Skip to content
Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization

Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization

Authors: Bing Zheng, Zongyao Zhao, Wenming Yang
Venue: arXiv cs.CL, 2026 — arxiv:2609.02316

TL;DR

Adversaries exploit Generative Engine Optimization (GEO) to craft web documents containing targeted false claims that rank highly in LLM-generated search results. This paper introduces Counter-GEO-Bench, a benchmark of 247 human-verified query-document pairs, evaluates existing guardrails (all ineffective), and proposes C-GEO Guard, a chunk-level detector that reduces attack success rate by 47.6%.

Contributions

  • First benchmark for information-distorting GEO. 247 human-verified query-document pairs pairing information-preserving and information-distorting rewrites of the same target document, isolating the misinformation effect from the GEO visibility lift.
  • Empirical evidence of guardrail failure. Granite Guardian, Llama Guard 3, and NeMo Self-Check Fact-Checking each reduce ASR by <3.2pp—negligible against the threat. Safety-taxonomy approaches miss GEO-specific attack patterns.
  • C-GEO Guard baseline. A chunk-level contrastive detector trained to distinguish ID-GEO rewrites from paired IP rewrites and clean text, achieving 47.6% relative ASR reduction (26.5pp absolute) with near-zero utility loss (0.2pp accuracy drop on clean queries).

Method

GEO attacks operate at the document level: adversaries control web content and optimize it for search ranking via citation hooks, structural formatting, and phrasing to embed targeted false claims. The threat model differs from typical adversarial-query attacks — the user query remains benign; only the retrieved malicious content enters the pipeline.

Benchmark construction starts with 1,000 GEO-Bench query-source pairs. For each, a Sonnet rewriter generates metadata and paired rewrites: information-preserving (IP, legitimate GEO) and information-distorting (ID, attack variant). A quality gate enforces plausive rewrites; human verification confirms the final 247 instances (50% pass rate on 500 queries).

Threat model distinguishes two rewrite categories: - Information-Preserving (IP): Legitimate GEO optimizing structure, phrasing, citation hooks, authority signals while preserving all original facts. - Information-Distorting (ID): Same GEO optimization strength plus a targeted false claim injected through varied phrasing, fabricated citations, temporal framing, and structured formatting.

Evaluation harness simulates a deployed generative search pipeline: documents are chunked (512 tokens, 128-token overlap), retrieved via hybrid BM25 + BGE embedding search returning top-50 candidates, reranked by cross-encoder, then synthesized by victim LLM.

Evaluation metrics: - Attack Success Rate (ASR): Fraction of LLM responses asserting the false claim without hedging. - False Positive Rate (FPR): For chunk-level defenses, fraction of clean or IP chunks incorrectly flagged. - Answer Quality: LLM judge scoring relevance, completeness, clarity (1–5 scale); orthogonal to ASR.

Off-the-shelf guardrails tested: - Granite Guardian (8B chunk filter after reranking) - Llama Guard 3 (8B chunk filter, same interface) - NeMo Self-Check Fact-Checking (output-rail verifier)

C-GEO Guard architecture: A sentence-embedding model (DeBERTa-v3-base, 184M params) trained via contrastive fine-tuning to detect manipulation patterns. Mean pooling over contextualized embeddings produces 768-dim chunk embeddings. Per attack class \(k\), the model computes class centroids \(c_k\) from training chunks; at inference, a candidate chunk \(e\) is scored by cosine similarity to the nearest centroid, blocked when similarity exceeds a detection threshold.

Training: Uses non-ID chunks as negatives; paired IP/ID/clean chunks; multi-negatives ranking loss (MNRL). Threshold calibrated on hold-out split (\(\tau=0.90\)) to minimize ASR while preserving clean utility.

Results

Attack mitigation on ID condition (N=247): - Undefended baseline: 56.5% ASR across three victim LLMs (Gemma-4-31B, Qwen-3.5-35B, Llama-4-Scout-17B). - Granite Guardian: −9.0pp reduction (51.4% ASR) — not statistically significant (\(p=0.096\)). - Llama Guard 3: −8.3pp reduction — statistically significant but operationally negligible. - NeMo Self-Check: −11.2pp reduction; however, blocks 3.24% of clean queries (utility cost) and 98.4% block rate on Llama-4 excludes it from reported 3-model average. - C-GEO Guard: −45.8pp reduction (30.6% ASR), 47.6% relative reduction; 95% CI [23.8, 29.3]pp, highly significant (\(p<0.001\)); answer quality remains stable (4.48/5.0).

Non-attacked performance: Granite Guardian and Llama Guard 3 maintain near-zero block rates on clean text; C-GEO Guard blocks 10.27% of ID chunks while preserving clean utility (−0.2pp accuracy).

Cross-rewriter transfer: When C-GEO Guard is retrained on GPT 5.5 rewrites (different attack template), it achieves 32.0% relative ASR reduction on Qwen-3.5 (weaker than Sonnet-trained version but non-zero transfer), suggesting detection of manipulation patterns beyond the training rewriter.

Quality-accuracy tradeoff: Unlike retrieval-poisoning attacks (where attack success is independent of output quality), Counter-GEO-Bench reveals an inverse relationship: full-success attacks narrow the answer toward a false claim, suppressing balanced hedging; thus, high-ASR queries average lower answer quality (4.29 vs. 4.70).

Connections

Notes

Strengths: - Novel threat model isolating information-distortion from GEO visibility effects via paired clean/IP/ID design. - Human-verified benchmark with realistic 1,000-query source corpus (GEO-Bench). - Rigorous empirical evidence of guardrail failure; Granite Guardian and Llama Guard 3 show no statistically significant ASR reduction. - C-GEO Guard introduces a reusable, lightweight chunk-level detector with near-zero utility cost (−0.2pp accuracy) and strong cross-rewriter transfer signal. - Clear decomposition of defense stages (chunk filter, output rail) and realistic harness matching deployed LLM synthesis pipelines.

Limitations: - Benchmark limited to 247 final instances after 25% pass rate (reflects realistic quality control but limits statistical power on subgroup analysis). - C-GEO Guard threshold (\(\tau=0.90\)) calibrated on hold-out data; deployment requires per-rewriter re-tuning or domain adaptation. - Evaluation restricted to three victim LLMs (Gemma, Qwen, Llama); generalization to closed-source or fine-tuned models unclear. - Paper does not evaluate adversarial adaptation (attacker aware of C-GEO Guard's contrastive signal and optimizing against it). - Quality-accuracy inverse relationship noted but not deeply analyzed; unclear whether hedging suppression is fundamental to high-ASR attacks or a side effect of the Sonnet rewriter's style.

Relevance to fake-news literature: This work directly addresses synthesized misinformation insertion into LLM pipelines—a novel and growing threat surface as generative search becomes ubiquitous. The benchmark and C-GEO Guard baseline enable future work on adversarial defenses and information-integrity guardrails. The empirical failure of existing safety taxonomy classifiers on information-distorting attacks suggests that misinformation-specific, manipulation-pattern-aware detectors (as exemplified by C-GEO Guard) are necessary.