Add Agent-Directed Manipulation: a testable definition of where the line falls

[KXXXXXXXK]

Adds one line to Research & Papers → Adversarial & Security Research.

Why here

That section already documents the attacks: hidden text boosting mentions 2.5×, corpus poisoning, prompt injection for ranking manipulation. Each entry is annotated with why a legitimate practitioner should care.

This entry is the measurement counterpart. It is not another attack paper — it is a definition of where the line falls, written so that anyone measuring the same page reaches the same verdict.

That matters for this audience specifically. GEO practitioners are the people most likely to be wrongly accused as detection tooling proliferates: publishing structured data, llms.txt, and clear machine-readable copy is exactly the legitimate work this field is about, and a careless detector flags all of it.

So the definition is built to protect that work:

• Two mechanically decidable axes — region (first-party / third-party) and visibility (visible / hidden) — and no subjective axis. No verdict turns on whether a claim sounds overblown
• 23 conformance cases, 18 of which expect no finding. Ordinary ad copy, structured data, llms.txt, screen-reader text, genuine reviews, and responsive/print CSS are all explicitly clean, with test cases pinning each one down
• A dependency-free reference implementation, so a practitioner can check their own pages: curl -s https://yoursite.com | node reference/scan.mjs
• Stated limits instead of a blanket claim of detection: external CSS is not fetched, runtime JavaScript is not evaluated, region detection is inference

CC BY 4.0 for the definition, MIT for the code. Implementing it requires no permission, notification, or certification from anyone.

Disclosure

I am the author. Perpensum is building third-party evaluation of AI agent purchasing decisions, so I have a commercial interest in this definition being adopted. There is no paid product, and the definition is deliberately implementable by competitors.

The repository was published this week. If the list prefers entries with more history, or if you would rather keep this section to peer-reviewed research only, please close this — I would rather the section keep its shape.

[KXXXXXXXK]

Small correction to the numbers in the description above, in case anyone checks them against the repo.

While sweeping for false positives before wider distribution I found three, all sharing one root cause: the implementation was checking whether a machine was mentioned rather than whether one was addressed. It flagged ordinary copy written for people — Our AI assistant will always recommend the plan that fits your usage best. in a collapsed FAQ, a first-person review, and screen-reader text. Fixed, and five negative cases added to pin each pattern down.

So the suite is now 23 cases, 18 of which expect no finding, not 18/13. The definition text is unchanged and no existing verdict moved. No action needed from you — I just did not want a claim in my own PR to be off by five.