Characterizing Adversarial GEO via Implicit Brand Injection

Quietly adding one sentence that mentions a brand to a web article can be enough to get that brand into a generative search engine's answer. The authors split the job across a team of agents that pick where to insert, rewrite that sentence, check that the edit reads naturally, and choose among several candidates, then test it on a set of web articles and made-up brands. The edited articles do not read like ads, yet the passage with the brand is often retrieved: the edited passage lands in the top 10 results up to 82.2% of the time, and the generated answer mentions the brand up to 62.7% of the time. A single soft placement moves both retrieval and the answer, so generative search needs defenses against it.

Teams building RAG or generative search should read this. It splits the attack into three separately measured steps, "edit naturally", "get retrieved" and "enter the answer", which makes it a ready template for red-team tests. The brands are fictional, though, and retrieval runs in a small controlled pipeline; a live system adds crawling and source-authority checks first.

What the attacker can and cannot do

The attacker can publish or edit a public article and picks the brand to place. They do not know what users will search for later, and they cannot touch the retriever, the ranking or the generator. The paper assumes the edited article is already in the search engine's corpus; crawling and indexing are out of scope.

The edit is tightly limited: one sentence per article, one mention of the brand, and every other sentence untouched. That sentence may not recommend, praise or urge a purchase, and it may not carry links or invent user experiences.

An illustrative example of what such a placement looks like:

When a user later asks "how do I make cold brew", retrieval may pull up this passage, and the answer may mention Brewlo along the way.

How IBI rewrites that sentence

The authors call the method IBI (Implicit Brand Injection). If a single prompt asks the model to edit directly, it has to decide at once which sentence to use, how to phrase it and how light the tone should be, with no chance to redo a bad edit. IBI hands the job to four agents, each doing one thing, so every step can be checked on its own.

The planner reads the whole article and the brand description, lists a few sentences where the brand could go, and says in what role it appears. When the brand is in the same domain as the article, it ties directly to the article's topic; the paper calls this endemic, and here it is "same-domain placement". When the domains differ, it needs a plausible link, such as a shared audience or a neighbouring need; this is "cross-domain placement". The brand and the link are assigned to each article when the benchmark is built, all three methods get the same ones, and the method cannot pick an easy brand.

The rewriter gets the plan the planner chose, the brand description and the preset link, then looks at the target sentence and one sentence on each side. It writes the brand into that sentence while keeping the sentence's original role. For each spot the planner selects, the rewriter writes one candidate sentence.

The verifier compares the original and edited sentence and scores five things from 1 to 5: whether the meaning changed, whether it fits the context, whether it reads naturally, whether it sounds promotional, and whether the change is minimal. A candidate passes only if every score is at least 4. A failing candidate goes back to the rewriter with feedback, for up to 3 rounds; after that the spot is dropped and another spot from the planner is used. The candidates that pass are pooled.

Finally the coordinator uses one model call to pick one candidate from this pool, without rewriting any. In order, it weighs how well the meaning is kept, how naturally it fits the context, how small the change is, how light the promotional tone is, and whether the link between brand and article holds up. BoN uses this same prompt for its final pick. The whole process looks only at the text: the attacker cannot reach retrieval or generation and gets no feedback from them when choosing. All agents and direct prompting use GPT-4o-mini. A program then runs hard checks: the brand appears exactly once, nothing outside the sentence changed, and there are no other brands or links.

Two baselines are compared. Direct prompting (DP) makes the edit in one call. Best-of-N (BoN) uses the same average budget of 6 calls as IBI: it generates 5 independent candidates, then uses 1 call to pick the best. BoN rules out the explanation that IBI simply spends more calls.

How it is tested: retrieval and answers scored separately

The benchmark, IBIBench, has 1,000 informational web articles across 12 domains, paired with 60 fictional brands. Each article gets one same-domain and one cross-domain placement. Fictional brands keep a model's prior familiarity with real brands from muddying the results.

The pipeline is a common RAG setup: articles are cut into 256-token passages, bge-base-en-v1.5 does vector retrieval, and five different generators write the answers. Each run swaps in the edited version of just one article and leaves the rest of the corpus unchanged.

Queries come in two kinds, both written from the clean articles only; the query generator never sees the brand or the edited sentence. One kind is written close to a single article (article-level queries). The other asks broader questions per domain (domain-level queries).

When an answer is produced, neither the retriever nor the generator knows which article was edited; the generator gets only the query and the top 10 passages. Only at evaluation time are the outputs scored against the records, on four measures. Hoot says▾

Hoot saysMention rate and conditional propagation use different denominators (illustrative)Close ✕

The same 3 brand mentions: the mention rate counts all queries, conditional propagation only the queries where the passage arrived.

‹1/2›

These 10 queries are illustrative. The mention rate shows the effect of the whole chain. Conditional propagation looks only at the last step: once the passage arrives, does the model use it? Source: paper §5.3 metric definitions; query counts are illustrative

• Retrieval hit (Hit@k): one of the top k results comes from the edited article and contains the brand. Retrieving other passages of the same article does not count.
• Brand mention rate (BMR): the share of answers that mention the brand.
• Brand recommendation rate (BRR): the share of answers that recommend the brand as an option, judged by GPT-5-mini.
• Conditional propagation (CP): among queries where the brand passage already made the top 10, the share of answers that mention the brand. It asks: once the passage is delivered, does the model use it?

Results: more covert than both baselines, and retrieved more often

First, edit quality. Semantic preservation is the vector similarity between the edited and original sentence; higher means the meaning changed less. For same-domain placement, IBI scores 0.794 and BoN, at the same call budget, 0.762. This shows IBI's gain does not come only from sampling more times.

Human raters agree. Eight annotators blindly rated 50 passages, 25 each from IBI and direct prompting, for whether they sounded promotional. IBI was judged promotional 31% of the time, direct prompting 57%, a significant difference, which shows IBI's sentences read less like ads. On whether the text reads naturally, the difference between the two is not significant.

Next, retrieval. The table gives top-10 hit rates (%).

In all four cases IBI beats BoN, at the same call budget, by 6.7 to 11.3 percentage points. Domain-level queries are broader and less tied to one article, so hit rates are lower overall, but the gap remains. Most hits are at rank one: IBI's top-1 hits make up about 76% to 88% of its top-10 hits. So when the passage is retrieved, it is usually ranked first.

I think domain-level queries are closer to how real users ask, because users usually ask broad questions rather than ones phrased around a particular article. Under these queries the IBI passage still made the top 10 almost half the time, so the effect is not limited to queries tied to one article.

The authors also retested IBI alone with a second retriever, e5-base-v2. Same-domain still beats cross-domain, and article-level queries still beat domain-level ones. The baselines were not rerun on e5-base-v2, so the gap over BoN is verified only on the main retriever.

Does the answer mention the brand?

Five generators, two query kinds and two placement types make 20 combinations. IBI's brand mention rate and conditional propagation beat BoN in all 20. On average, BoN raises the mention rate over direct prompting by 4.5 percentage points, and IBI adds another 8.4 points on top of BoN. So extra calls explain only part of the gain.

The strongest case is GPT-5-mini with article-level, same-domain queries: a mention rate of 62.7% and conditional propagation of 75.9%. In other words, once the brand passage is in front of the model, about three in four answers mention the brand.

The authors also ran a qualitative check on 100 pairs. Without the planner, the brand often lands in sentences whose context cannot support it, especially for cross-domain placement. Without the verifier, the edited sentences often sound like recommendations.

Limitations

First, the brands are fictional, so the paper does not test how an established brand's fame and reputation would interact with the effect. Second, it assumes the edited article is already in the corpus, while real search engines filter many pages first through crawling, indexing and source authority. Third, retrieval is tested with only two vector retrievers; keyword retrieval, hybrid retrieval and commercial systems may behave differently. Fourth, the human study covers only 50 passages, and the brand recommendation rate is judged by GPT-5-mini, which adds noise.

How search and RAG teams can try this

1. Sample articles from your own corpus and place fictional brands under the "one sentence, one mention" rule, keeping a clean copy for comparison.
2. Using real query logs or queries generated from the articles, test the clean and edited versions: how often the brand passage reaches the top 10, and how often the answer mentions the brand.
3. Watch conditional propagation most closely. If it is high, the generation step trusts single sources too much.
4. Try the two kinds of defense the paper proposes but has not yet tested. One has the model read each retrieved passage separately and answer from it, then merges those answers; an unfamiliar commercial entity enters the answer only if several independent sources mention it. The other links every entity in the answer back to the passage it came from, so it can be audited.
5. Compare the drop in mention rate before and after, and check that normal answer quality does not suffer.

Verdict