When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

The proposed defense combines protected evidence selection with regulated source use to address malicious optimization across the search-to-generation pipeline.

Source: E003

Its complementary components apply a defensive reranking correction and reusable natural-language guidance that enables a black-box target model to regulate source use without parameter updates.

Source: E003

Across the evaluated target models, the defense reports substantially lower average attack success and semantic influence than the undefended pipeline.

Source: E004, E006

The reported security gains are accompanied by strong average retention of benign evidence, rather than an indiscriminate reduction in evidence use.

Source: E011, E014

Relative to matched clean-reference answers, the reported average answer-quality change is close to neutral across the evaluated target models.

Source: E011

The evaluation reports protection against attack methods withheld during construction and reports that experience libraries can transfer across target models, although the results remain specific to the tested setup.

Source: E001, E012

Performance varies across some withheld attack methods, and later experience-library updates can produce non-monotonic changes.

Source: E002

The proposed defense combines protected evidence selection with regulated source use to address malicious optimization across the search-to-generation pipeline.

Source: E003

Its complementary components apply a defensive reranking correction and reusable natural-language guidance that enables a black-box target model to regulate source use without parameter updates.

Source: E003

The work examines provider-side protection across evidence selection and answer generation while seeking to preserve benign evidence use and answer quality under an asymmetric threat setting.

Source: E005

An attack is framed as a malicious rewrite of a web document intended to increase its selection and citation by a language model and thereby influence the generated answer.

Source: E007

The attacker is assumed able to rewrite a candidate document but unable to control retrieval, reranking, generation, or the target language model.

Source: E005

The defender may modify reranking and generation guidance while leaving target-model parameters unchanged.

Source: E005

The proposed defense combines protected evidence selection with regulated source use to address malicious optimization across the search-to-generation pipeline.

Source: E003

Its complementary components apply a defensive reranking correction and reusable natural-language guidance that enables a black-box target model to regulate source use without parameter updates.

Source: E003

The reranking component keeps its base model frozen and learns a lightweight preference-based defensive correction before answer generation.

Source: E017

Its training preferences favor both the original benign document and another relevant benign document over the malicious rewrite, while a consistency constraint preserves benign ranking structure.

Source: E009, E020

The generation component bootstraps an external experience library from controlled contrasts between successful outcomes and failures involving residual attack influence or excessive defense.

Source: E015, E016

It iteratively contrasts outcome groups, validates library revisions, and fixes the resulting guidance for inference, where it directs selective grounding in retrieved evidence.

Source: E010, E021

The benchmark pairs clean candidate sets with attack-injected variants in which a selected benign document is replaced by a malicious rewrite while the remaining candidates are benign.

Source: E018

Dataset partitioning occurs at the query-group level, preventing related queries, source documents, and rewrites from crossing construction and test partitions; the test coverage includes attack approaches withheld during construction.

Source: E018

The evaluation contrasts the proposed defense with an undefended pipeline, a perplexity-based filter, and a fixed safety-oriented generation prompt.

Source: E008

Evaluation measures attack-source use, semantic influence on answers, and retention of benign evidence relative to clean-reference answers; lower attack measures and higher benign retention are preferred.

Source: E013, E019

Across the evaluated target models, the defense reports substantially lower average attack success and semantic influence than the undefended pipeline.

Source: E004, E006

The reported security gains are accompanied by strong average retention of benign evidence, rather than an indiscriminate reduction in evidence use.

Source: E011, E014

Relative to matched clean-reference answers, the reported average answer-quality change is close to neutral across the evaluated target models.

Source: E011

The evaluation reports protection against attack methods withheld during construction and reports that experience libraries can transfer across target models, although the results remain specific to the tested setup.

Source: E001, E012

Performance varies across some withheld attack methods, and later experience-library updates can produce non-monotonic changes.

Source: E002