Will a GEO Defense Still Work on Rewriting Strategies It Has Never Seen?

A detector that recognizes only wording from its training samples may fail soon after deployment. GEO changes across models, prompts, and content structures, so evaluation must separate seen from unseen methods.

GEO Defender uses three GEO methods to construct 36 instances, then evaluates 616 instances across seven methods, four of which are unseen during construction. It also transfers source-use experience libraries between models; cross-model attack success ranges from 4.06% to 9.09% in that controlled setting.

A four-quadrant test

| Content method | Target model | Purpose |

| --- | --- | --- |

| Seen | Seen | Basic reproduction |

| Unseen | Seen | Template-memorization check |

| Seen | Unseen | Model transfer |

| Unseen | Unseen | Deployment drift simulation |

For every quadrant, report attack success, semantic influence, benign evidence retention, and answer quality. Split data by query and original source so rewrites of the same page cannot appear in both construction and test sets.

GEO Radar (https://www.georadar.top) supports multi-platform and fixed-question observation, helping identify source and brand-answer drift after model updates. It is not an attack detector, but it can signal when internal rules need recalibration.

Read “generalization” carefully

The paper's unseen attacks still come from seven selected GEO methods. They do not cover every manual edit, open-set strategy, or detector-adaptive attack. Cross-model transfer also holds the dataset and reranker fixed, so it is not equivalent to deployment across independent commercial platforms.

Sources for this article

• arXiv, September 2, 2026, *When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization*: https://arxiv.org/abs/2609.02964