AI search systems appear remarkably resistant to many of the black-hat SEO techniques that have polluted conventional search for years. A new security study accepted at The ACM Web Conference 2026 reports that LLM-enhanced search engines collectively mitigated more than 99.78% of traditional SEO attacks in its benchmark, with the retrieval stage doing most of the defensive work.
That sounds like an overwhelming victory for AI search until the researchers changed the attack model.
When they tested manipulation techniques designed specifically around how large language model search systems understand queries and process retrieved text, the success rate increased. Two approaches examined in the study—rewritten-query stuffing and segmented text—roughly doubled the manipulation rate compared with the baseline.
The contrast is the important finding. AI search may be unusually good at filtering yesterday's search spam while creating different attack surfaces that traditional search engines did not have to defend.
SEO-Bench is a security benchmark, not an SEO experiment
The paper, “Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation,” was submitted to arXiv on March 26, 2026 and is listed as accepted at The ACM Web Conference 2026.
The researchers describe it as the first systematic study focused on black-hat SEO attacks against LLM-enhanced search engines, or LLMSEs. Their goal was not to determine which legitimate optimization tactic produces more citations. It was to test whether malicious operators can manipulate AI search systems into surfacing attacker-controlled websites.
That distinction matters because the study's definition of success is adversarial. The threat model asks whether an attacker can induce an AI search system to include a clickable reference to a controlled domain in its generated response.
The paper actually studies ten AI search systems
Some summaries of the research describe nine systems, but the published paper lists ten representative LLM-enhanced search products.
Five are closed-source services: ChatGPT Search, Gemini Grounding, Google AI Overview, Perplexity and Komo AI. Five are open-source systems: Open WebUI, Khoj, STORM, Perplexica and GPT Researcher.
The researchers selected the commercial products from prominent AI search services and the open-source projects from widely used repositories. The resulting set was intended to cover different implementations rather than a single vendor architecture.
This also means the 99.78% figure should be read as a result across the study's evaluated ecosystem, not as an independently published security rate for any one named product today.
SEO-Bench contains 1,000 real-world black-hat SEO websites
To evaluate conventional attacks, the authors created SEO-Bench from 1,000 real-world websites associated with black-hat SEO activity.
Traditional manipulation can include techniques such as keyword stuffing, link schemes, cloaking, redirection and semantically confusing content designed to gain visibility for pages that would not deserve it on relevance or quality alone.
Rather than studying only synthetic prompts in a laboratory, the benchmark gives the researchers a collection grounded in real-world search abuse.
The central question was whether tactics developed to exploit conventional search infrastructure transfer effectively into search systems that add query rewriting, retrieval, reranking and LLM-generated summaries.
More than 99.78% of traditional attacks were mitigated
The headline result is unusually strong.
The authors report that the evaluated LLM-enhanced search engines resisted more than 99.78% of traditional black-hat SEO attacks in SEO-Bench.
That does not mean the systems are 99.78% secure against every possible form of manipulation. It means the conventional attack set tested in this benchmark was overwhelmingly prevented from achieving the study's defined objective.
The difference is essential. Security percentages are meaningful only in relation to the threat model, systems, dataset and time period used to produce them.
Retrieval was the main defensive barrier
The most interesting part of the study may be where the attacks failed.
The researchers break LLM-enhanced search into three broad phases: understanding, retrieval and summarization. The system first interprets and may rewrite the user's query, then retrieves and reranks information from external sources, and finally uses that material to construct an answer with references.
According to the paper, retrieval acted as the primary filter against traditional black-hat SEO. Most malicious material was intercepted before it could become useful evidence for the final generated answer.
This suggests that an LLM's final reasoning layer is not the only—or necessarily the most important—defense against search manipulation.
AI search has multiple opportunities to reject spam
A traditional mental model of generative search can overemphasize the language model itself. The study instead highlights the defensive value of the entire pipeline.
A suspicious page first has to become retrievable for a relevant query. It may then need to survive ranking or reranking. Even if retrieved, it still has to be selected as evidence that contributes to the generated answer or citation set.
Each stage can reduce the probability that a malicious site reaches the user.
That layered architecture may help explain why many legacy black-hat techniques transfer poorly into AI search even when they once succeeded at influencing conventional rankings.
But AI search introduces a new query-understanding attack surface
The same pipeline also creates new opportunities for manipulation.
LLM-enhanced search systems can reinterpret a user's request and generate rewritten queries before retrieval. Those machine-generated queries may differ substantially from the words the user typed.
The researchers therefore asked whether an attacker could design content around the system's likely internal interpretation rather than merely around the visible user query.
This moves the adversarial target upstream. Instead of optimizing only for a human-entered keyword, manipulation can attempt to exploit the intermediate language generated by the AI search system itself.
The researchers evaluated seven LLM-specific attack strategies
After testing traditional black-hat SEO, the authors designed seven attack strategies aimed more directly at LLM-enhanced search workflows.
The experiments used 450 self-deployed websites so the researchers could control the manipulated content while observing end-to-end system behavior.
Two categories produced the most notable result reported in the abstract: rewritten-query stuffing and segmented text approximately doubled the manipulation rate compared with the baseline.
The finding demonstrates that defensive success against traditional spam does not automatically generalize to attacks engineered for the architecture of generative search.
“Doubled” needs context
A doubling can sound dramatic while concealing the underlying base rate.
The study's claim is comparative: particular LLM-specific strategies achieved roughly twice the manipulation rate of the baseline used in those experiments.
It should not be translated into the statement that half of AI search results can be manipulated, that the techniques work consistently, or that every commercial system is equally vulnerable.
The responsible conclusion is narrower: attacks adapted to LLM search behavior performed materially better than the study's baseline, exposing weaknesses that conventional SEO-spam defenses do not fully address.
The research is about attacker-controlled citations
The paper's threat model is particularly relevant to modern AI search because generated answers frequently include links or citations.
The attacker's goal is to make an LLM-enhanced search engine embed a URL controlled by the attacker in its response. A successful manipulation therefore does more than move a page upward in a conventional ten-blue-links interface.
It can potentially place an untrusted source inside an AI-generated answer that users may perceive as synthesized or vetted.
This raises the security stakes because the interface can transfer some of the assistant's perceived authority to the cited source.
Retrieval security is becoming citation security
In generative search, the quality of the answer depends heavily on the quality of the evidence retrieved before generation.
If the retrieval system successfully excludes manipulated pages, the language model never has an opportunity to treat them as evidence. If an adversarial page enters the retrieved context, the system has to detect the problem later during reranking, evidence selection or answer generation.
That makes retrieval filtering a core component of citation integrity.
The 99.78% result is therefore significant not because it proves AI search is safe, but because it identifies where much of the observed resilience came from.
Legacy black-hat SEO may not transfer cleanly into generative search
The study challenges a simplistic assumption that AI search will inherit conventional SEO manipulation unchanged.
Search systems augmented with LLMs often perform more processing between the user's query and the final source selection. Query rewriting, multiple retrieval calls, reranking and synthesis can disrupt tactics designed for a more direct keyword-to-results pipeline.
A page engineered around an old search-engine weakness may simply fail to enter the AI system's retrieved evidence.
For defenders, that is encouraging. For researchers, it means future search security needs its own threat models rather than relying exclusively on historical web-spam benchmarks.
New manipulation can target the AI's own intermediate language
The paper's LLM-specific experiments point toward a broader problem in generative retrieval.
An AI search system does not merely receive a query. It may create internal representations, rewritten searches and segmented evidence that influence what comes next.
Those intermediate artifacts can become attack surfaces if malicious publishers learn enough about their statistical patterns.
This is conceptually different from ordinary keyword stuffing because the attacker is attempting to influence a machine-generated research process rather than simply matching a visible search phrase.
Text segmentation creates another generative-search weakness
LLM search systems frequently break retrieved material into chunks or segments so models can process long documents within practical context limits.
The study finds that manipulation designed around segmented text can outperform its baseline.
From a defensive perspective, the result highlights a known challenge in retrieval-augmented systems: a document can look different when evaluated as isolated passages than when understood as a complete page.
Security systems therefore need to evaluate not only individual chunks but also the broader context, provenance and behavior of the source that produced them.
This should not become a black-hat AI optimization playbook
The value of SEO-Bench is defensive.
The authors are identifying where AI search systems remain vulnerable so those systems can become more resilient. They say the issues were responsibly reported to major vendors.
Publishers should not interpret the findings as a recommendation to reproduce adversarial techniques in order to gain AI visibility.
Manipulating retrieval systems to inject low-quality or attacker-controlled sources is fundamentally different from legitimate GEO or SEO work that improves clarity, authority, accessibility and factual usefulness.
Legitimate optimization and adversarial manipulation need a clear boundary
AI search has created a vocabulary problem for the marketing industry.
Some techniques described as generative engine optimization simply make information easier for systems to understand: clear entity descriptions, crawlable text, useful citations, consistent facts and strong source provenance.
Security research uses a different definition of optimization when the goal is to cause a system to surface a page despite a lack of genuine relevance or trustworthiness.
Conflating those activities risks normalizing adversarial behavior under the broader GEO label.
The tested systems reflect 2025-era products and data
The biggest limitation for a September 2026 reader is time.
The paper states that its product popularity statistics were collected as of September 2025, and the experiments necessarily reflect versions, configurations and retrieval defenses available during the research period.
AI search systems change rapidly. Vendors can alter query rewriting, retrieval providers, ranking models, safety filters, citation logic and abuse detection without exposing every change publicly.
The benchmark therefore offers a valuable historical measurement, not a guarantee about the exact defenses running in ChatGPT, Gemini, Google AI Overviews or Perplexity today.
Vendor disclosure may already have changed the systems
The authors say they responsibly disclosed the identified issues to major LLM-enhanced search vendors.
That is another reason not to assume the measured vulnerabilities remain unchanged.
Responsible disclosure is intended to give vendors an opportunity to investigate and mitigate weaknesses before or around publication.
Without a fresh replication using current systems, it is impossible to know which defenses have already been modified in response to the findings or through unrelated product updates.
Closed systems make longitudinal research difficult
Security benchmarking is particularly challenging when several evaluated products are proprietary.
A researcher can rerun the same prompt months later and receive different behavior without knowing whether the change came from a new model, a new retrieval stack, a ranking update, an abuse classifier or an experiment affecting only some users.
This creates a moving target for reproducibility.
SEO-Bench is useful partly because it provides a methodology future researchers can repeat as systems evolve.
The 99.78% figure should not become a marketing claim for individual vendors
Because the headline percentage is so strong, it is easy to imagine it being reused without context.
The study does not establish that ChatGPT Search individually blocks exactly 99.78% of all SEO spam, nor that Gemini or Perplexity has that exact defense rate. It reports aggregate findings across the evaluated LLM-enhanced search ecosystem and benchmark.
Different systems have different retrieval architectures and may fail in different places.
Vendor-level security claims require vendor-level measurements under current conditions.
The study maps AI search into three security phases
One useful framework from the paper is its decomposition of the AI search workflow.
The understanding phase interprets user intent and may rewrite the query. The retrieval phase fetches information from multiple sources and reranks candidate references. The summarization phase assembles the selected evidence into a generated response with references.
Each phase has a distinct security role.
This framework gives researchers and search teams a more precise way to ask where manipulation enters the pipeline instead of treating an AI search engine as one opaque model.
Defenders should monitor the entire retrieval chain
If most traditional attacks are stopped during retrieval, operators need strong telemetry around what the system searches for, which domains enter candidate sets and why particular sources survive reranking.
Monitoring only the final generated answer can miss attempted manipulation that was successfully filtered earlier.
Conversely, monitoring only retrieval can miss malicious evidence that enters the context but is later rejected.
End-to-end security requires visibility across the chain.
Source reputation alone is unlikely to solve the problem
One tempting defense is to rely heavily on domain reputation.
That can reduce obvious spam, but it risks excluding legitimate new publishers while failing against compromised or previously trustworthy domains.
AI search systems need to evaluate relevance, content integrity, provenance and behavioral signals together rather than treating authority as a permanent binary property.
The study's emphasis on phase-specific vulnerabilities supports a layered defense rather than a single spam score.
AI search changes the economics of spam
Traditional black-hat SEO often aims to rank a page for enough queries to generate traffic at scale.
Generative search can create a different reward: inclusion as a cited source inside a synthesized answer.
Even if the user never visits the entire results page, a successful attacker may gain visibility, referral traffic or perceived legitimacy from being referenced by an AI assistant.
As AI-generated answers become more common, attackers have an incentive to develop techniques tailored specifically to that citation pathway.
The security arms race will evolve alongside GEO
Legitimate publishers are learning how AI systems retrieve and cite information. Adversarial publishers are studying the same infrastructure for different reasons.
That means improvements in understanding AI retrieval will have dual consequences. Better measurement can help brands publish clearer information, while the same architectural knowledge can reveal manipulation opportunities.
Search providers will have to update abuse detection as optimization practices evolve.
The history of conventional SEO suggests that any valuable discovery channel eventually attracts actors willing to test its boundaries.
SEO teams should care even if they never use black-hat tactics
Spam affects legitimate publishers because successful manipulation degrades the information environment in which everyone competes.
If AI systems respond by making retrieval filters more aggressive, innocent pages can face higher thresholds for inclusion. If vendors distrust certain content patterns because attackers abuse them, legitimate marketers may find those patterns less effective or more heavily scrutinized.
Understanding security research helps responsible SEO teams distinguish durable content practices from tactics likely to trigger an adversarial response.
The long-term advantage remains producing information that survives stricter quality controls rather than exploiting temporary weaknesses.
What SEO-Bench does not prove
The paper does not prove that AI search is immune to black-hat SEO. It does not prove that traditional search engines are less secure under equivalent modern conditions. It does not establish a permanent manipulation rate for any named product, and it does not measure every possible adversarial technique.
It also does not show that LLM-specific manipulation is reliably profitable or scalable in the wild.
What it does provide is controlled evidence that legacy SEO attacks transfer poorly into the tested LLM-enhanced search systems while attacks designed around the newer architecture can recover some effectiveness.
That is a narrower claim, but a strategically important one.
The next benchmark should test today's systems
The obvious follow-up is longitudinal replication.
Researchers could rerun SEO-Bench against current versions of the same products, add newer AI search systems, compare regions and languages, and measure whether responsible disclosure reduced the effectiveness of the LLM-specific attacks.
It would also be useful to distinguish retrieval, citation and final-answer influence more granularly.
AI search is changing too quickly for a single snapshot to define the security landscape for long.
AI search is filtering old spam while creating new attack surfaces
SEO-Bench delivers a result that is simultaneously reassuring and cautionary. Across 1,000 real-world black-hat SEO websites, the evaluated LLM-enhanced search engines mitigated more than 99.78% of traditional attacks, with retrieval acting as the main defensive filter.
But when the researchers designed attacks around the distinctive mechanics of LLM search, the picture changed. Rewritten-query stuffing and segmented-text approaches roughly doubled the manipulation rate relative to the baseline, demonstrating that a system can be highly resistant to yesterday's spam while remaining vulnerable to tactics designed for its new architecture.
The research should not be read as an instruction manual for AI-search manipulation, and its measurements should not be projected uncritically onto September 2026 products. The evaluated systems reflect a 2025-era snapshot, the authors disclosed weaknesses to vendors, and AI retrieval stacks evolve rapidly.
The durable lesson is about security architecture. Generative search does not eliminate the SEO arms race. It moves the battlefield—from conventional ranking tricks toward query understanding, retrieval, segmentation and citation selection. AI search may have blocked most of the old playbook, but SEO-Bench shows why defenders cannot assume the next playbook will look anything like the last one.