Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A defense that rewards verifiable content outperforms punitive countermeasures against GEO citation attacks.

desk verdict A genuinely new mechanism for GEO defense, backed by careful simulation work, but the theoretical lever (Assumption 1) is thinner than the empirical case and needs stronger validation. read the letter →

arxiv 2608.11390 v1 pith:J4KJOOQL submitted 2026-08-11 cs.LG

Chen Xu , Zitian Guo , Chenyan Xiong This is my paper · ORCID
classification cs.LG
keywords generativeengineoptimizationGEOcitationmanipulationmechanismdesignverifiable-contentrewardsrepeatedStackelberggameincentivealignmentdefenseagainstretrieval-augmentedgeneration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative engines allocate traffic and trust through citations, which gives content suppliers a direct incentive to rewrite pages for citation rather than for accuracy. The paper argues that when a platform answers only with suspicion penalties, repeated generative-engine-optimization (GEO) attacks adapt and the interaction settles into an inert state where neither answer quality nor creator exposure improves. It proposes VCR (verifiable-content rewards), a platform mechanism that also credits rewrites for surfacing checkable, source-supported facts, and reports five-round simulations on three benchmarks and three answer engines in which VCR gets the largest Net defense–utility score, beating the strongest baseline by 12.1 percentage points on average while keeping creator exposure inside a ±5-point equivalence band. The point of the mechanism is to make honest improvement the supplier's most profitable strategy instead of relying on a filter war.

What carries the argument

The load-bearing object is VCR, a two-sided scoring rule wrapped around the citation logit $v_i = \beta_q q_i - \alpha m_i + \lambda n_i + b_i$. The platform estimates $n_i$ with a pair-level LLM oracle that counts facts in the rewrite supported by the original version and made more salient; each pair earns credit $r_i = \lambda \min(c_{\max}, c_n n_i)$, which is subtracted from a GEO-suspicion score derived from the supplier's own rewrite rules before soft re-ranking of sources. The theoretical engine is a local best-response analysis of a repeated Stackelberg game with partial monitoring, in which Theorem 2's gain rests on the $n$-coordinate being block-separable from quality and manipulation in the supplier's rewrite cost, so the reward channel adds a strategic direction without changing the platform's penalty at first order.

What would settle it

Run a red-team supplier that is told the VCR rule and optimizes its rewrites directly against the verifiable-content oracle, adding internally consistent but false numeric claims and a crafted support page that the oracle might accept; then measure whether the oracle's $n_i$ stays uncorrelated with hallucination harm and whether VCR's Net remains above baselines. If the oracle rewards fabricated specifics or if creator exposure exits the ±5-point band under this attacker, the mechanism's load-bearing assumption fails.

Watch

Extended reading notes

Core claim

The central claim is that platform defense can be made incentive-compatible. In the paper's local model, the platform's best response to correlated quality and manipulation is to weaken its penalty, producing a stationary outcome with little joint utility; VCR adds a $+\lambda n_i$ term to each document's citation logit, where $n_i$ counts verifiable factual claims surfaced from the document's own earlier version, so the supplier's optimized direction tilts toward welfare-aligned content. Theorem 2 states that under the model's separability assumption this raises platform/user utility to first order while leaving creator utility unchanged to first order. The experiments show that this theoretical direction survives repeated play: VCR is the only defense with positive Net in every round and dataset, and its bootstrap Net intervals sit entirely above those of prompt warning, hard rejection, and keyword scrubbing, while direct quality rubrics also favor its rewrites and answers. The authors note that the ±5-point creator-exposure band is an operational tolerance, not a formal equivalence test.

Load-bearing premise

Everything rests on Assumption 1: that the number of verifiable facts a rewrite adds can be measured reliably from the original/rewrite pair and is uncorrelated with how manipulative the rewrite is; if an adaptive supplier can inflate that count with plausible but unsupported content, or if quality and manipulation signals entangle with the reward, the theorem's first-order utility gain collapses and the reward channel can subsidize the very manipulation it targets.

Editorial extensions

If this is right

  • If VCR works as claimed, GEO attackers' best response shifts from formatting tricks and fabricated specifics to surfacing genuinely checkable facts, because the reward makes that the most profitable rewrite direction.
  • Platforms that adopt it should be able to keep defense rollback high without the one-for-one creator-exposure loss that hard rejection produces, since creator exposure stays inside the ±5-point band in all nine settings.
  • The mechanism covers versioned content—a large share of the live web—and drops gracefully to a suspicion-only filter for brand-new pages, so deployment needs no external fact-checking service.
  • Disclosing the rule to suppliers does not invert the gain: the best available way to earn the reward is to add source-supported facts, so even a rule-aware attacker leaves Net positive.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A decisive next test outside the paper would be a red-team supplier that optimizes directly against the verifiable-content oracle, adding internally consistent but false specs with a fabricated support page; if the oracle credits them, the orthogonality assumption breaks and the Net advantage should shrink or reverse.
  • If multiple platforms each ran their own VCR-style reward, suppliers could face competing verification anchors and different credit caps; whether those standards converge or fragment is outside the paper's single-platform model.
  • The deployment value depends on the platform's objective: the paper's weighting sweep shows VCR wins for balanced objectives, but a platform that values immediate suppression above creator exposure would still prefer hard rejection, so the mechanism is a policy choice, not a universally dominant defense.
  • The credit channel could plausibly transfer to other citation-mediated surfaces such as product reviews or scholarly search, but only if the verification anchor stays outside the supplier's control; the paper's own external-support-page experiment suggests that external verifiers open a gameable channel.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the repeated interaction between content suppliers running GEO-style rewriting and a generative-engine platform defending answer quality. It first shows, via simulation and a local quadratic model, that conventional defenses (prompt warnings, hard rejection, keyword scrubbing) can approach an inert outcome in which neither content improvement nor manipulation is effectively sanctioned. It then proposes VCR, a mechanism that credits rewrites for verifiable, source-supported factual content and offsets this credit against a suspicion penalty before soft re-ranking. The paper's main claim is that VCR consistently achieves the largest Net defense–utility score (Def. + Welf.) across three benchmarks and three answer engines, by an average of 12.1 percentage points over the strongest baseline, while keeping creator exposure within a pre-specified ±5-point empirical equivalence band. A local-games theorem (Theorem 2) is offered as the theoretical counterpart of the empirical win–win outcome.

Significance. If the central claim holds, the paper makes a useful contribution: it reframes GEO defense as a two-sided incentive problem rather than a one-sided filter, and it proposes a concrete mechanism backed by multi-round simulations across datasets, engines, and attackers. Strengths include the release of code, the use of paired per-query bootstrap confidence intervals for the main Net results, robustness checks across five attackers and three answer engines, and a candid limitations section. The theoretical analysis, however, rests on an assumption whose empirical validation is limited to a marginal correlation statistic, and some of the direct quality claims lack uncertainty quantification. The paper is therefore of moderate significance: the empirical Net finding is promising and well-supported, but the theoretical guarantee and the quality improvements are not yet fully established.

major comments (3)
  1. [Sec. 4.4, Theorem 2] The theoretical guarantee of VCR depends on Assumption 1's orthogonality condition E[(n - mean(n))(m - mean(m))] = 0, the block-separability of the n coordinate in the supplier's cost H, and the vanishing mixed partial of the platform loss. The only empirical support offered in Sec. 4.4 is the single sentence reporting an estimated correlation rho_{m,n} in [-0.05, 0.1] on the authors' own data. A marginal correlation between point estimates of n and m is much weaker than orthogonality in the structural model, and it does not test block-separability or the mixed-partial condition at all. If an adaptive attacker can inflate n with plausible-looking but unsupported content that the LLM oracle credits, then n and m become positively correlated in deployment, the term eta_n lambda Theta in Eq. (12) is offset by manipulation harm, and the guarantee collapses. The paper should either provide direct evidence for the structural assumptions (for example, by estimating the cross-partials of the citation logit or supplier cost with respect to n and m), or prove a robustness version of Theorem 2 that quantifies welfare loss under bounded violations of orthogonality, or explicitly re-frame Theorem 2 as a conditional result whose key assumption is not yet empirically established.
  2. [Sec. 5.2, Table 2] The claim that VCR's Net advantage is 'accompanied by more substantive rewrites and better generated answers' relies on Table 2, which reports point estimates without confidence intervals or significance tests. The differences are small (for example, Usefulness 0.757 vs. 0.740 for Hard reject and Answer Clarity 0.564 vs. 0.554 for the runner-up). Given that the paper itself uses paired bootstrap CIs for the Net metric in Table 4, the absence of any uncertainty quantification for the quality dimensions is an asymmetry that weakens the direct-quality claim. The authors should report confidence intervals for Table 2, or at minimum soften the language from 'backed by genuinely better documents and answers' to a point-estimate statement.
  3. [Sec. 5.2, App. B/E] The verifiable-content oracle that computes the reward signal n_i uses gpt-4o-mini (App. B), and the paper does not state which model produces the direct quality judgments in Table 2 and the GEU scores in App. E.7. If the same model family assigns both the reward and the quality scores, then the 'more substantive rewrites' finding is partly endogenous: the mechanism may be optimizing for the judge's own preferences rather than for an independent notion of quality. The manuscript should explicitly identify the evaluation model for Table 2 and GEU, and ideally use a different model or a human-annotated holdout set for evaluation so that the reward channel and the quality measure are not confounded.
minor comments (5)
  1. [Appendix F] Sections F.3 and F.4 are both titled 'Proof of Theorem 2', but F.3 actually proves Proposition 2 (defense-effectiveness decomposition). Re-label F.3 as the proof of Proposition 2.
  2. [Title and abstract] The title uses 'Generative Engine' in the singular while the abstract and body use 'Generative Engines'; please make the title consistent.
  3. [Table 4, Sec. 5.2] The E-COMMERCE VCR Welf. bootstrap interval reaches 5.4 at its upper endpoint, slightly above the +5-point equivalence band; the text acknowledges this, but the abstract and Section 5.2 state that creator exposure stays within the band in all nine settings without this qualification. Please add the qualification or note the interval endpoint in the main text.
  4. [Sec. 3.3, F.1] The coefficients B and Q in Lemma 1 are defined in the proof (F.1) but not in the lemma statement; please include their definitions in the main text for readability.
  5. [Sec. 4.2 / Related Work] The sentence 'While our method rewards source-supported factual substance rather than only penalizing suspicious form.' is a fragment; please merge it with the preceding sentence.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical comparison and the conditional Theorem 2 analysis are not fitted to each other; the AutoGEO self-citation supplies an evaluation harness, not a load-bearing derivation.

full rationale

The paper's central claim is an empirical comparison: VCR's Net score is computed from citation visibility (g_a, g_d, g_0) via Eq. (13), not from the verifiable-content reward r_i itself, and the direct quality metrics (Table 2) use a separate LLM rubric. Theorem 2 is a conditional local result: under Assumption 1 (orthogonality of n and m, block-separability in H, positive marginal utility eta_n, and vanishing mixed partial), adding a verifiable-content reward shifts the supplier's best response along n and improves platform/user utility to first order while preserving creator utility to second order. The assumption is stated explicitly and tested only by a reported correlation ρ-hat_{m,n} in [-0.05, 0.1]; a weak test of a structural assumption is a robustness limitation, not a circular step, and the paper candidly lists residual risks (LLM oracle errors, reward-cap farming) in App. A. The only notable self-citation is the AutoGEO framework [43] used for two datasets, the attacker, and the reversed Explainer-Extractor-Merger-Filter pipeline for suspicion extraction. That reuse supplies an evaluation harness, not a theorem or a fitted parameter; the comparison also includes the external GEO-BENCH benchmark and visibility metric [1], and VCR's advantage is replicated against four non-AutoGEO attackers (Fig. 3a). No 'prediction' reduces by construction to a fitted input, and no load-bearing argument reduces to a self-citation.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The central claim depends on a small set of mechanism parameters (lambda, c_n, c_max, theta, omega) and a hard-reject baseline threshold tau, none of which are derived from first principles. The game-theoretic results rest on a softmax citation model, a local quadratic approximation, and Assumption 1 about the verifiable-content signal. The only invented construct is the n_i reward signal, which has operational but not external evidence.

free parameters (5)
  • reward strength lambda = 1 (main runs); swept 0 to 2 in Fig 4(b)
    Scales the verifiable-content reward in Eq (8). The qualitative result holds across the sweep, but the 12.1 pp figure is reported at lambda=1.
  • per-claim credit c_n and credit cap c_max = Calibrated to suspicion-penalty scale; exact values only in code
    Chosen by hand in Eq (8) so the reward is comparable to the strongest and weakest suspicion penalties; no separate sensitivity analysis is reported for these two values.
  • edit-magnitude threshold theta = Set so the median edited document contributes in round R1
    Gates which before/after pairs enter rule extraction in Algorithm 1; affects extracted rules and suspicion scores.
  • Net weight omega = 0.5 (equal weights)
    Net = Def + Welf is the primary metric; the paper sweeps omega and shows VCR optimal for omega in roughly [0.20, 0.60] on the three datasets, so the headline 12.1 pp advantage is specific to equal weights.
  • Hard-reject threshold tau = 0.45, tuned on a 50-query dev split
    Baseline parameter; the tuning set is small and could advantage or disadvantage Hard reject relative to VCR, whose parameters are not tuned on that split.
assumptions (4)
  • domain assumption Citation model Eq (1): softmax over beta_q q_i - alpha m_i + b_i
    The whole game analysis and the definition of local best responses assume this functional form; it is a modeling choice adapted from prior GEO work, not derived from measurements of any real engine.
  • domain assumption Local quadratic approximation of utilities
    Lemma 1, Theorem 1, and Theorem 2 are Taylor expansions around alpha=0 with negligible remainders; all theoretical conclusions about stationary outcomes and VCR improvements are local only.
  • ad hoc to paper Assumption 1 (measurability of n, orthogonality to m, block-separability of H)
    These conditions are introduced specifically to make Theorem 2 go through; only the correlation part is checked empirically.
  • domain assumption Partial-monitoring Stackelberg structure
    Suppliers see the defense before rewriting and platforms see only before/after pairs; this information structure is plausible but is an assumption about the ecosystem.
invented entities (1)
  • n_i (verifiable supported content count) independent evidence
    purpose: Reward signal in Eq (8); credits rewrites that surface source-supported facts.
    Operationalized through an LLM oracle on before/after pairs. Judge robustness across three models is reported, but the construct is defined by the paper and lacks an external gold-standard validation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes." pith.science (2026). https://pith.science/paper/J4KJOOQL

@misc{pith2026260811390,
  author       = {Pith},
  title        = {Pith review of: Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J4KJOOQL}},
  note         = {Machine review of arXiv:2608.11390}
}
read the original abstract

Generative engines are reshaping the web ecosystem by making citations a key mechanism for allocating attention, attribution, and downstream value. This creates a strategic tension: content providers are incentivized to optimize for model citation, while platforms must preserve answer quality and trustworthy attribution. We show that this tension can escalate into citation wars. In repeated simulations, state-of-the-art generative engine optimization (GEO) attacks adapt to conventional defenses by producing citation-seeking rewrites that degrade document quality and introduce unsupported claims. To study this problem, we formulate the supplier--platform interaction as a repeated Stackelberg game with partial monitoring. A local best-response analysis identifies when citation competition approaches an inert stationary outcome. Motivated by this finding, we propose a platform--creator mechanism called VCR based on verifiable-content rewards. Rather than only penalizing suspicious rewrites, the platform also credits rewrites that surface checkable factual substance, aligning creator incentives with answer trustworthiness. Experiments on three benchmarks show that VCR consistently achieves the largest Net defense-utility score, outperforming the strongest baseline by an average of 12.1 percentage points, and produces a win--win outcome under our empirical equivalence criterion.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 32 canonical work pages

  1. [1]

    Geo: Generative engine optimization

    Pranjal Aggarwal, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, Karthik Narasimhan, and Ameet Deshpande. Geo: Generative engine optimization. InProceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining, pages 5–16, 2024

    work page 2024

  2. [2]

    Self-rag: Learning to retrieve, generate, and critique through self-reflection

    Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. Self-rag: Learning to retrieve, generate, and critique through self-reflection. InThe Twelfth International Conference on Learning Representations (ICLR), 2024

    work page 2024

  3. [3]

    E-geo: A testbed for generative engine optimization in e-commerce.arXiv preprint arXiv:2511.20867, 2025

    Puneet S Bagga, Vivek F Farias, Tamar Korkotashvili, Tianyi Peng, and Yuhang Wu. E-geo: A testbed for generative engine optimization in e-commerce.arXiv preprint arXiv:2511.20867, 2025

    arXiv 2025

  4. [4]

    Baeza-Yates

    Luca Becchetti, Carlos Castillo, Debora Donato, Stefano Leonardi, and Ricardo A. Baeza-Yates. Link-based characterization and detection of web spam. InAIRWeb 2006, Proceedings of the Second International Workshop on Adversarial Information Retrieval on the Web, Seattle, Washington, USA, 10 August 2006, co-located with SIGIR 2006, pages 1–8, 2006

    work page 2006

  5. [5]

    A game-theoretic approach to recommendation systems with strategic content providers

    Omer Ben-Porat and Moshe Tennenholtz. A game-theoretic approach to recommendation systems with strategic content providers. InAdvances in Neural Information Processing Systems 31 (NeurIPS), 2018

    work page 2018

  6. [6]

    Bernd Bohnet, Vinh Q. Tran, Pat Verga, Roee Aharoni, Daniel Andor, Livio Baldini Soares, Massimiliano Ciaramita, Jacob Eisenstein, Kuzman Ganchev, Jonathan Herzig, Kai Hui, Tom Kwiatkowski, Ji Ma, Jianmo Ni, Lierni Sestorain Saralegui, Tal Schuster, William W. Cohen, Michael Collins, Dipanjan Das, Donald Metzler, Slav Petrov, and Kellie Webster. Attribute...

    arXiv 2023

  7. [7]

    Adversarial web search.Foundations and trends in Information Retrieval, 4(5):377–486, 2011

    Carlos Castillo and Brian D Davison. Adversarial web search.Foundations and trends in Information Retrieval, 4(5):377–486, 2011

    work page 2011

  8. [8]

    Cc-gseo-bench: A content-centric benchmark for measuring source influence in generative search engines.arXiv preprint arXiv:2509.05607, 2025

    Qiyuan Chen, Jiahe Chen, Hongsen Huang, Qian Shao, Jintai Chen, Renjie Hua, Hongxia Xu, Ruijia Wu, Ren Chuan, and Jian Wu. Cc-gseo-bench: A content-centric benchmark for measuring source influence in generative search engines.arXiv preprint arXiv:2509.05607, 2025

    arXiv 2025

Show all 51 references
  1. [9]

    Caption injection for optimization in generative search engine.arXiv preprint arXiv:2511.04080, 2025

    Xiaolu Chen, Jie Bao, Haojie Wu, Zhen Chen, and Yong Liao. Caption injection for optimization in generative search engine.arXiv preprint arXiv:2511.04080, 2025

    2025 arXiv

  2. [10]

    Role-augmented intent-driven generative search engine optimization.arXiv preprint arXiv:2508.11158, 2025

    Xiaolu Chen, Haojie Wu, Jie Bao, Zhen Chen, Yong Liao, and Hu Huang. Role-augmented intent-driven generative search engine optimization.arXiv preprint arXiv:2508.11158, 2025. 14 Mechanism Design for Generative Engine: From Exploitation to Win-Win Equilibrium

    2025

  3. [11]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. InAdvances in Neural Information Processing Systems 37 (NeurIPS), 2024

    2024

  4. [12]

    Shashidhar, Micheal Tuape, Dan Abudu, Beakcheol Jang, and Jong Wook Kim

    Kennedy Edemacu, Vinay M. Shashidhar, Micheal Tuape, Dan Abudu, Beakcheol Jang, and Jong Wook Kim. Defending against knowledge poisoning attacks during retrieval-augmented generation.arXiv preprint arXiv:2508.02835, 2025

    2025

  5. [13]

    Ragas: Automated evaluation of retrieval augmented generation

    Shahul Es, Jithin James, Luis Espinosa-Anke, and Steven Schockaert. Ragas: Automated evaluation of retrieval augmented generation. InProceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics: System Demonstrations, 2024

    2024

  6. [14]

    Dennis Fetterly, Mark Manasse, Marc Najork, and Janet L. Wiener. A large-scale study of the evolution of web pages. InProceedings of the 12th International Conference on World Wide Web, 2003

    2003

  7. [15]

    Enabling large language models to generate text with citations

    Tianyu Gao, Howard Yen, Jiatong Yu, and Danqi Chen. Enabling large language models to generate text with citations. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023

    2023

  8. [16]

    Ranking robustness under adversarial document manipulations

    Gregory Goren, Oren Kurland, Moshe Tennenholtz, and Fiana Raiber. Ranking robustness under adversarial document manipulations. InThe 41st International ACM SIGIR Conference on Research & Development in Information Retrieval, pages 395–404, 2018

    2018

  9. [17]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. InProceedings of the 16th ACM Workshop on Artificial Intelligenc...

    2023

  10. [18]

    Link spam alliances

    Zoltán Gyöngyi and Hector Garcia-Molina. Link spam alliances. InVLDB, volume 5, pages 517–528, 2005

    2005

  11. [19]

    Web spam taxonomy

    Zoltán Gyöngyi and Hector Garcia-Molina. Web spam taxonomy. InAIRWeb 2005, First International Workshop on Adversarial Information Retrieval on the Web, co-located with the WWW conference, Chiba, Japan, May 2005, pages 39–47, 2005

    2005

  12. [20]

    Strategic classification

    Moritz Hardt, Nimrod Megiddo, Christos Papadimitriou, and Mary Wootters. Strategic classification. InProceedings of the 2016 ACM Conference on Innovations in Theoretical Computer Science (ITCS), pages 111–122, 2016

    2016

  13. [21]

    Supply-side equilibria in recommender systems

    Meena Jagadeesan, Nikhil Garg, and Jacob Steinhardt. Supply-side equilibria in recommender systems. InAdvances in Neural Information Processing Systems 36 (NeurIPS), 2023

    2023

  14. [22]

    Sageo arena: A realistic environment for evaluating search-augmented generative engine optimization.arXiv preprint arXiv:2602.12187, 2026

    Sunghwan Kim, Wooseok Jeong, Serin Kim, Sangam Lee, and Dongha Lee. Sageo arena: A realistic environment for evaluating search-augmented generative engine optimization.arXiv preprint arXiv:2602.12187, 2026

    2026 arXiv

  15. [23]

    How do classifiers induce agents to invest effort strategi- cally? InProceedings of the 2019 ACM Conference on Economics and Computation (EC), 2019

    Jon Kleinberg and Manish Raghavan. How do classifiers induce agents to invest effort strategi- cally? InProceedings of the 2019 ACM Conference on Economics and Computation (EC), 2019

    2019

  16. [24]

    Manipulating large language models to increase product visibility.arXiv preprint arXiv:2404.07981, 2024

    Aounon Kumar and Himabindu Lakkaraju. Manipulating large language models to increase product visibility.arXiv preprint arXiv:2404.07981, 2024. 15 Mechanism Design for Generative Engine: From Exploitation to Win-Win Equilibrium

    2024 arXiv

  17. [25]

    Retrieval-augmented generation for knowledge-intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. InAdvances in Neural ...

    2020

  18. [26]

    Liu, Tianyi Zhang, and Percy Liang

    Nelson F. Liu, Tianyi Zhang, and Percy Liang. Evaluating verifiability in generative search engines. InFindings of the Association for Computational Linguistics: EMNLP 2023, 2023

    2023

  19. [27]

    Prompt injection attack against llm-integrated applications.arXiv preprint arXiv:2306.05499, 2023

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, Leo Yu Zhang, and Yang Liu. Prompt injection attack against llm-integrated applications.arXiv preprint arXiv:2306.05499, 2023

    2023 arXiv

  20. [28]

    Think before writing: Feature-level multi-objective optimization for generative citation visibility.arXiv preprint arXiv:2604.19113, 2026

    Zikang Liu and Peilan Xu. Think before writing: Feature-level multi-objective optimization for generative citation visibility.arXiv preprint arXiv:2604.19113, 2026

    2026 arXiv

  21. [29]

    Playing repeated stackelberg games with unknown opponents

    Janusz Marecki, Gerry Tesauro, and Richard Segal. Playing repeated stackelberg games with unknown opponents. InProceedings of the 11th International Conference on Autonomous Agents and Multiagent Systems - Volume 2, AAMAS ’12, Richland, SC, 2012. International Foundation for A...

    2012

  22. [30]

    Factscore: Fine-grained atomic evaluation of factual precision in long form text generation

    Sewon Min, Kalpesh Krishna, Xinxi Lyu, Mike Lewis, Wen tau Yih, Pang Wei Koh, Mohit Iyyer, Luke Zettlemoyer, and Hannaneh Hajishirzi. Factscore: Fine-grained atomic evaluation of factual precision in long form text generation. InProceedings of the 2023 Conference on Empirical ...

    2023

  23. [31]

    Webgpt: Browser-assisted question-answering with human feedback.arXiv preprint arXiv:2112.09332, 2021

    Reiichiro Nakano, Jacob Hilton, Suchir Balaji, Jeff Wu, Long Ouyang, Christina Kim, Christo- pher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders, Xu Jiang, Karl Cobbe, Tyna Eloundou, Gretchen Krueger, Kevin Button, Matthew Knight, Benjamin Chess, and John Schul- man. ...

    2021 arXiv

  24. [32]

    Algorithmic mechanism design.Games and Economic Behavior, 35(1–2):166–196, 2001

    Noam Nisan and Amir Ronen. Algorithmic mechanism design.Games and Economic Behavior, 35(1–2):166–196, 2001

    2001

  25. [33]

    What’s new on the web? the evolution of the web from a search engine perspective

    Alexandros Ntoulas, Junghoo Cho, and Christopher Olston. What’s new on the web? the evolution of the web from a search engine perspective. InProceedings of the 13th International Conference on World Wide Web, 2004

    2004

  26. [34]

    Detecting spam web pages through content analysis

    Alexandros Ntoulas, Marc Najork, Mark Manasse, and Dennis Fetterly. Detecting spam web pages through content analysis. InProceedings of the 15th International Conference on World Wide Web, WWW ’06, page 83–92, 2006

    2006

  27. [35]

    Adversarial text rewriting for text-aware recommender systems

    Sejoon Oh, Gaurav Verma, and Srijan Kumar. Adversarial text rewriting for text-aware recommender systems. InProceedings of the 33rd ACM International Conference on Information and Knowledge Management. ACM, 2024

    2024

  28. [36]

    Perdomo, Tijana Zrnic, Celestine Mendler-Dünner, and Moritz Hardt

    Juan C. Perdomo, Tijana Zrnic, Celestine Mendler-Dünner, and Moritz Hardt. Performative prediction. InProceedings of the 37th International Conference on Machine Learning (ICML), 2020

    2020

  29. [37]

    Ignore previous prompt: Attack techniques for language models

    Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527, 2022

    2022 arXiv

  30. [38]

    C-seo bench: Does conversational seo work?arXiv preprint arXiv:2506.11097, 2025

    Haritz Puerto, Martin Gubri, Tommaso Green, Seong Joon Oh, and Sangdoo Yun. C-seo bench: Does conversational seo work?arXiv preprint arXiv:2506.11097, 2025. 16 Mechanism Design for Generative Engine: From Exploitation to Win-Win Equilibrium

    2025

  31. [39]

    Towards more robust retrieval-augmented generation: Evaluating rag under adversarial poisoning attacks

    Jinyan Su, Jin Peng Zhou, Zhengxin Zhang, Preslav Nakov, and Claire Cardie. Towards more robust retrieval-augmented generation: Evaluating rag under adversarial poisoning attacks. arXiv preprint arXiv:2412.16708, 2024

    2024 arXiv

  32. [40]

    Springer Science & Business Media, 2010

    Heinrich Von Stackelberg.Market structure and equilibrium. Springer Science & Business Media, 2010

    2010

  33. [41]

    The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024

    Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024

    2024 arXiv

  34. [42]

    From experience to skill: Multi-agent generative engine optimization via reusable strategy learning.arXiv preprint arXiv:2604.19516, 2026

    Beining Wu, Fuyou Mao, Jiong Lin, Cheng Yang, Jiaxuan Lu, Yifu Guo, Siyu Zhang, Yifan Wu, Ying Huang, and Fu Li. From experience to skill: Multi-agent generative engine optimization via reusable strategy learning.arXiv preprint arXiv:2604.19516, 2026

    2026 arXiv

  35. [43]

    What generative search engines like and how to optimize web content cooperatively.arXiv preprint arXiv:2510.11438, 2025

    Yujiang Wu, Shanshan Zhong, Yubin Kim, and Chenyan Xiong. What generative search engines like and how to optimize web content cooperatively.arXiv preprint arXiv:2510.11438, 2025

    2025

  36. [44]

    Certifiably robust rag against retrieval corruption.arXiv preprint arXiv:2405.15556, 2024

    Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. Certifiably robust rag against retrieval corruption.arXiv preprint arXiv:2405.15556, 2024

    2024

  37. [45]

    Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models.arXiv preprint arXiv:2406.00083, 2024

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models.arXiv preprint arXiv:2406.00083, 2024

    2024 arXiv

  38. [46]

    Structural feature engineering for generative engine optimization: How content structure shapes citation behavior.arXiv preprint arXiv:2603.29979, 2026

    Junwei Yu, Mufeng Yang, Yepeng Ding, and Hiroyuki Sato. Structural feature engineering for generative engine optimization: How content structure shapes citation behavior.arXiv preprint arXiv:2603.29979, 2026

    2026

  39. [47]

    Agenticgeo: A self-evolving agentic system for generative engine optimization.arXiv preprint arXiv:2603.20213, 2026

    Jiaqi Yuan, Jialu Wang, Zihan Wang, Qingyun Sun, Ruijie Wang, and Jianxin Li. Agenticgeo: A self-evolving agentic system for generative engine optimization.arXiv preprint arXiv:2603.20213, 2026

    2026

  40. [48]

    Poisoning retrieval corpora by injecting adversarial passages

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023

    2023

  41. [49]

    If-geo: Conflict- aware instruction fusion for multi-query generative engine optimization.arXiv preprint arXiv:2601.13938, 2026

    Heyang Zhou, JiaJia Chen, Xiaolu Chen, Jie Bao, Zhen Chen, and Yong Liao. If-geo: Conflict- aware instruction fusion for multi-query generative engine optimization.arXiv preprint arXiv:2601.13938, 2026

    2026

  42. [50]

    optimized for GEO

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. {PoisonedRAG}: Knowledge corruption attacks to{Retrieval-Augmented} generation of large language models. In34th USENIX Security Symposium (USENIX Security 25), pages 3827–3844, 2025. 17 Mechanism Design for Generative Engin...

    2025

  43. [51]

    Listing 13|Quality judge for target-document selection

    {d_1} ... Listing 13|Quality judge for target-document selection. 32

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.