{"id":"bc509946-55dd-40db-8d07-f0e50b278e11","arxiv_id":"2608.11390","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A repeated-game analysis of generative-engine optimization shows that penalty-only defenses stall, and a verifiable-content reward mechanism (VCR) improves the joint defense-utility outcome in simulations on three benchmarks.","lead":"This paper studies the arms race between websites that rewrite their pages to be cited by AI search engines and search platforms defending answer quality. It proposes a scoring system that rewards verifiable facts, and simulations on three benchmarks suggest this keeps both answer quality and creator visibility healthy.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"VCR's win-win claim rests on Assumption 1's orthogonality/separability, which the paper validates only with a weak correlation measurement that does not test the structural assumptions Theorem 2 needs.","rationale":"The reader identifies Assumption 1 as the weakest assumption, and I agree. The paper's central claim is the empirical win-win result, but the theoretical load-bearing component is Theorem 2, which requires structural orthogonality and separability that the data does not verify. The paper's own limitation section admits the reward measures source support, not independent truth, and that LLM claim counting can err. This is not a fatal flaw; the empirical results are strong and include bootstrap CIs, a robustness sweep over attackers, and an aware-supplier test. However, the aware-supplier test (Fig. 5(c)) optimizes against the rule, not against the specific failure mode of n becoming correlated with m. A concrete adversarial test that optimizes for reward farming by claim-splitting and plausible-unsupported insertion would settle whether Assumption 1 holds under adaptive pressure. If it fails, the mechanism may still work empirically, but the theoretical guarantee would not transfer, and the win-win claim would rest only on simulation outcomes in a narrow threat model. Thus CONDITIONAL is appropriate, with the condition being a direct stress test of the verifiable-content signal's orthogonality and the reward channel's robustness to reward hacking.","tokens_in":23827,"tokens_out":1965,"duration_ms":15261,"concrete_test":"Re-run the full VCR pipeline against an adversarial supplier that is explicitly optimized to maximize VCR reward by (a) splitting supported claims into many atomic factual units, (b) repeating claims across sections, and (c) inserting plausible unsupported details that the LLM oracle (gpt-4o-mini, temperature 0) erroneously credits as verifiable. Measure, over five rounds, the realized correlation \\hat{\\rho}_{m,n}, the change in Net from the standard VCR runs, and the number of unsupported claims in rewarded rewrites. If Net drops below the strongest baseline (Prompt or Hard reject) or \\hat{\\rho}_{m,n} becomes significantly positive, then Assumption 1's orthogonality fails under adaptive attack and Theorem 2's guarantee does not support the empirical win-win claim. If Net remains positive and \\hat{\\rho}_{m,n} stays near zero, the concern is settled.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that VCR consistently achieves the largest Net defense-utility score and preserves creator exposure within the ±5-point band, and Theorem 2 is the theoretical guarantee that VCR improves platform/user utility to first order while preserving creator utility. Theorem 2 depends critically on Assumption 1 (Sec. 4.4): measurability of n_i, E[(n - \\bar n)(m - \\bar m)] = 0 (orthogonality of the verifiable-content signal and manipulation), positive marginal platform/user utility \\eta_n > 0, block-separability of n from (q, m) in the supplier's cost H, and a vanishing mixed partial \\partial^2 L_P/(\\partial \\alpha \\partial \\lambda) = 0. The paper's only direct empirical support for Assumption 1 is the single sentence in Sec. 4.4 reporting measured correlation \\hat{\\rho}_{m,n} \\in [-0.05, 0.1] on its own data, plus a robustness study (Fig. 5(c)) varying an aware supplier. A correlation near zero on a few datasets is weaker than orthogonality of the signals: an adaptive attacker can inflate n with 'plausible-looking but unsupported content' that a permissive LLM oracle credits, making n positively correlated with m in deployment; then \\Theta = (H^{-1})_{nn} and the welfare gain \\eta_n \\lambda \\Theta in Eq. (12) are offset by manipulation harm, and the supplier can farm the reward channel. The paper itself (Sec. 5.4, RQ2; App. A) admits that LLM claim counting can err and that suppliers may repeat or split supported claims to approach the reward cap; it also admits the reward checks source support, not independent truth. Because Theorem 2's structural assumptions are not directly tested, the theoretical guarantee collapses under an attacker who exploits the gap between 'verifiable against the original' and 'truthful'.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the repeated interaction between content suppliers running GEO-style rewriting and a generative-engine platform defending answer quality. It first shows, via simulation and a local quadratic model, that conventional defenses (prompt warnings, hard rejection, keyword scrubbing) can approach an inert outcome in which neither content improvement nor manipulation is effectively sanctioned. It then proposes VCR, a mechanism that credits rewrites for verifiable, source-supported factual content and offsets this credit against a suspicion penalty before soft re-ranking. The paper's main claim is that VCR consistently achieves the largest Net defense–utility score (Def. + Welf.) across three benchmarks and three answer engines, by an average of 12.1 percentage points over the strongest baseline, while keeping creator exposure within a pre-specified ±5-point empirical equivalence band. A local-games theorem (Theorem 2) is offered as the theoretical counterpart of the empirical win–win outcome.","tokens_in":24187,"tokens_out":5131,"duration_ms":45439,"significance":"If the central claim holds, the paper makes a useful contribution: it reframes GEO defense as a two-sided incentive problem rather than a one-sided filter, and it proposes a concrete mechanism backed by multi-round simulations across datasets, engines, and attackers. Strengths include the release of code, the use of paired per-query bootstrap confidence intervals for the main Net results, robustness checks across five attackers and three answer engines, and a candid limitations section. The theoretical analysis, however, rests on an assumption whose empirical validation is limited to a marginal correlation statistic, and some of the direct quality claims lack uncertainty quantification. The paper is therefore of moderate significance: the empirical Net finding is promising and well-supported, but the theoretical guarantee and the quality improvements are not yet fully established.","major_comments":[{"comment":"The theoretical guarantee of VCR depends on Assumption 1's orthogonality condition E[(n - mean(n))(m - mean(m))] = 0, the block-separability of the n coordinate in the supplier's cost H, and the vanishing mixed partial of the platform loss. The only empirical support offered in Sec. 4.4 is the single sentence reporting an estimated correlation rho_{m,n} in [-0.05, 0.1] on the authors' own data. A marginal correlation between point estimates of n and m is much weaker than orthogonality in the structural model, and it does not test block-separability or the mixed-partial condition at all. If an adaptive attacker can inflate n with plausible-looking but unsupported content that the LLM oracle credits, then n and m become positively correlated in deployment, the term eta_n lambda Theta in Eq. (12) is offset by manipulation harm, and the guarantee collapses. The paper should either provide direct evidence for the structural assumptions (for example, by estimating the cross-partials of the citation logit or supplier cost with respect to n and m), or prove a robustness version of Theorem 2 that quantifies welfare loss under bounded violations of orthogonality, or explicitly re-frame Theorem 2 as a conditional result whose key assumption is not yet empirically established.","section":"Sec. 4.4, Theorem 2"},{"comment":"The claim that VCR's Net advantage is 'accompanied by more substantive rewrites and better generated answers' relies on Table 2, which reports point estimates without confidence intervals or significance tests. The differences are small (for example, Usefulness 0.757 vs. 0.740 for Hard reject and Answer Clarity 0.564 vs. 0.554 for the runner-up). Given that the paper itself uses paired bootstrap CIs for the Net metric in Table 4, the absence of any uncertainty quantification for the quality dimensions is an asymmetry that weakens the direct-quality claim. The authors should report confidence intervals for Table 2, or at minimum soften the language from 'backed by genuinely better documents and answers' to a point-estimate statement.","section":"Sec. 5.2, Table 2"},{"comment":"The verifiable-content oracle that computes the reward signal n_i uses gpt-4o-mini (App. B), and the paper does not state which model produces the direct quality judgments in Table 2 and the GEU scores in App. E.7. If the same model family assigns both the reward and the quality scores, then the 'more substantive rewrites' finding is partly endogenous: the mechanism may be optimizing for the judge's own preferences rather than for an independent notion of quality. The manuscript should explicitly identify the evaluation model for Table 2 and GEU, and ideally use a different model or a human-annotated holdout set for evaluation so that the reward channel and the quality measure are not confounded.","section":"Sec. 5.2, App. B/E"}],"minor_comments":[{"comment":"Sections F.3 and F.4 are both titled 'Proof of Theorem 2', but F.3 actually proves Proposition 2 (defense-effectiveness decomposition). Re-label F.3 as the proof of Proposition 2.","section":"Appendix F"},{"comment":"The title uses 'Generative Engine' in the singular while the abstract and body use 'Generative Engines'; please make the title consistent.","section":"Title and abstract"},{"comment":"The E-COMMERCE VCR Welf. bootstrap interval reaches 5.4 at its upper endpoint, slightly above the +5-point equivalence band; the text acknowledges this, but the abstract and Section 5.2 state that creator exposure stays within the band in all nine settings without this qualification. Please add the qualification or note the interval endpoint in the main text.","section":"Table 4, Sec. 5.2"},{"comment":"The coefficients B and Q in Lemma 1 are defined in the proof (F.1) but not in the lemma statement; please include their definitions in the main text for readability.","section":"Sec. 3.3, F.1"},{"comment":"The sentence 'While our method rewards source-supported factual substance rather than only penalizing suspicious form.' is a fragment; please merge it with the preceding sentence.","section":"Sec. 4.2 / Related Work"}],"recommendation":"major_revision","confidential_remarks":"The main risk to the paper's contribution is the gap between Assumption 1 and its empirical validation. The empirical Net results are credible, with paired bootstrap CIs and robustness checks, but the theoretical claim needs either stronger assumption tests or a robustness bound. The circularity concern about the LLM judge is also worth pressing in revision. I would not recommend rejection; the central idea is promising and the experimental design is largely sound."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a serious look. The genuinely new piece is VCR, a two-sided incentive mechanism that credits verifiable content while still penalizing manipulation, and it is evaluated more carefully than most work in this area. The repeated Stackelberg framing of GEO is also new and the local analysis gives a plausible explanation for why penalty-only defenses stall. The empirical package is the strongest part: three benchmarks, three answer engines, five attackers, paired bootstrap CIs for the main Net results, ablations on reward strength, and an explicit check on an aware supplier. That is real work and the results are credible.\n\nThe soft spots are real but not fatal. The load-bearing theoretical assumption, Assumption 1, is only weakly validated. A correlation in [-0.05, 0.1] on your own data does not establish orthogonality between verifiable-content signal and manipulation, let alone the block-separability of the cost function. An adaptive attacker could plausibly inflate the reward channel by repeating or splitting supported claims, and the paper admits this; the cap and penalty reduce but do not eliminate the risk. The stress-test note is right that Theorem 2's guarantee would collapse under such an attacker, but the paper's own RQ2 and RQ3 results show the mechanism degrades gracefully rather than catastrophically. The direct quality claims in Table 2 also lack error bars, and the win-win conclusion rests on an operational equivalence band rather than a formal test. All of this is addressable with additional analysis rather than grounds for rejection.\n\nI would send this to peer review. The mechanism is novel, the experiments are honest, and the limitations are stated in the text. The main requests would be: validate Assumption 1 with a more direct test or weaken the theoretical claims to match what is actually supported, and add uncertainty quantification to the direct quality metrics. The paper is for researchers working on adversarial ML, GEO, strategic classification, and platform mechanism design; it is not a breakthrough but it is a solid step forward.","headline":"A genuinely new mechanism for GEO defense, backed by careful simulation work, but the theoretical lever (Assumption 1) is thinner than the empirical case and needs stronger validation.","tokens_in":24748,"tokens_out":1704,"would_cite":true,"duration_ms":17207,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A defense that rewards verifiable content outperforms punitive countermeasures against GEO citation attacks.","keywords":["generative engine optimization","GEO citation manipulation","mechanism design","verifiable-content rewards","repeated Stackelberg game","incentive alignment","defense against GEO","retrieval-augmented generation"],"falsifier":"Run a red-team supplier that is told the VCR rule and optimizes its rewrites directly against the verifiable-content oracle, adding internally consistent but false numeric claims and a crafted support page that the oracle might accept; then measure whether the oracle's $n_i$ stays uncorrelated with hallucination harm and whether VCR's Net remains above baselines. If the oracle rewards fabricated specifics or if creator exposure exits the ±5-point band under this attacker, the mechanism's load-bearing assumption fails.","tokens_in":23583,"feed_emoji":"🛡️","tokens_out":8427,"duration_ms":108580,"temperature":0.7,"pith_summary":"Generative engines allocate traffic and trust through citations, which gives content suppliers a direct incentive to rewrite pages for citation rather than for accuracy. The paper argues that when a platform answers only with suspicion penalties, repeated generative-engine-optimization (GEO) attacks adapt and the interaction settles into an inert state where neither answer quality nor creator exposure improves. It proposes VCR (verifiable-content rewards), a platform mechanism that also credits rewrites for surfacing checkable, source-supported facts, and reports five-round simulations on three benchmarks and three answer engines in which VCR gets the largest Net defense–utility score, beating the strongest baseline by 12.1 percentage points on average while keeping creator exposure inside a ±5-point equivalence band. The point of the mechanism is to make honest improvement the supplier's most profitable strategy instead of relying on a filter war.","feed_headline":"Rewarding verifiable facts beats punishing GEO spam","feed_subtitle":"Platform mechanism credits source-supported rewrites, defending answers without starving creators of visibility.","key_machinery":"The load-bearing object is VCR, a two-sided scoring rule wrapped around the citation logit $v_i = \\beta_q q_i - \\alpha m_i + \\lambda n_i + b_i$. The platform estimates $n_i$ with a pair-level LLM oracle that counts facts in the rewrite supported by the original version and made more salient; each pair earns credit $r_i = \\lambda \\min(c_{\\max}, c_n n_i)$, which is subtracted from a GEO-suspicion score derived from the supplier's own rewrite rules before soft re-ranking of sources. The theoretical engine is a local best-response analysis of a repeated Stackelberg game with partial monitoring, in which Theorem 2's gain rests on the $n$-coordinate being block-separable from quality and manipulation in the supplier's rewrite cost, so the reward channel adds a strategic direction without changing the platform's penalty at first order.","core_discovery":"The central claim is that platform defense can be made incentive-compatible. In the paper's local model, the platform's best response to correlated quality and manipulation is to weaken its penalty, producing a stationary outcome with little joint utility; VCR adds a $+\\lambda n_i$ term to each document's citation logit, where $n_i$ counts verifiable factual claims surfaced from the document's own earlier version, so the supplier's optimized direction tilts toward welfare-aligned content. Theorem 2 states that under the model's separability assumption this raises platform/user utility to first order while leaving creator utility unchanged to first order. The experiments show that this theoretical direction survives repeated play: VCR is the only defense with positive Net in every round and dataset, and its bootstrap Net intervals sit entirely above those of prompt warning, hard rejection, and keyword scrubbing, while direct quality rubrics also favor its rewrites and answers. The authors note that the ±5-point creator-exposure band is an operational tolerance, not a formal equivalence test.","pith_inferences":["A decisive next test outside the paper would be a red-team supplier that optimizes directly against the verifiable-content oracle, adding internally consistent but false specs with a fabricated support page; if the oracle credits them, the orthogonality assumption breaks and the Net advantage should shrink or reverse.","If multiple platforms each ran their own VCR-style reward, suppliers could face competing verification anchors and different credit caps; whether those standards converge or fragment is outside the paper's single-platform model.","The deployment value depends on the platform's objective: the paper's weighting sweep shows VCR wins for balanced objectives, but a platform that values immediate suppression above creator exposure would still prefer hard rejection, so the mechanism is a policy choice, not a universally dominant defense.","The credit channel could plausibly transfer to other citation-mediated surfaces such as product reviews or scholarly search, but only if the verification anchor stays outside the supplier's control; the paper's own external-support-page experiment suggests that external verifiers open a gameable channel."],"forward_implications":["If VCR works as claimed, GEO attackers' best response shifts from formatting tricks and fabricated specifics to surfacing genuinely checkable facts, because the reward makes that the most profitable rewrite direction.","Platforms that adopt it should be able to keep defense rollback high without the one-for-one creator-exposure loss that hard rejection produces, since creator exposure stays inside the ±5-point band in all nine settings.","The mechanism covers versioned content—a large share of the live web—and drops gracefully to a suspicion-only filter for brand-new pages, so deployment needs no external fact-checking service.","Disclosing the rule to suppliers does not invert the gain: the best available way to earn the reward is to add source-supported facts, so even a rule-aware attacker leaves Net positive."],"supporting_citations":[{"why":"This reference supplies the main GEO attacker and the e-commerce benchmark used in the repeated-game simulations.","marker":"[43]"},{"why":"This reference defines the GEO visibility metric and the open-domain benchmark used to compute creator exposure.","marker":"[1]"},{"why":"This reference provides one of the alternative GEO attackers in the cross-attacker generalization check.","marker":"[10]"},{"why":"This reference provides another alternative GEO attacker tested in the same generalization check.","marker":"[49]"},{"why":"This reference supplies a third alternative attacker and its prompts for the robustness evaluation.","marker":"[22]"},{"why":"This reference supplies the web-versioning statistics supporting the claim that most fast-changing pages have an earlier version available for pair verification.","marker":"[14]"},{"why":"This reference gives complementary web-evolution evidence for the same versioned-content deployment argument.","marker":"[33]"},{"why":"This reference frames how strategic suppliers react to a known decision rule, which motivates the supplier's repeated best response in the game.","marker":"[20]"},{"why":"This reference supplies the performative-prediction view that a platform's defense changes the distribution of documents it later sees.","marker":"[36]"},{"why":"This reference defines the Stackelberg leadership structure used to model supplier-first, platform-second interaction.","marker":"[40]"}],"fun_headline_variants":["Credit verifiable content to end citation wars","VCR mechanism: win-win for platforms and creators","Reward factual rewrites, not just punish manipulation","Verifiable rewards outscore spam defense by 12.1 points","Align creator incentives with answer trust"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on Assumption 1: that the number of verifiable facts a rewrite adds can be measured reliably from the original/rewrite pair and is uncorrelated with how manipulative the rewrite is; if an adaptive supplier can inflate that count with plausible but unsupported content, or if quality and manipulation signals entangle with the reward, the theorem's first-order utility gain collapses and the reward channel can subsidize the very manipulation it targets.","fun_headline_variants_meta":{"raw":{"variants":["Credit verifiable content to end citation wars","VCR mechanism: win-win for platforms and creators","Reward factual rewrites, not just punish manipulation","Verifiable rewards outscore spam defense by 12.1 points","Align creator incentives with answer trust"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000253,"raw_usage":{"total_tokens":1568,"prompt_tokens":952,"completion_tokens":616,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":568,"completion_tokens_details":{"reasoning_tokens":543}},"tokens_in":568,"tokens_out":616,"duration_ms":8277,"temperature":1.0,"reasoning_tokens":543,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:13:19.199339+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a red-team supplier that is told the VCR rule and optimizes its rewrites directly against the verifiable-content oracle, adding internally consistent but false numeric claims and a crafted support page that the oracle might accept; then measure whether the oracle's $n_i$ stays uncorrelated with hallucination harm and whether VCR's Net remains above baselines. If the oracle rewards fabricated specifics or if creator exposure exits the ±5-point band under this attacker, the mechanism's load-bearing assumption fails.","supporting_citations":[{"cited_title":"Geo: Generative engine optimization","cited_arxiv_id":null,"evidence_quote":"This reference defines the GEO visibility metric and the open-domain benchmark used to compute creator exposure."},{"cited_title":"If-geo: Conflict- aware instruction fusion for multi-query generative engine optimization.arXiv preprint arXiv:2601.13938, 2026","cited_arxiv_id":null,"evidence_quote":"This reference provides another alternative GEO attacker tested in the same generalization check."},{"cited_title":"SAGEO Arena: A Realistic Environment for Evaluating Search-Augmented Generative Engine Optimization","cited_arxiv_id":"2602.12187","evidence_quote":"This reference supplies a third alternative attacker and its prompts for the robustness evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"This reference supplies the web-versioning statistics supporting the claim that most fast-changing pages have an earlier version available for pair verification."},{"cited_title":"What’s new on the web? the evolution of the web from a search engine perspective","cited_arxiv_id":null,"evidence_quote":"This reference gives complementary web-evolution evidence for the same versioned-content deployment argument."},{"cited_title":"Strategic classification","cited_arxiv_id":null,"evidence_quote":"This reference frames how strategic suppliers react to a known decision rule, which motivates the supplier's repeated best response in the game."},{"cited_title":"Perdomo, Tijana Zrnic, Celestine Mendler-Dünner, and Moritz Hardt","cited_arxiv_id":null,"evidence_quote":"This reference supplies the performative-prediction view that a platform's defense changes the distribution of documents it later sees."},{"cited_title":"Springer Science & Business Media, 2010","cited_arxiv_id":null,"evidence_quote":"This reference defines the Stackelberg leadership structure used to model supplier-first, platform-second interaction."}],"review_version":1}