GEO, or generative engine optimization, has already turned into a grey-market industry on the Chinese internet. Batches of coordinated accounts publish content designed to get AI search assistants to cite and recommend a particular product. DeepSeek, Doubao and Kimi are the three most widely used of these assistants in China, and each of them answers product questions by summarizing sources rather than listing them. What the user reads looks like a neutral recommendation from an AI. Behind it there may have been a payment.
Compared with classic SEO, the leverage is higher and the exposed surface is smaller. A search results page at least puts its sources in front of you. An AI answer melts a dozen sources into one paragraph, so the user never sees which source looked suspicious and never gets the chance to compare prices. What is being contaminated is not the ranking. It is the conclusion.
What the paper says
CGEP is the first attempt I know of to turn this into a tractable research problem, and it does three things.
The first is a taxonomy of manipulation techniques, five categories in total, spanning the full range from cheap tricks like keyword stuffing up to organized behavior such as coordinated account clusters flooding a category with "hands-on review" and "things to avoid" posts.
The second is a reformulation of the task. Earlier work asked how high the attack success rate was, which is the attacker's question. CGEP rewrites it as a three-tier defender's task: detection, classification, and seller-cluster attribution.
The third is a synthetic benchmark that can be built legally, so evaluation does not require actually poisoning anything on the live internet.
The provenance experiments produce the paper's most useful finding: detection and attribution rest on different signal substrates. Content features are quite good at judging that a piece of text has been manipulated, reaching an F1 of 0.93, but they cannot trace it back to a specific seller cluster. The same script templates get reused across unrelated sellers, so the text itself carries no identity. Account-interaction graphs behave in exactly the opposite way. Publication timing and the topology of mutual likes and reposts group accounts into seller clusters with 0.96 attribution accuracy, but this approach has nothing to say about an isolated single post. A confidence-gated fusion of the two covers every technique on which the single-substrate detector, the graph neural network, and the zero-shot LLM baseline each failed on their own.
How strong is the evidence
The biggest limitation is stated in the methods section: the benchmark is synthetic. There is a good reason for that choice, since actually poisoning a live AI search product is neither legal nor ethical, but the cost of the choice should be stated plainly. The distribution of techniques in the synthetic data comes from the authors' survey of known grey-market practices, and in a real adversarial setting, any technique that starts getting caught mutates quickly. The right way to read 0.93 and 0.96 is as separability on known techniques, not as in-the-wild detection rates.
The account-graph route carries a second condition, this one about deployment: you have to be able to see the interaction graph. Platforms can. Third parties cannot. That means attribution capability belongs structurally to the platform, and an outside detector can only get as far as "this content looks manipulated." The three-tier task split makes that boundary explicit, which is itself the point: detection and enforcement are not things any single party can do alone.
The paper is still under review, so its conclusions should be treated as preprint-grade. Links will be added here once a public version is released.
What it means in practice
This is where FIM's work on AI search security starts, and the reasoning is contained in the limitations above. What is genuinely scarce is not another detection model. It is a continuously updated corpus of manipulation techniques in Chinese, plus an evaluation protocol someone else can re-run and check.
For a company on the receiving end of poisoning, there is honestly not much available today, and it is worth saying so. Attribution needs the platform's account graph, which a brand cannot get. What a brand can do on its own is periodically ask the major AI search assistants questions about its own product category, then look at who gets cited and whether "reviews" appear that the company never commissioned. There is no mature tooling for this yet. It is manual spot-checking. But it at least tells you whether you are being hit.
The same understanding applies on the constructive side. When we set up llms.txt and structured data for a site, we are taking the legitimate route of making sure AI engines can read accurate information. Both activities draw on one body of knowledge: understanding how an engine selects its sources is what tells you how to feed it real information correctly, and it is also what shows you which seam manipulation slips through. Understanding manipulation is how you defend against it.