Now live across the AI ecosystem: ChatGPT GPT Store · MCP Registry · mcp.so

Fundamentals

The GEO detectors work now. 8.9% of retrieved pages already trip them.

By Arnav Mukherjee, founder of TofuBofu · September 26, 2026

TLDR

  • Stop buying tactics that need to go unnoticed. A public detector hits 0.944 F1 on GEO-optimised pages.
  • This is already common. 8.90% of 10,095 retrieved pages flagged, and 16.36% of pages edited in 2026.
  • The field flipped in ten weeks. Five papers since 22 July are about catching GEO, not doing it.
  • Don't count on guardrails. Three shipped safety models cut GEO attacks by at most 5.7% relative.
  • Do the boring work instead. Of 39 B2B sites we crawled, 38 had no llms.txt at all.

I read the new arXiv listings for our category most weeks, mostly hoping somebody has measured something I can use. This week I noticed the listing had changed shape. Of the papers published on generative engine optimization since late July, five are about detecting it or defending against it. One is about doing it better.

That's a turn worth naming out loud, because the AEO industry is currently selling the other side of it. Scroll any vendor's blog and you'll find prompts, rewrites and templates designed to make a page more citable. Meanwhile a group at a research lab has built a classifier that spots pages rewritten for exactly that purpose, deployed it against real Google retrieval results, and put a number on how much of the retrieved web is already doing it.

I sell AI visibility software, so you should discount my enthusiasm for the finding that tricks have a shelf life. Read the papers yourself, they're all linked at the bottom. What follows is what they say, what they don't say, and the one decision I think it should change.

How I read these papers, and what the sample isn't

I queried the arXiv API for submissions matching "generative engine optimization" and "answer engine optimization", sorted newest first, and read the abstract and metadata of every hit from the last ten weeks at source on 26 September 2026. Five carry detection or defence as their stated purpose: GPE (22 July), GEO-Flag (17 August, updated 20 August), Counter-GEO-Bench and GEO Defender (both 2 September), and HAE-GEO (5 September, updated 17 September).

Four limits, stated here rather than buried. I read abstracts and metadata, not all five papers end to end. Four of the five are preprints with no venue, so nobody has refereed them; Counter-GEO-Bench is the exception, accepted to EMNLP 2026 Main Conference. Every number below is the authors' own reported result on their own benchmark, which is where methods look their best. And none of these papers is an engine vendor describing production behaviour, so nothing here tells you OpenAI or Google is running any of it today.

What survives all four limits is the thing I care about: the capability exists in public, with code, and it's cheap. HAE-GEO's benchmark and code sit in a public Ant Research repository, and Counter-GEO-Bench goes to EMNLP 2026's main conference. Five independent groups converged on the same problem inside ten weeks. Research attention is a leading indicator of engineering attention, and this much of it doesn't point nowhere.

A detector at 0.944 F1, and a prevalence estimate of 8.90%

GEO-Flag is the one to read first. The authors built GEOFlagBench, a benchmark of 3,200 web content instances spanning 400 queries, four domains and eight GEO optimizer families, then measured how well existing detection methods perform on it. The strongest baseline reached an aggregate F1 of 0.880, which sounds fine until they show it leans on authorship shortcuts rather than on the manipulation itself. Their own method, Intervention-Paired Training on ModernBERT, lifts F1 from 0.862 to 0.944 and worst-group accuracy from 0.725 to 0.883.

Then they pointed the finished pipeline at the real thing. Released Google Search and Gemini-grounded retrieval results for 1,000 real-user queries, and across the 10,095 pages available to them they estimate overall GEO prevalence of 8.90%, rising to 16.36% among pages modified in 2026.

Take that second figure seriously and hold it loosely. It's one detector's estimate over pages that two Google surfaces actually retrieved, so it describes a retrieval set rather than the web, and a detector with a 0.944 F1 still gets pages wrong. But roughly one in six recently edited pages in a live retrieval set looking machine-optimised is a real reading of where the category has got to in about eighteen months.

Their framing of the harm is also more careful than the industry's framing of the opportunity. GEO, they write, "can give strategically optimized pages visibility disproportionate to their authority or relevance and even make weak or false information appear well supported." Every founder I've shown that sentence to has recognised it immediately, because they've watched an engine recommend a rival whose website says almost nothing.

Where the research attention went arXiv submissions on generative engine optimization, 22 July to 5 September 2026 22 Jul 5 Sep GPE GEO-Flag Counter-GEO-Bench GEO Defender HAE-GEO All five ask the same question: can we catch it? What a detector can flag A page rewritten to win a citation it hasn't earned Shelf life: as long as nobody looks What it can't A true claim, on your own domain, answering a question buyers ask Shelf life: indefinite

The guardrails you assume exist cut GEO attacks by 5.7%

Counter-GEO-Bench, the one accepted at EMNLP 2026, asks a harder question: when somebody publishes an ordinary-looking GEO-optimised document carrying targeted misinformation, do the safety systems already deployed on these models stop it? The authors paired 247 human-verified, quality-gated queries with both information-preserving and information-distorting rewrites, and ran three off-the-shelf defences across three victim models.

Granite Guardian, Llama Guard 3 and NeMo Self-Check Fact-Checking together reduce attack success rate by at most 5.7% relative, and Granite Guardian's reduction isn't statistically significant. Their explanation is the most quotable line in the whole set: "Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content." The guardrails are looking for something else. A fluent, plausible, well-cited lie about which vendor is best isn't a policy violation.

The same paper shows the gap is closeable. Their own lightweight baseline, C-GEO Guard, cuts attack success by 47.6% relative with near-zero utility loss. GEO Defender, published the same day by a different group, reports a bigger swing: average attack success rate down from 50.32% to 6.20% across seven GEO attacks on two closed-source and three open-source models, while retaining 94.12% of benign evidence use.

Put those two results next to each other and the conclusion writes itself. What's deployed today barely notices GEO manipulation. What a small team can build in a few months mostly stops it. Every engine vendor in this market has more than a small team.

Before you optimise anything, find out where you stand. We ask five AI engines the buying questions your market actually types, and show you which ones name you, which name a rival instead, and what they say. No tricks in it, because the report is a measurement.

Run a free AI visibility scan →

Why GEO is hard to detect, and why that cuts both ways

Here's the part that stopped me, from the GEO Defender authors: "attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content."

Read that twice if you write for a living. The signals a GEO rewrite amplifies, clear structure, direct answers, specific claims, quotable sentences, are the same signals a genuinely good page has. That's why fact-checking doesn't catch it, and it's also why a detector aimed at GEO will sometimes flag honest work. GEO-Flag's own authors found the strongest baseline relying on authorship-related shortcuts, which is a polite way of saying it was learning who wrote a page instead of what was done to it.

So the risk isn't only to the people gaming the system. If engines start filtering on style, a well-structured page from a small firm with no brand history is exactly the kind of thing a shortcut-prone classifier gets wrong. I'd rather that were a solved problem than a known one, and the only defence available to you is boring: make the claims verifiable, put them on your own domain, and be the primary source for your own numbers.

HAE-GEO, from a group at Ant Research, adds the agent's side of this. They built a benchmark of 72,039 clean pages and 770 poisoned pages per attack level, across three escalating attack levels, eight product categories and 154 brands, then ran 10 search agents through it. Their finding about defence prompting deserves to be quoted whole: "defense prompting increases verification, yet rarely converts verification into recovery." The agents checked more, and still bought the lie.

What to do with this if you run a B2B firm

The good news is that almost nobody has done the legitimate work yet, so you don't need the illegitimate kind. We crawled 39 B2B sites and counted what was there: 26 of 39 carried no FAQ schema, 16 of 39 carried no Organization schema, and 38 of 39 had no llms.txt file at all. Those are sites belonging to firms that already suspected they were invisible in AI answers, so treat the numbers as a floor for a self-selected group rather than an industry average. Even so, the gap between where most firms are and where a detector starts caring is enormous.

Nothing on that list is a trick. Schema describes what your page already says. An llms.txt file tells a machine where your documentation lives. A comparison page that admits where a rival is better is not a manipulation, and no classifier trained on GEO rewrites will ever flag it, because the thing being flagged is a claim you didn't earn.

So the test I'd apply to any AEO tactic somebody sells you this quarter: would you be happy if the engine could see exactly what you did and why? If yes, do it. If the value depends on the engine not noticing, you're buying an asset that depreciates the moment a 0.944 F1 classifier goes into production, and five research groups just published the recipe.

Frequently asked questions

Can AI engines detect GEO-optimised pages?

Researchers can, at a level that works. The GEO-Flag paper reports that the strongest existing detection baseline reaches an aggregate F1 of 0.880, and its own method, Intervention-Paired Training on ModernBERT, lifts that to 0.944 while raising worst-group accuracy from 0.725 to 0.883. Whether any engine vendor runs a detector like this in production is a separate question, and none of them has said. So the honest position is that detection is now demonstrably possible and cheap, not that it is already switched on.

How much of the web is already GEO-optimised?

The GEO-Flag authors deployed their full pipeline on released Google Search and Gemini-grounded retrieval results for 1,000 real-user queries. Across the 10,095 available pages they estimate overall GEO prevalence of 8.90 percent, reaching 16.36 percent among pages modified in 2026. Read those as an estimate from one detector over pages that two Google surfaces actually retrieved, not as a census of the web. The direction is the point: roughly one in six recently edited pages in that retrieval set looked optimised for the machine.

Will Google or OpenAI penalise GEO?

No engine vendor has announced a GEO penalty, and this post does not claim one is coming. What changed is the cost of building the capability. Detectors, benchmarks and defences now exist in public with code, one of them accepted at EMNLP 2026, so the engineering is no longer speculative. A tactic whose value depends on nobody being able to spot it is a tactic with a shelf life, and that is a planning fact rather than a prediction.

Do existing AI safety guardrails catch GEO manipulation?

They barely move it. Counter-GEO-Bench tested Granite Guardian, Llama Guard 3 and NeMo Self-Check Fact-Checking against information-distorting GEO rewrites across three victim models, and reports that all three reduce attack success rate by at most 5.7 percent relative, with Granite Guardian's reduction not statistically significant. The authors explain why in one sentence: "Safety-taxonomy guardrails target policy violations, while GEO misinformation passes through them as fluent informational content." A purpose-built baseline, C-GEO Guard, cut attack success by 47.6 percent relative, so the problem is tractable once somebody aims at it.

Why is GEO hard to detect in the first place?

Because the manipulated page is usually true and well written. The GEO Defender authors state the difficulty directly: "attack documents remain factually consistent with their originals, rendering fact verification and perplexity filtering ineffective, and the features they amplify equally characterize high-quality benign content." So the signals that mark a GEO-optimised page also mark a genuinely good one. That is why the detection papers need paired training data, and it is also why a detector is a blunt instrument that can catch honest pages.

Does this mean AEO and GEO are black hat?

No, and the research draws the line in the same place we do. Every one of these papers is about documents rewritten to win citations they have not earned, up to and including targeted misinformation. Publishing an accurate comparison page, answering a buying question your rivals dodge, or adding structured data so a machine can parse what you already say, none of that is what a GEO detector is hunting. The dividing line is whether the claim is true and whether it is yours.

What should a B2B firm do about this?

Almost certainly the unglamorous work, because most firms have not done it. Across 39 B2B sites we crawled, 26 carried no FAQ schema, 16 carried no Organization schema and 38 of 39 had no llms.txt file. None of that is a trick and none of it can be flagged as manipulation. Measure which engines name you today, fix the plumbing, publish things that are true, and re-measure. A strategy that survives a detector is one that was never trying to beat it.

Sources and further reading

Related reading

The schema study everyone is quoting excluded every page that needed schema
Two AI engines, the same questions, and almost no shared sources
Claude now watermarks what it writes. Marked is not labelled.

Arnav Mukherjee

Founder, TofuBofu