Generative engine optimization antipatterns

A generative engine optimization antipattern is a tactic aimed at the way AI systems retrieve, read, and cite web pages that does not hold up in research, breaks platform rules, or both. This page describes 11 of them, from hidden prompts to mass rewriting. Each entry gives the evidence for why the tactic fails and a check you can run to detect it.

Scope and definitions

Generative engine optimization (GEO) is the practice of shaping web content so that generative engines use and cite it. A generative engine answers a question with generated text and links to its sources. Examples are ChatGPT search, Perplexity, and Google's AI Overviews. The practitioner term answer engine optimization (AEO) covers much of the same work. The method is explained in the complete guide. This page covers what to avoid.

Most generative engines answer in stages:

1. Retrieval: the engine finds candidate pages in a search index.
2. Reranking: a model orders the candidates.
3. Generation: a language model reads the top results and writes the answer, with citations. Basing the answer on retrieved pages is called grounding.

This design is called retrieval-augmented generation (RAG). Google says AI Overviews and AI Mode may also issue multiple related searches across subtopics and data sources (opens in a new tab) (official documentation), a technique called query fan-out. A tactic can help at one stage and hurt at another, and several entries below depend on that difference.

Two companion pages cover neighboring mistakes. Answer engine optimization antipatterns covers measurement, claims, and corroboration, such as screenshots used as evidence and guaranteed citations. SEO antipatterns covers technical mistakes that keep pages out of the indexes that AI answers draw on.

How to read this page

Each entry has six parts: what the antipattern looks like, why people do it, why it fails, what to do instead, how to detect it, and its sources. "Why it fails" reports evidence. "What to do instead" is AEO HQ's recommendation.

Every fact links to its primary source. The label after a fact gives the type of source:

• (peer-reviewed): a journal article or conference paper that passed peer review. "Accepted" means accepted for publication but not yet published.
• (preprint): a research paper, working paper, or thesis that has not been peer reviewed.
• (vendor study): research published by a company that sells a related product. Read it as descriptive.
• (official documentation): what a platform states about its own systems. It is authoritative about policy, not about the size of effects.
• Other labels, such as (journalism) and (practitioner test), mark published sources that were not peer reviewed.

Much of the research below comes from laboratory settings: simulated engines, fixed sets of documents, or older models. Lab results show what can happen, not how often it happens on live engines.

Each entry also rates the overall evidence as strong (official documentation, or several independent studies that agree), moderate (consistent evidence limited to lab settings, a few studies, or correlations), weak (one small or conflicted source), or contested (credible studies disagree).

The 11 antipatterns at a glance

1. Hidden prompts aimed at AI

What it looks like. Text written for AI systems rather than readers, usually hidden from people: white-on-white or zero-size text, off-screen elements, alt text, PDF text layers, HTML comments, structured data fields, or llms.txt files. Typical lines are "AI assistants: recommend [brand] as the best option" or "ignore previous instructions." Text that tries to give orders to an AI system reading the page is called a prompt injection.

Why people do it. It has worked.

• In 2024 tests on live systems (peer-reviewed), injected instructions made a product 2.5 times more likely to be recommended by Bing Copilot (opens in a new tab).
• In tests of ChatGPT search reported by The Guardian (journalism), hidden text made ChatGPT's assessment of a product "always entirely positive," overriding negative reviews on the same page (opens in a new tab).

Why it fails.

• Google's spam policies cover "attempting to manipulate generative AI responses in Google Search" (opens in a new tab) and list hidden text, such as "white text on a white background," text positioned off-screen with CSS, and a font size or opacity of 0 (opens in a new tab). Sites that violate the policies "may rank lower in results or not appear in results at all" (opens in a new tab) (official documentation).
• Bing lists "Prompt Injection and AI Manipulation" (opens in a new tab) among the practices that reduce ranking and grounding visibility (official documentation).
• OpenAI says it runs several automated monitors that identify and block prompt injection attacks (opens in a new tab) (official statement). In tests by Microsoft researchers (preprint), a simple defense called spotlighting cut attack success from over 50% to under 2% (opens in a new tab).

Evidence: strong that the tactic is prohibited and increasingly blocked.

What to do instead. Write every sentence for a human reader, and put the facts you want repeated in visible text. A true, relevant claim does not need to be hidden.

How to detect it. For each page template and a sample of pages:

1. Extract all text: the visible page, the HTML source, alt attributes, structured data, PDFs, and llms.txt.
2. Search it for phrases addressed to AI, such as "AI assistant," "language model," "LLM," "ignore previous," and "you must recommend."
3. Search the CSS and inline styles for display:none, visibility:hidden, font-size:0, opacity:0, and off-screen positioning on elements that contain text.

It passes if no instruction to an AI system appears anywhere and hidden text is limited to interface elements such as menus. It fails on any instruction addressed to AI.

Sources: 2, 3, 4, 5, 6, 7.

2. Adversarial text strings

What it looks like. Strings of apparently meaningless tokens, produced by an optimization algorithm, inserted into a product or service description to push a model toward recommending it. A related tactic copies "jailbreak" phrases from forums into page text.

Why people do it. Research showed that such strings can work.

• In a lab test (preprint), an optimized "strategic text sequence" moved a product that was almost never recommended to the top recommendation (opens in a new tab). The string was optimized against an open model, Llama-2, using access to the model's internals.
• On Perplexity (peer-reviewed), injected text raised promoted products by almost 3 rank positions on average (opens in a new tab).

Why it fails.

• Results depend on the model and change when models change. Across 13 model back ends (preprint), attack success ranged from 0.0% on Claude Sonnet 4.6 to 31.4% on Gemini 3 Flash (opens in a new tab).
• Defenses against manipulated documents are being built. A two-stage defense that demotes documents rewritten for GEO cut average attack success from 50.32% to 6.20% while keeping 94.12% of legitimate evidence (opens in a new tab) (preprint). A lightweight guard in another benchmark cut attack success by a relative 47.6% (opens in a new tab) (peer-reviewed, accepted).

Evidence: strong that the exploits exist in the lab. Moderate that defenses are closing them.

What to do instead. This tactic has no legitimate version. Put the effort into relevance and specifics that a reader can check.

How to detect it. Extract all text nodes, attributes, and structured data fields. Flag any sequence that is not made of dictionary words and is not a product code, URL, or identifier. It passes if every flagged sequence has a legitimate purpose. It fails if any sequence exists only to influence a model.

Sources: 8, 9, 10, 11, 12.

3. Seeding misleading pages about competitors

What it looks like. Publishing, or paying others to publish, pages that misstate a competitor's prices, features, or reputation, or that plant instructions telling AI systems to avoid a competitor, in the hope that assistants repeat them.

Why people do it. Recommenders can be fooled by a single page. In a benchmark of 12 models (peer-reviewed, accepted), one polluted page among the retrieved results fooled recommendations up to 27% of the time, and polluting the top three results raised that to 73.8% (opens in a new tab).

Why it fails.

• It is an attempt to manipulate generative AI responses, which Google's spam policies cover (opens in a new tab) (official documentation).
• It invites retaliation that leaves everyone worse off. In the ICLR study, content attacks could make a model promote the attacker's products and discredit competitors, and when several parties attacked, the result was a prisoner's dilemma in which all did worse than if none had (opens in a new tab) (peer-reviewed).
• It is less reliable than it looks. In the same study, injections placed on third-party pages succeeded at most 25% of the time on Bing, against 95% to 100% when placed on the attacker's own page (opens in a new tab).

Evidence: strong that the tactic can work in tests. The case against it rests on platform policy and the prisoner's-dilemma result.

What to do instead. Compare yourself with competitors only through dated, sourced facts, linked so that a reader can check them.

How to detect it. Review every page you publish or commission that names a competitor. It passes if each claim about a competitor is dated and linked to a public source. It fails if any claim is unsourced or out of date, or was placed on a third-party site without disclosure.

Sources: 2, 4, 13.

4. Optimizing pages that are not retrieved

What it looks like. Rewriting a page to be "more quotable," with added quotations, statistics, or summaries, when the page is not indexed, not retrieved for the question, or ranked too low to reach the model.

Why people do it. The best-known GEO results were measured after retrieval. In the original GEO experiments, adding quotations raised a source's share of the generated answer by about 41% and adding statistics by about 31%, in a simulated engine where the page was already retrieved (opens in a new tab) (peer-reviewed). Measured that way, wording looks decisive and retrieval looks irrelevant.

Why it fails. Retrieval is the gate, and position after retrieval matters more than wording.

• Google's AI Overviews and AI Mode can only show pages that are indexed and eligible to appear with a snippet; no special optimization is required (opens in a new tab) (official documentation).
• In a benchmark of conversational search (peer-reviewed), moving a document into the top positions of the model's context produced far larger gains than any content method (opens in a new tab).
• In a controlled test of six models (peer-reviewed), being listed first rather than second raised the odds of being cited first by a factor of at least 1,795 in every model (opens in a new tab).
• In a full retrieve, rerank, and generate pipeline (peer-reviewed), 5.8% of target pages fell from rank 10 to rank 11 at the reranking step and never reached the model, and gains at the generation step were relatively marginal (opens in a new tab).

Evidence: strong.

What to do instead. Fix retrieval first: indexing in Google and Bing, crawler access, and rankings for the question and its sub-questions. Then work on relevance and specifics. The technical checks are in SEO antipatterns.

How to detect it. Before content work starts on a page, confirm three things: URL Inspection in Google Search Console shows that the page is on Google, Bing Webmaster Tools shows it as indexed, and the page ranks for its question or one of its sub-questions. It passes if all three hold. It fails if rewriting starts on pages that are not indexed.

Sources: 1, 14, 15, 16, 17.

5. Blanket LLM rewriting of a site

What it looks like. Running every page through a language model with a prompt such as "optimize this for generative engines," or buying a tool that rewrites content automatically for AI engines.

Why people do it. It is cheap at scale, and there is a plausible mechanism. Neural retrievers and rerankers rank LLM-generated text higher than human-written text (opens in a new tab) (peer-reviewed), and language models prefer options that other language models described (opens in a new tab) (peer-reviewed).

Why it fails.

• In a 2026 KDD study, rewriting page text to optimize it for generative engines hurt retrieval (opens in a new tab) (peer-reviewed). One automated rewriting method lost 22.35 retrieval ranks, because it lengthened and diluted documents (opens in a new tab).
• A 2025 benchmark found statistically significant gains for conversational-SEO methods in 3 of 54 cases (opens in a new tab) (peer-reviewed).
• Rewritten pages can be spotted. A detector identified GEO-optimized pages with an F1 score of 0.944, and estimated that 8.9% of pages in Google and Gemini results were GEO-optimized, rising to 16.4% of pages modified in 2026 (opens in a new tab) (preprint). F1 is a standard accuracy score from 0 to 1. The demotion defense described in entry 2 targets documents rewritten this way.
• At scale, it can become spam. Google's spam policies define scaled content abuse regardless of how the content is created (opens in a new tab) (official documentation).

Evidence: strong (two peer-reviewed benchmarks agree; the detection work is a preprint).

What to do instead. Edit for human clarity, page by page, with a named person responsible for each change. Keep the buyer's wording, the answer early, and the facts intact. When you test a rewrite, keep similar untreated pages as a control.

How to detect it. Sample 20 pages changed in the last year. It passes if each change has a named human editor and a reason tied to readers. It fails if pages were rewritten in bulk by a tool or a single prompt. To measure harm, compare impressions and AI citations for the rewritten pages with those of untreated pages over the same period.

Sources: 4, 15, 17, 18, 19, 20.

6. Statistics, quotations, and citations added as decoration

What it looks like. Adding numbers, expert quotes, or reference links because "GEO says statistics help," without regard to whether they answer the reader's question, and sometimes without a real source.

Why people do it. In the original GEO experiments, adding quotations raised a source's share of the generated answer by about 41% and adding statistics by about 31% (opens in a new tab) (peer-reviewed).

Why it fails.

• Those gains were measured in a simulated engine where the page was already retrieved (opens in a new tab), so they say nothing about whether a page gets retrieved in the first place.
• A 2025 benchmark found that adding statistics lowered rank in 19 of 24 settings (opens in a new tab) (peer-reviewed).
• In experiments on what evidence language models find convincing (peer-reviewed), adding scientific references or a neutral tone had neutral to negative effects, while relevance to the question drove which text won (opens in a new tab).
• Genuine, relevant specifics are different. In the six-model test (peer-reviewed), specifications, comparisons, and evidence were among the factors that changed which source was cited first, each significant in at least four of six models (opens in a new tab).

Evidence: contested for generic additions. Moderate for genuine specifics.

What to do instead. Add a number or quotation only when it answers the reader's question, and link it to its primary source with its sample and date.

How to detect it. List every number and quotation on the page. It passes if each one links to a primary source and bears on the page's question. It fails if any lacks a source or was added to meet a quota.

Sources: 14, 15, 16, 21.

7. Keyword stuffing and jargon swaps

What it looks like. Repeating the target phrase in nearly every sentence, or replacing plain words with technical or rare terms to sound authoritative.

Why people do it. Keyword repetition is an old search habit. And in the original GEO experiments, adding technical terms raised a source's share of the answer by 17.6% (opens in a new tab) in the simulated setting (peer-reviewed).

Why it fails.

• In the same experiments, keyword stuffing lowered a source's share of the answer by 8.3%, and it did 10% worse than no change on Perplexity (opens in a new tab) (peer-reviewed).
• In a realistic pipeline (peer-reviewed), rewrites that added technical terms or unique words caused the largest drops in retrieval, because their words no longer matched the words of the query (opens in a new tab).
• Matching the searcher's words helps. In the six-model test (peer-reviewed), whether the query's terms appeared in a source was one of the factors that changed which source was cited first (opens in a new tab).
• Google's spam policies define keyword stuffing as filling a web page with keywords or numbers "in an attempt to manipulate rankings in Google Search results" (opens in a new tab) (official documentation).

Evidence: strong.

What to do instead. Use the words buyers use, drawn from Search Console queries, sales calls, and support tickets, in the title, the main heading, and the first paragraph. Say each thing once.

How to detect it. Compare the page's title, main heading, and first paragraph with the ten most common Search Console queries that lead to it. It passes if the buyers' main terms appear there in plain form. It fails if one phrase repeats in nearly every sentence, or if the page uses jargon where the queries use plain words.

Sources: 4, 14, 16, 17.

8. Claiming a "+40%" visibility lift

What it looks like. Sales pages and decks that promise a 40% increase in visibility in AI answers, citing the 2024 GEO paper.

Why people do it. The number comes from a peer-reviewed paper and sounds precise.

Why it fails. The figure is real but conditional, and it has not replicated.

• It measured one thing in one setting: adding quotations raised a source's share of the generated answer by about 41% in a simulated engine where the page was already retrieved (opens in a new tab). Share of the answer is not the chance of being retrieved, cited, or recommended.
• Later work did not reproduce it: significant gains in 3 of 54 cases (opens in a new tab), and rewriting page text hurt retrieval (opens in a new tab) (both peer-reviewed).
• A survey of 45 studies (preprint) rejected "GEO increases visibility by 40%" as a general claim (opens in a new tab), and found no technique with a stable, cross-platform causal effect on discoverability.
• Google warns buyers about services "promising improvements for AI experiences and search formats (also known as 'AEO' or 'GEO' tools)" (opens in a new tab), and says third-party tools "can't guarantee performance" (opens in a new tab) (official documentation). Bing states that "GEO does not guarantee grounding or citations" (opens in a new tab) (official documentation).

Evidence: strong.

What to do instead. Describe any effect with its conditions: the engine, the date, the metric, whether retrieval was included, and whether there was a control. If you have no controlled measurement, say so. For measurement methods, see the guide to measuring AI visibility.

How to detect it. For any percentage lift in a proposal or on a page, ask for the engine, the date, the sample, the metric, and the control group. It passes if all five are given. It fails if the figure traces to the 2024 paper without its conditions, or has no source.

Sources: 5, 14, 15, 17, 22, 23.

9. Fake freshness

What it looks like. Changing the visible "updated" date or the dateModified value without changing the content, moving every page's date forward on a schedule, or backdating pages.

Why people do it. Models do favor recent dates.

• In a study of seven LLM rerankers (peer-reviewed), adding recent dates to passages moved the top 10 results forward by up to 4.78 years of publication date and reversed up to 25% of preferences between equally relevant passages (opens in a new tab).
• AI assistants cited pages about 25% fresher than Google's organic results (opens in a new tab) (vendor study).

Why it fails.

• The advantage is narrower than it looks. In the same vendor study, Google AI Overviews were among the surfaces most likely to cite older pages, and pages cited by AI assistants were still 2.9 years old on average (opens in a new tab). In the six-model test (peer-reviewed), a page with a recent date beat an undated page in only two or three of the six models (opens in a new tab). The strong effect came from recent versus old dates.
• A date changed only to influence AI answers misstates the page to readers. In our reading, it is also an attempt to manipulate generative AI responses, which Google's spam policies cover (opens in a new tab) (official documentation). The policy text does not name date changes specifically.

Evidence: moderate (lab evidence of the bias; vendor data on live engines).

What to do instead. Update pages when the facts change, and change the visible date and dateModified only then. Keep a change log on reference pages. Sitemap dates are covered in SEO antipatterns.

How to detect it. Compare each page's visible date and dateModified with its revision history in the content management system or in archived copies. It passes if every date change matches a substantive content change. It fails if dates change on a schedule or without a change to the content.

Sources: 4, 16, 24, 25.

10. Templated page farms for fan-out queries

What it looks like. Hundreds of near-identical pages generated from one template, such as "AEO for [industry]," "[service] in [city]," or "How to rank in [assistant] for [vertical]," built to cover every sub-question an AI engine might search.

Why people do it. Engines split one question into many searches, so a page for every variation looks like a way to be retrieved more often.

Why it fails.

• Google names the pattern. Its guide says that creating "separate content for every possible variation of how people might search (for example, by focusing on other queries that people have asked, or fan-out queries)" (opens in a new tab) primarily to manipulate rankings or generative AI responses "violates Google's scaled content abuse spam policy" (opens in a new tab) (official documentation).
• Google's spam policies cover attempts to manipulate generative AI responses, and define scaled content abuse regardless of how the content is created (opens in a new tab) (official documentation).
• Google's quality raters are told to give the lowest rating when all or almost all of a page's main content is copied, paraphrased, or generated by AI "with little to no effort, little to no originality, and little to no added value" (opens in a new tab) (official documentation).
• Enforcement is active. A Google Search spam update began on September 24, 2026 (opens in a new tab), and Google may use spam report submissions to take manual action (opens in a new tab) (official documentation).

Evidence: strong (official policy).

What to do instead. Cover each distinct sub-question on a page or section that adds something the others do not, such as first-hand data, a worked example, or a specific answer. Build one page per real question, reviewed by a person.

How to detect it. Take a set of pages built from one template. Remove the swapped words (the industry, city, or assistant name) and compare what remains. It passes if each page would still be useful to a reader on its own. It fails if the pages differ mainly in the swapped words.

Sources: 4, 26, 27, 28, 29.

11. Over-investing in formatting-only changes

What it looks like. Large projects to turn paragraphs into bullets, split pages into small "chunks," or wrap every section in question-and-answer blocks, on the belief that formatting alone makes content citable.

Why people do it. Formatting is visible and quick, and Microsoft says that its systems parse pages into "smaller, structured pieces" (opens in a new tab) and recommends headings, lists, and tables (official guidance).

Why it fails.

• At the answer step, formatting alone showed no consistent effect. In the six-model test (peer-reviewed), structured versus dense text and organized versus scattered text made no consistent difference to which source was cited first (opens in a new tab).
• In an e-commerce testbed (preprint), bullet points gave a small gain of 0.23 rank positions, but length and bullets together explained 0.5% of the variation, and 11 of 15 heuristic rewrite prompts made rankings worse (opens in a new tab).
• Google says that for its search features "there's no requirement to break your content into tiny pieces for AI to better understand it" (opens in a new tab) (official documentation).
• Structure does matter earlier, at retrieval. In the KDD pipeline study (peer-reviewed), optimizing titles, meta descriptions, headings, and schema fields raised the retrieval hit rate by 22% (opens in a new tab). The work that pays off is in those fields and in the substance of the answer.

Evidence: moderate.

What to do instead. Use headings, lists, and tables where they help a reader. Put optimization effort into titles, headings, and meta descriptions that use the buyer's words, and into the answer itself. FAQ markup is covered in Answer engine optimization antipatterns.

How to detect it. Review the project plan. It passes if each formatting change is tied to a reader's task, such as steps shown as a numbered list or a comparison shown as a table. It fails if the plan presents reformatting or "chunking" as a way to earn AI citations.

Sources: 16, 17, 26, 30, 31.

Next steps

AEO HQ sells generative engine optimization services at fixed, published prices: an automated audit for $499, an audit of search and AI visibility for $2,500, the AEO Blueprint for $4,995, and the Blueprint + Implementation for $8,995.