Why this matters
When an AI engine answers a buying question, it reads a handful of pages and cites a few of them. Most advice about how to become one of those pages rests on counting what happens to get cited, which cannot separate cause from coincidence. This review starts with the first large experiment that changes one property of a page at a time and measures what the engine does, then sets it beside seven other 2026 studies on dates, citations, user-generated content and answer stability.
The experiment: eighteen content factors, tested one at a time
Vishwakarma, Kumar and Jamidar built 100 product-review articles across 50 consumer categories and replaced every brand, product and publisher name with a fictional alias, so that fame could not influence the result. From these they made 1,440 pairs of pages that differed in exactly one factor, matched on facts, prices, specifications and length to within 5%. Each pair was tested with three wordings of the question, five repetitions each, and with the order of the two pages swapped to cancel position effects. That produced 252,000 trials across six models: Gemini-2.5-Flash, GPT-5-Nano, GPT-5-Mini, GPT-5.2, Claude-3.5-Sonnet and Kimi-K2-Thinking. The outcome was simple: which of the two pages the model cited first. The paper was accepted at SIGIR 2026 and posted in May 2026.
Four factors won on every one of the six models. A page that was on topic beat one that was off topic, a page that stated a price beat one that did not, a page with a recent date beat one with an old date, and the page placed first beat the page placed second. A second group had strong effects on all six models: depth of coverage, technical specifications, confident rather than hedged wording, evidence attached to claims, strong social proof such as reviews, and use of the words in the question. Value propositions, internal consistency and comparisons with alternatives had moderate effects. Organization, promotional tone and a recent date compared with no date at all were weak or inconsistent.
One factor did nothing on any model. Structured layout compared with dense prose produced odds ratios between 0.79 and 1.68 with no consistent direction. Reformatting is among the most commonly sold services in this field, and the authors' own checklist says formatting "showed minimal ROI and can be deprioritized."
The date finding is about staleness
The three date comparisons, read together, describe a precise mechanism. A recent date against an old one was an overwhelming advantage. No date against an old date was a small but positive advantage, with odds ratios of 1.31 to 2.32. A recent date against no date was inconsistent, significant on three of six models with odds ratios from 1.15 to 13.0. The engines penalize a visible stale date far more than they reward a fresh one.
That has an uncomfortable implication. The experiment held the content identical and changed only the date string, so the advantage is available to anyone willing to edit a date on a page that has not changed. A separate study, EvoTrustRAG (August 2026), found that injecting a fabricated date or event pushed baseline systems into falsely reporting that a fact had been updated in 23.0% to 25.1% of cases. The same study found that a standard retrieval system answered current facts correctly 70.5% of the time, historical facts 48.2% of the time and facts that had changed only 42.0% of the time. These figures come from small open models with seven to eight billion parameters, so they show that the problem exists without measuring any commercial engine.
How to read these numbers carefully
Many cells in the experiment show an odds ratio above 10,000. Those figures mean the favored page won essentially every trial, so the odds ratio has no stable upper limit. The honest reading is that the effect was deterministic in this design, and the finite values (for the date factor, 68.7 on Kimi, 14.4 on GPT-5-Nano and 1,494 on GPT-5-Mini) are the ones worth quoting.
The study has real limits, and the authors state them. Each contest involved two pages, while production engines often retrieve five to ten or more. Brands were deliberately anonymized, so the results measure what the text contributes once fame is removed, and real engines may still favor known brands and trusted domains. GPT-4o generated the articles and the paired rewrites, checked by the authors on a stratified sample of 300 scenarios. Two of the six models, Claude-3.5-Sonnet and Gemini-2.5-Flash, are two generations old, and Claude-3.5 produced the most extreme values. The ranking of factors was consistent across all six models, and that ordering is the finding most likely to carry to newer systems.
All three authors work for a company that sells brand-visibility software, which is a conflict of interest. Three things weigh against it shaping the result. The paper passed peer review at a major information retrieval conference, the method is unusually conservative, and its clearest finding, that formatting does nothing, cuts against a common commercial offering.
Models cannot check their own citations
GhostCite, from Nankai and Tsinghua universities (February 2026, revised May 2026), asked 13 production models to cite academic papers across 40 computer science fields. It verified 375,440 generated citations against bibliographic databases and found 50.29% invalid overall, ranging from 14.23% for DeepSeek-V3.1 to 94.93% for Hunyuan-A13B. Fabrication rose sharply with the claimed publication year, from 27.61% for references dated 2000 to 98.75% for references dated 2025. Combined with the date experiment, this describes systems that prefer recent material and invent it most freely.
The researchers also gave the models a balanced set of 50 valid and 50 invalid citations to judge. Average accuracy was 38%, below a coin flip, and Claude-4 scored 27%. These are scholarly references rather than web links, so the rates should not be quoted as rates of fake web citations. The lesson about checking transfers well: a model asked to verify sources gives confident and unreliable answers, while a tool that actually resolves each reference does the job.
User-generated content is a channel and an attack surface
Zhang, Triedman and Shmatikov at Cornell Tech (May 2026, revised September 2026) ran 176 queries through five deep-research systems. On three open-source agents, user-generated content made up 16.7% to 23.4% of retrieved links, and Reddit accounted for 53.7% to 70.7% of that. Among commercial systems, Gemini Deep Research cited user-generated sources 12.1% of the time and OpenAI Deep Research 0.4%, a thirtyfold difference.
The attack finding is stark. A snippet of about 13 words appended to a search result was enough for one agent to cite the planted claim 72.9% of the time. Detection by text predictability pointed the wrong way, because planted text was more predictable than organic text, and filters that check whether a report looks plausible flagged honest runs more than poisoned ones. Blocking user-generated domains at retrieval worked and cost almost nothing in report quality, though only the operator of the engine can do it.
Who is asking changes the answer
In a study posted in May 2026, Jack, Lehman, Maloney and Xu, authors at an AI marketing company, ran 2,000 queries with ten buyer personas, such as a US e-commerce operator or a UK small-business owner. Changing the persona reduced the overlap of recommended brands by 0.12 to 0.20 on a zero-to-one scale, and every confidence interval excluded zero. The largest effect appeared on Claude-Sonnet-4.6, and a higher reasoning setting on GPT-5.4-mini produced a larger shift than a lower one. Mid-market brands were by far the most sensitive, with swap rates of 0.39 to 0.75, against 0.20 to 0.29 for category leaders, 0.05 to 0.23 for challengers and 0.27 to 0.33 for regional brands. The study ran on a single day, in English, so it describes direction more than fixed values.
A separate audit by a commercial research firm and the University of Oxford (March 2026) appears to contradict this. Across 2,070 questions on ChatGPT-4o, Gemini 1.5-Flash and DeepSeek-V3, the rank order of how often brands were included held almost perfectly across repetitions, with Spearman correlations of 0.952 to 1.00. Both results are correct because they measure different things. Totals across many questions are stable, while the set of brands in any single answer is not, and a measurement that reports the first can look far more reliable than a buyer's actual experience. The same audit found a strong preference for US brands, with a log-odds of 4.96 for US over European laptops on GPT, about 143 times.
Long documents hide their claims
PosIR (January 2026, revised March 2026) tested 10 embedding models across 421,708 queries and more than 17 million documents in 10 languages. Sensitivity to where information sits in a document rose from 0.18 for documents up to 512 tokens to 0.41 for documents up to 2,048 tokens, and in the worst model retrieval quality fell by 77%. Most models favored information near the start. The study covers the retrieval step only, but it suggests a claim buried deep in a long page may never be found.
Manipulation is harder than it looks
GEO-Bench, from the University of Southern California and Arizona State University (May 2026), compared eight manipulation methods and ten honest rewrites on 16,360 items. No attack was at once effective, hard to detect and fluent. Plain authoritative rewriting matched the best attacks on one dataset while staying undetectable, though it scored zero on two others. Every result comes from a single open model, Llama-3.1-8B-Instruct, so none of the numbers should be applied to commercial engines.
What this means for brands
The controlled evidence points to a short list of inexpensive actions. Pages that sell something should state a price and specifications, keep claims early and documents tight, attach evidence, and speak plainly where a claim is defensible. A page that carries a date should carry a true one, and a page that will not be updated should have its stale date removed. Spending on reformatting alone is poorly supported.
The same evidence draws an ethical line. Changing a date on unchanged content would probably work, and it is a fabrication. Brands should also expect forums such as Reddit to shape what some engines repeat, treat any model's judgment of its own sources with suspicion, and measure visibility across many questions, personas and runs before trusting a single answer.
Sources
- Vishwakarma, Kumar and Jamidar, "What Gets Cited: Competitive GEO in AI Answer Engines," arXiv, May 2026
- Nie et al., "EvoTrustRAG: Evolution-Aware Conflict Attribution and Evidence Handling," arXiv, August 2026
- Xu et al., "GhostCite: A Large-Scale Analysis of Citation Validity in the Age of Large Language Models," arXiv, February 2026
- Zhang, Triedman and Shmatikov, "Deep-Research Agents Can Be Poisoned via User-Generated Content," Cornell Tech, arXiv, May 2026
- Jack et al., "Persona Conditioning of Brand Recommendations in Retrieval-Augmented Commercial Chat," arXiv, May 2026
- Rienecker et al., "Auditing Preferences for Brands and Cultures in LLMs," arXiv, March 2026
- Zeng et al., "PosIR: Position-Aware Heterogeneous Information Retrieval Benchmark," arXiv, January 2026
- Nimase et al., "GEO-Bench: Benchmarking Ranking Manipulation in Generative Engine Optimization," arXiv, May 2026
Get every new issue by email
Long-form issues on clean and frontier technology markets, plus our research on AI search, written by the ZLABS team. Free, with no spam.
By subscribing you agree to receive the ZLABS University newsletter by email. You can unsubscribe at any time.