Search papers, labs, and topics across Lattice.
This paper re-evaluates the effectiveness of seven Generative Engine Optimization (GEO) prompt-injection attacks within a realistic three-stage RAG pipeline (retriever, LLM reranker, LLM generator). They find that the retriever and reranker stages significantly reduce the success rate of gradient-based and instruction override attacks, leading to a collapse in their effectiveness. However, LLM-driven prompt injections remain effective, although all attacks are easily detectable with a lightweight, fine-tuned guard.
Prompt-injection attacks that seem potent in isolation crumble when faced with the realities of a full RAG pipeline, suggesting current threat models are overly pessimistic.
Recent generative engine optimisation (GEO) research has shown that prompt-injection attacks can push a target product to the top of an LLM's recommendation list, with the strongest attacks reporting around $80\%$ success and raising serious security concerns about RAG-based recommendation. However, these results assume the attacked document is always fed directly to the generator, bypassing the retriever and reranker. This is unrealistic: in deployed RAG systems, the attack modifies the document content, which can in turn change whether the document is retrieved and reranked highly enough to reach the generator at all. In this paper, we re-evaluate seven GEO attacks under a realistic three-stage pipeline (retriever\,$\to$\,LLM reranker\,$\to$\,LLM generator). We find that prior protocols substantially overstate attack effectiveness: gradient-based and instruction override attacks largely collapse before reaching the generator, and only LLM-driven prompt injections remain effective end-to-end. Our analysis further reveals that current GEO attacks are easily detectable: a lightweight prompt-injection guard finetuned on a small attack dataset already detects every attack. Our code and data are available at https://anonymous.4open.science/r/geo_injection_rag_survival_anonymizations-8C12.
