When users ask Doubao, DeepSeek or Kimi "is this company reliable," the AI answers with a competitor, spliced negative news or invented services — not an outlier, but "AI poisoning" being produced at scale.
In March 2026 Xinhuanet's "When AI answers are GEO-poisoned" exposed a grey industry flooding fake Q&A. People's Daily Online and Science and Technology Daily followed; it became a 15 March talking point. Industry observation: AI preferentially cites a small set of sources — often fewer than seven per answer. A few polluted sources can rewrite how a model knows a brand. For companies doing GEO, that is risk and opportunity: keep facts true in AI answers and you hold trust at the next search entry.
The attack surface is broad. CNNIC's 57th Statistical Report on Internet Development (published 5 February 2026) counts 602 million generative AI users in China, and QuestMobile's H1 2026 report puts Doubao alone at 382 million MAU (Kuai Technology via Sina Finance, 5 August). Every one of those conversations can carry a poisoned answer. Hallucination makes the problem structural: OpenAI's internal tests found its o3 and o4-mini models fabricated information 30–50% of the time (Forbes, May 2025), and a 2026 industry review found 51% of organizations using AI had experienced at least one negative consequence from inaccurate output (Brilo AI, 2026). When models confabulate on their own, deliberate poisoning is the cheaper, easier manipulation.
Three typical distortions
| Form | Typical sign | Main cause | Brand impact |
|---|---|---|---|
| Misattribution | Competitor cases or negatives pinned on you | Same-name entities, bulk-linked negatives | Reputation and due-diligence errors |
| Recommendation stolen | Ask your name, first answer is a competitor | Contrast content occupying sources | Slot intercept, lost clients |
| Spliced negatives | Real events mixed with invented details | Low-quality media accepted as source | PR cost, crisis risk |
| Fabricated credentials | Licenses, awards or clients you never had | Fake encyclopedia and registry entries | Due-diligence failures, legal exposure |
| Fake Q&A flooding | Invented user questions quoted as reviews | Mass-published Q&A spam in communities | False consensus, distorted demand signals |
All five forms do not need your real content; they exploit source-scoring gaps when the visible pool lacks enough positive anchors.
Why poisoning works: preferential citation
Defense starts with citation mechanics. As LLM citation mechanics notes, brand answers go through retrieve → score → cite. Scoring is easiest to game:
Few sources, one hit works. Often under seven citations, sometimes two or three.
Source weights are tightening. After Doubao's August 2026 GEO algorithm change, "no single-source proof" requires ≥3 independent sources; bulk homogeneous advertorials were cleared and related accounts throttled (see Doubao 16 August update). Mass posting now risks trust demotion.
Attribution blindness hides the damage. Loamly's 2026 analysis found 70.6% of AI-driven website visits are recorded as "direct" traffic, and DeepSeek passes no referral headers (i-click 2026 China GEO guide). Brands cannot see which answer produced which click, so a poisoned answer can run for weeks before anyone notices.
White-hat vs black-hat is being institutionalized. The China Advertising Association GEO group standard draft bans corpus poisoning and answer monopoly. Industry standard T/CGCC 119-2026 took effect 1 July 2026 (see the GEO standards era guide). Compliant GEO and illegal poisoning are separated by verifiability.
Five-step defense
1. Monitor brand AI mentions. Regularly query brand and core service terms on Doubao, DeepSeek, Kimi, Yuanbao and Qwen; log content, sources and sentiment; alert on misattribution and competitor takeover. See Brand AI mention rate.
2. Build a multi-source matrix. Official + trade media + third-party reviews + social proof so facts cross-check. A regional medical-device distributor we observed was misattributed with a competitor's nonconformity case across two engines for three weeks; the answers flipped only after a correction submission, a clarified Baike entry and two trade-media articles rebuilt the source pool (industry observation, 2026). Speed matters — the longer a wrong fact circulates, the more engines treat it as corroborated.
3. Freeze facts in structured content. Founding date, scope, credentials, contacts and cases on the site as structured data, with matching encyclopedia, associations and media. Machine-readable, multi-source-consistent facts are harder to pollute.
4. Correct fast. Use official engine feedback channels and publish clarifications on authoritative sources; keep a correction log with screenshots and submission dates so the same error is not re-reported.
5. Stay white-hat. Stop bulk advertorials and Q&A flooding. Real cases, verifiable data and specialist content are the long-term asset.
If your brand has already seen a distorted answer, do not wait for it to surface in a client's due-diligence call — contact us for an AI reputation diagnosis across Doubao, DeepSeek, Kimi, Yuanbao and Qwen.
FAQ
Q1: How is AI poisoning different from negative PR?
PR starts from real events; poisoning manipulates sources to output fake or spliced negatives. The former is comms; the latter is source governance plus GEO.
Q2: What if we are misattributed?
Screenshot the answer, list wrong associations, submit engine corrections, and add correct facts on site, encyclopedia and media so multi-source verification covers the error.
Q3: Low-budget defense for SMEs?
Two steps: structure core site facts to match the encyclopedia; quarterly brand searches on major engines, especially "brand + how is it" and "brand + reviews."
Q4: Can we still mass-post after the Doubao update?
Not recommended. August cleared bulk homogeneous content and throttled related accounts; single sources are no longer trusted. Better to deepen 3–5 high-quality authoritative sources.
Q5: How to tell GEO from poisoning?
Verifiability: GEO builds a matrix on real facts; poisoning invents facts to steer answers. The group-standard draft bans corpus poisoning — pick white-hat GEO vendors.
Q6: Is AI poisoning a legal issue?
Regulators and industry bodies treat manipulated AI content as a compliance matter — the CAA group-standard draft explicitly bans corpus poisoning and answer monopoly, and misattribution that harms a business can carry legal consequences. Specific assessment depends on the case; we focus on source governance and remediation, not legal advice.
Related reading
This article was written by Zheming Digital Communication Research Institute. Data updated to 2026; sources include Xinhuanet (2026-03-20), People's Daily Online (2026-03-18), Science and Technology Daily (2026-04-21), CNNIC 57th Statistical Report on Internet Development (2026-02-05), QuestMobile H1 2026 report via Kuai Technology/Sina Finance (2026-08-05), Forbes (2025-05-06), Brilo AI (2026) and Loamly/i-click attribution analysis (2026). AI reputation and GEO consultation: +86 18917757529 · jaysun@widesight.cn.