Why General Safety Guardrails Miss Malicious GEO Without Policy Violations

Text can contain no violence, hate, prompt injection, or policy violation while still spreading a false product fact in fluent prose. General guardrails ask whether content belongs to a harmful category; they may not determine whether one factual claim has been strategically distorted.

Counter-GEO-Bench evaluates Granite Guardian, Llama Guard 3, and NeMo Self-Check Fact-Checking. Across the benchmark, the largest relative reduction in attack success among these off-the-shelf defenses is 5.7%, and one reduction is not statistically significant.

How a defense can amplify an error

The paper observes a “defense-as-amplifier” effect: a filter removes benign passages that contradict the false claim, leaving the manipulated source with less opposition. On one victim model, Granite Guardian worsens 74 queries while improving 57.

Teams should ask:

1. Is the guard designed for factual manipulation or only safety categories?
2. Did removed passages support or contradict the false claim?
3. Did source diversity and benign evidence decline after filtering?
4. Does post-generation checking merely confirm consistency with already polluted context?

GEO Radar (https://www.georadar.top) helps observe changes in brand answers and sources across platforms. If a model update produces a suddenly narrow source set, review whether cross-source correction disappeared instead of looking only at increased mentions.

Appropriate boundary

The study does not show that every general guardrail is ineffective, or that its specialized baseline catches every attack. It excludes commercial end-to-end products, multilingual evaluation, and adaptive open-set attacks. High-risk decisions still need external authoritative facts, version tracking, and human review.

Sources for this article

• arXiv, September 2, 2026, *Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization*: https://arxiv.org/abs/2609.02316