安德森角
五个可能的后门进入 LLM 搜索结果
在 Google 上的首选来源中添加 Unite.AI
随着搜索引擎结果中传统流量的下滑，由于AI摘要的新趋势，各级出版商现在都在寻求在大语言模型的注意中占据突出位置，这些模型可以直接在ChatGPT等流行前沿模型中提供网络搜索AI摘要。
根据诸如优化基因引擎的能见度和如何对AI搜索进行定位等先前的著作，合法方法包括确保独立的编辑报道；出版权威和结构完善的内容；提供机器可读产品信息；以及为不同语言和市场修改材料。
最近引起人们注意的替代方法类似于前几十年的黑帽子SEO做法：这些方法包括：在Reddit上进行天文活动，在Reddit上植入表面上独立的建议，以影响AI搜索结果；记忆中毒，其中欺骗性链接试图让助手们保留宣传声称作为可信赖的信息；提示词注入，其中隐藏的网站指示试图影响AI助手的建议，而不仅仅是为它提供总结的信息。
地球同步轨道操纵的一个特别有创意的例子是，在ETH Zürich的研究人员创建了一个虚构的照相机，并出版了一个宣传网页，其中包含一个隐蔽的指令，用微小的白色文本制作，指示Microsoft的Bing Copilot专门推荐照相机。 细小的字体大小和低对比度是为了掩盖操纵。
在受控测试中，假相机的推荐率从34%上升到59.4%，略高于真实的Nikon和富士胶卷相机所达到的57.9%，这表明嵌入在检索网页中的恶意指令确实会影响AI的建议。
黑帽GEO是一个活跃且资金充足的非法研究领域，包括营销行业及其他各部门
因此让我们看看一些可能或新出现的途径：
1：存档奇卡内里
互联网档案馆是环绕最详尽和最有用的网络资源之一，它的Wayback Machine在2025年通过了一三亿页的里程碑。 在本报告撰写时，共有47 381 733份PDF文件被储存并向公众提供：
从上面的例子可以看出，上传的许多PDF是相当有行人性的，从1950-90年代的晦涩的音乐传单；到稀有的、令人着迷的杂志和书本丢失给后代；到1970年代和80年代的市政议会的会议记录，甚至更多。
这一时期，这种收集正在被不加区别地敲打，显然的罪魁祸首是一群渴望获得新数据，或希望获得更好或确凿的数据版本的AI刮刀机器人。
显然，修改上传的文件以支持虚假陈述、虚假产品、对人的虚假提及(口头或诽谤)、关于同一内容的虚假陈述等，是一个无关紧要的问题。
此类材料可以注入LLMs视为 " 权威 " 来源的产出，如受人尊重的杂志的PDF，这些杂志恰巧没有在IA的收藏中完全索引；在这种情况下，" 权威 " 版将被视为合法 " 填补漏洞 "。
文本样式可以由AI本身模拟，以匹配短文章甚至标题的现有风格，PDF的日期也经过了修改，再加上其他许多小把戏，使文档看起来(例如)是1990年代或更早的档案中发现的东西：
在这类情况下，人们必须做的，似乎是等待AI刮刮机机机员收集信息。 现在还不能确定数据集中的任何过滤器或检查系统能够在多大程度上捕捉到这种非法修正；然而，这种数据集的规模如此之大，以致于普遍禁止这种特殊程度的监督。 在如此庞大的体积中，一个基本上是 " 信任数据 "。
2：合成共识网络
或者，如果你已经老到可以记住它们，现代的“网络” — — 早期互联网的互联网站，比Google的PageRank和Moz的域名管理局更早，后者重视入境链接的数量和质量。
然而，合成共识网络更进一步，在据称不相关的网站中制造明显的独立佐证。 香港中文大学和EPFL最近的一项研究概括地说明了该论文研究者对15类225种产品的12种AI模型进行测试的原则，用虚构的替代品取代检索结果中的真实品牌参考。
随着更多的结果包含同样的虚假信息，效果就更加明显。 主要结果有3页被操纵，最脆弱的模型在73.8%的测试中建议不存在产品。 即使是单一的腐败第一结果也会在27%的案件中误导某些模型。
更为显著的是，这些模型有时会发明自己的佐证：在一次涉及虚构的屏幕保护品牌的测试中，Claude和DeepSeek加入了关于社区建议和产品测试的声称，这些测试没有出现在所提供的材料中。
虽然试验是根据当地修改的搜索结果进行的，而不是由欺诈性网站组成的现场网络，但试验表明，协调收集表面上独立的审查可如何产生可信度，而大赦国际则通过更多的认可来加强不真实性。
3：引文生成和 " 孤儿 " 声称
引用生成(可以说，" 引用洗钱 " )是对合成共识网络的一种变异，但更强调信息的明显来源，而不是重复的信息来源的数量。
捏造的说法可能首先出现在一份模糊的贸易期刊、一份自发发表的研究论文或一份专家出版物中，几乎没有编辑监督。 博客、目录和其他出版物都可以引用
最终，AI搜索引擎可能会遇到从其原始来源中移除的几个步骤，或许是在一篇引证中间出版物的有声望的文章中；而最初作为无根据的断言现在有引证历史 — — 尽管后来的引用都不构成独立核查。
这一过程已经有几个有文献记载的例子，尽管大多数在AI搜索出现之前。 在一桩臭名昭著的案件中，一名青少年发明了外衣的绰号“巴西的苦艾酒”，并将其插入维基百科。
发明的名称传播到报纸和至少一本学术书籍。 最终，维基百科本身引用了一篇报纸文章作为证据，证明它最初拥有的推出——一个几乎完美无缺的权威圈子。 该集被"纽约客"(The New Yorker)所记录。
2025年出现了一个更刻意的演示，当时研究人员创作了多个AI生成的学术论文，归功于一个不存在的科学家。 捏造的出版物在Google Scholar上累计了380个引用和19个h指数，使虚构的研究人员获得了显然值得尊敬的学术地位。 该实验发表在《自然科学报告》中，说明在没有任何相应的真正研究的情况下如何制造引用数。
这两起案件都表明对AI搜索引擎的攻击是成功的。 然而，两者都确定了基本弱点，即一旦一个显然可信的来源重复了虚假的说法，随后的系统就可能难以区分独立确证与一次捏造的反复流通。 AI搜索面临的特别危险是，一个模型可以将这一连串的参考材料概括为佐证证据，而不承认所有明显的当局都会导致同样的未经核实的说法。
4：权力接管
过期域可以保持其前所有者的明显可信度、输入链接和可视性。 获取这些地址并添加新的材料，可以使最近-推出声称似乎来源于既定的出版物，这种做法可追溯到20-30年。 过期/被弃域的域权往往是收购，以便将其内容改造为 " 相关 " 但商业化的材料。
2024年，2018年关闭的有影响力的女性博客"The Hairpin"作为AI生成的内容农场在新所有权下重新出现，其原创文章与重写材料和虚构的作者旁线混为一谈，利用了曾经受到尊重的出版物的声誉和域名权威。 虽然这不是一次明显的AI搜索攻击，但该案说明了如何可以侵占一个既定网站的历史。
虽然存档的快照可以帮助揭示一个域的真实过去与其新制造的内容之间的区别，但即使这种证据也不一定是永久性的：2002年，互联网档案馆删除了在该组织的律师提出版权投诉后批评科学学的网站的快照，最初暗示这些删除是网站所有者自己要求的。
直到2017年，Wayback Machine追溯应用网站排除规则，有可能允许新域主隐藏其前任的内容。 虽然这种做法已经停止，但互联网档案馆仍然考虑删除历史快照的请求。
5：利用学术文献库
学术资料库为获得明显权威提供了另一种途径。 预印服务器允许研究人员在同行评审前发表论文，而搜索引擎和AI检索系统可能与既定科学文献同时遇到这些文件。
问题在于出版与核实并不相同：在2024年，研究人员展示了学术论文中嵌入的恶意指令如何可以操纵处理这些文件的AI助手。 他们的研究表明，研究论文的明显合法性并不妨碍其内容被用于影响AI系统。
不太明显的对地观测分布式观测方法将涉及存有可信但微不足道的研究，这些研究反复将具有特殊专门知识的公司、产品或个人联系起来。 即使没有向大赦国际发出明确指示，这种材料显然可以为来自受益人的声称提供学术支持。
结论
其他可能的途径包括审查生态系统的渗透情况(对比较网站和软件目录进行有利的评估)；对知识图表进行篡改(改变结构化数据，在公司、产品和专门知识之间建立误导性联系)；以及多语种的名誉清洗(将宣传声称放在审查较少的外语来源中)。
最后，代理GEO优化可以使这些技术自动化(重复对AI搜索引擎进行内容测试，并改进任何变化产生所希望的建议)。
2026年10月12日星期一首次出版。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anderson's Angle
Five Possible Back-Doors into LLM Search Results
Add Unite.AI to your preferred sources on Google
With the plunge in traditional traffic from search engine results, due to the new trend for AI summaries, publishers at all levels are now seeking to gain prominence in the attention of the Large Language Models that power web-search AI summaries, and directly, in popular frontier models such as ChatGPT.
Legitimate approaches, according to prior works such as Optimizing Visibility in Generative Engines and How to Dominate AI Search, include securing independent editorial coverage; publishing authoritative and well-structured content; providing machine-readable product information; and adapting material for different languages and markets.
Alternative methods that have recently attracted attention resemble the black-hat SEO practices of earlier decades: these include astroturfing on Reddit, where ostensibly independent recommendations were planted to influence AI search results; memory poisoning, in which deceptive links attempted to make assistants retain promotional claims as trusted information; and prompt injection, where hidden website instructions sought to influence an AI assistant’s recommendations, rather than merely provide information for it to summarize.
One particularly ingenious example of GEO manipulation was when researchers at ETH Zürich created a fictitious camera and published a promotional webpage containing a concealed instruction, rendered in tiny white text, directing Microsoft’s Bing Copilot to recommend the camera exclusively. The tiny font size and low contrast was designed to conceal the manipulation.
In controlled tests, the fake camera’s recommendation rate rose from 34% to 59.4%, slightly exceeding the 57.9% achieved by genuine Nikon and Fuji-film cameras, demonstrating that malicious instructions embedded in retrieved webpages could indeed influence AI recommendations.
With the stakes so high, it’s reasonable to assume that Black Hat GEO is an active and well-funded illicit strand of research across marketing industries and various other sectors looking to gain or restore their former SEO prominence by gaining recommendations from AI oracles and chat engines.
Therefore let’s take a look at some of the possible or emerging avenues:
1: Archive Chicanery
The Internet Archive is one of the most exhaustive and useful network resources around, with its Wayback Machine passing the one-trillion-page milestone in 2025. At the time of writing the IA reports a phenomenal 47,381,733 PDF documents stored and available to the public:
As can be seen from the example results above, many of the PDFs uploaded are quite pedestrian in nature, from obscure music fliers from the 1950s-90s; to rare and fascinating magazines and books thought lost to posterity; to mind-numbing tranches of meeting minutes from municipal assemblies in the 1970s and 80s; and much more.
This collection is being indiscriminately hammered in this period, and the obvious culprit is a horde of AI scraper-bots desperate for novel data, or for better or corroborating versions of data they already have.
Clearly it is a trivial matter to amend an uploaded document to support a false statement, false products, false references to people (laudatory or defamatory), false statements about the same, etc.
Such material can be injected into outputs considered ‘authority’ sources by LLMs, such as PDFs of well-respected magazines that happen not to be fully indexed yet in the IA’s collection; in such a case, the ‘doctored’ edition would be seen as ‘filling a hole’, legitimately.
Text style could be simulated by AI itself to match the existing style of a short article or even a caption, and the PDF’s date amended, along with multiple other trivial tricks to make the document appear to be (for instance) something found in an archive from the 1990s – or earlier:
All one has to do in such cases, it would seem, is wait for the information to be picked up by the avid AI scraper-bots. It’s still too early to know for sure the extent to which any filters or checking systems in dataset curation could catch such illicit amendments; however the scale of such datasets is so enormous as to generally prohibit that particular degree of oversight. At this enormity of volume, one is essentially ‘trusting the data’.
2: Synthetic Consensus Networks
Or, if you’re old enough to remember them, a modern ‘webring’ – the interconnected sites of the early internet, predating Google’s PageRank and Moz’s Domain Authority, which valued the number and quality of inbound links.
However, Synthetic Consensus Networks go further, manufacturing apparent independent corroboration across supposedly unrelated websites. A recent study from the Chinese University of Hong Kong and EPFL broadly demonstrated the principle when the paper’s researchers tested 12 AI models against 225 products in 15 categories, replacing genuine brand references in retrieved search results with fictitious alternatives.
The effect increased as more results carried the same false information. With three manipulated pages among the leading results, the most vulnerable model recommended nonexistent products in 73.8% of tests. Even a single corrupted first-place result could mislead some models in 27% of cases.
More remarkably, the models sometimes invented corroboration of their own: in one test involving a fictitious screen-protector brand, Claude and DeepSeek added claims about community recommendations and product testing that did not appear in the supplied material.
Though the experiment was conducted on locally-modified search results, rather than a live network of fraudulent websites, it suggests how a coordinated collection of ostensibly independent reviews could manufacture credibility, with AI reinforcing the untruth with additional endorsements.
3: Citation Generation and ‘Orphaned’ Claims
Citation generation (arguably, ‘citation laundering’) is a variation on synthetic consensus networks, but with greater emphasis on the apparent provenance of information rather than on the number of sources repeating it.
A fabricated claim might first appear in an obscure trade journal; a self-published research paper; or a specialist publication, with little editorial oversight. It can then be cited by blogs, directories and other publications – and each repetition gives the original assertion a little more apparent legitimacy.
Eventually, an AI search engine may encounter the claim several steps removed from its original source, perhaps in an otherwise reputable article that cites an intermediary publication; and what began as an unsupported assertion now has a citation history – even though none of the subsequent references constitutes independent verification.
There are already several documented examples of this process, though most predate the emergence of AI search. In one notorious case, a teenager invented the nickname ‘Brazilian aardvark’ for the coati, and inserted it into Wikipedia.
The invented name propagated to newspapers and at least one academic book. Eventually, Wikipedia itself cited a newspaper article as evidence for the claim it had originally introduced – a near-perfect circle of fabricated authority. The episode was documented by The New Yorker.
A more deliberate demonstration emerged in 2025, when researchers created multiple AI-generated academic papers attributed to a nonexistent scientist. The fabricated publications accumulated 380 citations and an h-index of 19 on Google Scholar, giving the fictional researcher an apparently respectable academic standing. The experiment, published in Nature’s Scientific Reports, illustrates how citation counts can be manufactured without any corresponding body of genuine research.
Neither case demonstrates a successful attack on an AI search engine. However, both establish the underlying weakness, in that once a false assertion has been reproduced by apparently credible sources, subsequent systems may have difficulty distinguishing independent corroboration from the repeated circulation of a single fabrication. The particular danger for AI search is that a model may summarize this chain of references as corroborating evidence, without recognizing that all the apparent authorities lead back to the same unverified claim.
4: Authority Takeovers
Expired domains can retain the apparent credibility, inbound links and search visibility of their former owners. Acquiring these addresses and populating them with new material can make recently-introduced claims appear to originate from established publications – a practice that goes back 20-30 years. The domain authority of an expired/abandoned domain is often acquired in order for its content to be revamped into ‘related’ but commercialized material.
In 2024, the influential women’s blog The Hairpin, which had closed in 2018, reappeared under new ownership as an AI-generated content farm, with its original articles intermingled with rewritten material and fictitious author bylines, exploiting the reputation and domain authority of a once-respected publication. While this is not a demonstrated AI-search attack, the case illustrates how an established website’s history can be appropriated.
Although archived snapshots can help expose the difference between a domain’s genuine past and its newly-manufactured content, even this kind of evidence is not necessarily permanent: In 2002, the Internet Archive removed snapshots of websites critical of Scientology following copyright complaints from the organization’s lawyers, initially suggesting that the removals had been requested by the website owners themselves.
Until 2017, the Wayback Machine applied website exclusion rules retroactively, potentially allowing new domain owners to conceal their predecessors’ content. Although this practice was discontinued, the Internet Archive still considers requests to remove historical snapshots.
5: Academic repository exploitation
Academic repositories offer another route to apparent authority. Preprint servers allow researchers to publish papers before peer review, while search engines and AI retrieval systems may encounter these documents alongside established scientific literature.
The problem is that publication and verification are not the same thing: in 2024, researchers demonstrated how malicious instructions embedded in academic papers could manipulate AI assistants processing those documents. Their work showed that the apparent legitimacy of a research paper does not prevent its contents from being used to influence an AI system.
A less conspicuous GEO approach would involve depositing plausible but marginal research that repeatedly associates a company, product or individual with particular expertise. Even without explicit instructions to an AI, such material could provide apparently scholarly support for claims that originated with the beneficiary.
Conclusion
Other potential avenues include review ecosystem infiltration (planting favorable assessments on comparison sites and software directories); knowledge graph manipulation (altering structured data to establish misleading associations between companies, products and expertise); and multilingual reputation laundering (placing promotional claims in less-scrutinized foreign-language sources).
Finally, agentic GEO optimization could automate these techniques (repeatedly testing content against AI search engines and refining whichever variations produce the desired recommendations).
First published Monday, October 12, 2026
Auto-fetched and translated by AI Atlas. All rights belong to the original author.