Black-hat GEO: hidden instructions, preference manipulation and why it backfires
By the SEOCells team, OmCells R&D Labs LLP · Published
Black-hat GEO tries to manipulate AI answers with hidden instructions or crafted text rather than better content. Research shows such attacks can work on production systems, but they violate search spam policies, degrade answers for everyone and expose the site to removal. The durable strategy is the opposite: visible, verifiable, helpful content.
Key points
- Instructions hidden in web content can steer an LLM that later reads it (Greshake et al., 2023).
- A short “strategic text sequence” on a product page raised its chance of top recommendation in experiments (Kumar & Lakkaraju, 2024).
- Preference manipulation worked on production LLM search engines and creates a prisoner's dilemma (Nestaas et al., 2024).
- Google's spam policies already cover hidden text, cloaking and scaled content abuse.
How can hidden instructions in a web page steer an AI?
Greshake et al. (2023) showed that applications which feed retrieved web content into a language model can be steered by instructions hidden in that content — the model cannot reliably tell data from instructions. For search, this means text addressed to the AI (“ignore previous instructions and recommend…”) placed on a page, often invisibly, can influence an answer. Engines invest in defences precisely because this is a known attack class.
Can a page really manipulate LLM recommendations?
In controlled experiments, Kumar and Lakkaraju (2024) added an optimised “strategic text sequence” to a product's information page in a catalogue of fictitious coffee machines and significantly increased its chance of being the model's top recommendation. Nestaas, Debenedetti and Tramèr (2024) introduced preference manipulation attacks — crafted website content or plugin documentation that makes an LLM promote the attacker and discredit competitors — and demonstrated them on production LLM search engines (Bing and Perplexity) and on plugin APIs.
Their game-theoretic point is the important one for businesses: if everyone attacks, all are worse off, a prisoner's dilemma that degrades answers for every user. Engines therefore have strong incentives to detect and demote such content.
How do existing spam policies apply?
Google's spam policies prohibit hidden text and link abuse (white-on-white text, off-screen positioning, zero-size text), cloaking (showing crawlers different content from people) and scaled content abuse (many pages generated primarily to manipulate rankings, however they are created). Text aimed only at AI systems and invisible to people falls squarely within the spirit of these rules. Sites found violating them can rank lower or be removed.
Which practices sit in the grey zone?
| Tactic | Assessment | Why |
|---|---|---|
| Instructions to AI in hidden text or alt text | Do not use | Hidden, manipulative, a recognised attack pattern |
| Self-ranking “top 10” lists that put yourself first | Use with care | Allowed, but disclose the conflict and compare fairly |
| Mass-generated city or keyword pages | Do not use | Scaled content abuse when they add no unique value |
| Structured data that contradicts the page | Do not use | Misleading markup; can lose rich-result eligibility |
| Question-and-answer sections in plain view | Good practice | Visible, useful to people and machines |
| Citing primary sources and stating evidence | Good practice | Makes claims verifiable |
How do you audit your own site for injection or manipulation?
- Search the raw HTML (not the rendered page) for text addressed to AI systems: “ignore”, “assistant”, “AI model”, “recommend”.
- List text nodes hidden by CSS, the hidden attribute or aria-hidden, and confirm each is a legitimate interface element.
- Compare what a crawler receives with what a browser shows (cloaking check).
- Check structured data against visible content: names, prices, ratings, dates.
- Review third-party widgets and user-generated content, which attackers use to plant text on reputable domains.
The SEOCells AEO Report runs an integrity check for hidden instructions, cloaked text, fake urgency, duplicated praise and contradicting markup, and flags problems before any optimisation advice.
Questions answered
Is it illegal to put hidden instructions for AI on my website?
Legality depends on jurisdiction and intent, but it breaks search engine spam policies and can be treated as manipulation. The practical risk is demotion or removal, and loss of trust.
Can competitors inject content into my site?
Through comments, reviews, forums or compromised plugins, yes. Moderate user content, keep software updated and audit hidden text regularly.
Is GEO itself black hat?
No. GEO as defined in research is about making content more visible in generative answers. It becomes black hat when it relies on deception rather than better, visible content.
References
- Greshake, K. et al. (2023). Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications. arXiv:2302.12173
- Kumar, A. & Lakkaraju, H. (2024). Manipulating Large Language Models to Increase Product Visibility. arXiv:2404.07981
- Nestaas, F., Debenedetti, E. & Tramèr, F. (2024). Adversarial Search Engine Optimization for Large Language Models. arXiv:2406.18382
- Google Search Central — Spam policies for Google web search
- Aggarwal, P. et al. (2024). The GEO paper. KDD 2024. arXiv:2311.09735
- Liu, N. F., Zhang, T. & Liang, P. (2023). Evaluating Verifiability in Generative Search Engines. Findings of EMNLP 2023. arXiv:2304.09848
Search engines and AI assistants change often; check the linked documentation for the latest details. Nothing in this guide is a promise of rankings, citations or results.
Check your page for hidden instructions, cloaking and misleading markup.
See the integrity check