CoChat
Sign Up
PreprintCited by 0Adversarial Robustness in Machine LearningSpam and Phishing DetectionInformation Retrieval and Search Behavior

GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization

Open access
Nimase, Ojas, Chen, Zhe, Zhao, Yue, Hu, Xiyang·2026·arXiv
DOI 10.48550/arxiv.2605.29107arXiv 2605.29107
Open this paper in CoChat — free accountOpen PDF

Abstract

Large language models (LLMs) increasingly rank products, documents, and recommendations for user queries, which makes manipulating these rankings a growing concern for fairness and information integrity. Research on generative engine optimization (GEO) has produced many manipulation methods, but each is evaluated on its own dataset with its own metrics, so their relative strength and detectability stay unclear. We present GEO-Bench, a benchmark that evaluates GEO ranking-manipulation attacks under one protocol. It unifies black-box prompt-based attacks (TAP, Zero-Shot), white-box gradient-based attacks (STS, RAF, StealthRank), and ten white-hat C-SEO strategies. We score every method on five datasets against a fixed open-weight ranker (Llama-3.1-8B-Instruct), using metrics for both effectiveness (NRG, Success@α, Promote@α) and stealth (keyword violation rate, perplexity ratio). Our evaluation shows that effectiveness and stealth trade off across adversarial attacks, that black-box content rewriting matches or exceeds gradient-based attacks on rank promotion while producing more fluent text and can evade both keyword- and perplexity-based detection on some domains, and that the access model does not predict attack strength. By standardizing datasets, attack implementations, and metrics, GEO-Bench enables the first direct comparison across these attack paradigms and supports the development of detection methods.

AI snapshot

Written from the paper’s full text.

TL;DR

GEO-BENCH unifies black-box prompt attacks, white-box gradient attacks, and ten white-hat C-SEO strategies across five datasets under one protocol against Llama-3.1-8B-Instruct, scoring both effectiveness and stealth. It finds adversarial attacks trade effectiveness against stealth, while black-box content rewriting can match or exceed gradient attacks and sometimes evade both keyword- and perplexity-based detectors.

Key findings

  • Across adversarial attacks, effectiveness and stealth trade off: TAP promotes well but has KVR ≥ 0.83 everywhere; STS keeps KVR low (0.03–0.20) but sharply degrades fluency (PPL-R up to 12.72); RAF and Zero-Shot stay quiet on both signals yet do not move the target (NRG ≤ 0.09 and ≤ 0.27).
  • White-hat C-SEO strategies match or exceed gradient-based attacks on three of five datasets; the three highest average-NRG methods (TAP, Authoritative, Content Improvement) are all black-box, so the access model does not predict attack strength.
  • On C-SEO Bench, Authoritative ties LLM Guidance for the highest NRG (0.83) at zero keyword violations and a 0.74 perplexity ratio, evading both detectors while promoting strongly.
  • Rankings are dataset-sensitive: TAP is strongest on average (NRG 0.53) but takes the top NRG on only one of five datasets; Authoritative leads on C-SEO Bench (0.83) yet collapses to 0.00 on LLM Rank Optimizer, and STS moves from 0.60 to 0.06. TAP leads Promote@0.1 up to 0.92, while RAF and Zero-Shot never exceed 0.28 and 0.02.

Methods

  • Benchmark evaluates eight algorithms across two paradigms—black-box prompt-based attacks (TAP, Zero-Shot) and white-box gradient-based attacks (STS, RAF, StealthRank)—plus ten white-hat C-SEO strategies, reporting the top three (Authoritative, Content Improvement, LLM Guidance) in main results.
  • Five datasets: Ragroll (399 items, 50 categories), STSData (30, 3), RewriteToRank (10,000 full; evaluated on a 20-category, 10-item-per-category subsample), LLM Rank Optimizer (40, 4), and C-SEO Bench (16,360, 6 domains).
  • Ranking target is Llama-3.1-8B-Instruct; PPL-R uses Vicuna-7B as reference; C-SEO rewrites use GPT-4o-mini; metrics are NRG, Success@α, Promote@α, KVR, and PPL-R; experiments ran on 3× NVIDIA L40S GPUs for approximately 200 GPU hours.

Limitations

  • The paper states all methods are evaluated against a single open-weight ranker (Llama-3.1-8B-Instruct); stealth metrics are automatic proxies (KVR and PPL-R) rather than human judgments or trained detectors; and datasets center on English product/content ranking, so conclusions may not transfer to other languages or domains without corresponding data.
  • The paper also notes the current version runs against offline open-weight models rather than deployed commercial systems, and release will be restricted after license, anonymization, and dual-use checks.
  • Evident from the text: detection-evasion claims rest on the two proxy detectors, and the benchmark’s own dataset-sensitivity findings mean single-dataset rankings overstate generalizability; subsampling and target selection may further constrain external validity.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2605.29107

Cites

0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

8 of 12 cited sources checked · 4 supported · 1 flagged · accuracy not yet measured

  • Premisereasoning

    Existing GEO manipulation methods are evaluated on disparate datasets, metrics, and experimental setups, preventing direct comparison of their relative strength and detectability.

    “Research on generative engine optimization (GEO) has produced many manipulation methods, but each is evaluated on its own dataset with its own metrics, so their relative strength and detectability stay unclear.”
    • Also stated in: § 1 Introduction · plain
      “However, the field lacks a unified framework for comparing these approaches: existing work uses disparate datasets, metrics, and experimental setups.”
    • Also stated in: § Adversarial Ranking Manipulation. · plain
      “Each evaluates on its own dataset and metrics, preventing direct cross-method comparison.”
    Quote in the paperSubstantial claim3 of 3 sources checked
    • cites Tang et al., 2025 source

      Section 4.1 (page unavailable) says StealthRank benchmarks against STS and TAP using a dataset drawn from earlier work. Section 4.2 directly compares their ranking performance and perplexity, while Section 4.4 compares StealthRank and STS on human-rated manipulation detectability. The paper therefore does not support the claim that separate datasets and metrics prevent direct comparison of these methods. (LLM, conf=0.84)

      Checked by a reasoning model — may be wrong.

      Experimental — accuracy not yet measured
    • cites Kumar and Lakkaraju, 2024 source

      The Related Work section says that research on influencing LLMs to enhance content visibility remains underexplored. The Experiments section evaluates this paper’s own strategic text sequence, but our copy does not assess whether existing GEO methods use disparate datasets, metrics, or setups, or whether those differences prevent comparison of strength and detectability. (LLM, conf=0.76)

      Experimental — accuracy not yet measured
    • cites Nestaas et al., 2024 source

      The SEO discussion (page unavailable) distinguishes a concurrent white-box study from this paper’s black-box experiments on production search engines, supporting a difference in experimental setups. The Experiment Reproducibility section (page unavailable) says the authors’ own results may be hard to replicate. Neither passage establishes that existing GEO methods use disparate datasets and metrics or that their relative strength and detectability cannot be directly compared. (LLM, conf=0.76)

      Experimental — accuracy not yet measured
  • Findingown data

    Effectiveness and stealth trade off across adversarial attacks.

    “Our evaluation shows that effectiveness and stealth trade off across adversarial attacks”
    • Also stated in: § 4.1 Analysis · plain
      “Across the adversarial attacks, effectiveness and stealth trade off: each method either stays detectable or fails to promote.”
    • Also stated in: § 5 Conclusion · plain
      “Its central finding is twosided: adversarial attacks trade off effectiveness against stealth, yet Authoritative rewriting on C-SEO Bench evades both detectors while promoting strongly.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.
  • Findingown data

    Black-box content rewriting produces more fluent text than gradient-based attacks.

    “while producing more fluent text”
    • Also stated in: § 4.1 Analysis · plain
      “white-hat rewriting matches or exceeds the gradient methods on promotion while staying far more fluent”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.
  • Findingown data

    Method rankings are unstable across datasets.

    “Method rankings are unstable across datasets.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The five datasets used are representative of GEO ranking manipulation domains, so conclusions generalize across the benchmark.
  • Findingown data

    Black-box content rewriting can evade both keyword- and perplexity-based detection on some domains.

    “can evade both keyword-and perplexity-based detection on some domains”
    • Also stated in: § 3.3 Evaluation Metrics · plain
      “white-hat content rewriting can evade both detection signals on some domains”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.
  • Classified as probably not a substantial claim. 8
  • The quote only partly states this claim. 2
  • May combine two claims. 17

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Kumar and Lakkaraju showed that gradient-optimized token sequences appended to descriptions can force LLMs to rank a target item first.

    “Kumar and Lakkaraju showed that gradient-optimized token sequences appended to descriptions can force LLMs to rank a target item first (Kumar and Lakkaraju, 2024).”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Kumar and Lakkaraju, 2024 source

      The Introduction and Conclusion describe optimized token sequences inserted into product information to improve LLM rankings. The Experiments section reports that a target coffee machine became the top recommendation in most cases, but not invariably; “force” overstates that probabilistic finding. (LLM, conf=0.86)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Nestaas et al. demonstrated that crafted website content can bias LLM selections in production engines including Bing and Perplexity.

    “Nestaas et al. (2024) demonstrated that crafted website content can bias LLM selections in production engines including Bing and Perplexity.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Nestaas et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    C-SEO Bench evaluates ten white-hat C-SEO strategies across six domains and two tasks (product recommendation and question answering).

    “C-SEO Bench (Puerto et al., 2025), which evaluates ten white-hat C-SEO strategies across six domains and two tasks (product recommendation and question answering).”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Puerto et al., 2025 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Tang et al. proposed StealthRank, jointly optimizing for rank promotion, fluency, and keyword avoidance.

    “Tang et al. (2025) proposed StealthRank, jointly optimizing for rank promotion, fluency, and keyword avoidance.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Tang et al., 2025 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Pfrommer et al. adapted jailbreaking techniques to ranking via black-box prompt search.

    “Pfrommer et al. (2024) adapted jailbreaking techniques to ranking via black-box prompt search.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Pfrommer et al., 2024 source

  • The quote only partly states this claim.

    Findingown data

    Across the five datasets, black-box content rewriting matches or exceeds gradient-based attacks on rank promotion on three of the five datasets.

    “black-box content rewriting matches or exceeds gradient-based attacks on rank promotion while producing more fluent text and can evade both keyword-and perplexity-based detection on some domains”
    • Also stated in: § 4.1 Analysis · plain
      “White-hat C-SEO strategies match or exceed the gradient-based attacks on three of the five datasets despite using only black-box API access”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Llama-3.1-8B-Instruct is a representative ranking LLM for the conclusions about attack strength and tradeoffs.

  • May combine two claims.

    Findingown data

    The three highest average-NRG methods (TAP, Authoritative, Content Improvement) are all black-box, while the gradient methods rank in the middle and bottom.

    “the access model does not predict attack strength, since the three highest average-NRG methods (TAP, Authoritative, Content Improvement) are all black-box while the gradient methods rank in the middle and bottom.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Llama-3.1-8B-Instruct is a representative ranking LLM for the conclusions about attack strength and tradeoffs.

  • May combine two claims.

    Findingreasoning

    StealthRank produces adversarial prompts that are effective yet difficult to detect via simple keyword or perplexity filters.

    “producing adversarial prompts (SRPs) that are effective yet difficult to detect via simple keyword or perplexity filters.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingreasoning

    STS optimized sequences achieve high effectiveness but produce unnatural text with elevated perplexity (PPL-R ≫ 1).

    “The optimized sequences achieve high effectiveness but produce unnatural text with elevated perplexity (PPL-R ≫ 1), as the optimization prioritizes rank gain over linguistic fluency.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    RAF keeps keywords low and Zero-Shot stays quiet on both signals, yet neither moves the target (NRG ≤ 0.09 and ≤ 0.27).

    “RAF keeps keywords low and Zero-Shot stays quiet on both signals, yet neither moves the target (NRG ≤ 0.09 and ≤ 0.27).”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    STS keeps keyword rates low (0.03-0.20) but sharply degrades fluency (PPL-R up to 12.72).

    “STS keeps keyword rates low (0.03-0.20) but sharply degrades fluency (PPL-R up to 12.72)”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    TAP leads Promote@0.1 (up to 0.92); keyword-quiet RAF and Zero-Shot never exceed 0.28 and 0.02.

    “TAP leads (up to 0.92); the keyword-quiet RAF and Zero-Shot never exceed 0.28 and 0.02.”
    Quote in the paperSubstantial claim

  • May combine two claims. The quote only partly states this claim.

    Findingown data

    On C-SEO Bench, Authoritative rewriting ties LLM Guidance for the highest NRG (0.83) while reaching zero keyword violations and a 0.74 perplexity ratio, evading both detectors while promoting strongly.

    “on C-SEO Bench, Authoritative ties LLM Guidance for the highest NRG (0.83) at zero keyword violations and a 0.74 perplexity ratio.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    The two stealth signals are complementary: Content Improvement stays fluent (PPL-R 0.40) but trips the keyword filter (KVR 0.70), while STS does the reverse.

    “The two stealth signals are also complementary: Content Improvement stays fluent (PPL-R 0.40) but trips the keyword filter (KVR 0.70), while STS does the reverse.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingnone given

    TAP tends to produce text with explicit promotional language, resulting in high keyword violation rates.

    “This tree-structured search achieves high attack success rates but tends to produce text with explicit promotional language, resulting in high keyword violation rates.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    TAP promotes well but stuffs keywords (KVR ≥ 0.83 everywhere).

    “TAP promotes well but stuffs keywords (KVR ≥ 0.83 everywhere)”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Findingown data

    Even TAP, the strongest method on average (NRG 0.53), takes the top NRG on only one of the five datasets; individual methods swing by an order of magnitude, with Authoritative leading on C-SEO Bench (0.83) yet collapsing to 0.00 on LLM Rank Optimizer and STS moving from 0.60 to 0.06.

    “Even TAP, the strongest method on average (NRG 0.53), takes the top NRG on only one of the five datasets; individual methods swing by an order of magnitude, with Authoritative leading on C-SEO Bench (0.83) yet collapsing to 0.00 on LLM Rank Optimizer and STS moving from 0.60 to 0.06.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The five datasets used are representative of GEO ranking manipulation domains, so conclusions generalize across the benchmark.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Ho et al. showed that retrieval-aware rewriting can optimize ad visibility at scale.

    “Ho et al. (2025)showed that retrieval-aware rewriting can optimize ad visibility at scale.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Ho et al., 2025

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationown data

    The pressing threat is benign content optimization, not gradient attacks.

    “Second, the pressing threat is benign content optimization, not gradient attacks: white-hat rewriting matches or exceeds the gradient methods on promotion while staying far more fluent, and at its best evades both detectors through black-box API access alone.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.
    • Rests on an assumption: Llama-3.1-8B-Instruct is a representative ranking LLM for the conclusions about attack strength and tradeoffs.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationown data

    The datasets center on English product-and content-ranking, so conclusions may not transfer to other languages or domains without corresponding data.

    “the datasets center on English product-and content-ranking, so conclusions may not transfer to other languages or domains without corresponding data.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The five datasets used are representative of GEO ranking manipulation domains, so conclusions generalize across the benchmark.

  • May combine two claims.

    Interpretationreasoning

    GEO-BENCH enables the first direct comparison across attack paradigms and supports the development of detection methods.

    “By standardizing datasets, attack implementations, and metrics, GEO-BENCH enables the first direct comparison across these attack paradigms and supports the development of detection methods.”
    • Also stated in: § Adversarial Ranking Manipulation. · plain
      “GEO-BENCH addresses these gaps by unifying adversarial and white-hat methods under a common framework that jointly measures effectiveness and stealth across diverse datasets, enabling the first direct comparison across attack paradigms.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Xing et al. introduced RAF, a two-stage gradient method balancing rank gain with readability.

    “Xing et al. (2026) introduced RAF, a two-stage gradient method balancing rank gain with readability.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Xing et al., 2026 source

      Checked before — its earlier verdict is held back until a new check runs.

  • May combine two claims.

    Interpretationown data

    The surface detectors are porous and jointly incomplete: keyword and perplexity checks each miss a different set of methods, and Authoritative on C-SEO Bench clears both.

    “First, the surface detectors are porous and jointly incomplete: keyword and perplexity checks each miss a different set of methods, and Authoritative on C-SEO Bench clears both”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

  • May combine two claims.

    Premisecitation

    Aggarwal et al. introduced the term generative engine optimization (GEO) and proposed white-hat content transformation strategies to improve document visibility, though their evaluation used a single task and metric (word count) and did not test competitive multi-actor settings.

    “Aggarwal et al. (2024) introduced the term generative engine optimization (GEO) and proposed white-hat content transformation strategies (e.g., authoritative rewriting, adding statistics) to improve document visibility, though their evaluation used a single task and metric (word count) and did not test competitive multi-actor settings.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Aggarwal et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    GEO-BENCH unifies black-box prompt-based attacks (TAP, Zero-Shot), white-box gradient-based attacks (STS, RAF, StealthRank), and ten white-hat C-SEO strategies under one protocol.

    “It unifies black-box prompt-based attacks (TAP, Zero-Shot), white-box gradient-based attacks (STS, RAF, StealthRank), and ten white-hat C-SEO strategies.”
    • Also stated in: § Adversarial Ranking Manipulation. · plain
      “GEO-BENCH addresses these gaps by unifying adversarial and white-hat methods under a common framework that jointly measures effectiveness and stealth across diverse datasets”
    Quote in the paperSubstantial claim
25 of 25

  • The paper relies on this without support.

    The five datasets used are representative of GEO ranking manipulation domains, so conclusions generalize across the benchmark.

    “which GEO-BENCH exposes by spanning five heterogeneous datasets.”
    “We evaluate GEO-BENCH on five datasets drawn from recent GEO and ranking-manipulation literature”

  • The paper relies on this without support.

    Keyword violation rate and perplexity ratio are valid proxies for human-detectability or stealth.

    “Our stealth metrics are automatic proxies (keyword-violation rate and perplexity ratio) rather than human judgments or trained detectors”

  • The paper relies on this without support.

    Llama-3.1-8B-Instruct is a representative ranking LLM for the conclusions about attack strength and tradeoffs.

    “GEO-BENCH evaluates all methods against a single open-weight ranker (Llama-3.1-8B-Instruct)”

  • The paper relies on this without support.

    The benchmark's attack implementations faithfully reproduce the original methods.

    “Unified datasets with consistent formatting, reproducible algorithm im-plementations, and standardized evaluation metrics spanning both effectiveness and stealth.”
4 of 4

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Unified dataset format is described as both item-per-line JSONL and hierarchical JSON

    Minor

    An item-per-line JSONL file does not have the stated unified structure of a JSON object whose category keys contain arrays of items. The two descriptions specify different formats for the standardized datasets.

1 of 1

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 3

  1. Keqin Bao, Jizhi Zhang, Yang Zhang, Wang Wenjie, Fuli Feng, and Xiangnan He. 2023. Large language models for recommendation: Progresses and future directions. In Proceedings of the Annual Interna- tional ACM SIGIR Conference on Research and De- velopment in Information Retrieval in the Asia Pacific Region, SIGIR-AP '23, page 306-309, New York, NY, USA. Association for Computing Machinery. · DOI
  2. Yixuan Du, Chenxiao Yu, Haoyan Xu, Ziyi Wang, Yue Zhao, and Xiyang Hu. 2026. Multimodal generative engine optimization: Rank manipulation for vision- language model rankers. In Proceedings of the 4th Workshop on Towards Knowledgeable Foundation Models (KnowFM), San Diego, California, United States. Association for Computational Linguistics.
  3. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Red- field, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Ken- ton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. 2019. Natu- ral questions: A benchmark for question answering research. Transactions of the Association for Compu- tational Linguistics, 7:453-466. · DOI · Paper page

Related

Authors
Nimase, O., Chen, Z., Zhao, Y., & Hu, X.
Affiliations
University of Southern California (US)
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2605.29107
arXiv
2605.29107
OpenAlex
W7162788538
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › Information Retrieval and Search Behavior
Keywords
generative engine optimization, large language models, benchmark, adversarial attacks, black-box attacks, gradient-based attacks, stealth, search engine optimization, information integrity, fairness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-29.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-29.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review