---
title: "GEO Research Papers"
type: summary
tags: [geo, research, arxiv, benchmarks, adversarial, prompt-injection]
created: 2026-11-04
updated: 2026-11-04
confidence: medium
sources: ["raw/web_community-2311-09735-geo-generative-engine-optimization.md", "raw/web_community-geo-generative-engine-optimization.md", "raw/github_doc-readme-md.md", "raw/web_community-ranking-manipulation-for-conversational-search-engines.md", "raw/web_community-2504-05804-stealthrank-llm-ranking-manipulation-via-stealthy.md", "raw/web_community-2510-11438-what-generative-search-engines-like-and-how-to-op.md", "raw/web_community-2602-03608-controlling-output-rankings-in-llm-based-search-v.md", "raw/web_community-2604-19516-from-experience-to-skill-multi-agent-generative-e.md", "raw/web_community-from-citation-selection-to-citation-absorption-a-measurement.md", "raw/web_community-geo-bench-benchmarking-ranking-manipulationin-generative-eng.md", "raw/github_doc-readme-md-2.md", "raw/github_doc-datasets-datasets-subsampled-all-readme-md.md", "raw/web_community-2605-28017-can-it-reach-the-generator-investigating-the-surv.md", "raw/web_community-2604-27202-indirect-prompt-injection-in-the-wild-an-empirica.md", "raw/web_community-2608-30303-lazy-grounding-attacking-search-agents-with-factu.md"]
---

# GEO Research Papers

## Key Points

The gathered literature has three strands: content-side optimisation ("white-hat" rewriting), adversarial ranking manipulation, and measurement or critique. For most papers other than the Princeton GEO paper only the arXiv abstract page was gathered, so findings below are abstract-level claims by the authors, not independently checked. Results are mostly from lab setups using the authors' own benchmarks; apart from the citation-absorption dataset and the perplexity.ai tests (Princeton, Pfrommer), none measures Google, ChatGPT or Perplexity in production.

### Optimisation and benchmarks

| Paper | Date / venue | Method | Reported finding | Limits stated or visible |
|---|---|---|---|---|
| **GEO: Generative Engine Optimization** (Aggarwal, Murahari, Rajpurohit, Kalyan, Narasimhan, Deshpande), arXiv 2311.09735 | v1 16 Nov 2023; v3 28 Jun 2024; KDD '24, Barcelona, 25-29 Aug 2024 | See the dedicated section below | "up to 40%" visibility gain; efficacy varies by domain | See below |
| **AutoGEO** (Wu, Zhong, Kim, Xiong), arXiv 2510.11438 | 13 Oct 2025 | LLMs explain engine preferences, rules are extracted and used as context (AutoGEO_API) and as rule-based rewards to train AutoGEO_Mini | Improves content "traction" while preserving search utility on GEO-Bench plus two new real-query benchmarks | Abstract gives no numbers. |
| **MAGEO** (Wu et al.), arXiv 2604.19516 | 21 Apr 2026; ACL 2026 Findings | Multi-agent planning, editing and fidelity-aware evaluation; distils reusable engine-specific "skills"; Twin Branch Evaluation Protocol; DSV-CF metric; MSME-GEO-Bench | Outperforms heuristic baselines in visibility and citation fidelity on three engines; ablations credit engine-specific preference modelling and strategy reuse | No numbers in abstract. |
| **From Citation Selection to Citation Absorption** (Zhang, He, Yao; independent researchers), arXiv 2604.25707 | 29 Apr 2026 | Descriptive study of the public geo-citation-lab dataset: 602 prompts, ChatGPT, Google AI Overview/Gemini, Perplexity; 21,143 valid citations; 18,151 fetched pages; 72 features | Perplexity cites most sources per prompt; ChatGPT cites fewer but with higher average influence; high-influence pages are longer, more modular, more semantically aligned and contain definitions, numbers, comparisons, procedures. Q&A formatting alone did not improve absorption | Authors say the snapshot is static, claims are descriptive, and they separate documented statistics from proposed models. |

### The Princeton GEO paper in detail

- **Setup.** Two-step engine: top 5 sources fetched from Google, answer generated by gpt3.5-turbo, 5 responses sampled at temperature=0.7. One randomly chosen source per query is optimised, each of 9 methods applied separately. GEO-bench: 10K queries from nine source datasets, 25 domains, 9 query types; categorised by difficulty and intent. Every query is tagged (by GPT-4, manually verified) and manually inspected, per the authors.
- **Metrics.** Position-Adjusted Word Count (words of cited sentences, shared equally when several sources cite one sentence, weighted by an exponentially decaying function of citation position) and Subjective Impression (seven LLM-scored facets, including relevance, influence, uniqueness and likelihood of click).
- **Methods tested.** Authoritative, Statistics Addition, Keyword Stuffing, Cite Sources, Quotation Addition, Easy-to-Understand, Fluency Optimization, Unique Words, Technical Terms.
- **Results.** Best methods improved on baseline by 41% (Position-Adjusted Word Count) and 28% (Subjective Impression). Cite Sources, Quotation Addition and Statistics Addition gave relative gains of 30-40% and 15-30% on the two metrics. Fluency Optimization and Easy-to-Understand gave 15-30%. Authoritative tone gave "no significant improvement". Keyword Stuffing gave "little to no improvement".
- **Domain dependence.** Authoritative helped debate-style questions and the "historical" domain; Cite Sources helped factual questions; Statistics Addition helped "Law & Government" and "Opinion" questions; Quotation Addition helped "People & Society", "Explanation" and "History". Best combination in a 200-example subset: Fluency Optimization plus Statistics Addition.
- **By SERP rank.** Cite Sources raised visibility 115.1% for sites ranked fifth, while the top-ranked site's visibility fell 30.3% on average.
- **Perplexity.ai.** Quotation Addition gained 22% on Position-Adjusted Word Count; Cite Sources and Statistics Addition showed gains of up to 9% and 37% on the two metrics; Keyword Stuffing was 10% worse than baseline.
- **Stated limitations.** Methods may need to adapt as engines evolve; query nature changes over time; effect on search rankings not evaluated; labelling may contain errors. Only one self-built engine plus Perplexity.ai was tested.

### Adversarial ranking manipulation

| Paper | Date | Method | Reported finding |
|---|---|---|---|
| **Ranking Manipulation for Conversational Search Engines** (Pfrommer, Bai, Gautam, Sojoudi; UC Berkeley), arXiv 2406.03589v3 | EMNLP 2024 per the GEO-Bench repository | Tree-of-attacks prompt injection on real consumer product pages | LLMs differ in how much they weight product name, content and context position; attacks promote low-ranked products and transfer to perplexity.ai |
| **StealthRank** (Tang et al.), arXiv 2504.05804 | v1 8 Apr 2025; v2 23 May 2025 | Energy-based optimisation with Langevin dynamics to generate fluent adversarial prompts | Outperforms adversarial ranking baselines in effectiveness and stealth across multiple LLMs |
| **CORE** (Jin, Zeng, Luo, Wang), arXiv 2602.03608 | v1 3 Feb 2026; v2 21 Oct 2026 | Appends string-, reasoning- or review-based content; ProductBench: 15 categories x 200 products | Average Promotion Success Rate 91.4% @Top-5, 86.6% @Top-3, 80.3% @Top-1 on GPT-4o, Gemini-2.5, Claude-4, Grok-3 |
| **Lazy Grounding** (arXiv 2608.30303) | 31 Aug 2026 | Injects factual-but-nearby evidence into search corpora | Across 12 model-benchmark pairs search-agent accuracy fell 5.9 points on average, up to 17.3 |

### Critiques and field measurement

| Paper | Date | Finding |
|---|---|---|
| **Can It Reach the Generator?** (arXiv 2605.28017) | 27 May 2026 | Prior evaluations feed the attacked document straight to the generator. Re-testing seven GEO attacks through retriever, LLM reranker and LLM generator: prior protocols "substantially overstate" effectiveness; gradient-based and instruction-override attacks largely collapse before the generator; only LLM-driven prompt injections remain effective; a lightweight guard detects every attack |
| **GEO-Bench: Benchmarking Ranking Manipulation** (Nimase, Chen, Zhao; USC; Hu; ASU), arXiv 2605.29107 | 2026 | 15 methods from three threat models (white-box gradient, black-box prompt, white-hat rewriting), 729 shared targets, four LLM rankers: the evaluation script alone changes measured gains five-fold; weights-optimised suffixes weakest; black-box search that queries the deployed system gains most; an LLM judge separates every effective method from clean text, yet at a low false-positive rate several strong methods keep most of their gain |
| **Indirect Prompt Injection in the Wild** (arXiv 2604.27202) | 29 Apr 2026 | 1.2B URLs, 24.8M hosts: 15.3K validated instances on 11.7K pages; about 70% in non-rendered HTML; compliance up to 8% across 13 models in 5,200 experiments |

Reading across them (Wiki analysis): attack success reported by method authors is high, and independent re-evaluation reports large drops once a realistic retriever and reranker sit in front of the generator. That is a conflict between sources, not a settled answer. The Princeton 40% and CORE's 80.3% use different metrics and benchmarks; do not compare them.

## Relevant Concepts

- [[concepts/generative-engine-optimization]]
- [[concepts/content-manipulation-and-prompt-injection]]
- [[concepts/ai-search-retrieval-and-fan-out]]
- [[summaries/ai-citation-studies]]

## Source Metadata

| Item | Detail |
|---|---|
| Gathered formats | arXiv full text of 2311.09735v3; abstract pages (2311.09735, 2504.05804, 2510.11438, 2602.03608, 2604.19516, 2604.27202, 2605.28017, 2608.30303); arXiv HTML full text (2406.03589v3, 2604.25707, 2605.29107, abstract and introduction read only) |
| Repositories | GEO-optim/GEO README (install, `run_geo.py`, GEO-bench on Hugging Face). glad-lab/geobench aggregates nine method branches (`AdversialSEO` [sic, as spelled in the README], cse, cseo, geo, Manipulating-LLMs, RAF, Stealth-Rank, STS, zero-shot), subsampled to at most 20 categories and 10 items each |
| Independence | Academic authors except the citation-absorption paper (independent researchers). No vendor funding is stated in the gathered pages |
| Status | Preprints unless a venue is stated; venue claims (KDD 2024, EMNLP 2024, ACL 2026 Findings) are as given in the arXiv metadata or repository README |