AI search citations look like evidence, but each link is the output of a supply chain: publishing, crawling, indexing, retrieval, citation selection, answer synthesis, and display. A 2026 study of 17,211 citation instances shows that source preference can amplify ordinary web publishing into a low-barrier security path. The result is narrower than arbitrary answer manipulation, but strong enough to require provenance controls at every interface.
Reading time: 8 minutes | Words: about 1,450
TL;DR
- Ten AI-search platforms concentrated citations in different preferred domains; their top 20 domains captured 20.5% to 70.8% of citations.
- Fifteen of 22 tested publication platforms had low or medium barriers for both account creation and posting.
- Controlled posts for a fabricated concept were cited by eight of ten systems within seven days.
- The study measures a publication-to-citation path. It does not prove reliable control of arbitrary answers, user belief, or business harm.
A citation is the end of a pipeline
Traditional search gives users a ranked list and leaves source comparison visible. AI search selects pages and synthesizes an answer before the user inspects the evidence.
That creates a multi-owner supply chain:
| Stage | Main decision | Typical owner |
|---|---|---|
| Publication | Who may place content on a domain | Publisher or UGC platform |
| Crawl and index | What enters the searchable corpus | Search backend |
| Retrieval and reranking | Which pages become candidates | AI-search provider or partner |
| Citation selection | Which candidates receive visible attribution | AI-search provider |
| Answer absorption | Which claims enter generated text | Model and orchestration layer |
| User display | How provenance, date, and uncertainty appear | Product interface |
A domain can rank as a preferred source while allowing ordinary users to publish quickly. The study calls this mismatch a citation-governance gap. The attacker does not need model weights, prompt access, or direct writes to a private retrieval index. Ordinary publication can be enough.
This is distinct from RAG poisoning, indirect prompt injection, and query-side jailbreaks. The content can look like normal evidence and enter through standard public interfaces.
What 17,211 citations actually measure
The Fudan University team evaluated ten consumer AI-search systems across Chinese and English web ecosystems. In March 2026, it used 120 queries, balanced across product comparisons, technical documentation, news, and experience or opinion. Each question was issued once per platform in a fresh conversation.
The resulting dataset contained 17,211 cited URLs across 6,356 unique source domains. These are citation instances, not 17,211 attacks or independent articles.
The distributions were concentrated but platform-specific:
- each platform's top 20 domains captured between 20.5% and 70.8% of citations;
- the mean Jaccard overlap between platforms' top 20 domains was only 0.201;
- Chinese- and English-web systems largely formed different citation networks;
- concentration changed by query category and platform.
The practical lesson is not that every system trusts the same bad sources. It is that each platform develops a preferred source surface, so security audits must be platform-specific.
Source preference amplifies ordinary publishing
The researchers then tested 22 publication platforms linked to frequently cited source domains. Fifteen had low or medium barriers for both account setup and posting, while 18 showed minutes-level or no visible review delay.
Next came controlled publication experiments. For a fabricated concept with no prior web presence, eight of ten AI-search platforms cited the researchers' content within seven days. After the first citations appeared, citation and marker absorption varied substantially by topic and platform.
Platform choice mattered. In five matched low-competition topic pairs, articles on high-preference platforms appeared before matched low-preference posts. One low-preference case needed 20 posts before appearing, while 40 self-hosted WordPress posts remained uncited during the one-week window.
Volume helped less than linearly. Increasing high-preference posts from one to 20 raised citation instances from 24 to 128, a 5.3 times increase for 20 times the content. Some systems showed no signal in that experiment.
The correct statement is therefore precise: existing source preference can amplify targeted ordinary publication. The study does not show that an attacker changed the platform's preference or can control any desired answer.
The $14 GEO experiment proves one chain
The team also purchased one commercial generative engine optimization service. For $14, a vendor published 13 posts across five public platforms within 28 minutes. Within one hour, Doubao cited one vendor-published page and reproduced a designed marker that had been absent from pre-purchase queries.
This is a useful end-to-end trace: payment, public posting, production citation, and marker absorption. It is also an n=1 case study involving one vendor, topic, budget, and observed platform. It cannot estimate the success rate of the GEO market or show that the same tactic works for politics, medicine, finance, or competitive commercial queries.
That limitation matters. A security article should preserve the evidence chain instead of upgrading one reproducible event into a market-wide claim.
Citation is not claim adoption
A visible URL can fail in several ways:
- the page is cited but its claim is not used;
- the answer uses the claim but cites the wrong page;
- the source is accurate but stale;
- multiple URLs repeat one upstream claim, creating false diversity;
- the answer merges a reliable source with a low-quality source without showing the conflict.
The paper used designed markers because URL presence alone does not establish answer absorption. This distinction should become a standard metric. Platforms need to measure retrieval, citation, and claim use separately.
Independent work supports the concern from another direction. Columbia Journalism Review's Tow Center tested 1,600 source-identification queries across eight AI-search tools and reported errors in more than 60% of responses. That study examined downstream attribution, not publication-side influence. Together, the two results show that upstream source entry and downstream citation accuracy are separate failure surfaces.
Build a citation security ledger
No single filter can secure this pipeline. A practical control set should record source identity, publication history, and claim lineage.
| Signal | Why it matters | Caveat |
|---|---|---|
| Domain concentration | Finds over-reliance on a small source set | Expertise can legitimately concentrate sources |
| Page and account age | Flags sudden low-history publication | New sources are not automatically malicious |
| Cross-platform near-duplicates | Detects coordinated seeding | Syndication may be legitimate |
| Publication-time clusters | Reveals campaigns | Breaking news naturally clusters |
| First-citation latency | Highlights unusually fast uptake | Crawl schedules vary |
| Independent source families | Prevents one claim masquerading as many | Ownership graphs are incomplete |
| Citation-to-marker absorption | Separates visible links from claim use | Markers are mostly available in controlled tests |
| Version and correction history | Reduces stale evidence | Publishers expose revisions inconsistently |
The output should resemble a citation software bill of materials: page, domain, owner, publication path, first seen time, retrieval time, cited claim, independent corroboration, and known corrections.
At ranking time, providers can add provenance-aware reranking, diversity constraints, and temporal anomaly detection. At answer time, they can distinguish primary sources from commentary, collapse duplicate source families, and expose conflicts. At the interface, users need dates, source types, and claim-level citation links rather than a decorative list of URLs.
These are engineering proposals, not proven defenses. Their detection and false-positive rates still require evaluation.
The research has its own supply-chain boundary
The authors published fabricated but low-risk material on real public platforms to establish causality. They excluded medicine, finance, politics, public safety, and vulnerable populations, used attribution markers, monitored propagation, and removed or relabeled controlled content after the experiment where possible.
Vendor-published GEO pages were outside the researchers' direct account control, so cleanup depended on requests to the vendor or platform. That is an important lesson: a real-world experiment inherits the deletion and governance constraints of the publication systems it uses.
Frequently asked questions
Is this the same as RAG poisoning?
No. Traditional RAG poisoning assumes direct or indirect placement into a retrieval corpus. This study used ordinary public publishing on domains already favored by AI-search systems.
Did all ten platforms get hacked?
No. Eight cited a controlled fabricated concept within seven days. Results varied by platform and experiment, and one snapshot cannot establish permanent vulnerability or immunity.
Does a citation mean the answer believed the source?
No. Retrieval, visible citation, and claim absorption are separate events. The study measured both URLs and designed markers to reduce this ambiguity.
Does the $14 case prove that GEO usually works?
No. It proves one attributable commercial path. Market-wide effectiveness needs many vendors, topics, budgets, platforms, and repeated trials.
How can users verify an AI-search citation?
Open the source, confirm that it supports the exact claim, check date and authorship, trace repeated claims to an independent primary source, and compare at least one source family not selected by the same answer.
Next action: AI-search providers should publish source-concentration and claim-attribution audits by platform and query category. Teams using AI search for consequential decisions should preserve the answer, cited pages, timestamps, and independent checks as one reviewable evidence bundle.