Generative engine optimization (GEO) has reshaped how sellers compete for visibility in LLM-generated rankings. By embedding persuasive arguments in the content they control, sellers can influence how generative engines rank products and web pages and push their own items to the top. Existing defenses either detect harmful intent or unnatural language, which fluent GEO content often lacks, or rewrite all candidates, which alters legitimate listings without identifying the manipulated ones. However, these approaches overlook the persuasive structure through which GEO attacks influence LLM-based rankings. To address this gap, we present SCI-Defense, a framework for detecting persuasion-structured ranking manipulation, in which an LLM judge scores five persuasion devices grounded in research on influence and deception: authority, social proof, scarcity and urgency, comparative claims, and narrative purposiveness. Two lightweight gates for unnatural strings and inflated relevance complement the judge, and flagged candidates are demoted rather than rewritten, each with a record of the candidate and the criterion that triggered the flag. On 1,152 optimized CORE attacks across six Amazon product categories and six MS MARCO web domains, SCI-Defense detects 89.6% of reasoning attacks and 96.2% of review attacks at a 1.2% false positive rate and blocks 96.1% of the attacks that pushed their target into the top three. On a 120-query subset, paraphrasing and truncation block a similar share of attacks but push 4.0--4.5% of honest items out of the top three, compared with 0.6% for SCI-Defense.
Min Zeng, Xin Wen, Xi Chen, Yichen Zhang, Wen-Xin Zhou
We develop a derivative-free temporal-difference (TD) framework for calibrating black-box simulators using one-step transitions from a target system and noisy simulator-generated continuation values. The calibration parameter is defined through Bellman orthogonality, recovering the physical parameter under correct simulator specification and yielding a near-optimal $L_2$ approximation of the policy value under misspecification. We propose three TD algorithms based on random-direction finite differences, distinguished by their query costs and reuse of noisy simulator evaluations. We establish almost-sure convergence, last-iterate mean-square error bounds, and central limit theorems for Polyak-Ruppert averages across four query-noise regimes. Our analysis reveals a specification-dependent bias phenomenon: for two algorithms, the finite-difference bias of the TD estimating equation vanishes at the calibration target under correct specification, even when the gradient surrogate remains biased. This permits a fixed perturbation radius and rate exponents approaching $1/2$ in the simulator rollout budget, whereas misspecification generally recovers the classical Kiefer-Wolfowitz rates. We also develop a few-replicate online bootstrap that yields Student-$t$ calibrated confidence intervals under negligible query noise, and identify a covariance mismatch that can invalidate conventional multiplier inference along Markov trajectories. Finally, a second-stage TD recursion corrects the remaining value discrepancy without additional simulator queries.