Researchers at Fudan University published a fictional concept online and watched it get cited by AI search tools within a week. Eight of the ten platforms they tested picked it up, including ChatGPT, Perplexity, Grok, and Google AI.
The study was posted to arXiv on October 8, 2026. It is one of the clearest live demonstrations yet of AI search citation manipulation, showing how easily fabricated content can land in an AI answer, just by publishing it in the right place.
For anyone doing generative engine optimization (GEO), the work this blog covers under its GEO Trends posts, this matters for two reasons. It shows how AI tools actually pick sources, and it shows how a competitor, a bad actor, or an overeager GEO vendor could abuse that process. I will walk through what the researchers did, what they found, and what I think GEO practitioners should take from it.
How the AI search citation manipulation test worked
The team, Qi Liu, Geng Hong, Xinyang Zhang, Pei Chen, Yutong Li, and Min Yang, ran the study in two stages. Their paper on arXiv (2610.11932) carries a submission header for the Network and Distributed System Security Symposium 2027.
In March 2026, they ran 120 baseline questions through 10 AI search tools and logged which domains each one cited. Across the board, 6 to 10 of each tool’s top 10 most-cited sites allowed ordinary users to publish on them.
That alone is worth sitting with. Most of the sources these tools lean on are not gated newsrooms. They are platforms anyone can sign up for.
In April, the researchers tested 22 of those publishing platforms for how hard they were to post on. Medium, GitHub, LinkedIn, and Facebook had low barriers. Reddit was harder, because of karma requirements and aggressive deletion of new accounts. From the platforms tied to each tool’s most-cited domains, they picked nine sites a new account could realistically use, including Medium, YouTube, and the Chinese platform Sohu.
For content, ChatGPT wrote first drafts, which the researchers then revised by hand and seeded with fabricated names and numbers. Those markers let them confirm, later, whether an AI answer had actually pulled from their post rather than coincidentally matching it.
Three fake topics, three different outcomes
They tested three invented subjects. These were the “Cactus Gravity Protocol” (a concept with no real basis), a fictional keyboard product, and a planted opinion about whether AI will replace junior programmers within five years. Before posting, they confirmed none of the 10 tools could answer questions about these topics. After posting, they ran five questions per topic on every tool, every day, for seven days.
What the numbers show about AI search citation manipulation
The Cactus Gravity Protocol spread fastest. Eight of 10 tools cited it within the week. That included all four tools the paper describes as English-web platforms: ChatGPT, Perplexity, Grok, and Google AI (the paper does not say which specific Google AI product was tested).
Citation frequency varied a lot by tool. Grok linked to the planted post in 30 of 32 answers during the test window. Google AI linked in 15 of 33 answers.
Perplexity linked in 13 of 35. ChatGPT linked in 7 of 20.
Linking is one measure. Whether the fabricated detail actually showed up in the answer text is another, and a more telling one. Grok’s answers included a planted detail 53% of the time. ChatGPT’s did 10% of the time.
Google AI’s did 6% of the time. Perplexity never repeated a planted detail, even though it linked to the source fairly often.
Across all 10 tools and all three topics, 176 of 1,004 total answers linked to the researchers’ posts within the week. Perplexity cited the planted opinion post in 11.4% of its answers on that topic. None of the four English-web tools cited the fictional keyboard within the seven-day window, which suggests product-style claims may be a harder sell than a vague technical-sounding concept.
Why placement mattered more than volume
The most useful finding, for anyone tracking AI search citation manipulation as a GEO risk, is what happened when the researchers varied placement. Instead of posting more, they changed where the content went.
They tested five obscure vacation destinations, publishing matched posts on both frequently-cited sites and a rarely-cited, self-hosted WordPress site. The posts on frequently-cited platforms always picked up the first citation or planted detail. The posts on the low-authority WordPress site, even with 20 and then 40 posts pushed live, got zero references within seven days.
A separate test on Sohu, a Chinese platform the tools already cited often, found that citations did rise with more posts. Across six fictional subjects, posting between 1 and 20 times pushed total citations from 24 up to 128. ChatGPT never cited any of these Sohu posts, for what it’s worth. The authors are careful to call this an association rather than a proven cause, since more posts and more time online move together.
My take: this lines up with what most of us already assume about AI search, that the tools lean on a small set of trusted domains. It is still useful to see it measured directly. If you’re assessing where AI search citation manipulation could realistically hit your industry, look at which handful of sites keep showing up in AI answers for your topics. Don’t worry about how much content anyone could pump into the open web generally.
The $14 GEO package that got cited in an hour
The researchers also ran a cheaper, more realistic test of how this plays out commercially. They bought a $14 Chinese web-posting package, the kind marketed as a GEO service, to see how cheap this version of AI search citation manipulation could get. It delivered 13 public posts in about 28 minutes. One of those posts, carrying the researchers’ planted markers, showed up with a fabricated detail in a Doubao answer within an hour.
This is presented in the paper as a single confirmed case, not a success rate, and I’d treat it the same way. It is not proof that cheap GEO packages reliably game every AI tool. It is proof that the path exists, it is commercially available right now, and at least one platform fell for it fast.
In a follow-up round, the team posted once each on Sohu, YouTube, and CSDN for 10 new fictional topics. At least one citation or planted detail showed up for 9 of those 10 topics, somewhere across the 10 tools tested. That is a higher hit rate than the original three-topic test, though the sample is still small and the topics were still fictional.
Where this sits next to Google’s spam policy
Google has already addressed this territory, separately from the study. Its AI optimization guidance says chasing inauthentic “mentions” of a brand “isn’t as helpful as it might seem,” a fairly direct warning to anyone buying that kind of placement.
More concretely, Google clarified on May 15, 2026, that its spam policies for Google Search cover attempts to manipulate generative AI responses, not just traditional rankings. The Fudan University tests ran in March and April, before that clarification, so the paper itself doesn’t speak to how Google has enforced the policy since.
But the timing matters for anyone reading this now. Trying to force AI citations through fake or thin content on high-authority platforms carries explicit policy risk with Google now. It also risks a reputational mess if the content gets traced back to you.
The researchers disclosed their methodology and findings to all 10 platforms before and after publication. ChatGPT, Perplexity, and Google AI acknowledged receiving the disclosure, according to the paper.
What AI search citation manipulation means for your brand
This study didn’t test real brands or products, and the authors say so plainly. Nothing here proves that a competitor can reliably use AI search citation manipulation to plant false claims about your company. What it does show is that the mechanism is real and cheap enough to try.
Three practical risks follow from that. First, false or outdated information about your brand could get picked up from a low-quality third-party post, not from anything you published. Second, a competitor or a disgruntled party has an inexpensive route to attempt the same thing against you, even if the hit rate is inconsistent. Third, GEO vendors selling “guaranteed AI mentions” through mass posting on open platforms are selling something closer to this study’s volume test than to durable, policy-safe visibility.
None of that means AI search citation manipulation is happening to your brand right now. It means the attack surface exists, and ignoring it because the research used fake topics instead of real companies would be the wrong lesson to take.
What to do about AI search citation manipulation this week
I’d start with monitoring, not defense. You can’t fix what you can’t see.
- Run your own brand name, product names, and key claims through ChatGPT, Perplexity, Google AI Mode, and Grok monthly, and note which sources each tool cites.
- Flag any cited source you don’t recognize or control, especially ones that platform doesn’t normally cite, and check whether the content about you there is accurate.
- If you find fabricated or outdated claims tied to your brand, request a correction or removal from the hosting platform. Then resubmit your own accurate, well-sourced content to the same high-authority domains the AI tools already trust.
- Treat any GEO vendor pitch built mainly around volume publishing on open platforms with skepticism. Ask what happens to that content under Google’s spam policy for generative AI responses, and ask for a sample of citations they’ve actually produced, not promised.
- Keep your own first-party pages (your site, your documentation, your verified profiles) complete and current, since that’s the content you’d rather have an AI tool surface first.
None of this is about gaming the system faster than the next person. It’s about making sure the version of your brand that shows up in an AI answer is the one you’d actually recognize.
FAQ: AI search citation manipulation
Is AI search citation manipulation illegal?
Not inherently. Publishing content, even promotional content, isn’t illegal. But using it to manipulate generative AI responses now falls under Google’s spam policies for Search. That carries site-level risk like demotion or removal from Google’s index, separate from any legal question.
Which AI tools are most vulnerable to this kind of manipulation?
In this one study, Grok linked to the planted content most often and repeated fabricated details most often. Perplexity linked less often and never repeated a fabricated detail. Google AI and ChatGPT fell in between.
That’s one test with three fictional topics. I wouldn’t treat it as a permanent ranking of which tool is “safest.”
Can a competitor really plant fake claims about my company in AI answers?
The study suggests the mechanism works for invented concepts and products. It did not test real brands, so there’s no direct evidence it works the same way against an established company with its own strong first-party presence. Treat it as a real but unproven risk, not a confirmed attack you should panic about.
Does blocking AI crawlers protect against this?
No, and that’s a separate issue. This kind of manipulation works by publishing on third-party sites the AI tools already trust, not by crawling your own site. Our look at llms.txt and AI crawler data covers why crawler-side controls don’t address content published elsewhere about your brand.
How is this different from rank-tracking data manipulation?
Related, but not the same problem. Rank tracking tools can be fed misleading data too, which we covered in our piece on checking for poisoned SERP data. This study is about what the AI tools themselves cite and repeat, not about what your analytics dashboard reports back to you.
Why This Matters
This is early, limited research using invented topics, not a verdict on how often brands get targeted this way in practice. But it’s independently measured evidence that a cheap, fast path into AI citations exists, and that Google now treats this kind of manipulation as a policy violation.
The fix on your side starts with simply checking what these tools already say about you. Run that check this month if you haven’t. Treat any GEO offer promising guaranteed AI mentions through mass publishing as a flag to ask more questions, not a shortcut to take.
Leave a response