When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization

The proposed defense combines protected evidence selection with regulated source use to address malicious optimization across the search-to-generation pipeline.

Source: [3]

Its complementary components apply a defensive reranking correction and reusable natural-language guidance that enables a black-box target model to regulate source use without parameter updates.

Source: [3]

The work examines provider-side protection across evidence selection and answer generation while seeking to preserve benign evidence use and answer quality under an asymmetric threat setting.

Source: [5]

An attack is framed as a malicious rewrite of a web document intended to increase its selection and citation by a language model and thereby influence the generated answer.

Source: [7]

The attacker is assumed able to rewrite a candidate document but unable to control retrieval, reranking, generation, or the target language model.

Source: [5]

The defender may modify reranking and generation guidance while leaving target-model parameters unchanged.

Source: [5]

The reranking component keeps its base model frozen and learns a lightweight preference-based defensive correction before answer generation.

Source: [17]

Its training preferences favor both the original benign document and another relevant benign document over the malicious rewrite, while a consistency constraint preserves benign ranking structure.

Source: [9], [20]

The generation component bootstraps an external experience library from controlled contrasts between successful outcomes and failures involving residual attack influence or excessive defense.

Source: [15], [16]

It iteratively contrasts outcome groups, validates library revisions, and fixes the resulting guidance for inference, where it directs selective grounding in retrieved evidence.

Source: [10], [21]

The benchmark pairs clean candidate sets with attack-injected variants in which a selected benign document is replaced by a malicious rewrite while the remaining candidates are benign.

Source: [18]

Dataset partitioning occurs at the query-group level, preventing related queries, source documents, and rewrites from crossing construction and test partitions; the test coverage includes attack approaches withheld during construction.

Source: [18]

The evaluation contrasts the proposed defense with an undefended pipeline, a perplexity-based filter, and a fixed safety-oriented generation prompt.

Source: [8]

Evaluation measures attack-source use, semantic influence on answers, and retention of benign evidence relative to clean-reference answers; lower attack measures and higher benign retention are preferred.

Source: [13], [19]

Across the evaluated target models, the defense reports substantially lower average attack success and semantic influence than the undefended pipeline.

Source: [4], [6]

The reported security gains are accompanied by strong average retention of benign evidence, rather than an indiscriminate reduction in evidence use.

Source: [11], [14]

Relative to matched clean-reference answers, the reported average answer-quality change is close to neutral across the evaluated target models.

Source: [11]

The evaluation reports protection against attack methods withheld during construction and reports that experience libraries can transfer across target models, although the results remain specific to the tested setup.

Source: [1], [12]

Performance varies across some withheld attack methods, and later experience-library updates can produce non-monotonic changes.

Source: [2]