Search papers, labs, and topics across Lattice.
This paper introduces GEO Defender, a robust two-stage defense mechanism designed to protect generative search engines from malicious Generative Engine Optimization (GEO) that manipulates document visibility. By employing a Shield Reranker to demote GEO-rewritten documents while maintaining relevance and a Training-Free Shield Generation (TFSG) to guide the target LLM's source use, the system effectively counters the challenges posed by factually consistent attack documents. Experimental results show a dramatic reduction in attack success rates from 50.32% to 6.20%, while preserving 94.12% of benign evidence and maintaining answer quality across various LLMs and GEO attacks.
GEO Defender slashes the success rate of malicious generative optimizations from over 50% to just 6%, all while preserving the integrity of benign content.
This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines'citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.
