The gathered literature has three strands: content-side optimisation ("white-hat" rewriting), adversarial ranking manipulation, and measurement or critique. For most papers other than the Princeton GEO paper only the arXiv abstract page was gathered, so findings below are abstract-level claims by the authors, not independently checked. Results are mostly from lab setups using the authors' own benchmarks; apart from the citation-absorption dataset and the perplexity.ai tests (Princeton, Pfrommer), none measures Google, ChatGPT or Perplexity in production.
Outperforms heuristic baselines in visibility and citation fidelity on three engines; ablations credit engine-specific preference modelling and strategy reuse
No numbers in abstract.
From Citation Selection to Citation Absorption (Zhang, He, Yao; independent researchers), arXiv 2604.25707
29 Apr 2026
Descriptive study of the public geo-citation-lab dataset: 602 prompts, ChatGPT, Google AI Overview/Gemini, Perplexity; 21,143 valid citations; 18,151 fetched pages; 72 features
Perplexity cites most sources per prompt; ChatGPT cites fewer but with higher average influence; high-influence pages are longer, more modular, more semantically aligned and contain definitions, numbers, comparisons, procedures. Q&A formatting alone did not improve absorption
Authors say the snapshot is static, claims are descriptive, and they separate documented statistics from proposed models.
The Princeton GEO paper in detail
Setup. Two-step engine: top 5 sources fetched from Google, answer generated by gpt3.5-turbo, 5 responses sampled at temperature=0.7. One randomly chosen source per query is optimised, each of 9 methods applied separately. GEO-bench: 10K queries from nine source datasets, 25 domains, 9 query types; categorised by difficulty and intent. Every query is tagged (by GPT-4, manually verified) and manually inspected, per the authors.
Metrics. Position-Adjusted Word Count (words of cited sentences, shared equally when several sources cite one sentence, weighted by an exponentially decaying function of citation position) and Subjective Impression (seven LLM-scored facets, including relevance, influence, uniqueness and likelihood of click).
Results. Best methods improved on baseline by 41% (Position-Adjusted Word Count) and 28% (Subjective Impression). Cite Sources, Quotation Addition and Statistics Addition gave relative gains of 30-40% and 15-30% on the two metrics. Fluency Optimization and Easy-to-Understand gave 15-30%. Authoritative tone gave "no significant improvement". Keyword Stuffing gave "little to no improvement".
Domain dependence. Authoritative helped debate-style questions and the "historical" domain; Cite Sources helped factual questions; Statistics Addition helped "Law & Government" and "Opinion" questions; Quotation Addition helped "People & Society", "Explanation" and "History". Best combination in a 200-example subset: Fluency Optimization plus Statistics Addition.
By SERP rank. Cite Sources raised visibility 115.1% for sites ranked fifth, while the top-ranked site's visibility fell 30.3% on average.
Perplexity.ai. Quotation Addition gained 22% on Position-Adjusted Word Count; Cite Sources and Statistics Addition showed gains of up to 9% and 37% on the two metrics; Keyword Stuffing was 10% worse than baseline.
Stated limitations. Methods may need to adapt as engines evolve; query nature changes over time; effect on search rankings not evaluated; labelling may contain errors. Only one self-built engine plus Perplexity.ai was tested.
Tree-of-attacks prompt injection on real consumer product pages
LLMs differ in how much they weight product name, content and context position; attacks promote low-ranked products and transfer to perplexity.ai
StealthRank (Tang et al.), arXiv 2504.05804
v1 8 Apr 2025; v2 23 May 2025
Energy-based optimisation with Langevin dynamics to generate fluent adversarial prompts
Outperforms adversarial ranking baselines in effectiveness and stealth across multiple LLMs
CORE (Jin, Zeng, Luo, Wang), arXiv 2602.03608
v1 3 Feb 2026; v2 21 Oct 2026
Appends string-, reasoning- or review-based content; ProductBench: 15 categories x 200 products
Average Promotion Success Rate 91.4% @Top-5, 86.6% @Top-3, 80.3% @Top-1 on GPT-4o, Gemini-2.5, Claude-4, Grok-3
Lazy Grounding (arXiv 2608.30303)
31 Aug 2026
Injects factual-but-nearby evidence into search corpora
Across 12 model-benchmark pairs search-agent accuracy fell 5.9 points on average, up to 17.3
Critiques and field measurement
Paper
Date
Finding
Can It Reach the Generator? (arXiv 2605.28017)
27 May 2026
Prior evaluations feed the attacked document straight to the generator. Re-testing seven GEO attacks through retriever, LLM reranker and LLM generator: prior protocols "substantially overstate" effectiveness; gradient-based and instruction-override attacks largely collapse before the generator; only LLM-driven prompt injections remain effective; a lightweight guard detects every attack
15 methods from three threat models (white-box gradient, black-box prompt, white-hat rewriting), 729 shared targets, four LLM rankers: the evaluation script alone changes measured gains five-fold; weights-optimised suffixes weakest; black-box search that queries the deployed system gains most; an LLM judge separates every effective method from clean text, yet at a low false-positive rate several strong methods keep most of their gain
Indirect Prompt Injection in the Wild (arXiv 2604.27202)
29 Apr 2026
1.2B URLs, 24.8M hosts: 15.3K validated instances on 11.7K pages; about 70% in non-rendered HTML; compliance up to 8% across 13 models in 5,200 experiments
Reading across them (Wiki analysis): attack success reported by method authors is high, and independent re-evaluation reports large drops once a realistic retriever and reranker sit in front of the generator. That is a conflict between sources, not a settled answer. The Princeton 40% and CORE's 80.3% use different metrics and benchmarks; do not compare them.
arXiv full text of 2311.09735v3; abstract pages (2311.09735, 2504.05804, 2510.11438, 2602.03608, 2604.19516, 2604.27202, 2605.28017, 2608.30303); arXiv HTML full text (2406.03589v3, 2604.25707, 2605.29107, abstract and introduction read only)
Repositories
GEO-optim/GEO README (install, run_geo.py, GEO-bench on Hugging Face). glad-lab/geobench aggregates nine method branches (AdversialSEO [sic, as spelled in the README], cse, cseo, geo, Manipulating-LLMs, RAF, Stealth-Rank, STS, zero-shot), subsampled to at most 20 categories and 10 items each
Independence
Academic authors except the citation-absorption paper (independent researchers). No vendor funding is stated in the gathered pages
Status
Preprints unless a venue is stated; venue claims (KDD 2024, EMNLP 2024, ACL 2026 Findings) are as given in the arXiv metadata or repository README
