Aquifa detects, measures and maps hostile-actor manipulation of large language models — and develops the means to outcompete it.
Foreign information manipulation and interference (FIMI) actors no longer need to compromise a model or its training data. They target the online sources from which AI systems retrieve, using Generative Engine Optimisation (GEO) techniques to make their material more likely to be found, cited and treated as authoritative.
The stakes will only rise as the internet becomes agentic. AI agents will retrieve, evaluate and act on information themselves — so manipulation may shape a decision before a human ever sees the underlying source. The integrity of the machine-readable information environment is now a critical security problem.
How often adversarial sources and narratives appear in response to realistic user questions; which models and languages are most exposed; and whether systems challenge, contextualise, amplify or endorse the material. We measure penetration — the share of answers a source shapes — not raw citation counts.
We trace problematic answers back to the domains, URLs and source networks the model draws on — revealing originators, amplifiers, syndication networks and the pseudo-corroboration that lends adversarial narratives authority.
Using a taxonomy of 56 tactics, we reverse-engineer why particular sources are winning retrieval: technical configuration, content architecture, authority mimicry and network effects — distinguishing deliberate optimisation from exploitation of data voids.
Diagnosis informs response: suppress adversarial content by making it less likely to be retrieved or cited; displace it by surfacing high-quality, evidence-based sources instead; and disrupt the wider architecture that supports adversarial visibility.
Every run is fully auditable, and the capability is model, language and topic agnostic — the same pipeline can be applied to any defined information threat, from state narratives around a conflict to election interference.
We define the threat by actor, discourse and audience; turn it into hundreds of realistic, multilingual user queries; barrage target LLMs at scale; classify every response by whether it cites, amplifies, endorses, contextualises or challenges adversarial narratives; map the sources being retrieved; reverse-engineer their GEO fingerprint; and design the response. Our long-term ambition is an always-on detect–respond–measure flywheel that adapts as both AI systems and adversary tradecraft evolve.
Measure adversarial share of voice on priority topics, across agreed models and languages, with full infrastructure and GEO-tactic analysis.
Assessed options for suppressing, displacing and disrupting adversarial visibility, with mechanisms, costs, risks and policy levers.
Deploy approved tactics against a measured baseline and control topics, and evaluate whether adversarial citation share actually falls.
An always-on watch over priority discourses, detecting changes in penetration, new sources and new techniques as they emerge.
Safeguards. All interventions are fully regulatory compliant and rely only on overt and attributable sources. Every intervention is agreed with the client and subject to legal and ethical review before deployment.
Whether you are a government, platform or institution, we can establish your baseline exposure, map the infrastructure behind it, and design the response.