Citation Wars: Five Rounds of GEO Made the Content Worse, and the Fix Rewards Checkable Facts

A simulation ran a content supplier and a search platform against each other for five rounds. The supplier used an automated GEO system to rewrite its pages for more citations. The platform used a standard prompt-warning defense against manipulation.

By the end, rewrite quality had gone negative, the platform's defense recovery had decayed, and answer utility sat below the clean baseline. The paper shows a before-and-after document with the newly added unsupported claims highlighted in red [1].

Both sides lost. That outcome is the starting point of a paper that treats generative engine optimization as a mechanism design problem, and it arrives at a conclusion content teams can act on: the only profitable way to game the proposed defense is to actually add facts a reader can check.

---

Quick answer

The paper formulates the supplier-platform interaction as a repeated Stackelberg game with partial monitoring, then proposes a platform mechanism called VCR, for verifiable-content rewards [1].

1. Penalty-only defenses stall. The paper derives a threshold: once latent content quality is correlated enough with manipulation intensity, the platform's local best response stops penalizing manipulation at all, because penalizing the manipulation signal also suppresses genuine quality.
2. The resulting state is inert. Useful content is not induced, suspicious content is weakly penalized, and further platform updates produce little joint utility.
3. Rewarding checkable substance beats filtering it out. VCR credits rewrites that surface factual claims supported by the original document, offsets that credit against a suspicion score, and softly re-ranks sources. Across three benchmarks and three answer engines it achieves the highest Net defense-utility score in all nine settings, averaging 12.1 percentage points above the strongest baseline in each setting.
4. The mechanism survives disclosure. When the supplier is told the rule and optimizes against it, Net drops but stays far above the prompt-warning defense, because the reward only pays for verifiable factual substance.

The hard boundary: every result comes from simulation, with LLMs acting as answer engines and as quality judges. The paper is an arXiv preprint. No evidence links VCR to any production platform.

---

What did the study actually set up?

The authors are Zitian Guo (UC San Diego) and Chen Xu and Chenyan Xiong (Carnegie Mellon University). Code is published at github.com/cxcscmu/GameTheory-GEO [1][2].

The game runs in rounds. In each round the supplier observes the platform's current defense rule and commits to a rewriting strategy for its target documents. The platform then observes only document-level before/after pairs, estimates what rule produced them, and updates its answer-time defense.

That asymmetry is the point. A supplier can adapt directly to a published rule. A platform has to infer whether a given rewrite reflects a real quality improvement or strategic manipulation, working from the edit alone.

The model gives each document a latent quality score and a manipulation intensity score, then sets citation probability as a softmax over a linear combination: quality times a positive weight, minus manipulation times the platform's defense strength, plus noise. The correlation between quality and manipulation is the variable that drives the paper's central result [1].

The supplier maximizes citation exposure net of rewrite cost, where cost covers editing effort, factual drift, and detectability. The platform suppresses manipulated citations while avoiding false positives.

---

Why does a penalty-only defense stop working?

Three results stack into the same conclusion.

The false-positive cost is where the first row comes from. In the paper's model, the leading false-positive cost is proportional to defense strength times the quality weight times the covariance of quality and manipulation. Penalizing manipulation also suppresses quality whenever the two move together [1].

The paper's own summary of the failure: the default game is one-sided. It penalizes manipulation but rewards no feature directly aligned with platform and user utility. High quality-manipulation correlation weakens defense, partial monitoring erodes it further, and the resulting state induces no useful content while weakly penalizing suspicious content.

---

How VCR changes the incentive

VCR adds a reward channel. The platform credits rewrites that make source-supported factual content more salient, then calibrates that credit against a suspicion penalty before applying the defense [1].

What counts as verifiable content

For each before/after pair, the mechanism counts factual claims, numerical details, or named citations that are present in the rewrite, supported by the original document, and surfaced more prominently than before. A pair-level LLM oracle produces the count.

The paper's worked example is a pair of earbuds. The rewrite surfaces three facts checkable against the original: eight-hour battery life, sweat resistance, and per-bud weight. Count is three.

Additions with no support in the original, the paper names "expert-recommended" and "industry-leading", earn no credit. They feed the manipulation signal instead [1].

That distinction is the whole mechanism in one line. A number that exists in your source material earns credit. An adjective that exists nowhere costs you.

The credit is capped per rewrite, which bounds how much reward any single document can farm.

Where the penalty comes from

The platform infers the supplier's current strategy from its own rewrite history. It reuses the Explainer-Extractor-Merger-Filter pipeline from AutoGEO, the automated GEO system used as the default attacker, but reverses its direction [1][4].

AutoGEO compares preferred against less-used documents to infer what the engine likes. The platform compares original against rewritten documents to infer what the supplier is doing. Each retrieved document then gets a baseline suspicion score equal to rule-match strength times recent edit magnitude. Trivial rewrites below an edit-magnitude threshold are skipped.

The combined score subtracts the verifiable-content credit from the suspicion score.

Nothing gets deleted

The final step is a soft re-rank. Less suspicious and more verification-friendly sources move earlier in the context, and the platform adds a system-level warning telling the engine to treat the labels as auxiliary evidence, prioritize verifiable claims, and avoid over-crediting sources whose citation value comes mainly from manipulative rewriting.

No document is removed. High-suspicion documents can still be cited when they provide uniquely necessary evidence [1].

---

What the experiments found

Three benchmarks: commercial search (E-commerce), open-domain factual queries (GEO-Bench), and research-oriented queries (Researchy-GEO). Each query is paired with five candidate documents, and held-out test splits contain up to 1,000 queries [1][3][4].

Three metrics, all in percentage points. Def. is the fraction of manipulation-induced visibility the platform rolled back, representing platform and user interests jointly. Welf. is creator exposure relative to the no-attack baseline, where negative means the defense pushed exposure below its natural level. Net is their equal-weight sum.

Here are the Net results on the default answer engine, Gemini 2.5 Flash-Lite:

The three classical defenses fail in different ways. Prompt warning and keyword scrub land near zero, which is the inert outcome the theory predicted. Hard reject buys defense by suppressing creator exposure almost one for one: on Researchy-GEO with the default engine it rolled back 63.8 points of manipulated visibility while pushing creator exposure 63.3 points below baseline, netting 0.5 [1].

VCR held the highest Net in all nine dataset-engine combinations and stayed the only defense with strictly positive Net when the engine was swapped for GPT-4o-mini or Claude Haiku 4.5. Creator exposure stayed inside a pre-specified five-point equivalence band in all nine settings.

The documents themselves scored better

Citation placement could explain a Net advantage on its own, so the authors also ran a direct LLM-rubric evaluation on E-commerce. VCR held the highest point estimate on all five document dimensions and on the answer-quality average.

The largest gap was factuality: 0.820 under VCR against 0.778 for prompt warning, 0.785 for keyword scrub, and 0.788 for hard reject. Document averages were 0.760 for VCR against 0.724 to 0.741 for the baselines [1].

It held across five different attackers

The default attacker is AutoGEO. The authors swapped in four more on E-commerce: RAID, IF-GEO, SAGEO Arena, and a Statistics Addition strategy from the original GEO paper. VCR kept a positive Net at round five under all five attackers and consistently exceeded the three classical defenses [1][3][5][6][7].

Over five rounds, VCR was the only method that stayed in positive Net territory. Prompt warning decayed toward the inert outcome, keyword scrub stayed near zero, and hard reject stayed slightly negative.

The ablation rules out the obvious objection

Removing each component in turn produced three findings [1]:

• Drop the suspicion penalty and keep the reward: Net turns negative, because the supplier farms the reward with no defense against it.
• Drop the reward and keep the penalty: this is the prompt-warning defense, and it returns to the inert outcome.
• Keep both but drop the soft re-rank, handing the oracle's output to the engine as prompt text instead: results fall back to the no-reward level, with the same LLM budget and the same information.

That third test matters most. It shows the gain comes from enforcing the verification signal through source ordering, rather than from spending an extra LLM call.

---

Three design questions the authors tested separately

Should the reward credit anything broader than facts?

The authors re-scored the same rewrites under five candidate reward scopes, separating content units grounded in the original from units that cannot be verified. Fact-style units were predominantly verifiable. Rewarding attribution or authority signals would credit a content type dominated by unverifiable claims, which directly invites fabricated sourcing [1].

Broadening to explanatory or structural content kept Net positive while trading defense against exposure. So the fact-level scope is a robust choice rather than a knife-edge one.

Can the verifier trust an external page?

This test is the sharpest. After each rewrite, the attacker additionally creates an external "support page" that justifies its fabricated claims.

Verifying against the attacker-created page nearly eliminated the earned reward while simultaneously weakening the fabrication penalty, letting a substantial share of unsupported claims go undetected. External verification opens a circular, gameable channel. Verification anchored on the original document pair stays outside the attacker's control. The authors list trusted external verifiers as future work [1].

Does it survive the rule being public?

The supplier was told the VCR rule explicitly and kept optimizing against it across rounds. Net dropped relative to the standard supplier but stayed far above the prompt-warning defense throughout.

The paper's explanation is the line worth keeping: because the reward only credits verifiable factual substance, the most profitable way to game VCR is to actually add checkable content. Strategic awareness weakens the joint gain without inverting it [1].

---

The clearest result is a table of rules

The platform infers rules from rewrite behavior, and the extractor is identical in both conditions. So when the inferred rules diverge, the divergence comes from how the supplier responded to the incentive [1].

Both columns start in the same place: formatting. By round three they have split. The baseline column drifts toward disguise, ending at "hidden GEO intent with AI-friendly form." The VCR column drifts toward explanation and then verifiability.

A content team can read the right-hand column as a specification and the left-hand column as a warning.

---

What this study does not establish

Five more limits belong in the same frame.

It is a preprint. The paper is posted to arXiv. There is no peer-review record to cite [1].

The judges are language models. Document and answer quality come from LLM rubric scoring. The authors check robustness across GPT-4o-mini, Claude Haiku 4.5, and Gemini 2.5 Flash-Lite judges, and the VCR-prompt ordering holds. Agreement among LLM judges is not the same as human validation.

The equivalence band is pre-specified, not a significance test. Prior repeated runs showed roughly five percentage points of standard deviation, so creator utility within plus or minus five points is read as exposure preserved within run variability. The authors also report signed point estimates and per-query bootstrap intervals, where VCR's Net interval separates from every baseline on every dataset [1].

The scope is one platform and one creator pool. The authors name extending the model beyond that as the promising next step.

One of the cited deployment figures is old. The paper notes that VCR targets versioned content and cites prior work finding about 40% of pages change within a week while about 8% are newly created. Those two studies are from 2003 and 2004 — Fetterly and colleagues at WWW 2003, and Ntoulas, Cho, and Olston at WWW 2004. Treat the coverage argument as directional. For a new page with no prior version the count is zero, and the mechanism degrades to its suspicion-only special case.

One more disclosure that the paper itself makes plainly: Chenyan Xiong is a co-author of both AutoGEO, the attacker used as the default in these experiments, and this defense paper [1][4]. The same group built both sides of the simulation. The code release makes that checkable.

---

What a content team can take from a simulation

The mechanism is hypothetical. The incentive logic transfers anyway, because it describes what any platform trying to separate substance from decoration would have to measure.

On step 2, the detail that matters

The paper counts a fact only when it is supported by the original document and surfaced more prominently in the rewrite. Credit comes from making existing substance easier to find, not from adding substance that no source backs.

For a content operation, that maps onto a specific discipline: your source material, the spec sheet, the test report, the internal data pull, has to exist before the page does. A page assembled from claims with no upstream record would score zero on the reward channel and still accumulate suspicion on the penalty channel.

On step 3, why deletion is the cheap win

Unsupported superlatives sit on the wrong side of both channels in this model. They earn nothing from the reward and they raise the suspicion score. Under the baseline defense they were merely wasted words. Under a mechanism like the one described, they actively cost you.

---

Where Innflows fits

This paper describes what a platform could do. Innflows sits on the other side of that boundary: it monitors AI answers, citations, and brand mentions across major AI platforms and languages, from the outside.

Around a content revision program, a team can use it to:

• record which pages AI answers cite before a rewrite, as a baseline;
• compare citation patterns for a set of pages before and after a fact-density pass;
• check whether AI answers describe the brand accurately across platforms and languages;
• see which competitors appear alongside the brand in the same answers.

The boundaries are specific. Innflows is not a platform and cannot apply or observe a mechanism like VCR. It has no access to any platform's internal suspicion scores, defense rules, or source ordering, and it cannot tell you whether a platform rewards verifiable content. Citation changes observed after a revision are correlations across runs rather than proof of cause, and no monitoring tool can guarantee citations.

---

Five readings worth correcting

1. "Platforms now reward verifiable facts."

The paper proposes a mechanism and tests it in simulation. No platform is reported to have deployed it [1].

2. "This proves GEO degrades content."

It shows degradation in a five-round simulation where a specific automated GEO system ran against a specific prompt-warning defense [1][4]. The finding is a demonstrated failure mode, with the scope of a simulation.

3. "Hard reject is the strong defense."

Hard reject produced the largest raw defense numbers and a Net near zero, because it suppressed creator exposure almost one for one. The authors show it wins only under a weighting that heavily prioritizes immediate suppression and discounts creator exposure [1].

4. "Adding statistics is the tactic."

Statistics Addition from the original GEO paper was one of the five attackers VCR defended against [1][3]. The mechanism credits facts traceable to the source document. Inserted numbers with no upstream support are the thing it penalizes.

5. "Structure and formatting no longer matter."

Formatting was the round-one inferred rule in both conditions, and it did not disappear [1]. What the study shows is a ceiling: suppliers that stayed at formatting and disguise drifted toward the inert outcome.

---

FAQ

What is a citation war in this paper?

An escalation where a content supplier repeatedly adapts its rewriting strategy to the platform's defense, producing citation-seeking rewrites that degrade document quality and introduce unsupported claims, while the platform's defense loses effectiveness each round [1].

Why does the platform's best response stop penalizing manipulation?

Because penalizing manipulation also suppresses quality when the two signals are correlated. The paper derives a threshold on that correlation, above which the locally optimal defense strength is zero [1].

What exactly does VCR reward?

Factual claims, numerical details, or named citations that appear in the rewrite, are supported by the original document, and are surfaced more prominently than before. A pair-level LLM oracle counts them, and the credit is capped per rewrite [1].

How much better did VCR perform?

It achieved the highest Net defense-utility score in all nine dataset-engine settings, averaging 12.1 percentage points above the strongest baseline in each setting, and held the highest point estimate on all five document-quality dimensions [1].

Can a supplier game VCR if the rule is public?

The authors tested that directly. Net fell relative to an unaware supplier but stayed far above the prompt-warning defense, because the reward only pays for verifiable factual substance [1].

Is any real platform using this?

No source says so. The results are simulations with LLMs as answer engines and judges, and the paper is an arXiv preprint [1].

---

Bottom line

The useful part of this paper is the failure it formalizes. A platform that only punishes manipulation ends up punishing nothing, because the signals it would punish are tangled with the signals it wants to keep. Both sides then settle into a state where no one gains anything.

The proposed exit is a reward channel narrow enough to be hard to fake: a fact that already exists in your source material, surfaced where a reader can find it. Everything the authors tested about that channel pointed the same way. Widening it to authority or attribution signals invited fabrication. Letting the attacker supply the verifying page broke it. Publishing the rule weakened the gain without reversing it, because the cheapest way to exploit the rule is to comply with it.

None of this has been observed on a live platform, and the paper does not claim otherwise.

Build pages whose claims have an upstream record, then measure the answers separately from the theory.

---

References

[1] - Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes — Zitian Guo, Chen Xu, Chenyan Xiong, arXiv:2608.11390, submitted August 11, 2026 (preprint)

[2] - GameTheory-GEO — code release for the paper, GitHub

[3] - GEO: Generative Engine Optimization — Pranjal Aggarwal et al., arXiv:2311.09735, accepted to KDD 2024

[4] - What Generative Search Engines Like and How to Optimize Web Content Cooperatively (AutoGEO) — Yujiang Wu, Shanshan Zhong, Yubin Kim, Chenyan Xiong, arXiv:2510.11438

[5] - Role-Augmented Intent-Driven Generative Search Engine Optimization (RAID) — Xiaolu Chen et al., arXiv:2508.11158

[6] - IF-GEO: Conflict-Aware Instruction Fusion for Multi-Query Generative Engine Optimization — Heyang Zhou et al., arXiv:2601.13938

[7] - SAGEO Arena: A Realistic Environment for Evaluating Search-Augmented Generative Engine Optimization — Sunghwan Kim et al., arXiv:2602.12187