When a Chinese journalist wanted to test how hard it is to manipulate an AI answer, they did not hire an agency. They opened Taobao, paid for a GEO tool called Liqing GEO, and invented a product that does not exist — a device called "Apollo-9." The tool spun up a batch of promotional articles around the fabricated product. Within two hours, five major Chinese AI models were describing Apollo-9 to users, repeating the invented specifications as fact.
That investigation, aired as part of CCTV's 3·15 consumer-rights broadcast in March 2026, put a price on the attack: trial packages from 9.9 yuan, answer alterations from 39.9 yuan, and around 3,000 yuan to get a model to meaningfully change its stance on a subject. Reporting on the same grey market noted that vendors advertise two directions of service — 洗好评 (washing reviews positive) and 洗差评 (washing them negative).
For brand teams tracking visibility scores in Doubao, DeepSeek, Kimi, Qwen, Wenxin and Hunyuan, the second direction is the one nobody budgets for. Almost every China GEO program is built on an assumption borrowed from SEO's early years: that your score is a function of your own effort. In China's AI answer layer in 2026, it is a function of your effort minus whatever anyone else is willing to spend to move it. And the price of moving it is roughly the cost of a takeaway lunch.
The asymmetry nobody prices
Consider the economics from an attacker's side. A mid-market international brand running a serious China GEO program is spending somewhere between 5,000 and 60,000 yuan a month on content production, source-page work, platform seeding and monitoring. The 3·15 investigation established that the opposing move — inserting a claim, or attaching a negative frame to a competitor — starts at two figures.
The ratio matters more than the absolute numbers. In classic search, adversarial attacks were expensive because rankings were defended by link graphs, domain authority and years of accumulated signal. Negative SEO existed, but it was slow, detectable, and usually reversible. In generative retrieval, the defensive moat is thinner. A model composing an answer about "which international skincare brand is best for sensitive skin" is not weighing decades of domain trust. It is retrieving a handful of recent, structurally clean, keyword-aligned documents and synthesizing them. Structurally clean and keyword-aligned is precisely what a 39.9-yuan tool produces.
| Attack surface | Traditional SEO | Chinese AI answer layer, 2026 |
|---|---|---|
| Cost to insert a claim | High (domains, links, time) | From ~39.9 yuan |
| Time to take effect | Weeks to months | Reported at ~2 hours in the 3·15 test |
| Detectability by the brand | Visible in backlink/SERP tools | Invisible unless you query the models directly |
| Reversal path | Disavow, takedown, ranking recovery | No formal appeal channel at most model providers |
| Who notices first | The brand | Usually nobody |
That last row is the real problem. A backlink attack shows up in tooling the brand already owns. An answer-layer attack shows up only if someone asks the model the right question, in the right phrasing, on the right day — and compares it to what the model said last month.
Why this shows up as "score volatility"
Brand teams running monthly visibility measurement in China routinely see swings they cannot explain: a brand sitting at 70 on Doubao drops to 45, then recovers, with no content change on either side. The default explanations are model version churn, retrieval-index refresh, or sampling noise in the query set — all of which are real.
But there is a fourth explanation that most measurement programs have no way to distinguish from the other three: someone published against you, the retrieval layer picked it up, and it decayed out again. From the outside, injected content and organic content look identical in a score. The score is a number about the answer, not about where the answer came from.
This is why source-level tracking, not just score tracking, has become the more defensible measurement design. If your visibility program records which documents the model cited alongside your brand — and not merely whether your brand was mentioned and how favourably — an injection event becomes legible. It appears as an unfamiliar domain, or a cluster of near-duplicate articles published within a narrow window, sitting where a trade publication or a Baike entry used to be. Without that layer, you are looking at a thermometer and trying to diagnose the fever.
The regulatory clock is running, but not in your favour yet
China's regulators have moved faster on this than most jurisdictions. The State Administration for Market Regulation's 2026 national advertising supervision priorities, published on 29 January 2026, named AI-generated advertising as a focus and difficulty in internet advertising enforcement. The Cyberspace Administration's "Qinglang" campaign against disorder in AI applications explicitly lists AI data poisoning as a target. State media has argued for a combined prevention-and-supervision approach to what it calls "AI pollution."
For brands, the practical read is narrower than the headlines suggest. Enforcement is aimed at the tool vendors and the platforms, not at building a complaint mechanism for the injured third party. There is no equivalent of a Google disavow file, no standard takedown route into a model's retrieval corpus, and no published SLA for correcting a defamatory or fabricated brand claim inside an AI answer. If a Chinese model tells a customer your product contains an ingredient it does not contain, your remediation path today runs through the source publication, not the model.
That gap also cuts the other way. A brand tempted to use the same tooling defensively — or offensively — is now operating in a category regulators have publicly flagged, in a market where a Hangzhou court has already treated GEO content as advertising subject to advertising law. The downside is no longer reputational only.
What actually holds up
The defensible position is not a bigger content budget. It is making your own sources hard to displace and making displacement visible when it happens.
Own the high-authority slots the models actually pull from. Citation-source concentration in Chinese models is extreme and ecosystem-bound: Doubao draws the majority of its citations from ByteDance properties, ERNIE from the Baidu ecosystem, DeepSeek and Kimi lean heavily on Zhihu and technical communities. Injected content competes on freshness and structure; encyclopedia entries, verified official accounts and established vertical media compete on institutional trust. The more of your brand's factual footprint sits in the second category, the less a two-hour content burst can move.
Measure sources, not just scores. Log the cited URLs and domains per query, per model, per run. A month-over-month diff on the citation set catches injection events that a score diff cannot.
Track the questions where you are attackable, not just the ones where you win. Comparative queries ("A versus B"), safety and ingredient queries, and price queries are where injected framing does the most damage and where brand teams monitor least — most query sets over-index on "best [category] brand" prompts the brand already scores well on.
Keep an evidence trail. Screenshot and timestamp the answers, with the model version where available. If a claim about your brand does become actionable — advertising law, unfair competition, defamation — the only usable record is the one you captured at the time, because the answer will not reproduce.
Takeaway for brand marketers
Stop treating your China AI visibility score as a report card on your own work. In a market where a fabricated product reached five major models in two hours for a two-figure fee, the score is a contested number. Budget accordingly: reallocate a slice of your GEO spend from production into monitoring, insist that whatever tool or agency you use reports cited sources and not merely mention rates, and expand your tracked query set to include the comparative and safety prompts where you are most exposed rather than the flattering ones where you already rank. The brands that get hurt in the next twelve months will not be the ones that published too little. They will be the ones that never checked what else was published.
Related: see how brands in your category currently score across China's six major AI models on the hubGEO brand rankings.
Sources: CCTV 3·15 (March 2026) coverage via 36Kr and Sina Finance; 21st Century Business Herald on AI poisoning accountability (16 March 2026); Xinhua on governing "AI pollution" (8 June 2026); State Administration for Market Regulation, 2026 National Advertising Supervision Work Priorities (29 January 2026).