$ cat AI-Search / GEO Manipulation
AI-search retrieval and citation manipulation, platform distinctions, academic evidence and the limits of proposed citation studies.
Generative Engine Optimization (GEO) is optimising to be cited and repeated by AI answer engines rather than to rank in a list of blue links. Its black-hat form, sometimes called "AI poisoning," tries to manipulate what AI Overviews, ChatGPT, Perplexity, and Gemini say and cite. This is the newest frontier in the field, and the one with the least settled ground truth, so this chapter leans heavily on the evidence hierarchy.
1 · Definition
GEO manipulation seeks to influence the answers and citations that generative engines produce. Where classic SEO wants position #1, GEO wants to be the source the AI quotes, summarises, or recommends. The black-hat variants try to seed, bias, or poison the content these models retrieve and cite. practitioner[1]
2 · Why it works
Retrieval-enabled answer engines can search for pages, select passages and generate an answer with citations. Retrieval, citation selection and answer generation are separate outcomes: being fetched does not ensure being cited, and citation does not ensure an accurate summary. A model answering without web retrieval is a different experiment. Results from one engine or model version do not automatically transfer to Google AI Overviews, AI Mode, ChatGPT search, Gemini, Perplexity or Copilot.
Product-specific retrieval and publisher controls
The following is a documentation comparison reviewed on 2026-09-19, not a live product benchmark. Record the exact product, mode, date and available model label in any observation. Publisher crawl controls govern access or permitted use; they do not guarantee citations.
| Product / surface | Documented distinction | What to measure separately |
|---|---|---|
| Google AI Overviews and AI Mode | These are Search features that can use different models and query fan-out. Supporting pages need Search indexing and snippet eligibility; Googlebot and Search preview controls apply. [4] | Whether an overview triggers, which mode was used, cited URLs and the complete answer. A query without an overview is not a zero-rank result in an identical interface. |
| ChatGPT search | OpenAI distinguishes OAI-SearchBot for search, GPTBot for potential training use, and ChatGPT-User for certain user-initiated fetches. Search and training preferences are independent; ChatGPT-User is not the search-indexing control. [5] | Search-enabled answers versus answers without retrieval; citation versus navigational link; crawler access versus an observed citation. No particular model or account entitlement was tested here. |
| Gemini Apps / other Google grounding | Google-Extended is a robots control token for the documented Gemini training/grounding uses. It is not a separate HTTP user agent and does not control inclusion or ranking in Google Search. [6] | The Gemini application or API and grounding configuration. Do not label an AI Mode result a Gemini Apps observation or pool them because the provider is the same. |
| Perplexity | Perplexity documents PerplexityBot for search discovery and Perplexity-User for user-requested fetches. The latter generally does not follow robots.txt because it is user initiated. Its published crawler/IP guidance describes intended access behavior, not an independent compliance test. [7] | The consumer interface/mode or API endpoint, full response, sources and access conditions. A fetched page, a cited page and a recommended entity are distinct outcomes. |
| Bing / Microsoft Copilot surfaces | Bing documents section-level data-nosnippet controls for snippets and AI previews. Its February 2026 AI Performance preview reports citations across supported AI surfaces. [8] [9] | Dashboard citation counts are not ranking, authority scores or answer position. Separate aggregate publisher reports from a specific captured Copilot answer and from clicks. |
Interpretation: a useful study has at least three distinct stages: access/discovery, retrieval/citation, and answer accuracy or recommendation. A control that changes one stage cannot automatically explain a change at another. Also preserve uncited and unsuccessful responses; counting only cited pages inflates apparent visibility.
3 · Architecture / tactic map
YOUR CONTENT ─▶ RETRIEVED BY AI ENGINE ─▶ SUMMARISED / CITED ─▶ USER SEES ANSWER
tactics feeding the pipeline:
· quotable, structured, "answer-shaped" content (legit GEO)
· citation seeding across many trusted sources (grey)
· fake consensus: same claim planted on many sites/forums (black)
· UGC seeding: Reddit/Quora threads engineered to be the cited source (grey/black)
· prompt-injection in page content aimed at the model (black) → see prompt-injection chapter
4 · Historical evolution
| Era | What changed |
|---|---|
| 2025 | "AI poisoning" reported as black-hat SEO's comeback: fake consensus, citation seeding, and cloaking aimed at AI crawlers. practitioner[2] |
| 2025–2026 | Published evaluation of selected LLM-search engines; findings apply to the tested websites, strategies and configurations. experimental[3] |
5 · Requirements & infrastructure (three tiers)
Minimum viable
- Answer-shaped content on your site; participation in the Reddit/Quora threads models cite.
Typical practitioner
- Coordinated placement of a claim across many credible-looking sources to build "consensus" the model repeats.
Scaled / black
- Networks of sites, automated UGC seeding, and content-embedded prompt injection aimed at AI crawlers and agents.
6 · Setup & prerequisites
Understand which sources a given engine cites for your target queries (inspect its citations), and what "answer-shaped" content looks like: clear claims, structure, statistics, quotable sentences, and schema. The legitimate version is just excellent, citable content; the black-hat version manufactures false authority and consensus.
7 · Workflow overview
Identify the AI engine and the queries → inspect what it currently retrieves and cites → produce quotable, well-structured content → get it into trusted retrieved sources → measure whether the engine now cites/repeats you → iterate.
8 · Step-by-step execution (proposed procedure; not executed)
- Pick a query and ask the engine (AI Overviews / Perplexity) to answer it; note which sources it cites.
- Publish genuinely superior, answer-shaped content: a crisp claim, supporting data with sources, structured headings, and schema.
- Earn citations in the community sources the engine trusts, by genuinely contributing.
- Re-query over weeks and record whether your content is now retrieved/cited.
The black-hat variants (fake consensus, sockpuppet UGC, injection) are documented in the misconceptions/detection sections and the prompt-injection chapter; the proposed workflow below has not been executed in this archive.
9 · Demonstration
Supplied practice: Offline Lab 4 demonstrates citation scoring over fictional responses, with no AI-engine efficacy claim. Its captured output is distinct from any unexecuted live protocol below.
Hypothetical scenario
In an invented example, several apparently independent pages repeat the same unsupported recommendation. An answer engine might retrieve and repeat them, or might omit them. A citation to repeated content is not independent corroboration: the observer must trace where the claim originated and whether the pages share a source. No observed ranking or citation gain is claimed.
Unexecuted observation protocol. Record the engine, mode, model/version if exposed, account state, language, location, exact query, timestamp and cited URLs. Repeat a fixed query set before and after a documented content change, with untreated comparison pages. Report citation frequency and answer accuracy separately. Shared-domain competition, canonical selection, index changes and stochastic answers prevent a simple two-page comparison from establishing causation.
10 · Expected output & results
No original citation or referral measurements are reported. Useful, accessible content may be eligible for retrieval, but no durable citation is guaranteed. A complete output would preserve repeated answers and source lists, separate citation frequency from referral traffic, and report uncertainty across queries and dates.
11 · Documented context
Chen and colleagues evaluated ten LLM-enhanced search engines using a sample of 1,000 black-hat websites and studied additional manipulation strategies. The authors report strong resistance to the traditional techniques in that sample while identifying other attack surfaces. This is external experimental evidence, not this archive’s experiment. Its selected websites, tested engines, timing and definitions limit generalization to all current products or benign GEO practices. [3]
12 · Common mistakes
Pooling different engines and modes, reporting one answer as a stable result, treating repeated websites as independent evidence, and confusing retrieval visibility with training-data influence.
13 · What experts get wrong
14 · Detection methods
A defender can trace cited claims to their origin, compare apparently independent sources for shared provenance, and record content and citation changes over repeated observations. These are investigation steps, not a verified description of every provider’s internal detection stack. The cited external study evaluates particular systems and attacks; it does not establish universal use or efficacy of consensus, provenance or cloaking defenses. [3]
15 · Defense & recovery
Correct inaccurate source material, preserve the original answer and citations, and use the relevant provider’s reporting process for a documented problem. At application level, keep source provenance, treat retrieved text as evidence rather than authority, and limit consequential actions. These measures need evaluation against the actual task; neither provenance nor a trust score proves an answer correct.
16 · Risk & legal status
Mostly a policy/ToS matter today, but overlaps with existing law where it becomes deceptive advertising, defamation, or fake reviews (FTC). Injecting instructions into content aimed at agents crosses into the prompt-injection chapter's territory, which can be computer-misuse.
17 · Expert analysis
Separate optimization for accessible, evidence-backed content from attempts to falsify consensus. In Google’s AI search features, ordinary search eligibility and spam policies still matter; a special schema or “AI file” does not guarantee inclusion. [4] For research, measure each engine and mode independently and preserve the answers, citations and conditions that support the conclusion.
Field guide: an auditable citation observation
Prerequisites: define the exact search product and audience task, then choose a stable query set and observation conditions. A spreadsheet and permitted manual access can support a small descriptive study; a larger one requires an authorized API or other permitted collection method, reliable scheduling and a record of product changes. An API response from a base model is not automatically an observation of a consumer search product. Account, locale and feature availability are part of the method.
Capture contract: retain a run ID, UTC timestamp, product/version when exposed, exact prompt, location/session conditions, full answer, cited URLs and failure code. Keep an unanswered request, an unavailable feature and a completed answer with no citation as different states. Record intended versus completed runs. Otherwise dropped failures can make apparent citation coverage improve without any retrieval change.
| Observed state | Suggested coding | Inference limit |
|---|---|---|
| Answer names the brand but links another site | Mention=yes; target citation=no | A mention is not a source attribution |
| Two links point to fragments on the same canonical source | One source occurrence per run, with raw links preserved | Deduplication must not silently erase genuinely different documents |
| Feature unavailable in the selected session | Unavailable, with the predeclared denominator rule | Not equivalent to a completed uncited answer |
| Source is cited but supporting fact is wrong | Citation present; factual support fails separate review | Citation count does not establish answer quality |
A basic cost model is scheduled runs × billed usage, plus capture/storage and human support-review time. Use current account tariffs and measured review time; do not infer total cost from one short prompt. Define a fixed collection window before seeing outcomes. Discovery and indexation are separate checks, and their timing may differ from the answer product’s source selection.
Interpretation: a citation may reflect retrieval eligibility, ranking, answer synthesis or output formatting. Observing the last stage does not identify the first. Compare source quality and task usefulness as separate outcomes, and keep policy-control observations separate from causal effectiveness claims. The offline scoring demonstration exercises counting only; the proposed public-product study has no collected observations.
Adult (XXX) is moving early on AI-citation seeding because AI surfaces are a fresh, under-defended discovery channel. See the adult vertical chapter.
18 · References
- Black Hat GEO: Tactics & Risks Explained. Similarweb. practitioner
- AI Poisoning: Black Hat SEO Is Back. Search Engine Journal, 2025.
- Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation. arXiv. academic
- Google Search — AI features and website guidance. primary
- OpenAI — Overview of OpenAI Crawlers. Primary product documentation; reviewed 2026-09-17.
- Google — Common crawlers, Google-Extended. Primary product documentation; reviewed 2026-09-17.
- Perplexity — Crawlers. Primary product documentation; reviewed 2026-09-17.
- Microsoft Bing — data-nosnippet support, October 15, 2025. Primary product documentation; reviewed 2026-09-17.
- Microsoft Bing — AI Performance public preview, February 2026. Primary product documentation; reviewed 2026-09-17.