当优化演变为操纵：防御针对生成式搜索的恶意生成引擎优化

文章背景与核心概要

随着生成式搜索引擎（如Perplexity、ChatGPT Search等）的普及，网页内容如何被大语言模型（LLM）检索和引用成为了新的兵家必争之地。生成引擎优化（GEO）由此诞生，它通过重写网页文档来迎合搜索引擎的引用偏好，从而操纵生成的搜索结果。然而，恶意GEO攻击不仅在事实层面上与原始内容保持一致（导致传统的事实核查和困惑度过滤失效），其放大的特征也与高质量的良性网页内容难以区分，给系统安全带来了严峻挑战。

为了应对这一安全威胁，本文提出了一种名为 GEO Defender 的两阶段防御框架，该框架无需对目标大语言模型进行任何微调。它包含两个核心模块：一是通过学习偏好防御残差来降级GEO重写内容的防御重排器（Shield Reranker）；二是将防御成果蒸馏为自然语言经验库以指导推理阶段源利用的免训练防御生成（TFSG）。在多个闭源与开源大语言模型及7种GEO攻击上的广泛实验表明，该框架能将平均攻击成功率从50.32%大幅降至6.20%，同时保留了94.12%的良性证据利用率，展现出极强的鲁棒性与泛化能力。

Summary

This paper investigates Generative Engine Optimization (GEO), a technique where web documents are rewritten to mimic search engines' citation preferences and manipulate generated search answers. While modern GEO methods have evolved from basic manual edits to automated, agentic optimization that dramatically increases the visibility of targeted documents, defending against them remains exceedingly difficult. Attack documents preserve factual consistency with their originals—rendering traditional fact-verification and perplexity-filtering mechanisms ineffective—while the features they amplify are often indistinguishable from high-quality, benign web content.

To counter this, the authors introduce GEO Defender, a two-stage defense framework that operates entirely without fine-tuning the target Large Language Model (LLM): 1. Shield Reranker: Learns a preference-based defensive residual over a frozen base reranker to demote GEO-rewritten content while retaining accurate relevance judgments. 2. Training-Free Shield Generation (TFSG): Distills defense outcomes into a natural-language experience library to guide the target LLM's source utilization during inference.

Extensive experiments across 2 state-of-the-art closed-source LLMs and 3 open-source LLMs over 7 distinct GEO attacks show that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence utilization, preserves overall answer quality, and effectively generalizes to unseen attack variants.

本文研究了生成引擎优化（GEO），这是一种通过重写网页文档来模仿搜索引擎的引用偏好并操纵生成的搜索答案的技术。虽然现代GEO方法已从基础的手动编辑演变为自动化的智能体（agentic）优化，显著提高了目标文档的可见性，但防御此类攻击仍然极其困难。攻击文档与原始内容保持了事实一致性，这使得传统的事实核查和困惑度过滤机制形同虚设；同时，它们所放大的特征通常与高质量的良性网页内容无法区分。

为了应对这一挑战，作者引入了 GEO Defender，这是一个在完全不需要微调目标大语言模型（LLM）的情况下运行的两阶段防御框架： 1. 防御重排器（Shield Reranker）： 在冻结的基础重排器之上学习基于偏好的防御残差，以降级GEO重写的内容，同时保留准确的相关性判断。 2. 免训练防御生成（TFSG）： 将防御结果蒸馏为自然语言经验库，以指导目标LLM在推理过程中的源利用。

在2个最先进的闭源LLM和3个开源LLM上针对7种不同的GEO攻击进行的广泛实验表明，GEO Defender 将平均攻击成功率从 50.32% 降至 6.20%，保留了 94.12% 的良性证据利用率，保持了整体答案质量，并能有效泛化到未见过的攻击变体。

Abstract

This paper focuses on defending generative search engines against malicious Generative Engine Optimization (GEO), which rewrites web documents to match engines' citation preferences and thereby manipulates generated answers. Recent GEO methods have advanced from hand-crafted rewriting to automated and agentic optimization, substantially increasing the visibility of target documents in generated answers. However, defending against such manipulation poses two major challenges: attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content. To address these limitations, we propose GEO Defender, a two-stage defense aligned with the attack chain that requires no fine-tuning of the target LLM. GEO Defender consists of Shield Reranker and Training-Free Shield Generation (TFSG). Specifically, Shield Reranker learns a preference-based defensive residual over a frozen base reranker, demoting GEO-rewritten documents while preserving relevance judgments, and TFSG distills defense outcomes into a natural-language experience library that guides the target LLM's source use at inference. Experiments on two state-of-the-art closed-source LLMs and three open-source LLMs across seven GEO attacks demonstrate that GEO Defender reduces the average attack success rate from 50.32% to 6.20%, retains 94.12% of benign-evidence use, preserves answer quality, and generalizes to unseen attacks from construction instances.

本文聚焦于防御生成式搜索引擎对抗恶意的生成引擎优化（GEO）。恶意GEO通过重写网页文档以迎合搜索引擎的引用偏好，从而操纵生成的答案。近期的GEO方法已从手工重写发展到自动化和智能体优化，大幅提升了目标文档在生成答案中的可见性。然而，防御此类操纵面临两大主要挑战：攻击文档与原始内容在事实保持一致，导致事实核查和困惑度过滤失效；且它们放大的特征同样也是高质量良性内容的特征。为解决这些局限性，我们提出了 GEO Defender，这是一个与攻击链对齐的两阶段防御方案，且无需对目标LLM进行微调。GEO Defender 由“防御重排器”和“免训练防御生成（TFSG）”组成。具体而言，防御重排器在冻结的基础重排器之上学习基于偏好的防御残差，以降级经GEO重写的文档，同时保持相关性判断；TFSG则将防御结果蒸馏为自然语言经验库，以指导目标LLM在推理时的源选择。在两个最先进的闭源LLM和三个开源LLM上针对七种GEO攻击进行的实验表明，GEO Defender将平均攻击成功率从50.32%降至6.20%，保留了94.12%的良性证据使用率，维护了答案质量，并能泛化至从未见过的构造实例攻击。

Submission History

[v1] Wed, 2 Sep 2026, 07:13:40 UTC (474 KB)

[v1] 2026年9月2日星期三，07:13:40 UTC (474 KB)