Study reveals covert tactics for gaming AI answers

A team of researchers has built a machine for doing something that, until now, required a PR agency, a trade journalist willing to look the other way, and considerable patience: slipping a brand into an article where it does not belong, so skilfully that neither reader nor retrieval algorithm notices the seam.

The paper is called "Characterizing Adversarial GEO via Implicit Brand Injection," and its authors, publishing on arXiv, have given the technique a name (IBI) and a benchmark (IBIBench: 1,000 web articles, 60 synthetic brands). IBI is a multi-agent system. One agent finds the best sentence in an article to tamper with. Another rewrites it to include the brand. A third checks whether the edit reads as native or as an advert that wandered in by mistake. A fourth picks the best candidate from the options generated. The goal, stated plainly in the abstract, is a single mention that is "contextually integrated," relevant enough to survive retrieval, and subtle enough to avoid looking "overtly promotional."

This is not spam, in the old sense. Spam shouts. IBI whispers, and whispers in the right register, in an article that has nothing to do with the brand at all.

The retrieval problem, inverted

Generative search engines work by retrieving source documents and then synthesising an answer from them. The entire discipline of generative engine optimisation has, until now, assumed that brands want to be found in content that is already about them: a product review, a comparison page, a "best tools for X" listicle. The implicit threat the paper documents is different. It shows that a brand mention can be planted in content with no topical relationship to the brand whatsoever, and that the mention can still survive the retrieval step and surface in a generated answer to an unrelated query. The target article does not need to be about the brand. It needs only to be retrievable, and to contain one well-placed sentence.

That inversion matters more than the headline trick. The standard defence against manipulated AI answers is topical: if a company monitors how it is mentioned in articles about its sector, its products, its competitors, it assumes it has covered the attack surface. IBI shows that assumption is the vulnerability. A brand can be injected into a piece on urban drainage policy, or Alpine logistics, or microfinance regulation in East Africa, and if the retrieval system judges the article relevant to a query touching any of those themes, the planted mention rides along into the generated answer. Monitoring your own category tells you nothing about the thousand adjacent categories someone else might use as a vehicle.

Who has the most to lose

This should concern four kinds of institution more than most. Financial services firms operate in a trust economy where an unexplained, out-of-context citation (a bank name appearing in an article about something it has no business being in) is not a neutral mention; it is either an error that undermines confidence in the AI answer, or evidence of exactly the kind of manipulation regulators are already nervous about. Multilaterals and UN bodies face a sharper version of the same problem: a covertly injected mention in development or policy content can imply an institutional endorsement that never happened, and the reputational cost of correcting the record runs far higher than ignoring a bad listicle ranking. Major industrial groups, which already struggle with ESG-adjacent content pollution, now have a mechanism by which a competitor or an interested third party can make a claim about them appear in unrelated technical or regulatory content, dressed as neutral editorial judgment. Philanthropic and policy institutions, whose authority rests on being cited accurately by third parties rather than by themselves, are perhaps the most exposed: their visibility strategy has always depended on trusting that mentions of them in the wild are organic.