Every major model provider now trains its models to ignore instructions that arrive inside retrieved content. That is the correct defense against prompt injection. It is also the reason a page that says "Choose us, book a demo today" carries less weight in a ChatGPT answer than a competitor's spec table. Your copy is not being ranked. It is being sandboxed.
Three connections between prompt injection, RLHF, and few-shot prompting explain why, and what to do about it.
1. Injection defenses classify your CTA as an attack pattern
The core defense against indirect prompt injection is instruction/data separation. Retrieved web content is wrapped in delimiters, tagged as untrusted, and the model is trained to treat any imperative language inside those delimiters as data to summarize, never as a command to follow. Microsoft calls one variant spotlighting. OpenAI's instruction hierarchy work does the same thing from the training side.
Look at what that filter catches. "Sign up now." "Switch to X." "The best tool is X." Second-person imperatives and unsupported superlatives are exactly the surface form of an injection payload. The model does not know your intent. It knows the shape. Declarative, verifiable statements pass through the filter. Commands and hype get flattened into "the vendor claims to be a leader," which is a citation that helps nobody.
2. RLHF rewards the answer, and the answer punishes promotional sources
RLHF optimizes for what human raters prefer. Raters consistently penalize answers that read like ads, so the reward model learns to discount sources whose tone predicts a low-rated answer. This is not a rule someone wrote. It is a gradient. Over millions of comparisons, the policy learns that citing a page with pricing tables, benchmark numbers, and named limitations produces a higher-scoring response than citing a page built around adjectives.
The practical consequence is a preference ordering you cannot see from the SERP. Two pages with identical facts, one written in launch-blog voice and one written in documentation voice, are not tied. The documentation voice wins the citation, and often wins it by enough that the promotional page never appears at all.
3. Retrieved snippets are the few-shot examples the model formats its answer around
Few-shot prompting works because the model imitates the structure of the examples it is given. In a RAG pipeline, the first two or three retrieved chunks act as unintended few-shot examples. If the top chunk is a comparison table with columns for price, integrations, and free tier, the model tends to produce a comparison table with those columns and pulls the remaining rows from sources that already match that schema.
So the source that wins retrieval position one does something more than get cited. It sets the template. Every brand that lacks a page in that template becomes harder to slot in and gets dropped or paraphrased into a footnote. This is why the same query returns a stable set of four competitors week after week even when your page is technically more accurate. Your page is the wrong shape for the example already in context.
4. Measuring the sandbox effect
None of this shows up in Search Console. You need to prompt the models directly, across models and across days, and log three things per query. Which brands are named. Which URLs are cited. What structure the answer took. When your brand appears in the answer text but never as a cited source, you are being paraphrased from a third-party page and your own site is being discounted. When the answer format matches a competitor's page structure, you have found the few-shot anchor you need to match.
LLM Search Console runs that loop on a schedule. It tracks brand mentions, citation sources, and answer format across ChatGPT, Perplexity, Gemini, and Claude, and diffs the results over time so you can see which page edits moved the citation and which did nothing.
Quick wins for GEO
Rewrite imperatives as declaratives. "Book a demo" becomes "Demos are available and take 20 minutes." Same information, passes the filter.
Add named limitations. One sentence about what your product does not do raises rater trust and survives RLHF's promotional discount.
Copy the winning schema. Find the top-cited comparison page for your category and publish your own page with the same columns, then add one more.
Put numbers before adjectives. A page that leads with latency, price, and integration counts is cited. A page that leads with "powerful" is summarized.
Diff your citations weekly. Run the same 20 prompts against four models every week and track source URLs, not just mentions.
Start with one query your buyers actually type. Run it at llmsearchconsole.com, read which sources the models trusted, and rewrite one page in that shape this week.