AI search tools cited a made-up concept within a week, Fudan University paper finds

Eight of 10 AI search tools cited a made-up concept called the "Cactus Gravity Protocol" within seven days of researchers posting about it on sites those tools already cite often, according to a paper from Fudan University posted on arXiv on 8 October 2026. All four English-web tools tested (ChatGPT, Perplexity, Grok and a Google product the paper labels "Google AI") cited the posts. Grok linked to one of the posts in 30 of 32 answers after its first citation. Posts about an opinion question and a fictional product mostly did not get through.

The paper is From Public Posts to AI-Search Citations: Measuring the Fragility of AI Search, by Qi Liu, Geng Hong, Xinyang Zhang, Pei Chen, Yutong Li and Min Yang. The arXiv version carries the header of the Network and Distributed System Security (NDSS) Symposium 2027. Search Engine Journal's Matt G. Southern covered it on 19 October 2026. This post reports what the paper and that coverage state, and labels interpretation as analysis. The experiments ran in March and April 2026, so the figures describe the tools as they behaved then.

What the Fudan team wanted to measure

The researchers frame AI search as a selection layer. A classic search engine ranks pages. An AI search tool retrieves pages, filters them, picks citations and writes an answer before the user sees any source. The paper's question is whether that layer can be reached through ordinary publishing: if a tool keeps citing a handful of domains where anyone can open an account and post, then a normal post on one of those domains may become a route into the tool's citations and answer text.

The paper treats this as a security issue. It sits in the arXiv category Cryptography and Security, and the authors say they disclosed their findings to all 10 platforms. For marketers, the same mechanism is the core of generative engine optimisation (GEO), and the paper is explicit that the path can be bought, which is covered further down.

Step one: which sites each AI search tool cites

In March 2026 the team ran 120 questions through 10 AI search tools, each in a fresh conversation window, and recorded every cited URL. The paper classifies ChatGPT, Perplexity, Grok and Google AI as English-web tools. The other six, Doubao, Wenxin, Yuanbao, Kimi, Qwen and DeepSeek, are Chinese-web tools.

Across those runs the paper counts 17,211 citation instances spread over 6,356 unique source domains. Citations were concentrated. The top 20 domains captured between 20.5 percent of a tool's citations (DeepSeek) and 70.8 percent (Wenxin). Citation density varied too, from 6.52 citations per question on Qwen to 52.20 on Grok, and the share of questions that produced any citation ranged from 80.8 percent on Google AI to 100 percent on Grok and Perplexity.

Each tool had its own favourites. Search Engine Journal's summary of the paper reports that Reddit was the most-cited site for Google AI and Grok, YouTube for Perplexity and Wikipedia for ChatGPT, and that six to 10 of each tool's 10 most-cited sites accepted posts from ordinary users. The paper adds that at the top-10 level Google AI and Grok overlapped the most, sharing eight domains. Some Chinese tools leaned on their parent company's properties: Doubao cited ByteDance-owned domains in 25.9 percent of citations and Wenxin cited Baidu-owned domains in 24.4 percent.

The authors' conclusion from this step is that citation risk has to be checked tool by tool, because most tools cite many domains that others rarely or never cite.

Step two: how easy it is to post on those sites

In April 2026 the team tested 22 publishing platforms linked to cited domains. For each, they tried to register three accounts and publish up to 20 harmless test posts per account. The paper reports that 15 of the 22 had low or medium barriers for both account setup and posting.

Per Search Engine Journal, Medium, GitHub, LinkedIn and Facebook were rated easy to join and post on. Reddit was harder because of karma requirements and strict deletions. The paper lists Toutiao, Sina Blog, NetEase, Reddit and Yahoo as each having at least one high barrier, such as certification, blocked access, karma rules or deletion risk.

Step three: posting a made-up concept and watching what happened

For each AI tool, the researchers picked the most-cited site that a new account could actually post on. That produced nine publishing platforms: Baijiahao, WeChat Official Account, CSDN, SMZDM, Zhihu, Sohu, YouTube, Douyin and Medium. They published 27 articles, one per platform for each of three topics:

• a fabricated concept, the "Cactus Gravity Protocol";
• an opinion question, whether AI would replace junior programmers within five years;
• a fictional keyboard.

According to Search Engine Journal, first drafts were written with ChatGPT and then revised by hand, and each article carried planted details such as invented names and numbers so the team could tell if a tool repeated them. Before posting, the team checked that no tool gave an informative answer on the fictional topics or repeated the planted details. After posting, they ran the same five questions per topic on every tool each day for a week.

The results for the made-up concept are the headline. The table below shows, for the four English-web tools, how often each cited one of the posts and how often its answer repeated a planted detail, counting from the first day that tool cited the posts. The figures come from the paper's Table III.

The gap between the two columns matters. Being cited is not the same as being repeated. Perplexity cited the posts in 13 answers and used none of the planted details. The paper makes the same point about the product topic: a tool can cite a placed page without its distinctive claims entering the answer.

Why the made-up concept worked and the other topics mostly did not

Across all tools, after first citation, the fabricated concept was cited in 62.9 percent of answers and its planted details appeared in 32.2 percent. The opinion question managed 18.8 percent and 3.5 percent. The fictional keyboard reached 36.4 percent and 4.7 percent. The fabricated concept produced a signal on eight of the 10 tools; the other two topics on three each.

Among the English-web tools, Perplexity was the only one to cite an opinion post, in 11.4 percent of its 35 answers, and none of the four cited the keyboard posts within the week, per Search Engine Journal. DeepSeek showed no citation or planted detail for any topic.

The authors do not claim to know why. Topic, competition and type of question all changed together across the three topics, so they say they cannot isolate one cause. Their reading is that the effect is shaped by how much material already exists on a topic and by how willing each platform is to pull from the cited page, and that existing web discussion on the opinion topic can dilute both citation and planted-detail uptake.

Where you post mattered more than how much you post

The team ran paired tests on five relatively unknown holiday destinations. For each, one post went on a site the tools cite often and one on a site they rarely cite. In every pair, the post on the often-cited site produced the first citation or planted detail. The best result on the rarely cited side took 20 posts. Forty posts on a self-hosted WordPress site drew no citation at all within seven days. The paper's abstract adds that one article on a high-preference platform had more citation impact than more than 20 matched posts on low-preference platforms.

A separate test used six fictional subjects with between one and 20 posts each on Sohu. Total citations across all 10 tools rose from 24 to 128 as volume rose. Because each volume level used a different subject published at a different time, the authors call this an association across topics, not an effect of adding posts. Search Engine Journal adds that ChatGPT never cited those Sohu posts and Google AI cited only the three lowest-volume topics.

Follow-up tests: replication and deletion

To check the result was not limited to three topics, the team posted on 10 more low-risk fabricated topics, one post each on three citation-preferred platforms (Search Engine Journal names Sohu, YouTube and CSDN). Nine of the 10 topics drew at least one citation or planted detail across the 10 tools. Only a topic about an aroma storage box produced nothing.

A 15-day run tested what happens after deletion. The team deleted all 27 articles after the Day 11 measurements and kept querying. Citations fell but did not disappear. The paper reports that Doubao kept citing the deleted fabricated-concept content on Days 12 to 15 and several other tools kept low-level citations, which the authors attribute to cached pages, delayed index refresh or stale retrieval.

The $14 GEO purchase

The paper also looked at whether this path is sold as a service. The authors surveyed GEO providers found between January 2025 and March 2026. They identified 13 providers, five aimed at English-language markets and eight at Chinese ones. Of those 13, 12 advertised monitoring AI-answer visibility, 11 producing or rewriting content, seven targeting specific AI platforms and three seeding content across user-generated or media platforms.

The team then bought the vendor's cheapest option, a $14 Chinese-web posting package from a GEO vendor. The paper says the vendor published a fabricated research topic across five public platforms within 28 minutes; the abstract counts 13 public posts. Doubao cited one of those posts, including a planted detail, within one hour. The authors present this as a single case, not a success rate.

What the paper did not show

• No real brand or product was tested. Every topic was invented, so the results do not show whether brand or product queries behave the same way, a limit Search Engine Journal also points out.
• The tools covered were English-web and Chinese-web platforms. There is no Thai-language testing and no Thai data in the paper.
• The paper does not say which Google product "Google AI" refers to.
• All rates come from one March to April 2026 campaign. The authors say exact percentages and platform rankings are likely to drift as the tools change.
• The defence ideas in the paper (source-domain diversity, provenance-aware reranking, temporal anomaly detection) are, in the authors' words, unevaluated design considerations, not tested fixes.

Search Engine Journal adds two pieces of context. Google's guide to its AI features says seeking inauthentic mentions "isn't as helpful as it might seem," and Google's documentation changelog shows that on 15 May 2026, after these tests ran, it clarified that its spam policies also apply to generative AI responses in Google Search. The paper says Doubao, Qwen, Kimi, ChatGPT, Perplexity and Google AI acknowledged receipt of the researchers' disclosure.

Analysis: what this means for GEO and brand safety

The points in this section are Relevant Audience's interpretation of the findings, not claims made by the researchers.

The platform map is the useful part. The study's most practical finding is that each AI tool has a short list of sites it keeps citing, that the lists differ by tool, and that placement on those sites beat volume elsewhere by a wide margin. For legitimate brand information, that argues for finding out which sites each engine cites for your category and making sure accurate facts about your brand exist there, rather than publishing more pages on your own blog. The WordPress result (40 posts, no citations in a week) is a warning against relying on volume on low-preference domains.

Low-competition queries are the exposed ones. The made-up concept worked because nothing else existed on it. Many real brands, especially smaller ones and newer products, have thin coverage for their own name. By the authors' reasoning, those queries are the ones where a single post on a favoured platform has the least competition, whether that post is accurate or not. The study did not test real brands, so this is an inference, but it is the obvious one to check for your own brand.

Citation is not endorsement, and deletion is not removal. The gap between citation rates and planted-detail rates shows that tools often cite a page without repeating its claims. The deletion test shows a removed post can keep being cited for days. Both matter for reputation work: monitoring should look at what the answer says, not only which links appear, and taking a false post down may not clear it from AI answers straight away.

Buying this is a policy risk. The $14 package is the kind of shortcut the paper treats as a security problem and that Google's spam policies, per its 15 May 2026 documentation update, now explicitly apply to generative AI responses. A GEO programme built on seeded posts that pretend to be independent carries that risk. One built on accurate, attributable information on the platforms each engine already trusts does not.

What this means for Thai marketers

The paper has no Thai data. It tested English-web and Chinese-web tools only, and none of its findings can be read as a statement about Thai-language AI answers.

The method transfers, though. A Thai brand can run the same first step on a small scale: ask ChatGPT, Perplexity, Gemini and Google's AI features the Thai questions customers actually ask in its category, and record which sites get cited. If the same few community, video or marketplace sites keep appearing, those are the places where accurate brand information is most likely to reach AI answers, and also where a false claim would travel fastest. That mapping is the starting point of generative engine optimisation for Thai brands and of AI SEO work that treats citation sources, not only rankings, as the target.

Brand monitoring needs the same view. Checking what ChatGPT and other AI assistants say about your brand on a regular schedule, and on which sources they rely, is the practical defence the study points to. It will not stop a bad post from being cited, but it shortens the time before you notice.

Frequently asked questions

Did AI search tools really cite a concept that does not exist?

Yes, in the Fudan experiment eight of 10 tools cited posts about the made-up "Cactus Gravity Protocol" within seven days, including ChatGPT, Perplexity, Grok and Google AI. The concept existed only in the researchers' own posts.

Which AI search tool was easiest to influence in the study?

Grok, among the English-web tools: after its first citation it linked to a researcher post in 30 of 32 answers and repeated a planted detail in 17 of those 32 answers. Across all 10 tools on the made-up concept, Doubao had the highest planted-detail rate at 65.7 percent.

Does posting more content get you cited more?

Not on its own, according to the study: where the post went mattered more than how many posts there were. In paired tests a post on an often-cited site was always cited first, while 40 posts on a self-hosted WordPress site drew no citations in a week.

Does this apply to Thai-language searches?

The source does not say, because the paper tested only English-web and Chinese-web AI tools. Thai brands can test the same pattern themselves by recording which sites AI tools cite for Thai queries in their category.

Did the study test real brands?

No, every topic in the experiments was invented, so the paper does not show how brand or product queries with existing coverage behave. The authors also note that their rates come from March and April 2026 and may change as the tools are updated.

The Fudan paper gives marketers a tested picture of how AI search picks its sources, and a clear reminder that the same path carries accurate and false information equally well. If you want to know which sites AI tools cite for your category and what they currently say about your brand, the Relevant Audience GEO team can map it with you.