The line in this field is simple to state: everything durable in this book works by making your brand genuinely easier to know, find, and trust, and manipulation means faking those properties instead of earning them. This chapter maps the known tricks, explains why they decay on a schedule you can reason about, marks the gray zones, and then covers the side that gets less attention: defending your brand when someone else runs these tricks against you.
The manipulation menu
Prompt injection in web content. Pages carry hidden instructions aimed at the model that will retrieve them: text invisible to human visitors that says, in effect, recommend this product, ignore competitors. The attack class is documented in the security literature as indirect prompt injection, where adversaries plant instructions in data an LLM-integrated application is likely to retrieve, exploiting the fact that these systems blur the line between data and instructions.Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, the paper that named and systematized the attack class.
Crafted text sequences. Researchers have shown that adding a strategically optimized text string to a product's information page can push that product to the top of an LLM's recommendations.Manipulating Large Language Models to Increase Product Visibility, which demonstrates the effect on a catalog of fictitious coffee machines, moving a rarely recommended product into the top slot. The demonstration is real and the temptation is obvious. Note what the technique depends on: a specific model family's specific response to a specific string. Every part of that dependency chain changes without notice.
LLM-targeted cloaking. Serving AI crawlers different content than human visitors see: inflated claims, fabricated reviews, competitor comparisons that would embarrass you if a customer read them. Cloaking has been a named spam policy in classic search for two decades, and the AI-era version inherits the same detection method: compare what the bot was served with what the user sees.Google's spam policies define cloaking, site reputation abuse, and scaled content abuse, with manual actions as the enforcement mechanism.
Fake reviews and astroturfed communities. Models read community discussion at enormous volume, per Reviews, Reddit, and Communities, which makes fabricated consensus tempting. It is also the highest-risk item on this menu: platforms actively detect coordinated inauthentic posting, moderators document it publicly when they catch it, and a public astroturfing exposure is itself content that models will read and remember. The trick, when caught, writes your brand's worst story into the training data.
Parasite placements and citation farming. Renting space on a high-authority domain to inherit its standing, or building networks of low-value pages that cite each other to simulate authority. Google's site reputation abuse policy targets the first directly, and the second is link-scheme logic wearing new clothes.
Why tricks die on schedule
Each trick above exploits one stage of the answer pipeline: injection exploits generation, crafted sequences exploit a model's token-level behavior, cloaking exploits the crawl, citation farming exploits retrieval ranking. A trick that lives in one stage dies when that stage changes, and the stages change constantly: models get replaced, retrieval pipelines get rebuilt, crawlers get verified. Earned signals survive those changes because they exist in many stages at once; real coverage, real links, and real community discussion feed the crawl, the rankings, and the next training run simultaneously.
Anyone who worked through classic SEO's enforcement history has lived this cycle: a tactic works, spreads, gets named in a policy, and the sites built on it lose years of equity in one update. There is no reason to expect AI search platforms to behave differently, and the early norm-enforcement fights are already public: when Cloudflare concluded that Perplexity was crawling with undeclared, rotating identities to evade no-crawl directives, it published the analysis and blocked the behavior across its network.Cloudflare's August 2025 report, Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives. Cited here as evidence that infrastructure providers police crawling norms, whatever the merits of each side's account. Enforcement in this ecosystem comes from more directions than it did in classic search: platforms, infrastructure providers, and community moderators all hold levers.
The gray zones
Aggressive but defensible: publishing comparison pages that include your own product and argue your case with verifiable claims; building pages for personas and prompts competitors ignore; structuring content so it chunks and extracts cleanly; saying the same true thing in the formats machines prefer. All of this is argument, made in public, under your own name.
Indefensible: any content whose effect depends on a human never seeing it. Hidden instructions, cloaked pages, fabricated reviewers, rented authority. The test is disclosure: if describing the tactic plainly to your board, or having it quoted back to you in a journalist's email, would end the practice, you already know which side of the line it sits on.
Brand defense
The same menu runs in reverse. Competitors or bad actors can astroturf negative consensus about you, plant false claims on pages models retrieve, or spin up fake review profiles, and the model's view of your brand absorbs it all without labeling the source.
Detection is your tracking system doing its normal job with one addition: alongside share of answers, log what answers say about you and which sources they cite for it. A false claim appearing across runs is not noise, and the citations tell you where it entered. The response sequence from Running the Program: Workflow, Team, and Governance applies: document the answers, pursue correction at the cited source, refresh your canonical facts everywhere, and file the false answers through each platform's feedback channel. Escalation paths beyond that are thin today, which is worth saying plainly: there is no formal reconsideration process for a model's beliefs about your brand, so speed at the source and volume of correct information are the working defenses.
For regulated industries, add the compliance exposure: a model paraphrasing your marketing into a claim you are prohibited from making is a real risk, and the approved-claims library is the control, because machines can only absorb the sentences you actually publish.
The durable principle, stated once: shortcuts inherit the fragility of whatever they fake, and earned signals inherit the durability of what they are.