Engines are learning to discount GEO rewrites

A GEO defense is a filter or reranker placed in front of an AI answer engine that detects documents rewritten to sway the answer and demotes or blocks them before the model reads them.

For most of the short history of generative engine optimization, the research has run in one direction: find a rewrite that raises a page's share of an AI answer. That is changing. Two papers posted to arXiv on the same day this month build the other side of the arms race, and both report that the defense works. Neither describes a system that ChatGPT, Perplexity or Google has deployed. They do show what a defense looks like, what it keys on, and who gets caught in it.

#The attack works more than half the time

The starting point is uncomfortable for anyone who treats AI answers as neutral summaries. Counter-GEO-Bench paired 247 human-verified queries with two kinds of rewrites of the same source document. One applied GEO techniques and kept every fact. The other applied the same techniques and slipped in a false claim, dressed up with fabricated authority, fake citations, temporal framing and structured formatting.

With no defense in place, the distorting version moved the answer toward the false claim in 55.7% of cases on average across three open models, from a single ordinary-looking document. The second paper, GEO Defender, measured seven published GEO methods against five models, including GPT-5.5 and Claude Opus 4.8, and put the average attack success rate at 50.32% before its defense.

Those numbers come from controlled setups, not live search. They are still high enough that any engine operator reading them has a reason to act.

#Existing safety filters miss it

The obvious first defense is the guardrail models engines already run. Counter-GEO-Bench tested three of them: Granite Guardian, Llama Guard 3 and NeMo's self-check fact-checking. The best of the three cut attack success by at most 5.7% relative, and Granite Guardian's reduction was not statistically significant.

The authors' explanation is the useful part. Safety guardrails look for policy violations such as hate speech or weapons instructions. A GEO attack contains none. It is fluent, informational, confident prose, which is exactly what a safety classifier is built to let through.

#What the new defenses key on

The two papers take different routes, and both are worth understanding because they show what a working defense has to notice.

Style similarity. The Counter-GEO-Bench baseline, C-GEO Guard, is a small encoder model trained to recognise the signature of known attack types. It scores each retrieved chunk against a centroid for each attack class and blocks chunks above a similarity threshold. That simple approach cut attack success by 47.6% relative, and by 60.4% relative on attack rewrites generated with GPT-5.5, a different rewriter, according to the full paper.

Originals over rewrites. GEO Defender adds a reranker trained on preference pairs. It learns that an original benign document should outrank its GEO-rewritten variant, and that other relevant benign documents should also outrank the rewrite, while keeping the order among benign sources intact (method details). Combined with a generation-stage shield, it brought average attack success down from 50.32% to 6.20% while keeping 94.12% of benign-evidence use. Four of the seven attack methods were held out of training, and the defense still generalised to them.

Neither system checks whether a claim is true against the world. They detect how a document was written and how it compares with its neighbours.

#Honest optimization pays a tax

This is where the research touches ordinary publishers. A detector that keys on style cannot fully separate an honest page that uses GEO techniques from a dishonest one that uses the same techniques.

Counter-GEO-Bench measured that directly. On information-preserving rewrites, the ones that kept every fact and only changed tone and structure, C-GEO Guard blocked 2.16% of chunks, against 0.29% for Granite Guardian. The authors call this an acceptable trade-off for a research baseline, and at that level it is small. The direction matters more than the size. A filter tuned harder to catch attacks will catch more honest pages that carry the same stylistic fingerprint: inflated authority language, citation-shaped claims, "as of this year" framing wrapped around content that does not need it.

The GEO Defender reranker has a similar property by design. Its training objective is that the unoptimized original beats the optimized variant. If a production engine adopted that objective, a page rewritten to look like GEO output would compete against a preference learned to discount it.

#Where the line sits

The most useful framing comes from the critical survey of 45 GEO studies published in July. It proposes four cumulative tests for separating optimization from manipulation: semantic preservation, evidentiary authenticity, content and instruction separation, and disclosure fairness. It also recommends that engines separate instructions from content and limit how much authority any single document can claim.

The same survey reports that in a controlled experiment of 252,000 trials across six LLMs, relevance and position were the primary drivers of the first citation. Google's own documentation says there are "no additional requirements to appear in AI Overviews or AI Mode, nor other special optimizations necessary". Put together, the tactics most at risk from defenses are also the ones with the weakest evidence behind them.

#What to do with this

Treat these papers as a preview, not a policy change. Practical steps that hold up either way:

• Make authority checkable. Every claim of expertise or data should point to something a reader or a model can open. A named author page, a linked study, a dated dataset. Fabricated or vague authority is the exact pattern the attack classes use.
• Use dates where they are true. A real "updated" date on a page that changed is a freshness signal. Year stamps added to unchanged copy look like temporal framing, which is one of the tested attack features.
• Keep instructions out of content. Text addressed to an AI system, visible or hidden, fails the content and instruction separation test outright and is the first thing a defense will look for.
• Audit rewrites, not just originals. If your team or a tool has run pages through an AI rewriter to "optimize for LLMs", compare the output with the original. Additions of authority phrasing or citation-like claims without new evidence are the parts to remove.
• Measure before and after. When you change a page, rerun the same fixed prompt set and check whether its citation rate in AI answers actually moved. A rewrite that helps nothing is pure risk once filters like these exist.

The practical conclusion is plain. Engines have a documented reason to discount content that reads like it was written for them. Pages that carry their own evidence do not need the style, and lose nothing when the filters arrive.