This paper addresses the defense of generative search engines against malicious Generative Engine Optimization (GEO). GEO rewrites web documents to align with the citation preferences of the engine, causing the rewritten pages to be preferentially cited in generated answers. Recent advances have moved GEO from handcrafted rewriting to automated, agentic optimization, dramatically increasing the visibility of target documents in the output.
Defending against such manipulation faces two major challenges. First, the rewritten documents remain factually consistent with the originals, rendering fact‑checking and perplexity‑based filtering ineffective. Second, the amplified features of GEO‑modified content also characterize high‑quality benign material, making discrimination difficult.
To overcome these limitations, we propose GEO Defender, a two‑stage defense aligned with the attack chain that requires no fine‑tuning of the target LLM. The Shield Reranker learns a preference‑based defensive residual on top of a frozen base reranker, demoting GEO‑rewritten documents while preserving relevance judgments. The Training‑Free Shield Generation (TFSG) distills the defense outcomes into a natural‑language experience library that guides the target LLM’s source usage at inference time.
Experiments on two state‑of‑the‑art closed‑source LLMs and three open‑source LLMs across seven GEO attacks show that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign‑evidence usage, maintains answer quality, and generalizes to unseen attack constructions.
Review