Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains

Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains Riku Mochizuki

Shusuke Komatsu

riku-m@keio.jp Keio University/QueryLift Inc. Tokyo, Japan

shusuke.komatsu@querylift.co.jp QueryLift Inc. Tokyo, Japan

Souta Noguchi

Kazuto Ataka

souta.noguchi@querylift.co.jp QueryLift Inc. Tokyo, Japan

ataka@sfc.keio.ac.jp Keio University Tokyo, Japan

arXiv:2608.15814v1 [cs.CR] 16 Aug 2026

Abstract We characterize the attack surface of generative search engines (GSEs) against poisoning attacks in the political domain, from the perspectives of citation selection and personalization. GSEs integrate web search and answer generation with user preferences and backgrounds using large language models (LLMs). They play a crucial role in how users access information on the web. Because anyone can publish content on the web, GSEs are vulnerable to poisoning attacks that manipulate citations to undermine reliable information delivery. Existing studies on citation evaluation focus on how faithfully answers reflect cited content. However, they leave unexamined the two critical aspects to capture the attack surface of GSEs against poisoning attacks: which publishers GSEs prefer to cite, and how personalization affects citation behavior. To fill this gap, we introduce an evaluation framework that characterizes the attack surface of GSEs against poisoning attacks. Our contributions are twofold: (1) we propose a novel metric, content-injection barrier, which quantifies the difficulty of injecting arbitrary content onto the web with a given level of publisher authority; and (2) we reveal how personalization affects citation behavior by embedding user profiles into GSEs. We conduct experiments on three major GSEs in the political domain of the United States and Japan. Our results show that (a) the attack surface differs across GSE models; (b) the web search functionality of GSEs shapes the attack surface; (c) ruling parties have a broader attack surface than opposition parties; and (d) user profiles have little influence on the attack surface.

CCS Concepts • Information systems → Web searching and information discovery; • Security and privacy → Social network security and privacy; • Computing methodologies → Search methodologies.

Keywords generative search engines, web security, information retrieval

1

Introduction

Large language model (LLM) applications such as ChatGPT, Gemini, and Claude increasingly incorporate web search functions, providing internet users with new ways of accessing information [1, 46, 71]. Information retrieval has become a primary use case for LLMs, with a survey showing that about 30% of all prompts

involve information seeking [9]. Such systems that perform web searches and generate textual answers based on users’ needs and backgrounds are known as generative search engines (GSEs) [1]. Web search services are rapidly transitioning from traditional search engines to GSE-based systems [3, 20, 47], changing the way users access and interpret web content. The nature of GSEs, which cite web content published by a wide range of actors, makes them vulnerable to poisoning attacks that inject malicious content onto the web and induce attacker-intended answers [7, 77]. When GSEs generate answers lacking factuality, the cause is not only LLM hallucinations [23, 74] but also the lack of factuality in the web content obtained through web searches [41, 77]. Web content can be published and modified by any user with any intent [7, 77]. Prior studies formalize poisoning attacks that place disinformation and misinformation on the web to generate attackerintended answers in systems that retrieve from external databases and generate answers, including GSEs, because these systems can cite such content and generate text that reflects it [7, 77]. Specific to GSEs, prior studies show patterns in styles of web content that GSEs prefer to cite in answers and propose a method to optimize their own content to increase citation exposure [1, 64]. Although they are beneficial for primary information providers that seek to increase the exposure of their web content as citations, they can also facilitate poisoning attacks. This indicates that systematically evaluating the citation safety of GSEs against poisoning attacks is indispensable. Existing evaluation criteria aim to assess two aspects: (1) how faithfully the cited content is reflected in the answers, and (2) how much the cited content dominates the answers. Several studies evaluate faithfulness by measuring the semantic consistency between the cited web content and the generated answers [12– 14, 17, 31, 37, 53, 66, 70]. Prior studies also evaluate the domination score, which represents the proportion of cited text relative to the total text volume of the generated answer [1, 64]. By combining these metrics, we can measure how much a cited source has the power to influence the answer to a given question. However, these studies alone cannot capture the attack surface of GSEs against poisoning attacks. Faithfulness studies target systems called RAG systems, which retrieve from curated, fixed, and closed external authoritative databases to generate answers. In contrast, GSEs treat the web as an external database that is open to anyone and dynamically updated, allowing attackers to easily inject malicious content

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

that GSEs can cite. Although the domination score is designed for the GSE context, it only measures the degree of influence of the cited content on the generated answer. To reveal the potential attack surface, we need to consider not only the relation between cited content and answers, but also which publishers GSEs cite in those answers. Because of these differences, existing evaluation criteria alone are insufficient to assess the attack surface. Moreover, existing citation evaluation also does not consider the impact of personalization on citation behavior [25, 62]. The LLM applications actively personalize inference to improve user experience [4, 19, 48]. In political domains, a user’s political ideology influences inference in LLMs without web search mode [43, 61]. However, how personalization influences the selection of citations in GSEs remains insufficiently explored. To reveal the attack surface of GSEs under real deployment scenarios, we need to consider the effects of personalization on their citation behavior. To address these gaps, we introduce a novel framework to characterize the potential attack surface of GSEs against poisoning attacks. Our framework classifies each citation of answers by GSEs into content-injection barrier, categorized as low, medium, or high, based on the practical difficulty of publishing content on the web with a given level of publisher authority. In addition, the framework evaluates the faithfulness score and domination score across different content-injection barriers to validate the identified potential attack surfaces in specific scenarios. We conduct experiments on three major GSEs (OpenAI GPT-5, Claude Sonnet 4, and Gemini Flash 2.5 with search mode enabled) in the United States and Japan. We use 33 question templates across 13 parties, 3 user profiles, and 3 GSE models, totaling 3,861 generated answers. To retrieve GSE answers, we set a user profile that varies the user’s level of political knowledge and ideology, and pose political questions to GSEs. This enables systematic analysis of personalization’s effect on citation behavior. Our experiments reveal four findings. First, each GSE has a distinct attack surface: some GSEs concentrate citations on primary information sources and exclude low-barrier sources, while others cite low-barrier sources more frequently. Second, when citations contain few primary sources, web search results tend to include fewer primary sources and more low-barrier sources. This suggests that the web search functionality of GSEs (e.g., query generation by LLMs) shapes the potential attack surface, rather than the LLM’s preference for which sources from web search results to cite. Third, answers to ruling party questions rely more on sources with lower content-injection barriers than answers to opposition party questions, making the ruling side more vulnerable. Lastly, in contrast to biases arising from the LLM’s internal knowledge, user profiles have little influence on the citation barrier pattern, faithfulness, or domination score across content-injection barriers. Our main contributions are as follows:

• We propose an evaluation framework of GSEs to characterize the potential attack surface against poisoning attacks. As a technical contribution, the framework classifies citations of answers by GSEs into content-injection barrier, and evaluates the potential attack surface along three axes: barrier distribution, faithfulness, and domination score.

• We conduct experiments on three major GSEs in the United States and Japan in the political domain, using 33 question templates across 13 parties, 3 user profiles, and 3 GSE models for a total of 3,861 generated answers. • We find that the potential attack surface differs by GSE model and by whether the party in question is in the ruling or opposition position, but not by user profile.

2

Generative Search Engine

This section introduces Generative Search Engine (GSE) and its system model. GSEs are retrieval-and-generation systems that retrieve information from the web and generate synthesized answers with user intent and backgrounds using LLMs [1]. Aggarwal et al. formalize GSEs and provide a system model [1]. 𝑚𝑜𝑑𝑒𝑙 that takes a user question A GSE is formalized as a function 𝑓𝐺𝑆𝐸 𝑞𝑢 and personalization information 𝑃𝑈 as inputs and generates a 𝑚𝑜𝑑𝑒𝑙 := (𝑞 , 𝑃 ) → 𝑟 . textual answer 𝑟 : 𝑓𝐺𝑆𝐸 𝑢 𝑈 GSEs consist of two components: content retrieval and answer generation. Content retrieval collects the information necessary to generate answers from the web. The user query 𝑞𝑢 is converted by LLMs into multiple queries 𝑄 ′ = {𝑞 1, 𝑞 2, · · · , 𝑞𝑛 } for the web search. These queries are sent to a search engine 𝑆𝐸, and GSEs obtain a set of web sources 𝑆 = {𝑠 1, 𝑠 2, · · · , 𝑠𝑚 } from the search results. Each result set in 𝑆 for a web search query 𝑞𝑖 typically consists of the top 𝑘 web sources ranked by the search engine’s metrics [1, 57, 77]. Answer generation cites the web sources obtained in the content retrieval phase and outputs the textual answer 𝑟 . Web sources 𝑆 are converted into a summary set 𝑆𝑢𝑚 = {𝑆𝑢𝑚 1, 𝑆𝑢𝑚 2, · · · , 𝑆𝑢𝑚𝑚 } that extracts and summarizes the content of web sources obtained in the content retrieval phase. LLMs then generate the final answer 𝑟 from the summary set 𝑆𝑢𝑚 while citing web sources 𝑆. The answer 𝑟 consists of 𝑘 sentences {𝑙 1, 𝑙 2, · · · , 𝑙𝑘 }, and each sentence 𝑙𝑖 is associated with a citation set 𝐶𝑖 ⊆ 𝑆, 𝐶𝑖 = {𝑐 1, 𝑐 2, · · · , 𝑐𝑙 }. Although GSEs ideally have one or more citations for each sentence, there are cases where 𝐶𝑖 = ∅, meaning there are no citations for the corresponding sentence. A core technology of GSEs is Retrieval-Augmented Generation (RAG), which retrieves content relevant to the user query from outside of LLMs and incorporates it into LLM inference [15, 28, 33]. Information retrieval systems that use RAG are called RAG systems [40, 65, 68]. However, several studies of RAG systems implicitly focus on systems that retrieve from authoritative, fixed, curated, and closed external databases defined by developers [40, 65, 68]. While GSEs similarly use the web as an external database, the nature of this database differs from that of these RAG systems. The web targeted by GSEs is open, allowing anyone to freely publish information, including malicious content, and is dynamic, with information being updated as needed. Therefore, unlike these RAG systems, GSEs use search engines (SE) for retrieval from the external database (the web). Our study distinguishes GSEs and RAG systems based on the differences in external database characteristics.

Assessing Attack Surfaces in Generative Search Engines

3

Related Work and Motivation

This section introduces poisoning attacks on RAG systems, summarizes key evaluation criteria, and highlights the challenges we identify for GSEs.

3.1

Vulnerabilities of GSEs

We introduce poisoning attacks on GSEs. Zou et al. [77] reveal and formalize an attack method called PoisonedRAG that exploits RAG systems to generate attacker-intended answers by placing malicious content into external databases. Even if attackers can inject a small volume of malicious text into external databases, RAG systems can produce attacker-intended answers for specific questions. This malicious content includes text that attackers want displayed as answers to specific questions, especially false information such as “OpenAI’s CEO is Tim Cook.” PoisonedRAG attacks target closed-ended questions like “Who is the CEO of OpenAI?” rather than open-ended questions like “What are the latest trends in AI?” [77]. In fact, several studies support the effectiveness of this attack. Chen et al. [10] show that in RAG systems, when content containing two different claims (e.g., OpenAI’s CEO is Tim Cook. and OpenAI’s CEO is Sam Altman.) is placed and answers are generated for each claim, the answers may include each respective claim. Wang et al. [63] and Liu et al. [38] demonstrate that even when there is an imbalance in the volume of supporting documents for each claim, RAG systems tend to favor the answer with more supporting evidence, yet the underrepresented claim can still appear in responses. These studies support the effectiveness of PoisonedRAG attacks and demonstrate that RAG may cite malicious content even when attackers place only a small volume of it. To succeed in poisoning attacks, the malicious content must satisfy two conditions: Retrieval Condition and Generation Condition. Retrieval Condition means that malicious content (such as text or HTML placed by attackers) is selected as top-𝑘 relevant content through retrieval tasks for target questions. In GSEs, Retrieval Condition means that content on the web is retrieved as web pages ranked highly in search engine results. Generation Condition means that the content is used in LLM inference and reflected in the generated answers. Aggarwal et al. [1] propose generative engine optimization (GEO), a method that optimizes website text structure and content from the perspective of Generation Condition to increase the exposure of web page content as citations in answers when the website passes the Retrieval Condition. GEO provides theoretical evidence that GSEs are vulnerable to poisoning attacks.

3.2

Citation Evaluation

We first introduce seminal studies that aim to evaluate retrieval-andgeneration systems. These studies evaluate a citation’s influence on the generated answer mainly from two aspects: how much it shapes the answer and how faithfully it is reflected in the answer’s sentences. To evaluate these systems, the key evaluation metrics are faithfulness and domination. Faithfulness measures how accurately the generated answer reflects the content of its citations [12–14, 17, 31, 37, 53, 66, 70]. Faithfulness is typically computed by three methods: entailmentbased [14, 22, 31, 70], similarity-based [67, 72], and QA-based [12].

Similarity-based methods are most appropriate for calculating reflection accuracy. Similarity-based methods quantitatively measure semantic similarity between two texts and rely on neural encoder models. Zhang et al. show that similarity-based methods achieve higher precision than entailment-based and QA-based methods in tasks evaluating consistency between long documents and their summaries [73]. This approach aligns with GSE behavior of summarizing web page content retrieved from search results and generating answers with citations. Citation evaluation applies these faithfulness evaluation methods to each sentence 𝑙𝑖 of generated answer 𝑟 with citations 𝐶𝑖 , and evaluates reflection accuracy for the entire answer 𝑟 . Domination measures the proportion of cited text relative to the total text volume of the generated answer [1, 64]. For each citation 𝐶𝑖 , they count the number of words in the sentences to which 𝐶𝑖 is attached and report this count as a proportion of the total number of words in the generated answer 𝑟 . This is a major metric for evaluating the influence of citations in GSEs. However, they do not assess the authority and trustworthiness of cited content, as they disregard the publisher of those sources. Such content-driven evaluations limit their applicability to GSEs for revealing the potential attack surface of poisoning attacks. In RAG systems, poisoning attack studies focus on how much malicious content attackers need to inject into external databases to succeed in a poisoning attack. In contrast, GSEs retrieve information from the open web, where attackers can inject malicious content more easily than in RAG systems. This ease of injection can enable a successful poisoning attack as previously described. The main concern shifts from preventing malicious content from existing in external databases to preventing the system from incorporating even a small amount of malicious content injected by attackers during web searches. Unlike RAG systems, GSEs operate under the assumption that malicious content is always present in their external databases (the web), and therefore existing evaluation methods alone are insufficient to assess the safety and reliability of GSEs.

3.3

Authority and Trustworthiness

Several studies propose methods to improve the inclusion of authoritative sources in citations generated by RAG systems and GSEs [34, 76]. TrustRAG [76] identifies and removes malicious documents during content retrieval by clustering candidate documents and matching them with the internal knowledge of the LLM. AuthGR [34] computes an authority score for web pages using a vision-language model that evaluates both the textual content of the page and visual features extracted from page screenshots, such as layout quality, design, and advertisement density. The system prefers to cite web pages with high authority scores. However, evaluating only the citation content itself is insufficient for assessing the safety of GSEs under poisoning attacks. As described in Section 3.2, because anyone can publish content on the web, attackers can deliberately optimize the scores of contentbased evaluation metrics while still injecting malicious information into the web. In fact, the “Doppelganger” operation reported by EU DisinfoLab [2, 52] shows that more than 700 fake news websites were created by imitating designs of legitimate media, and their content was distributed while disguised as legitimate media. Such

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

legitimate-looking malicious content undermines approaches that evaluate only the content itself, causing both false negatives and false positives. Therefore, for GSEs, we need to evaluate not only the citation content itself, but also the authority and trustworthiness of content publishers. Furthermore, these methods typically assume the presence of poisoning attacks and primarily focus on developing defenses or system improvements. However, they do not provide a systematic understanding or measurement of the actual extent of citation selection bias and vulnerability found in production GSEs.

3.4

Personalization of LLMs

Personalization is a key factor in improving the user experience of chat-based applications [4, 19, 48] and is a recognized research direction for language models [45, 54]. In personalization, the general approach is to embed the user’s attribute information together with the user’s question. This approach enables the applications to generate answers that more accurately reflect the user’s preferences, background, and needs. Several studies investigate how personalization affects inferences based on the internal knowledge of LLMs. Kearney et al. [25] show that across several domains, answers change systematically depending on user attributes such as race, gender, and age. The influence of user attributes also extends to tasks that have objectively correct answers. Vijjini et al. [62] show that LLM response performance varies systematically even in tasks such as mathematical reasoning, general knowledge, and programming. This effect also extends to the user’s political ideology. Tornberg et al. [61] analyze political ideology bias in representative and widely used LLMs. The study shows that LLMs produce oppositionleaning answers by default and LLMs shift strongly toward the ruling party for conservative users but only slightly toward the opposition party for progressive users, showing an asymmetric response to personalization. Miyazaki et al. [43] show that a similar pattern holds in the Japanese language and Japanese political context. They show that when users do not indicate their policy positions, LLM answers lean toward the ruling party, whereas when users explicitly indicate their political stance, the answers shift substantially in that direction. However, these prior studies focus on biases that arise from the internal knowledge of LLMs and do not examine biases in GSEs. To the best of our knowledge, no prior study has examined how personalization affects the citation behavior of GSEs, including aspects such as source authority and trustworthiness, and domination and faithfulness of citations.

3.5

Research Motivation

To understand the potential attack surface of GSEs, our goal is to build a novel evaluation framework. Our framework introduces new evaluation criteria centered on the publisher attributes of citations in generated answers, enabling a systematic assessment of the underlying attack surfaces and the resilience of GSEs against poisoning attacks. Note that our framework does not aim to identify actual malicious content, nor to demonstrate practical attacks that could exploit such surfaces; its sole purpose is to evaluate potential attack surfaces.

Our framework addresses the following research questions: R-1 Which publishers’ content do GSEs prefer to cite, and does this reveal any bias in citation selection from the perspective of publishers? R-2 Which publishers’ content has the power to influence the domination and faithfulness of citations? R-3 How does personalization affect the citation behavior of GSEs? We apply our framework to the political domain, where GSEs increasingly mediate access to information essential to democratic processes. Because the flow of information from political parties to citizens is a cornerstone of democratic electoral processes [30, 59], GSEs can substantially influence citizens’ decision-making in elections [16]. Especially, focusing on the task of voters gathering information about specific political parties, we characterize the potential attack surface across political parties, ideologies, countries, and voter profiles (e.g., prior political knowledge and ideology). Based on this analysis, we discuss where attackers could distort political information delivered through GSEs.

4

Proposed Framework

In this section, we present a framework for revealing the potential attack surface of GSEs. As a technical contribution, we introduce content-injection barriers of each publisher in citations to characterize the practical difficulty of publishing content on the web with specific publisher attributes and authority. In this framework, we characterize potential attack surfaces along three axes: (1) barrier distribution, (2) domination score across barriers, and (3) grounding score across barriers. Figure 1 illustrates the overall pipeline. Our framework is designed not to directly measure the success rate of poisoning attacks, but rather to identify citation behaviors that constitute potential attack surfaces. Estimating the attack surface allows us to characterize one of the vulnerabilities of GSEs to poisoning attacks.

4.1

Setting User Profiles into GSEs

As one form of personalization, we set a user profile, which assembles a user’s attributes, to GSEs. We select a user attribute set A that influences the retrieval and generation tasks of GSEs. We then build a set of user profiles from their combinations U = Combinations(A). To provide a user profile 𝑢 ∈ U to GSEs, we introduce a storytelling function MakeProfileInfo(𝑢) that converts 𝑢 into personalization information 𝑃𝑈 to be set in the GSE. Note that 𝑃𝑈 𝑚𝑜𝑑𝑒𝑙 : (𝑞 , 𝑃 ) → 𝑟 is used as part of the system prompt, and 𝑓𝐺𝑆𝐸 𝑢 𝑈 from Section 2 models the personalized information retrieval and answer generation. Following Lutz et al. [39] and related prior studies [5, 55], we combine interview formats and name-based priming to accurately set user profiles in GSEs.

4.2

Injection Barrier

We introduce the content-injection barrier, which refers to the practical difficulty of publishing content on the web based on specific publisher attributes and authority. We define a classifier CIB P (𝑐) for categorizing citations in answers generated by GSEs into contentinjection barrier categories: low, medium, high, and primary, where P denotes the target political party and 𝑐 denotes the citation. These

Assessing Attack Surfaces in Generative Search Engines

Knowledge ✖

Goal: Reveal the attack surface and the reliance of GSEs using combinations of the scores

Prompts

User Attributes

User Pro le

Ideology

+

Question Classi cation into Content Injection Barrier

MakePro leInfo( ⋅ ) It appears that the Republican Party is currently grappling with internal [1] https://democrats.org/… tensions regarding government debt, with some factions prioritizing debt restraint while others lean towards growth-oriented investment [1]. Republicans [2] havehttps://en.wikipedia.org/… voiced concerns about the rising national debt, exceeding $36 trillion, and the increasing burden of debt payments [2]. Some members of the party have called for scal responsibility, spending cuts, and [3] https://medium.com/… addressing the budget de cit [3].

Setting Question: ”Regarding government debt, does Republican Party currently prioritize debt restraint or growth-oriented investment?”

Generating Prompt with User Pro les

CIBP(

Citation Citation Citation

URL

)

λ Citation Citation

λ

Di cult to inject Easy to inject

Cited Text Cited CitedText Text

DS( ⋅ )

Domination Score

Cited CitedText Text Content Text

CGS( ⋅ )

Grounding Score

Citation Extraction and Classi cation into Content Injection Barrier

Computing Scores

Figure 1: Overview of our framework. Given a user profile and question sets, the GSE generates an answer with citations, which are classified into content-injection barriers. We then identify the attack surface along three axes: (1) barrier distribution, (2) domination score across barriers, and (3) grounding score across barriers. barriers indicate the level of publisher authority and editorial process that an attacker must obtain to successfully inject malicious content to influence GSE answers. We perform multi-stage classification to ensure interpretability of the classification results. Because content-injection barriers are abstract high-level categories, we ensure the validity and interpretability of this categorization by first classifying publishers into primary and secondary information sources, then categorizing secondary sources into fine-grained publisher categories, and finally deriving content-injection barriers from these categories. Primary Information Identification. We identify primary information sources, which are domains officially operated by the target party P. First, we define the target domain set D P that enumerates the official domains of P (e.g., when P is the U.S. Democratic Party, D P = {democrats.org, . . . }). Let 𝑑𝑐 = Domain(𝑐) be a function that extracts the domain from each citation 𝑐 ∈ 𝐶 in a generated answer 𝑟 of a GSE. We check whether D P includes 𝑑𝑐 . When 𝑑𝑐 is included in D P , we classify the citation as a primary information source. Here, IsPrimary P (𝑐) outputs 1 if 𝑑𝑐 is included in D P and ⊥ otherwise. Secondary Information Category Classification. We categorize secondary information into fine-grained publisher categories, which serve as intermediate categories for calculating contentinjection barriers. We prepare a publisher category set Π = {𝜋1, 𝜋2, · · · , 𝜋𝑝 }. Here, Cat(𝑐) maps citation 𝑐 to a category 𝜋𝑖 ∈ Π (𝑖 ∈ {1, 2, · · · , 𝑝}). In our experiments in Section 5, we use labels such as “Party”, “Media”, “Platform”, “Owned”, “Academia”, “Non-media-industry”, and “Government.” To build the function Cat(𝑐), we adopt a hybrid strategy combining automatic category classification using LLM-as-a-Judge [21, 75] and manual category classification. We prepare two GSE models (ideally two models from different providers such as GPT and Gemini with web search mode enabled) and use them to identify publishers from domains and WHOIS information. Combining multiple GSE models can reduce potential biases of single GSE models and increase classifier accuracy [75]. When classification results from the two GSE models agree, we adopt that result directly; when they disagree, we perform manual classification. In our experiments, the authors make the final determination based on company fi

ffi

fi

fi

fi

fi

fi

fi

information from the website and domain registration data. We employ zero-shot classification [50] following Kostina et al. [29], who demonstrate high performance without training examples. For each citation 𝑐 ∈ 𝐶, the prompt receives two inputs: Url(𝑐) extracts the complete URL indicating the publisher’s domain and path, and Whois(Url(𝑐)) retrieves domain registration data including ownership and organizational information. Content-Injection Barrier Classification. Finally, we classify citations into content-injection barriers based on the primary information identification and secondary information category classification results. We derive content-injection barriers from these categories. Here, CatBar P (𝜋) maps publisher category 𝜋 ∈ Π to a content-injection barrier 𝜆 𝑗 ∈ Λ = {𝜆1, 𝜆2, · · · , 𝜆𝑞 }. The overall classifier is then defined as the composition CIB P (𝑐) = 𝜆prim if IsPrimary P (𝑐) = 1, and CIB P (𝑐) = CatBar P (Cat(𝑐)) otherwise. We define five content-injection barriers Λ: primary sources, opponent sources, low-barrier sources, medium-barrier sources, and high-barrier sources. Primary sources are domains owned by the party referenced in the question. If IsPrimary P (𝑐) = 1, then 𝑐 is classified as a primary information source. Opponent sources are domains operated by rival parties. If IsPrimary P (𝑐) = ⊥ and Cat(𝑐) is “Party” in our experiment, then 𝑐 is classified as an opponent information source. Low-barrier sources are domains where users or owners can freely publish or edit content (“Platform” and “Owned” in our experiments). The political influence operations described in Section 3, including troll accounts on social media platforms [11, 42, 69], fake news websites mimicking legitimate media [2, 52], and LLM-generated false claims [49], are all published through low-barrier sources, as these platforms and self-owned domains require no editorial oversight. Medium-barrier sources are domains owned by organizations or companies with editorial processes where journalism bias or interests may appear (“Media” and “Non-media-industry” in our experiments). High-barrier sources are domains where authors are required to remain neutral and objective and manipulation is difficult (“Academia” and “Government” in our experiments). An increasing proportion of lower-barrier citations suggests that it is easier for attackers to successfully influence generated answers by injecting malicious content on the web. Therefore, the

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

degree of content-injection barriers serves as an indicator inversely correlated with the difficulty of successful attacks.

4.3

Domination Score

Our framework computes the Domination Score (DS) for each generated answer. It quantifies the proportion of cited text relative to the total text volume of the generated answer. This metric has been one of the primary evaluation criteria in the context of GEO, originally defined as a word-count-based measure [1]. However, decomposing text into words is language-dependent and biased toward English; thus, we redesign it on a character-count basis and refer to it as the Domination Score. The domination score is comÍ puted as DS(𝑟 ) = 𝑐 ∈𝐶 CharCount(𝑐)/CharCount(𝑟 ), where CharCount(·) returns the number of characters in the given text. By aggregating the domination score for each content-injection barrier, we analyze the impact of each barrier’s content on the generated answers.

4.4

Citation Grounding Score

Our framework computes the Citation Grounding Score (CGS) for each citation. It quantifies how strongly the answer sentences are reflected in the cited content, which relates to faithfulness evaluation. We introduce a scoring function CGS(𝑐, 𝑟 ) that measures the citation grounding score for each citation 𝑐 and answer 𝑟 . By aggregating the citation grounding score for each content-injection barrier, we analyze the effectiveness of each barrier’s content. We decompose the computation into three steps: Decomposing Answers and Citations into Sets of Sentences. First, we decompose answer 𝑟 into a sentence set 𝐿 = {𝑙 1, 𝑙 2, . . . , 𝑙𝑘 } and each citation 𝑐𝑖 ∈ 𝐶 into a sentence set 𝐿𝑐𝑖 = {𝑙𝑖,1, 𝑙𝑖,2, . . . , 𝑙𝑖,𝑛𝑖 }. Because some sentences of answer 𝑟 have citation labels attached and the semantics of each answer sentence is independent, we decompose answer 𝑟 into sentences to evaluate grounding. Sentence-level Similarity. We measure semantic similarity between each answer sentence in 𝐿 = {𝑙 1, 𝑙 2, . . . , 𝑙𝑘 } and each citation sentence in 𝐿𝑐𝑖 = {𝑙𝑖,1, 𝑙𝑖,2, . . . , 𝑙𝑖,𝑛𝑖 } for each citation 𝑐𝑖 ∈ 𝐶. To measure similarity between two sentences, we introduce the similarity function sim(𝑥, 𝑦) between two sentences 𝑥 and 𝑦. The function sim(𝑥, 𝑦) returns a similarity score between the two sentences 𝑥 and 𝑦 as a value in the range of −1 to 1. Here, a similarity value closer to −1 indicates lower semantic similarity, whereas a value closer to 1 indicates higher semantic similarity. To calculate the similarity, we employ Sentence-BERT [51], which converts each sentence into dense embedding vectors and computes their semantic similarity through cosine similarity. In our experiments in Section 5, we use the pre-trained Sentence-BERT model “stsbxlm-r-multilingual” [51], which has been trained on multilingual semantic textual similarity tasks. Maximum-grounding Aggregation. GSEs often use only a few sentences within long citation texts to generate a particular answer sentence; thus, we aggregate the sentence-level similarities by taking the maximum between the answer sentence set 𝐿 and citation 𝑐𝑖 to reveal how strongly a citation grounds the answer. Taking the maximum identifies the most relevant part of the citation text to the answer content. Concretely, we define MaxSim(𝐿, 𝑐𝑖 ) = max 𝑗 ∈ {1,...,𝑘 }, 𝑚∈ {1,...,𝑛𝑖 } sim(𝑙 𝑗 , 𝑙𝑖,𝑚 ), where 𝑙 𝑗 ∈ 𝐿 and 𝑙𝑖,𝑚 ∈ 𝐿𝑐𝑖 . In

computing this maximum, we evaluate sim(·, ·) for every answercitation sentence pair (𝑙 𝑗 , 𝑙𝑖,𝑚 ) within citation 𝑐𝑖 and adopt the highest similarity value across all combinations.

5

Experiment

We apply our framework to questions about U.S. and Japanese political parties on major GSE models.

5.1

Experimental Setup

We provide details of our experimental setup, including the target GSE models, user profiles, questions, and political parties. To ensure the reproducibility of our study, the question-answer datasets and the prompts used for classification are available in our repository 1 . Target GSE Models. We employ three GSE models for answer generation: OpenAI GPT-5, Claude Sonnet 4 (claude-sonnet-420250514), and Gemini Flash 2.5 (gemini-2.5-flash) with web search mode enabled. According to surveys [44], closed models dominate the LLM market in both enterprise and consumer segments, with ChatGPT, Claude, and Gemini together accounting for 88% of spending share, while open-source models account for only 11%. These models are developed in the U.S., but they dominate usage in Japan as well according to GMO Research & AI [18]. Furthermore, Google AI Overview, which integrates Google Search by default, relies on the closed model Gemini [58]. In our experiments, we set the temperature of each GSE model to 1.0, and the answers were obtained in May 2026. User Profiles. We design three user profiles based on two user attributes: political knowledge, which represents the user’s familiarity with political issues and takes the levels Ignorant and High; and political ideology, which represents the user’s political leanings and takes the levels Progressive, Conservative, and Neutral. Using these attributes, we construct three user profile combinations: Ignorant-Neutral, High-Progressive, and High-Conservative. The Ignorant-Neutral profile represents a user with no political knowledge and a neutral ideology; the High-Progressive profile represents a user with high political knowledge and a progressive ideology; and the High-Conservative profile represents a user with high political knowledge and a conservative ideology. The user profiles Ignorant-Progressive and Ignorant-Conservative are not introduced, because the political ideology attribute is not applicable to users without political knowledge; for the same reason, HighNeutral is not introduced. Questions. We design political questions on topics common to each country to elicit policy positions in a politically neutral manner. Our question design focuses on whether GSEs cite content articulating positions on the target topics, rather than on questions tailored to a specific party. All questions are closed-ended and include a party name following PoisonedRAG (e.g., “What is {PARTY}’s current position on economic regulation and free markets?”). To avoid bias, we build the question set on MARPOR (Manifesto Project) [35], an established political-science framework for classifying party manifestos. MARPOR has a hierarchical structure consisting of seven policy domains, each of which is composed of multiple topics. We select four voter-facing MARPOR domains most 1 Our Repository: https://github.com/mzhkz/QL_Research_CIKM26_Artifacts

Assessing Attack Surfaces in Generative Search Engines

Low Claude

p. op

ru

p.

l. JP

JP

l. ru

op S

S

p.

81% 91% 87% 92% ±16% ±12% ±18% ±15%

U

op

ru

l. JP

p.

l.

op

ru S

S U

p.

Mid

54% 69% 47% 60% ±13% ±17% ±19% ±23%

U

op

ru

l. JP

JP

op

S

S U

ru

l.

p.

61% 89% 83% 80% ±36% ±29% ±25% ±28%

U

High Gemini

U

Opponent

JP

Primary GPT

Figure 2: Barrier distribution by party group. Each cell has two stacked bars: the left shows the barrier distribution of web search results, and the right shows that of GSE citations.

relevant to everyday political judgment: External Relations, Economy, Welfare and Quality of Life, and Fabric of Society. We then select 11 topics on which all target parties take an explicit stance. Using these 11 topics as input, we generate questions using three closed-weight LLMs and finally obtain 33 question templates for asking the position of each party in each country. Questions and answers are written in English for U.S. parties and in Japanese for Japanese parties. Each question is instantiated per party, yielding 33 × 5 = 165 queries for the U.S. and 33 × 8 = 264 for Japan. Combined with three user profiles and three GSE models, this produces 165 × 3 × 3 = 1,485 U.S. queries and 264 × 3 × 3 = 2,376 Japan queries, for a total of 3,861 generated answers. Following the DETAIL framework [26], we fix question specificity at the least specific domain-level (asking about a stance on an entire policy domain without proper nouns or concrete figures). It prevents questions and citations from being skewed toward topics that specific publishers actively promote, and reflects the abstraction level typical of voters’ everyday political judgments. Target Political Parties. We target political parties satisfying each country’s requirements for national political parties as primary sources. Specifically, in Japan we target eight parties. The ruling parties are “Liberal Democratic Party” and “Japan Innovation Party”, and the opposition parties are “Centrist Reform Coalition”, “Democratic Party for the People”, “Japanese Communist Party”, “Reiwa Shinsengumi”, “Sanseito”, and “Conservative Party of Japan”. In the U.S., we target five parties. The ruling party is “Republican Party”, and the opposition parties are “Democratic Party”, “Green Party”, “Libertarian Party”, and “Constitution Party.”

5.2

Experimental Results

We analyze the citation behavior of GSEs along three axes: (1) the content-injection barrier distribution of citations, (2) the domination score distribution across barriers, and (3) the citation grounding score distribution across barriers. We report Cramér’s 𝑉 alongside 𝜒 2 tests. When 𝑁 is large, even small differences yield 𝑝 < .001; therefore, we use 𝑉 to assess the magnitude of differences. Distribution of Content-injection Barriers. We first analyze the content-injection barrier distribution of citations. To reveal the citation selection bias of GSEs, we compare the barrier distribution of top-10 web search results with that of GSE citations. We use Brave Search API [6] to obtain web search results. Since the search engines used by the target GSEs are not disclosed, we cannot replicate their

exact search results. However, Brave Search API returns results comparable to those of major search engines such as Google and Bing on standard retrieval metrics, and we therefore consider it a reasonable approximation. We first show the barrier distribution of citations in Figure 2, with parties grouped into ruling (rul.) and opposition (opp.). Each cell contains two stacked bars side by side: the left bar shows the barrier distribution of web search results, and the right bar shows that of GSE citations. We also report the mean and standard deviation of the proportion of GSE citation URLs that appear in the corresponding web search results. The citation tendency differs across models (U.S.: 𝜒 2 (8) = 568.94, 𝑝 < .001, 𝑉 = 0.328; Japan: 𝜒 2 (8) = 574.80, 𝑝 < .001, 𝑉 = 0.250). GPT has the highest primary source ratio (U.S. 67.2%, Japan 83.1%) and does not cite low-barrier sources (U.S./Japan both ≤ 0.1%). Gemini has the highest ratios of opponent sources (U.S. 12.4%, Japan 6.1%) and low-barrier sources (U.S. 12.9%, Japan 17.2%) among the three models. The attack surface of Gemini is broad, with many pathways through which content injection via low-cost sources can reach the answer. Claude has the highest mid-barrier source ratio (U.S. 59.3%, Japan 37.1%) among the three models, with primary source ratios of U.S. 16.5% and Japan 53.7%. The ruling and opposition distinction also affects the composition of GSE citations (U.S.: 𝜒 2 (4) = 1044.06, 𝑝 < .001, 𝑉 = 0.361; Japan: 𝜒 2 (4) = 357.92, 𝑝 < .001, 𝑉 = 0.161). In the U.S., citations for ruling party questions are dominated by mid-barrier sources (Claude 78.9%, Gemini 58.5%, GPT 21.8%), with primary source ratios at Claude 0.9%, Gemini 0.9%, and GPT 10.3%. In contrast, opposition party questions have higher primary source ratios: GPT 86.8%, Gemini 19.8%, Claude 21.3%. This means that answers to ruling party questions rely more on sources with lower contentinjection barriers, and the attack surface for the ruling party is broader. In particular, for models other than GPT, we see that the primary source ratio is already low at the web search result stage. This suggests that these models may generate search queries that are unable to retrieve primary sources. We find that the primary source ratio in GSE citations is correlated with that in web search results. We report in Table 1, for each model and party group, two values: Pearson correlation between the primary source share in web search results and in GSE citations (𝑟 𝑃 ), and the mean absolute difference between these two primary source shares (MAE) in percentage points. We observe that the direction of the gap between party groups depends on the model: for Gemini, 𝑟 𝑃 is lower for ruling parties than for opposition parties, whereas for GPT and Claude, 𝑟 𝑃 is higher for ruling parties than for opposition parties. In addition, GPT shows large MAE values, indicating that its citation composition diverges from the web search results regardless of party group, whereas Claude and Gemini exhibit much smaller MAE for U.S. ruling-party questions, meaning their citations track the web search results in that condition. The lower primary source ratio for ruling party questions may be caused by the larger volume of web content about ruling parties. We additionally investigate Google search hit counts for party names: Japan’s long-ruling LDP has 4.71 × 107 hits, far exceeding the otherparty average of 8.57 × 106 . In the U.S., the Republican Party and the Democratic Party have 1.65 × 108 and 3.99 × 108 hits, respectively. When the total volume of web content about a party is large, the

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

Primary

Opponent

High

Mid

Low

US GPT

JP

Gemini

Claude

GPT

Gemini

Claude

ign.

83% ±33%

66% ±17%

89% ±13%

81% ±28%

57% ±23%

91% ±16%

cons.

81% ±33%

66% ±18%

90% ±14%

82% ±26%

57% ±23%

89% ±18%

prog.

85% ±29%

67% ±19%

88% ±15%

82% ±25%

57% ±23%

90% ±17%

al-cons.

85% ±30%

67% ±19%

92% ±14%

82% ±25%

56% ±22%

88% ±19%

al-prog.

87% ±29%

63% ±16%

87% ±15%

84% ±24%

60% ±24%

89% ±17%

op-cons.

75% ±38%

64% ±16%

88% ±14%

82% ±27%

59% ±24%

90% ±17%

op-prog.

84% ±29%

69% ±20%

88% ±15%

81% ±26%

56% ±21%

90% ±17%

0

25 50 75 100

0

25 50 75 100

0

25 50 75 100

0

25 50 75 100

0

25 50 75 100

0

25 50 75 100

Figure 3: Barrier distribution by user profile. Each bar shows the barrier distribution of GSE citations for each user profile. Table 1: Correlation between primary source ratios in web search results and those in GSE citations by party group.

Table 2: Correlation between primary source ratio in web search results and in GSE citations by user profile.

Country Party group GPT [𝑟 𝑃 /MAE] Gemini [𝑟 𝑃 /MAE] Claude [𝑟 𝑃 /MAE]

Country User profile GPT [𝑟 𝑃 /MAE] Gemini [𝑟 𝑃 /MAE] Claude [𝑟 𝑃 /MAE]

ign. cons. prog.

0.259 / 46.7±22.8 0.377 / 45.1±22.1 0.411 / 46.5±20.9

0.454 / 22.0±16.2 0.406 / 22.9±16.7 0.432 / 21.6±16.4

0.526 / 27.0±20.2 0.522 / 27.5±19.8 0.526 / 26.5±19.7

Opponent

Mid

Low

ru l. op p.

p.

l.

op

ru S

S U

U

ru l. op p. JP

p.

JP

l.

op

ru S

S U

U

Claude

JP

High

Gemini

JP

Primary

GPT

ru l. op p.

relative share of primary sources decreases, which may lower the primary source ratio in citations. However, the U.S. Green Party has 2.19 × 109 hits, far exceeding the two major parties, yet its primary source ratio in GSE citations remains high. This counterexample suggests that publishers can suppress this relationship through their content dissemination strategies. In contrast, user profiles do not affect the content-injection barrier distribution of citations. We show the barrier distribution in Figure 3 for three user profiles: Ignorant-Neutral (ign.), HighConservative (cons.), and High-Progressive (prog.). Each bar shows the barrier distribution of GSE citations for each user profile. The distributions across the three profiles are nearly identical. 𝜒 2 tests are not significant for any model in either country (U.S. overall: 𝜒 2 (8) = 6.62, 𝑝 = .579, 𝑉 = 0.020; Japan overall: 𝜒 2 (8) = 10.07, 𝑝 = .260, 𝑉 = 0.019; all 6 model-level tests also not significant), with all 𝑉 ≤ 0.06. We also analyze the effect of alignment between the user profile ideology and the target party ideology: aligned (alcons., al-prog.) and opposed (op-cons., op-prog.). GPT shows no significant difference between aligned and opposed conditions (U.S.: 𝜒 2 (12) = 14.25, 𝑝 = .285, 𝑉 = 0.081), selecting the same citations regardless of whether the user ideology matches the party. Gemini (U.S.: 𝜒 2 (12) = 62.12, 𝑝 < .001, 𝑉 = 0.086) and Claude (U.S.: 𝜒 2 (12) = 58.50, 𝑝 < .001, 𝑉 = 0.103) show statistically significant differences, but the effect sizes are small. We report the same correlation between the primary source ratios in web search results and GSE citations broken down by user profile in Table 2. Within every (country, model) cell, 𝑟 𝑃 and MAE are almost the same across the three user profiles. The per-model

JP

JP

0.598 / 27.1±17.5 0.504 / 27.0±20.6

0.693 / 13.3±18.7 0.693 / 12.3±18.3 0.724 / 12.5±17.6

p.

0.218 / 29.1±17.7 0.508 / 19.9±15.3

0.582 / 11.5±11.6 0.566 / 13.3±12.7 0.588 / 12.9±13.7

JP

0.447 / 49.6±21.8 0.309 / 45.0±21.9

0.312 / 40.1±34.8 0.371 / 36.4±33.1 0.545 / 29.5±30.6

l.

rul. opp.

ign. cons. prog.

op

JP

U.S.

ru

0.800 / 0.3±1.5 0.637 / 15.8±19.0

S

0.120 / 3.5±6.7 0.459 / 14.8±12.8

S

0.314 / 22.4±28.4 0.211 / 38.6±33.4

U

rul. opp.

U

U.S.

Figure 4: Domination score distribution by party group. Each bar shows the barrier-wise domination score.

correlations hold across all three user profiles as well. This suggests that user profiles affect neither the citation barrier distribution itself nor the size of its difference from the web search results. Distribution of Domination Score. We next analyze the domination score distribution across barriers. We show the distribution by model and party group in Figure 4. As with barrier distribution, model choice and the ruling/opposition position again govern the distribution (model: U.S. 𝜒 2 (8) = 34120, 𝑉 = 0.356, Japan 𝜒 2 (8) = 54892, 𝑉 = 0.229; party group: U.S. 𝜒 2 (4) = 59662, 𝑉 = 0.386, Japan 𝜒 2 (4) = 31743, 𝑉 = 0.144; all 𝑝 < .001). Across all models and both countries (ruling/opposition combined), the primary source domination ratio exceeds the citation ratio. GPT shows +3.9pt in the U.S. and +7.0pt in Japan; in Japan, Gemini shows +13.1pt and Claude +8.5pt. This means that the

Assessing Attack Surfaces in Generative Search Engines

Mid

Low

Gemini

Claude

ig n co . ns pr . og . ig n co . ns p . al rog -c . al ons -p . op rog -c . op ons -p . al rog -c . al ons -p . op rog -c . op ons -p . ro g.

High

ig n co . ns pr . og . ig n co . ns p . al rog -c . al ons -p . op rog -c . op ons -p . al rog -c . al ons -p . op rog -c . op ons -p . ro g.

Opponent

ig n co . ns pr . og . ig n co . ns p . al rog -c . al ons -p . op rog -c . op ons -p . al rog -c . al ons -p . op rog -c . op ons -p . ro g.

Primary

GPT

US persona / JP persona / US alignment / JP alignment

Figure 5: Domination score distribution by user profile. Each bar shows the barrier-wise domination score for each user profile. Primary

US rul.

Opponent

US opp.

High

Mid

JP rul.

Low

JP opp.

GPT

Gemini

Claude

w Mid

Lo

h

Hig

w Mid

Lo

h w id Hig Lo M

h Hig

w d Lo Mi

h

Hig

Figure 6: Grounding distribution by party group. In each cell, the width shows the count share of each grounding bin, and the height shows the barrier distribution within that bin.

text span of the answer attributed to each primary source citation is longer than that of citations from other barriers. However, the ruling/opposition gap depends strongly on model and country. In the U.S., the primary domination is higher for opposition questions (GPT +76.6pt, Claude +25.0pt, Gemini +20.5pt), and the U.S. rulingparty primary domination for GPT drops to 14.6%; in Japan, the gap stays within 6pt for all models. For low-barrier sources, Gemini’s domination in Japan substantially exceeds the other models (Gemini 9.8% vs. Claude 4.3%, GPT 0.1%). We show the domination score distribution by user profile in Figure 5. User profile differences are negligible (U.S. 𝜒 2 (8) = 301, 𝑉 = 0.019, Japan 𝜒 2 (8) = 377, 𝑉 = 0.011; all 𝑝 < .001). Together with barrier distribution (all 𝑉 ≤ 0.06), user profiles do not affect the attack surface in either metric. Distribution of Citation Grounding. We next analyze the citation grounding score distribution across barriers. We discretize grounding scores with thresholds (𝜏𝐿 , 𝜏𝐻 ) into Low (< 𝜏𝐿 ), Mid ([𝜏𝐿 , 𝜏𝐻 )), and High (≥ 𝜏𝐻 ). Because the distribution of SBERT cosine similarity can differ by model and language [56], we calibrate the thresholds separately for English (U.S.) and Japanese (Japan). For calibration, we use the semantic textual similarity (STS) benchmarks STS-B [8] for English and JSTS [32] for Japan. In these datasets, each sentence pair is assigned a human similarity score from 0 (unrelated) to 5 (identical in meaning). SBERT maps sentences into a vector space and compares their meaning using cosine similarity.

Its sentence embeddings are commonly evaluated by their correlation with human scores on STS benchmarks [51]. The empirical relationship between human scores and cosine similarity on STS data allows us to set language-specific thresholds. We define 𝜏𝐻 as the median cosine similarity of pairs with human score ≥ 4, and 𝜏𝐿 as the median cosine similarity of pairs with human score ≥ 3. Under this calibration, 𝜏𝐻 serves as a conservative threshold for near-paraphrase similarity, whereas 𝜏𝐿 serves as a threshold for substantial shared content. As a result, we obJapan Japan tain (𝜏𝐿U.S., 𝜏𝐻U.S. ) = (0.80, 0.90) and (𝜏𝐿 , 𝜏𝐻 ) = (0.70, 0.85). In SBERT-based sentence similarity studies, values such as 0.8 and 0.9 are commonly used to detect paraphrases and highly similar sentences [24, 60], which agrees with our English thresholds. On the other hand, Japanese SBERT may give lower cosine similarity than English models even for synonymous or highly similar pairs [56], so we use lower thresholds for Japan. High means the answer is strongly grounded in the source, Mid means the core content is partly shared, and Low means only a weak semantic link. For Japanese questions, 86% of citation sources are in Japanese and 14% in English, while for English questions 100% are in English. Since a single language is dominant within each country in questions and citations, language-specific calibration is reasonable for consistent comparison. We show the barrier distribution for each grounding bin in Figure 6. Each cell is a Marimekko chart: the width along the x-axis shows the count share of each grounding bin (Low/Mid/High), and the y-axis shows the barrier distribution within each bin. Except for U.S. Claude, the primary source ratio increases as the grounding bin goes from Low to Mid to High. For example, in Japan, GPT shows primary ratios of 42.1% (Low bin), 75.6% (Mid), and 89.2% (High). The magnitude of this increase differs by country and model: all three models in Japan show steep increases (Low→High by +30 to +47pt), while in the U.S. GPT and Gemini show only moderate increases (+15 to +17pt), and Claude is non-monotonic with Low= 27.5%, Mid= 12.9%, High= 18.2%. Except for this case, citations with high grounding scores are concentrated in primary sources, and citations with low grounding scores are concentrated in low-barrier sources. That is, primary sources with high barriers are faithfully reflected in answers, while sources with lower barriers contribute less to the answer text and are incorporated in a form that diverges more from the original content. This tendency is not uniform across ruling and opposition parties. Answers to ruling party questions have lower High-bin ratios. In

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

ign.

Primary Opponent prog.

cons.

High

Mid al-cons.

Low

al-prog.

op-prog.

op-cons.

GPT

US

Gemini

Claude

GPT

JP

Gemini

Claude

w Mid

Lo

h

Hig

w Mid

Lo

h

Hig

d w Lo Mi

h

Hig

w Mid

Lo

h

Hig

w Mid

Lo

h

Hig

w Mid

Lo

h

Hig

w Mid

Lo

Hig

h

Figure 7: Grounding distribution by user profile. Each cell shows the grounding bin barrier distribution for each user profile. the U.S., the High-bin ratio for ruling party questions is GPT 28%, Gemini 30%, Claude 33%, while for opposition party questions it is GPT 38%, Gemini and Claude 39% (𝜒 2 (2) = 1091, 𝑝 𝐻 < .001, 𝑉 = 0.094 with Holm correction). Given that ruling party questions also have lower primary source ratios in the barrier distribution, their answers rely more on citations in the Mid and Low grounding bins. The effect size of user profile on the grounding distribution is also negligible (U.S. 𝑉 = 0.012, Japan 𝑉 = 0.009). GPT (U.S.) and Claude (U.S. and Japan) are not significant (𝑝 𝐻 ≥ .05), while the other combinations show statistically significant differences (𝑝 𝐻 < .001); however, all have 𝑉 ≤ 0.022, meaning the effect is negligible. This suggests that the potential attack surface of GSEs does not depend on who the user is, but on which GSE model is used and which party the question is about.

5.3

Summary

While LLM outputs can vary with the user’s political ideology, we observe no consistent effect on GSE citation behavior across the three models and both countries. What shapes the differences in citation behavior is not who is asking the question but which model answers about which party. Model choice produces large differences in the barrier distribution, ruling-party questions have lower primary source ratios than opposition-party questions, and in the U.S. the domination and grounding distributions skew in the same direction. That is, the attack surface of GSEs is characterized by the model and the target party, not by the user’s ideology.

6

Discussion

We discuss the ideal citation balance between primary and secondary sources in GSEs. For closed-ended questions in the political domain, increasing citation proportions of primary sources is desirable. However, prior studies claim that primary providers may present only excessively positive aspects in content shown to users [27, 36]. When social doubts arise about the reliability of primary sources, secondary sources are appropriate to include in citations. For instance, regarding product reviews, not only official

product websites but also secondary sources such as reviews by others should be included in citations of answers. Some domains and tasks require secondary sources alongside primary sources, and it is not always optimal to maximize citation proportions of primary sources. Accordingly, it is desirable to define an ideal balance between primary and secondary sources for each task and domain, and to evaluate the citation tendencies of GSEs based on it. We discuss two limitations in our study. First, we target closedended questions in the political domain in the U.S. and Japan rather than conducting a large-scale cross-domain study. We also limit profile dimensions to political knowledge and ideology, excluding attributes such as age, gender, and education to contain experimental cost. Future work will extend to more models, questions, user attributes, and domains such as health and finance. Second, our category classification approach has limited granularity in distinguishing between web source types within each publisher attribute category. Content-injection barriers depend on our publisher attribute classification. However, our method does not account for cost differences, such as publisher selection processes or peer review processes on individual pages. Content-injection barriers vary between peer-reviewed journal papers and preprint papers, and between different newspaper publishers. By considering these differences within the attribute groups, future work can capture content-injection barriers at a finer resolution.

7

Conclusion

We proposed a framework to characterize the potential attack surface of GSEs against poisoning attacks in the political domain. To build our framework, we introduced the content-injection barrier, a novel evaluation criterion. Our experiments on three major GSEs in the U.S. and Japan showed that (a) each model has a distinct attack surface; (b) the web search functionality of GSEs (e.g., query generation by LLMs) shapes the attack surface; (c) ruling parties have a broader attack surface than opposition parties; and (d) user profiles do not affect the potential attack surface. Our findings suggest that the potential attack surface depends on the model and the target party, not on the user.

Assessing Attack Surfaces in Generative Search Engines

Acknowledgments We thank Prof. Koichi Moriyama at Keio University for his helpful feedback. This study was supported by a donation from Yahoo Japan Corporation to the Ataka Laboratory at Keio University Shonan Fujisawa Campus.

GenAI Usage Disclosure We used Claude Opus 4.7 to assist with visualization scripts, code refactoring, and language refinement of author-written drafts. All outputs were reviewed and revised by the authors, who are responsible for the final content.

References [1] Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., and Deshpande, A. Geo: Generative engine optimization. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (New York, NY, USA, 2024), Association for Computing Machinery, pp. 5–16. [2] Alaphilippe, A., Machado, G., Miguel, R., and Poldi, F. Doppelganger: Media clones serving Russian propaganda. Tech. rep., EU DisinfoLab, 2022. Technical partner: Qurium. [3] Anthropic. How we built our multi-agent research system. https://www. anthropic.com/engineering/multi-agent-research-system. Accessed: 2026-05-15. [4] Anthropic. Memory in Claude. Anthropic News. https://www.anthropic.com/ news/memory. Accessed: 2026-05-15. [5] Argyle, L. P., Busby, E. C., Fulda, N., Gubler, J. R., Rytting, C., and Wingate, D. Out of one, many: Using language models to simulate human samples. Political Analysis 31, 3 (2023), 337–351. [6] Brave Software. Brave search api. https://brave.com/ja/search/api/. Accessed: 2026-05-15. [7] Carlini, N., Jagielski, M., Choqette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F. Poisoning web-scale training datasets is practical. In 2024 IEEE Symposium on Security and Privacy (SP) (2024), pp. 407–425. [8] Cer, D., Diab, M., Agirre, E., Lopez-Gazpio, I., and Specia, L. SemEval-2017 task 1: Semantic textual similarity multilingual and crosslingual focused evaluation. In Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval2017) (Vancouver, Canada, Aug. 2017), S. Bethard, M. Carpuat, M. Apidianaki, S. M. Mohammad, D. Cer, and D. Jurgens, Eds., Association for Computational Linguistics, pp. 1–14. [9] Chatterji, A., Cunningham, T., Deming, D. J., Hitzig, Z., Ong, C., Shan, C. Y., and Wadman, K. How people use chatgpt. Working Paper 34255, National Bureau of Economic Research, September 2025. [10] Chen, H.-T., Zhang, M., and Choi, E. Rich knowledge sources bring complex knowledge conflicts: Recalibrating models to reflect conflicting evidence. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (Abu Dhabi, United Arab Emirates, Dec. 2022), Y. Goldberg, Z. Kozareva, and Y. Zhang, Eds., Association for Computational Linguistics, pp. 2292–2307. [11] Cinus, F., Minici, M., Luceri, L., and Ferrara, E. Exposing cross-platform coordinated inauthentic activity in the run-up to the 2024 u.s. election. In Proceedings of the ACM on Web Conference 2025 (New York, NY, USA, 2025), WWW ’25, Association for Computing Machinery, p. 541–559. [12] Durmus, E., He, H., and Diab, M. FEQA: A question answering evaluation framework for faithfulness assessment in abstractive summarization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics (Online, July 2020), D. Jurafsky, J. Chai, N. Schluter, and J. Tetreault, Eds., Association for Computational Linguistics, pp. 5055–5070. [13] Es, S., James, J., Espinosa Anke, L., and Schockaert, S. RAGAs: Automated evaluation of retrieval augmented generation. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics: System Demonstrations (St. Julians, Malta, Mar. 2024), N. Aletras and O. De Clercq, Eds., Association for Computational Linguistics, pp. 150–158. [14] Falke, T., Ribeiro, L. F. R., Utama, P. A., Dagan, I., and Gurevych, I. Ranking generated summaries by correctness: An interesting but challenging application for natural language inference. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics (Florence, Italy, July 2019), A. Korhonen, D. Traum, and L. Màrquez, Eds., Association for Computational Linguistics, pp. 2214–2220. [15] Fan, W., Ding, Y., Ning, L., Wang, S., Li, H., Yin, D., Chua, T.-S., and Li, Q. A survey on rag meeting llms: Towards retrieval-augmented large language models. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (New York, NY, USA, 2024), KDD ’24, Association for Computing Machinery, pp. 6491–6501.

[16] Fisher, J., Feng, S., Aron, R., Richardson, T., Choi, Y., Fisher, D. W., Pan, J., Tsvetkov, Y., and Reinecke, K. Biased LLMs can influence political decisionmaking. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (Vienna, Austria, 2025), W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar, Eds., Association for Computational Linguistics, pp. 6559–6607. [17] Gao, T., Yen, H., Yu, J., and Chen, D. Enabling large language models to generate text with citations. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (Singapore, Dec. 2023), H. Bouamor, J. Pino, and K. Bali, Eds., Association for Computational Linguistics, pp. 6465–6488. [18] GMO Research & AI. Japan’s generative ai market penetration and business adoption trends 2025. https://gmo-research.ai/en/resources/studies/2025-studygen-AI-jp. Accessed: 2026-05-15. [19] Google. Personal intelligence from Gemini—AI help just for you. Google. https://gemini.google/overview/personal-intelligence/. Accessed: 2026-05-15. [20] Google AI for Developers. Grounding with google search. Google AI for Developers. https://ai.google.dev/gemini-api/docs/google-search. Accessed: 202605-15. [21] Gu, J., Jiang, X., Shi, Z., Tan, H., Zhai, X., Xu, C., Li, W., Shen, Y., Ma, S., Liu, H., Wang, S., Zhang, K., Lin, Z., Zhang, B., Ni, L., Gao, W., Wang, Y., and Guo, J. A survey on llm-as-a-judge. The Innovation 7, 6 (2026), 101253. [22] Honovich, O., Aharoni, R., Herzig, J., Taitelbaum, H., Kukliansy, D., Cohen, V., Scialom, T., Szpektor, I., Hassidim, A., and Matias, Y. TRUE: Re-evaluating factual consistency evaluation. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Seattle, United States, July 2022), M. Carpuat, M.-C. de Marneffe, and I. V. Meza Ruiz, Eds., Association for Computational Linguistics, pp. 3905–3920. [23] Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y. J., Madotto, A., and Fung, P. Survey of hallucination in natural language generation. ACM Comput. Surv. 55, 12 (Mar. 2023). [24] Kabir, M. R., Nabil, M. M. R., and Khan, M. A. Banglaembed: Efficient sentence embedding models for a low-resource language using cross-lingual distillation techniques. In 2024 7th International Conference on Algorithms, Computing and Artificial Intelligence (ACAI) (2024), IEEE, pp. 1–6. [25] Kearney, M., Binns, R., and Gal, Y. Language models change facts based on the way you talk. https://arxiv.org/abs/2507.14238, 2025. [26] Kim, O. Detail matters: Measuring the impact of prompt specificity on reasoning in large language models. https://arxiv.org/abs/2512.02246, 2025. [27] Klüver, H., and Sagarzazu, I. Setting the agenda or responding to voters? political parties, voters and issue attention. West European Politics 39, 2 (2016), 380–398. [28] Komeili, M., Shuster, K., and Weston, J. Internet-augmented dialogue generation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (Dublin, Ireland, May 2022), S. Muresan, P. Nakov, and A. Villavicencio, Eds., Association for Computational Linguistics, pp. 8460–8478. [29] Kostina, A., Dikaiakos, M. D., Stefanidis, D., and Pallis, G. Large language models for text classification: Case study and comprehensive review. https: //arxiv.org/abs/2501.08457, 2025. arXiv preprint. [30] Kovach, B., and Rosenstiel, T. The Elements of Journalism: What Newspeople Should Know and the Public Should Expect. Three Rivers Press, 2007. [31] Kryscinski, W., McCann, B., Xiong, C., and Socher, R. Evaluating the factual consistency of abstractive text summarization. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) (Online, Nov. 2020), B. Webber, T. Cohn, Y. He, and Y. Liu, Eds., Association for Computational Linguistics, pp. 9332–9346. [32] Kurihara, K., Kawahara, D., and Shibata, T. JGLUE: Japanese general language understanding evaluation. In Proceedings of the Thirteenth Language Resources and Evaluation Conference (Marseille, France, June 2022), N. Calzolari, F. Béchet, P. Blache, K. Choukri, C. Cieri, T. Declerck, S. Goggi, H. Isahara, B. Maegaard, J. Mariani, H. Mazo, J. Odijk, and S. Piperidis, Eds., European Language Resources Association, pp. 2957–2966. [33] Lazaridou, A., Gribovskaya, E., Stokowiec, W., and Grigorev, N. Internetaugmented language models through few-shot prompting for open-domain question answering. Transactions on Machine Learning Research (2022). arXiv:2203.05115. [34] Lee, S., Back, J., Jeon, D., Kwon, S., Kim, M., Kang, I., and Lee, J. From relevance to authority: Authority-aware generative retrieval in web search engines. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 6: Industry Track) (San Diego, California, USA, July 2026), Y. Li, G. Rehm, and M. Tu, Eds., Association for Computational Linguistics, pp. 796–811. [35] Lehmann, P., Franzmann, S., Al-Gaddooa, D., Burst, T., Ivanusch, C., Regel, S., Riethmüller, F., Volkens, A., Wessels, B., and Zehnter, L. The manifesto data collection. Manifesto Project (MRG/CMP/MARPOR). Version 2025a. https: //doi.org/10.25522/manifesto.mpds.2025a. Accessed: 2026-05-15. [36] Leung, S., Parker, L., and Courtis, J. Impression management through minimal

Riku Mochizuki, Shusuke Komatsu, Souta Noguchi, and Kazuto Ataka

narrative disclosure in annual reports. The British accounting review 47, 3 (2015), 275–289. [37] Liu, N. F., Zhang, T., and Liang, P. Evaluating verifiability in generative search engines. In Findings of the Association for Computational Linguistics: EMNLP 2023 (Singapore, Dec. 2023), H. Bouamor, J. Pino, and K. Bali, Eds., Association for Computational Linguistics, pp. 7001–7025. [38] Liu, S., and Roth, D. Conflicts in texts: Data, implications and challenges. In Findings of the Association for Computational Linguistics: EMNLP 2025 (Suzhou, China, Nov. 2025), C. Christodoulopoulos, T. Chakraborty, C. Rose, and V. Peng, Eds., Association for Computational Linguistics, pp. 10073–10091. [39] Lutz, M., Sen, I., Ahnert, G., Rogers, E., and Strohmaier, M. The prompt makes the person(a): A systematic evaluation of sociodemographic persona prompting for large language models. In Findings of the Association for Computational Linguistics: EMNLP 2025 (Suzhou, China, Nov. 2025), C. Christodoulopoulos, T. Chakraborty, C. Rose, and V. Peng, Eds., Association for Computational Linguistics, pp. 23212–23237. [40] Lála, J., O’Donoghue, O., Shtedritski, A., Cox, S., Rodriqes, S. G., and White, A. D. Paperqa: Retrieval-augmented generative agent for scientific research. https://arxiv.org/abs/2312.07559, 2023. [41] Maekawa, S., Iso, H., Gurajada, S., and Bhutani, N. Retrieval helps or hurts? a deeper dive into the efficacy of retrieval augmentation to language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) (Mexico City, Mexico, June 2024), K. Duh, H. Gomez, and S. Bethard, Eds., Association for Computational Linguistics, pp. 5506–5521. [42] Maiko, I. Japan’s upper house election reveals how Russian influence operations are infecting AI with a flood of propaganda, stoking divisions. https://www. nippon.com/en/in-depth/d01170/. Accessed: 2026-05-15. [43] Miyazaki, S., and Hall, A. B. Why do ai models tell left-wing voters to support the communist party? ai voting advice in japan’s 2026 general election. Working paper, 2026. [44] Moore, O., and Moore, J. State of consumer AI 2025: Product hits, misses, and what’s next. Andreessen Horowitz (a16z). https://a16z.com/state-of-consumerai-2025-product-hits-misses-and-whats-next/. Accessed: 2026-05-15. [45] Mysore, S., Lu, Z., Wan, M., Yang, L., Sarrafzadeh, B., Menezes, S., Baghaee, T., Gonzalez, E. B., Neville, J., and Safavi, T. Pearl: Personalizing large language model writing assistants with generation-calibrated retrievers. In Proceedings of the 1st Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual (CustomNLP4U) (Miami, Florida, USA, Nov. 2024), S. Kumar, V. Balachandran, C. Y. Park, W. Shi, S. A. Hayati, Y. Tsvetkov, N. Smith, H. Hajishirzi, D. Kang, and D. Jurgens, Eds., Association for Computational Linguistics, pp. 198–219. [46] Nakano, R., Hilton, J., Balaji, S., Wu, J., Ouyang, L., Kim, C., Hesse, C., Jain, S., Kosaraju, V., Saunders, W., Jiang, X., Cobbe, K., Eloundou, T., Krueger, G., Button, K., Knight, M., Chess, B., and Schulman, J. Webgpt: Browser-assisted question-answering with human feedback. arXiv preprint arXiv:2112.09332 (2021). [47] OpenAI. Introducing chatgpt search. https://openai.com/index/introducingchatgpt-search/. Accessed: 2026-05-15. [48] OpenAI. Memory and new controls for ChatGPT. OpenAI Blog. https://openai. com/index/memory-and-new-controls-for-chatgpt/. Accessed: 2026-05-15. [49] OpenAI. Disrupting malicious uses of our models: An update, february 2026. Tech. rep., OpenAI, 2026. Accessed: 2026-05-15. [50] Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. Language models are unsupervised multitask learners. OpenAI Blog 1, 8 (2019), 9. [51] Reimers, N., and Gurevych, I. Sentence-BERT: Sentence embeddings using Siamese BERT-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) (Hong Kong, China, Nov. 2019), K. Inui, J. Jiang, V. Ng, and X. Wan, Eds., Association for Computational Linguistics, pp. 3982–3992. [52] Rid, T. The lies Russia tells itself: The country’s propagandists target the West— but mislead the Kremlin, too. Foreign Affairs (2024). [53] Saad-Falcon, J., Khattab, O., Potts, C., and Zaharia, M. ARES: An automated evaluation framework for retrieval-augmented generation systems. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) (Mexico City, Mexico, June 2024), K. Duh, H. Gomez, and S. Bethard, Eds., Association for Computational Linguistics, pp. 338–354. [54] Salemi, A., Mysore, S., Bendersky, M., and Zamani, H. LaMP: When large language models meet personalization. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (Bangkok, Thailand, Aug. 2024), L.-W. Ku, A. Martins, and V. Srikumar, Eds., Association for Computational Linguistics, pp. 7370–7392. [55] Santurkar, S., Durmus, E., Ladhak, F., Lee, C., Liang, P., and Hashimoto, T. Whose opinions do language models reflect? In Proceedings of the 40th International Conference on Machine Learning (2023), ICML’23, JMLR.org. [56] Shibayama, N., and Shinnou, H. Construction and evaluation of Japanese

sentence-BERT models. In Proceedings of the 35th Pacific Asia Conference on Language, Information and Computation (Shanghai, China, 11 2021), K. Hu, J.-B. Kim, C. Zong, and E. Chersoni, Eds., Association for Computational Lingustics, pp. 731–738. [57] Singhal, A. Modern information retrieval: A brief overview. IEEE Data Eng. Bull. 24 (2001), 35–43. [58] Stein, R. Expanding AI overviews and introducing AI mode. The Keyword (Google blog). https://blog.google/products-and-platforms/products/search/aimode-search/. Accessed: 2026-05-15. [59] Swart, J., and Broersma, M. The trust gap: Young people’s tactics for assessing the reliability of political news. The International Journal of Press/Politics 27, 2 (2022), 396–416. [60] Tumre, S., Patil, S., and Kumar, A. Improved near-duplicate detection for aggregated and paywalled news-feeds. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 3: Industry Track) (2025), pp. 979–987. [61] Törnberg, P., and Schimmel, M. Political bias audits of llms capture sycophancy to the inferred auditor. https://arxiv.org/abs/2604.27633, 2026. [62] Vijjini, A. R., Basu Roy Chowdhury, S., and Chaturvedi, S. Exploring safetyutility trade-offs in personalized language models. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) (Albuquerque, New Mexico, Apr. 2025), L. Chiruzzo, A. Ritter, and L. Wang, Eds., Association for Computational Linguistics, pp. 11316–11340. [63] Wang, H., Prasad, A., Stengel-Eskin, E., and Bansal, M. Retrieval-augmented generation with conflicting evidence. In Proceedings of the First Conference on Language Modeling (COLM) (2025). [64] Wu, Y., Zhong, S., Kim, Y., and Xiong, C. What generative search engines like and how to optimize web content cooperatively. https://arxiv.org/abs/2510.11438, 2025. [65] Xiong, G., Jin, Q., Lu, Z., and Zhang, A. Benchmarking retrieval-augmented generation for medicine. In Findings of the Association for Computational Linguistics: ACL 2024 (Bangkok, Thailand, Aug. 2024), L.-W. Ku, A. Martins, and V. Srikumar, Eds., Association for Computational Linguistics, pp. 6233–6251. [66] Xu, Y., Qi, P., Chen, J., Liu, K., Han, R., Liu, L., Min, B., Castelli, V., Gupta, A., and Wang, Z. CiteEval: Principle-driven citation evaluation for source attribution. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (Vienna, Austria, July 2025), W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar, Eds., Association for Computational Linguistics, pp. 32759–32778. [67] Yuan, W., Neubig, G., and Liu, P. Bartscore: Evaluating generated text as text generation. In Advances in Neural Information Processing Systems (2021), M. Ranzato, A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34, Curran Associates, Inc., pp. 27263–27277. [68] Zakka, C., Shad, R., Chaurasia, A., Dalal, A. R., Kim, J. L., Moor, M., Fong, R., Phillips, C., Alexander, K., Ashley, E., Boyd, J., Boyd, K., Hirsch, K., Langlotz, C., Lee, R., Melia, J., Nelson, J., Sallam, K., Tullis, S., Vogelsong, M. A., Cunningham, J. P., and Hiesinger, W. Almanac — retrieval-augmented language models for clinical medicine. NEJM AI 1, 2 (Jan. 2024). [69] Zannettou, S., Caulfield, T., De Cristofaro, E., Sirivianos, M., Stringhini, G., and Blackburn, J. Disinformation warfare: Understanding state-sponsored trolls on twitter and their influence on the web. In Companion Proceedings of The 2019 World Wide Web Conference (New York, NY, USA, 2019), WWW ’19, Association for Computing Machinery, p. 218–226. [70] Zha, Y., Yang, Y., Li, R., and Hu, Z. AlignScore: Evaluating factual consistency with a unified alignment function. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (Toronto, Canada, July 2023), A. Rogers, J. Boyd-Graber, and N. Okazaki, Eds., Association for Computational Linguistics, pp. 11328–11348. [71] Zhai, C. Large language models and future of information retrieval: Opportunities and challenges. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval (New York, NY, USA, 2024), SIGIR ’24, Association for Computing Machinery, pp. 481–490. [72] Zhang, T., Kishore, V., Wu, F., Weinberger, K. Q., and Artzi, Y. BERTscore: Evaluating text generation with BERT. In International Conference on Learning Representations (2020). [73] Zhang, W., Aliannejadi, M., Yuan, Y., Pei, J., Huang, J.-h., and Kanoulas, E. Towards fine-grained citation evaluation in generated text: A comparative analysis of faithfulness metrics. In Proceedings of the 17th International Natural Language Generation Conference (Tokyo, Japan, Sept. 2024), S. Mahamood, N. L. Minh, and D. Ippolito, Eds., Association for Computational Linguistics, pp. 427– 439. [74] Zhang, Y., Li, Y., Cui, L., Cai, D., Liu, L., Fu, T., Huang, X., Zhao, E., Zhang, Y., Chen, Y., Wang, L., Luu, A. T., Bi, W., Shi, F., and Shi, S. Siren’s song in the ai ocean: A survey on hallucination in large language models. Computational Linguistics (08 2025), 1–46. [75] Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., Zhang, H., Gonzalez, J. E., and Stoica, I. Judging

Assessing Attack Surfaces in Generative Search Engines

llm-as-a-judge with mt-bench and chatbot arena. In Proceedings of the 37th International Conference on Neural Information Processing Systems (Red Hook, NY, USA, 2023), NIPS ’23, Curran Associates Inc. [76] Zhou, H., Lee, K.-H., Zhan, Z., Chen, Y., Li, Z., Wang, Z., Haddadi, H., and Yilmaz, E. Trustrag: Enhancing robustness and trustworthiness in retrievalaugmented generation. https://arxiv.org/abs/2501.00879, 2025.

[77] Zou, W., Geng, R., Wang, B., and Jia, J. Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models. In Proceedings of the 34th USENIX Conference on Security Symposium (USA, 2025), SEC ’25, USENIX Association.

Related documents

• Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains#616950
• Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains#616450
• GENERATIVE AI TRAINING AND COPYRIGHT INFRINGEMENT : A COMPARATIVE ANALYSIS OF THE INDIA, UK, US AND EU#444332
• Generative AI Compresses Expertise Signals and Accelerates the Withdrawal of Genuine Contributors from Online Communities#336404
• Stylometric Analysis for Authorship Verification and Generative AI Detection#387424