🤖 AI

GPE: Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning

This paper introduces GPE, a multi-domain benchmark and evaluation framework designed to assess the robustness of fact-verification systems against Generative Engine Optimization (GEO) poisoning by controlling evidence sources and attack ratios, revealing critical vulnerabilities and trade-offs not detectable in clean environments.

Original authors: Zhaoqi Wang, Zijian Zhang, Xiaomei Yuan, Pengtao Kou, Jiamou Liu, Zhen Li, Liehuang Zhu

Published 2026-07-24

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zhaoqi Wang, Zijian Zhang, Xiaomei Yuan, Pengtao Kou, Jiamou Liu, Zhen Li, Liehuang Zhu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a massive, bustling library where the books are constantly being rewritten by a chaotic crowd. In this library, Artificial Intelligence (AI) acts like a super-smart librarian who doesn't just memorize facts but goes out to fetch the latest books to answer your questions. This is how modern AI works: it uses "retrieval-augmented generation," meaning it searches the web for fresh information to back up its answers. But here's the catch: what if someone sneaks into the library and swaps the real books for fake ones that look and sound exactly like the real thing? This is the danger of "GEO poisoning." Just as a bad actor might try to trick a search engine into showing their fake news first, they can flood the library with convincing lies designed specifically to fool the AI librarian. The big question for scientists is: if the library is full of these clever forgeries, can the AI still tell the truth, or will it get tricked into believing the fake books are real?

This is exactly the problem tackled by a new study called GPE (Generative Engine Optimization Poisoning Evaluation). The researchers built a special "training gym" for fact-checking AI, designed to test how well these digital librarians can spot lies when the evidence they find is contaminated. Instead of just asking, "Can the AI find the right answer?" they asked, "Can the AI find the right answer when 33%, 67%, or even 100% of the evidence it finds has been secretly poisoned?" They created a massive dataset covering six different worlds: politics, celebrity gossip, science, medicine, history, and everyday life. For every claim, they gathered real evidence and then injected different types of "poison"—some were fluent fake articles, some were real news articles with key facts swapped out, and some were even instructions telling the AI to ignore the truth.

The results were a bit of a wake-up call. The study found that even the smartest AI models struggle significantly when the evidence is poisoned. In a clean environment with no lies, the best models got the answer right about 52% to 53% of the time. But as soon as the evidence was polluted, their performance dropped sharply. For instance, when the evidence was completely replaced with fake content, some models' accuracy plummeted to single digits. The researchers discovered that no single method was a superhero; a model that was good at spotting one type of fake news often failed miserably against another. They also found that trying to be more careful often cost the AI more "brain power" (in the form of computer tokens), making it slower and more expensive without necessarily making it safer.

One of the most interesting findings was about the type of poison. The study showed that "Adaptive Tampering Attacks" (ATA)—where bad actors take a real, trustworthy-looking article and just change a few numbers or names—were the most dangerous. These were harder for the AI to detect than obvious, made-up fake news because they looked so much like the real thing. The researchers also built a "knowledge graph," which is like a giant map connecting all the people, places, and documents in their dataset. This map helps researchers see how a single piece of poisoned evidence can spread and trick the AI about multiple different claims.

Ultimately, the paper suggests that we cannot rely on current AI fact-checking methods to be robust against these attacks. The study proves that an AI might look confident and smart when the evidence is clean, but that confidence can vanish the moment the evidence is manipulated. The authors conclude that we need new ways to evaluate these systems, not just on how well they work in a perfect world, but on how they survive in a messy, adversarial one where the truth is hidden behind a wall of convincing lies.

Technical Summary: GPE – Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning

1. Problem Statement

The rapid advancement of Large Language Models (LLMs) has led to the widespread adoption of retrieval-augmented workflows, where models use external search tools to access up-to-date information. However, this introduces a critical vulnerability: the retrieval stage can be manipulated. This risk is exacerbated by Generative Engine Optimization (GEO), a paradigm designed to make content more likely to be retrieved, summarized, and cited by generative search engines. In adversarial settings, GEO poisoning occurs when adversaries publish large volumes of search-friendly, model-optimized content around a target claim to steer the model toward incorrect conclusions.

Existing fact-verification benchmarks (e.g., FEVER, LIAR, GossipCop) are insufficient for evaluating robustness in this new environment because they:

Lack a unified, open evidence environment where competing methods are tested against the same retrieved information.
Often focus on single domains, limiting generalization.
Do not systematically inject poisoned evidence, making it impossible to measure how reliability degrades as adversarial content increases.
Fail to address the "Byzantine-robust aggregation" challenge, where a system must judge a mixed pool of evidence containing outdated, inaccurate, or intentionally fabricated documents.

2. Methodology: The GPE Framework

The authors propose GPE (GEO Poisoning Evaluation), a multi-domain fact-verification benchmark and evaluation framework designed to control evidence sources and poisoning ratios.

A. Benchmark Construction

Data Collection: Claims are collected from six categories: politics, entertainment gossip, science, medicine/health, history, and life commonsense. Sources include fact-checking sites (PolitiFact, Snopes), news outlets (Reuters, BBC), and official organizations (WHO, NASA).
Evidence Environment: For each claim, an agent-based pipeline collects raw evidence from diverse sources (web, Wikipedia, arXiv, social media, etc.). The process is iterative, seeking stance-balanced evidence and avoiding redundant sources.
Labeling: Claims are assigned a six-way label space: true, mostly_true, half_true, mostly_false, false, uncertain. The framework also supports fine-grained subclaim labels to decompose compound claims into atomic facts.
Poisoning Mechanism: The framework generates malicious evidence sets ( $D^m_i$ $D_{i}^{m}$ ) to mix with benign evidence ( $D_i$ $D_{i}$ ) at controlled ratios ( $\alpha \in \{0\%, 33\%, 67\%, 100\%\}$ $α \in {0%, 33%, 67%, 100%}$ ). Four attack types are implemented:
1. FakeGPT-style: Synthesized, fluent, and persuasive misleading passages optimized for LLMs.
2. PoisonedRAG-style: Documents injected to steer the model toward an adversarial target label (e.g., flipping true to false).
3. Adaptive Tampering Attack (ATA): Real documents where key entities, quantities, dates, or causal relations are altered while preserving the original style and source appearance.
4. Ignore Injection: Instructions embedded in documents that command the verifier to ignore other evidence and adopt a specific target label.
Knowledge Graph: An auxiliary graph connects claims, subclaims, evidence, entities, events, and sources to enable analysis of evidence reuse, source dependence, and poisoning propagation.

B. Evaluation Protocol

Black-Box Testing: The framework evaluates user-supplied methods (Direct, RAFTS, SAFE, STEEL) as black boxes. Methods receive the same raw evidence list but apply their own internal analysis ( $\Phi_M$ ).
Metrics:
- Exact Six-Way Accuracy: Strict matching of the predicted label to the ground truth.
- Token Efficiency: Measured via Tokens per Correct Verification (TCV) and 1000 Correct Predictions per Token (1000C/T) to assess the cost-efficiency of robust reasoning.
- Fine-Grained Analysis: Subclaim-level accuracy and ordinal mean scores (giving partial credit for near-miss labels).

3. Key Contributions

GPE Dataset: A multi-category fact-verification dataset covering six domains with human-verified labels, collected benign evidence, and systematically generated poisoned evidence.
Evaluation Framework: A unified protocol that allows for the systematic variation of poisoning ratios while keeping claims and evidence selection fixed, enabling the isolation of robustness from retrieval variance.
Knowledge Graph: A structured registry linking 638 claims to over 22,000 entities and 11,000 evidence items, facilitating graph-based analysis of cross-instance dependencies and poisoning paths.

4. Experimental Results

The authors evaluated four verification strategies (Direct, RAFTS, SAFE, STEEL) using DeepSeek-V4-Flash and GPT-5.4 backbones.

Clean Performance: Even without poisoning, six-way verification is difficult, with best clean accuracies around 52–54%. No single method dominates across all domains.
Robustness Degradation: All methods suffer significant accuracy drops as poisoning ratios increase.
- ATA (Adaptive Tampering) proved to be the most damaging attack on average, causing the steepest degradation. This suggests that preserving source-like context while altering key facts is highly effective.
- Ignore Injection showed varied results; STEEL (which uses staged control flow) was more resistant to this specific attack but remained vulnerable to content tampering.
- No Universal Robustness: A method robust against one attack type or poisoning ratio was not necessarily robust against others.
Efficiency Trade-offs: As accuracy collapses under poisoning, the Tokens per Correct Verification (TCV) increases dramatically. For example, under 100% FakeGPT poisoning, the TCV for the Direct method on DeepSeek-V4-Flash rose from 2.00K to 11.92K, indicating that inexpensive predictions become highly inefficient when accuracy fails.
Subclaim Analysis: Fine-grained evaluation revealed that while overall accuracy drops, some methods (like STEEL) retained higher ordinal mean scores, suggesting they could still approximate the correct veracity level even when failing exact label matching.

5. Significance and Claims

The paper asserts that GPE fills a critical gap by providing the first controlled environment to evaluate fact verification under adversarial GEO-style poisoning. The authors claim that:

Robustness is distinct from clean accuracy: High performance on clean data does not guarantee resilience against poisoned evidence.
Attack specificity matters: Defenses effective against instruction injection (Ignore Injection) do not necessarily protect against semantic tampering (ATA).
Efficiency is conditional: Low token costs are only meaningful when accuracy is maintained; otherwise, the cost per correct judgment becomes prohibitive.
Need for new evaluation: Current benchmarks cannot assess the "Byzantine-robust aggregation" required for real-world fact-checking in untrusted information environments.

The paper concludes that evaluating fact verification requires moving beyond clean retrieval settings to understand how models aggregate diverse, noisy, and potentially malicious evidence.