Consider a generative answer assembled from several retrieved documents. If an optimized page systematically gains more prominence than comparable sources, the model may overrepresent its framing, product, organization or preferred conclusion. The resulting answer can remain superficially factual while becoming less representative of the available evidence. In that environment, provenance, ranking robustness and source diversity become security concerns rather than merely search-quality concerns.
This is also why the distinction between legitimate GEO and malicious GEO is not always obvious from surface characteristics. A publisher may structure an article so that an AI system can understand it accurately, cite primary sources and extract clear claims. Those practices can improve information quality. An attacker can use similar optimization knowledge to gain disproportionate influence. Defensive systems therefore need to distinguish intent and manipulation patterns without punishing ordinary high-quality publishing.
What this means for SEO and GEO practitioners
For marketers, the study should not be read as evidence that GEO itself is being blocked. The research is specifically concerned with malicious optimization intended to manipulate generative search. There remains a legitimate role for making content understandable, well sourced, technically accessible and useful to both people and machine retrieval systems.
But the direction of the research suggests that AI search platforms may increasingly evaluate more than simple relevance. If defenses resembling GEO Defender become practical, attempts to reverse-engineer citation preferences and aggressively rewrite content around those preferences could face a new layer of adversarial scrutiny. The long-term advantage may shift toward sources that provide original evidence, transparent provenance and genuine information value rather than pages engineered primarily to trigger an AI system’s selection heuristics.
That would mirror a familiar pattern from conventional search. Optimization techniques tend to work best over time when they align with the system’s quality objectives, while tactics that exploit a temporary ranking weakness create an arms race between manipulators and platform defenses. Generative search changes the mechanics of that contest, but not the underlying incentive for platforms to protect the integrity of their results.
A promising preprint, not a deployed industry standard
The reported results make GEO Defender worth watching, but the limits of the evidence should remain visible. The current work is an arXiv preprint, and the published abstract describes controlled experiments rather than a large-scale deployment in a commercial search engine serving real-world web traffic. Production systems encounter continuously changing documents, multilingual content, latency and cost constraints, novel attacks and ranking objectives that laboratory benchmarks cannot fully reproduce.
There is also no basis in the paper for claiming that major commercial AI search providers currently use GEO Defender. Similar ideas—defensive reranking, source-quality controls and inference-time instructions—may exist independently in production systems, but that is different from saying this particular framework has been adopted. The distinction is especially important in an area where security research can quickly be mistaken for a product announcement.
What the study does provide is evidence that the problem may be tractable. Instead of trying to identify malicious GEO with a single factuality filter, the researchers intervene both before and during generation: first by adjusting evidence ranking, then by guiding how the model consumes retrieved sources. In their experiments, that combination cut average attack success from roughly one in two attempts to about one in sixteen while retaining most legitimate evidence use.
As AI search becomes a larger source of discovery, traffic and commercial visibility, attempts to manipulate its evidence pipeline are likely to become more sophisticated. GEO Defender is not proof that the problem is solved, and it is not a feature announcement from a commercial search engine. It is something more useful at this stage: a concrete experimental demonstration that generative search can be designed to resist optimization that crosses the line into manipulation without simply rejecting the legitimate evidence those systems need to answer well.