Perplexity Cites 215,128 Machine-Generated Pages. The Problem Is Not Perplexity.

The Retrieval Substrate Is Already Poisoned. Perplexity’s Grounding Layer Shows How.

A research firm called Trellner published a dataset this week that should make anyone building on top of AI search engines uncomfortable. They queried Perplexity across 380 software categories — CRM to museum collection management — and kept every URL the system retrieved to construct its answers. Of the 7,534 citations that came back, 59.8% point at domains ranked outside the 100,000 most-visited websites on the internet. Nearly a quarter point at domains that do not appear in the top million at all.

The finding that lit up Hacker News was more specific: three sites, apparently under common control, have published 215,128 machine-generated “best software” pages. All three domains were registered between December 2023 and May 2024. None of them existed before the grounding arms race did. Perplexity cites them.

I want to be precise about what this study does and does not show, because the popular reading — “AI search is broken” — is both true and incomplete. The more interesting finding is structural: the poisoning is not a bug in Perplexity’s ranking heuristics. It is a predictable consequence of how retrieval-augmented generation was designed, and fixing it requires changes that the industry is not currently making and has financial incentives not to make quickly.

This matters beyond the immediate finding about Perplexity. Every grounded AI system — every RAG application, every enterprise knowledge tool, every AI-native search product — faces the same dynamics. Perplexity is the visible case because it surfaces its citations. The invisible cases are everywhere.

What the Data Actually Shows

Trellner ran 760 API calls to perplexity/sonar and perplexity/sonar-pro through OpenRouter, one prompt per category per model. Each call asked for a ranked top five products as JSON with each vendor’s homepage URL. Both Perplexity tiers report their retrieved URLs, which is why they were chosen — most grounded models do not expose the retrieval layer at all. The categories spanned 380 buyer-intent queries from “CRM software” to “museum collection management software,” written before any results were seen and never revised after.

The citation distribution is striking:

The median Tranco rank of cited domains is 71,611. For comparison, Reddit is rank 105. G2 — the top-cited domain at 291 citations — is rank 4,027. The third-most-cited domain is guideflow.com at rank 177,039, with 194 citations across 96 categories. Guideflow sells interactive product demos. It does not review software. It is ahead of Gartner in Perplexity’s citation distribution.

Wikipedia appeared three times. In 7,534 citations.

The concentration at the top of the distribution is less remarkable than the distribution itself. The ten most-cited domains account for 17.3% of all citations, which means four-fifths of citations go to the long tail. That long tail is dominated by new, low-traffic, and in some cases purpose-built domains. The study found that unranked cited domains have a median first Wayback Machine capture of 2020, against 2011 for ranked ones. Sixteen percent of archived unranked domains were first captured in 2025 or later, against 1.6% of ranked ones. The citation corpus skews young in exactly the way you would expect if someone started building grounding-optimized pages in 2023 and 2024.

The Three Sites That Built 215,128 Pages

The story inside the story is worldmetrics.org, wifitalents.com, and gitnux.org. Trellner found them through infrastructure analysis: all three were registered through Namecheap between December 2023 and May 2024, all three delegate DNS to the same Cloudflare nameserver pair (pam.ns.cloudflare.com and sean.ns.cloudflare.com), and all three run an identical page template with identical navigation — Services, Market Data, Software Advice, Editorial Process, Company. A fourth brand, zipdo.co, sits on the same nameserver pair and gives its homepage the same “Facts & Grounding Page” HTML title.

Their sitemaps list 103,578, 107,083, and 105,541 URLs respectively. Of those, 70,731, 71,684, and 72,713 are /best/<something>-software/ pages: 215,128 generated buying guides total, against six blog posts each. The blog posts, which Trellner examined, are about each other — two posts each on the other brands in the set, and two on zipdo.co. The math makes the intent unmistakable. These are not publishers with a software review sideline. They are software review pages with a nominal publisher wrapped around them to pass editorial credibility checks.

What makes them genuinely unusual — and technically interesting rather than merely cynical — is their self-description. Fetched on September 2, worldmetrics.org and gitnux.org both return an HTML title of the form “<Brand> — Facts & Grounding Page.” Their meta description reads: “Verified facts about Gitnux: an independent market research company publishing industry statistics, custom research, and software Best Lists. Company, legal, methodology, and compliance details in one machine-readable record.”

Grounding is not a term buyers use. It is the name of the retrieval step in which an LLM fetches documents to condition its answer on. A “machine-readable record of verified facts” is not a description for a human reader either. These pages are not titled for people. They are titled for the retrieval crawler that indexes them before a query fires. I have spent enough time reading retrieval system documentation and building RAG pipelines to recognize that phrasing immediately — it is schema designed to pass a relevance and freshness check, not to communicate with a person doing research.

The content itself shows the same pattern under less careful inspection. Each of the three brands employs named staff for its editorial process. Worldmetrics credits Kathryn Blake, Alexander Schmidt, and Victoria Marsh. Gitnux credits Diana Reeves, Helena Kowalczyk, and Olivia Thornton. WifiTalents credits Ryan Gallagher, Isabella Rossi, and Natasha Ivanova. Nine distinct people, per the pages, wrote the same buying guide question for three different brands. Every page also carries an unrendered template variable in the byline reading “Within the next 26 days” on two of them and “Within the next 40 days” on the third — a production artifact showing that at least one content field was never filled in before the pages went live. Gitnux labels its result “AI-verified · Expert reviewed.” The expert reviewer’s deadline is a Jinja placeholder that was never replaced.

These are not the artifacts of a carefully constructed deception. They are the artifacts of a system optimized for coverage and indexation speed rather than human legibility, because human legibility was never the goal.

Why This Is an Architecture Problem, Not a Content Farm Problem

The framing I keep seeing in response to this study is “Perplexity should do better filtering.” That framing is wrong, or at least insufficient, because it treats the symptom rather than the cause.

Retrieval-augmented generation works by fetching documents at query time and conditioning the model’s generation on what it retrieves. The retrieval step is usually a web search — in Perplexity’s case, their own Sonar index. That index ranks documents using signals that have been the target of manipulation since the first web directory existed: link graphs, domain age, keyword density, structured data markup, user engagement proxies. The optimization pressure is enormous and well-understood. The people who built 215,128 “facts and grounding pages” are not naive; they understand exactly which signals retrieval systems measure and have built their infrastructure to match those signals precisely.

The specific mechanism that makes AI grounding more vulnerable than traditional search is temporal asymmetry. When a user searches Google for “best CRM software,” the system applies years of accumulated quality signals against years of accumulated manipulation attempts. The adversarial equilibrium is mature — Google has learned what thousands of link farms look like, and link farmers have learned what Google’s countermeasures look like, and the equilibrium shifts slowly. When a grounding crawler indexes the same query today, it is applying signals trained mostly on a pre-LLM web against attackers who have had three years to optimize specifically for how grounding systems work, with no historical baseline of what “grounding spam” looks like because grounding spam is a new category. The defenders are always behind when a new attack surface opens.

There is also a recall-precision tradeoff that gets underappreciated in discussions of retrieval quality. Aggressive filtering removes junk and also removes obscure legitimate sources — the small publisher with genuine expertise in museum collection management software, the solo practitioner who has actually evaluated RFID tools in a warehouse context. Retrieval system designers know this and calibrate accordingly, accepting some low-quality sources to preserve coverage in long-tail categories. Optimizers exploit that calibration deliberately by targeting exactly those long-tail categories where quality filtering is weakest, because the signal-to-noise ratio in niche verticals is harder to maintain than in high-traffic queries.

There is a second structural problem: grounding transparency. Perplexity shows its citations; most other systems do not. This study exists because Perplexity exposes its retrieval layer. ChatGPT’s web browsing, Google’s AI Mode, and Gemini’s grounding are all black boxes to outside researchers. This does not mean they are cleaner — it means we cannot measure them. The rational inference is that the same dynamics apply across grounded systems, because the same economic incentives apply to anyone who wants AI systems to recommend their product. The optimizers are not targeting Perplexity specifically; they are targeting the indexing layer that grounded systems share, and Perplexity happens to be the system where the results are visible.

The Inconsistency Problem Is Underappreciated

Trellner’s spot-check of the three brands on a single category — project estimation software — is the most damning part of the report, but not for the reason most commentators have focused on.

Yes, the bylines are fake. Yes, the template is shared. But the more operationally interesting finding is the ranking disagreement:

Gitnux’s winner, Saviom, does not appear in Worldmetrics’ top five at all. These three pages share infrastructure and a generation template. They produce contradictory rankings. The three pages carry structured data (JSON-LD) declaring their rankings in machine-readable form, which means a retrieval crawler that ingests structured data does not need to parse the prose — it reads directly conflicting top-five lists from what is effectively a single source.

This is the core failure mode of treating retrieval coverage as a quality signal. More sources is not the same as more information. Three conflicting lists from one operator is one data point with substantial noise attached, not three independent measurements. The averaging behavior of a large language model presented with these three sources is not well-characterized in the retrieval literature, but “produces a well-calibrated answer” is not the most likely outcome when the inputs are contradictory and the model has no signal to distinguish which input is more reliable.

The correct framing is epistemic: these sites do not add evidence to the retrieval context. They add noise that resembles evidence because it is formatted correctly, carries structured data markup, and comes from domains that have passed basic indexation checks. The model cannot distinguish between “three sources agree on Saviom” and “one source generated three conflicting pages about Saviom.” From the retrieval layer’s perspective, those look identical. The LLM generating the final answer receives the context after retrieval and has no way to recover the provenance information that would reveal the single-operator origin.

What the Study Cannot Tell Us — and What That Itself Tells Us

Trellner is careful about the limits of their methodology, and the limitations matter for understanding how to interpret the findings.

The two Perplexity tiers returned byte-identical citation lists in 289 of 380 categories and had a Jaccard overlap of 0.898 on their URL sets — so they share a retrieval layer and should be read as one search stack sampled twice, not as two independent systems converging on the same sources. The difference between sonar and sonar-pro in this study is sampling variation on one retrieval index, not independent confirmation.

The study covers Perplexity only. It explicitly notes there is no reason to assume other engines are better or worse, which is the honest position given the lack of data. I have run retrieval experiments on smaller scales across different systems — none published, and with different query sets — and the pattern of low-traffic manufactured sources appearing in grounding citations is not unique to Perplexity’s index. But I cannot cite that as evidence; it is prior probability shaping my interpretation rather than data.

The 380 categories are Trellner’s construction, not a sample of what buyers actually ask. A list weighted toward niche verticals will surface more long-tail sources than a list of common queries would, because the high-traffic queries are where retrieval system operators have invested most in quality filtering. The manufactured source problem may be worse in niche verticals than in “CRM software” or “project management software” — or it may be present everywhere at similar rates and simply more detectable in niches where the known-good sources are fewer. The study does not resolve this.

The vendor dead-link data is a useful sanity check. Of 1,502 vendor homepages the models supplied as official product URLs, 10 resolve to no address at all — including graphiql.com (returned as the home of GraphiQL, which does not own that domain) and todo.com (returned for Microsoft To Do). Another 2 redirected to unrelated sites: dryad.co redirects to an Indonesian gambling portal, and montecarlo.com redirects to the Monaco hotel and casino group. This is a 0.8% actively-wrong rate on the actual product recommendations, which is low enough that most users would not encounter it. It also means the product recommendation layer is less corrupted than the citation layer, which is worth noting: the system is producing mostly real product names while citing sources of uncertain quality to justify those names. The authority for the recommendation and the accuracy of the recommendation are partially decoupled.

The Self-Optimizing Loop No One Wants to Name

The uncomfortable version of this story: the economic incentives to optimize for AI grounding are larger than the incentives that existed for traditional SEO, for reasons that are structural rather than incidental.

First, the B2B software market is large and the conversion value per recommendation is high. A single grounded recommendation in the right enterprise software category — ERP, HRIS, supply chain management — can influence procurement decisions worth hundreds of thousands of dollars annually. The cost of generating 215,128 pages with current language model infrastructure is, generously, in the tens of thousands of dollars for the full corpus. At B2B software conversion rates, a single influenced deal covers the entire content operation. The return-on-investment calculation is not close.

Second, the attack surface is multi-surface in a way traditional SEO never was. In 2010, gaming Google’s ranking algorithm meant gaming one ranking algorithm for one search product with one interface. In 2026, grounding optimization means potentially influencing every system that indexes the open web: Perplexity, ChatGPT’s web access, Google’s AI Mode, Microsoft Copilot, Gemini’s grounding, and every enterprise RAG application that fetches from the open web. A set of pages that gets indexed well appears across all of them simultaneously. The multiplier on the attack surface is real and large.

Third, the feedback loop for optimization is faster than it was for traditional SEO. The pages that worldmetrics.org, wifitalents.com, and gitnux.org built are not sophisticated — unrendered template variables, shared infrastructure, fabricated bylines. But they work, as Trellner’s citation counts demonstrate. The feedback signal (citations per domain) is measurable by anyone running the same API queries that Trellner ran. An optimizer can observe which page formats receive more citations, iterate on template variations, and converge on more effective formats within a few weeks of testing. The iteration cycle for grounding optimization is shorter than the cycle for traditional link-building because the output is directly observable through API calls rather than inferred from rank position changes.

The pages that Trellner found are first-generation grounding spam. They have the characteristics of a system that was built for coverage rather than robustness — the template variable artifacts, the shared infrastructure that is detectable through DNS queries, the six blog posts that exist solely to create the appearance of a legitimate publisher. These are the artifacts of optimizers who did not expect anyone to look carefully. Second-generation grounding spam will be harder to detect: independent DNS infrastructure, real (or convincing) author profiles with verifiable social presence, citation networks seeded from legitimate-looking intermediate sources, and no unrendered template variables. The economic incentive for that upgrade is substantial and the technical barrier is low.

What Builders Using These APIs Should Actually Do

If you are building a RAG application, an AI purchasing advisor, or any product that passes grounded web results to users as authoritative information, this study has direct operational implications that are worth taking seriously rather than treating as a Perplexity-specific problem.

Audit your citation distribution, not just your answer quality. Trellner’s methodology — fetch citations from grounded API responses, look up domains in the Tranco list, check registration dates in WHOIS or the Wayback Machine — is reproducible in an afternoon. The Tranco list is freely available and updated daily. Running this audit on your own system’s outputs gives you a baseline that you can track over time. If 60% of your citations are outside the top 100,000 domains by traffic, you have a source quality problem regardless of how coherent the final answers look to human evaluators.

Domain age filtering is a cheap first pass. The three sites in question were registered between December 2023 and May 2024. Any domain first captured by the Wayback Machine after January 2023 that is generating buying guides across dozens of unrelated software categories at scale should be treated as suspect until verified otherwise. This filter will produce false positives — legitimate new publishers exist — but the false positive rate on genuine new software review publishers with comprehensive coverage across 200+ categories is functionally zero. The base rate of legitimate comprehensive-coverage review sites that are also two years old is very low.

Retrieval transparency is not optional for high-stakes applications. If you are building a product where a wrong recommendation has material consequences — B2B purchasing, medical device selection, legal research, financial product comparison — you need to surface citations to users and you need a quality signal on those citations beyond “the grounding system returned this URL.” This means showing users the source domains, their traffic tier, and their age, not just the extracted text. Most custom RAG stacks do not do this. Building it in after launch is harder than building it at the start.

Do not confuse coverage breadth with source quality at index time. The instinct in retrieval system design is to maximize recall and let the generation model sort out quality. Perplexity’s results suggest that the generation model does not reliably sort out quality when a significant fraction of the retrieval context is optimized to look authoritative rather than to be authoritative. The model cannot see through fabricated editorial processes and JSON-LD structured data. Quality signals need to operate at index time, before retrieval, not only at generation time.

Test your system against niche categories. The manufactured sources Trellner found are most concentrated in long-tail software categories, which is also where quality filtering is weakest and human quality checks are rarest. If your system is used across a broad category range, stress-test it on the obscure end: “RFID inventory software,” “heritage asset management systems,” “dental practice analytics.” These are the categories where grounding spam is most effective because there are fewer authoritative sources to dilute it.

The Wikipedia Data Point

Wikipedia appeared three times in 7,534 citations across 380 software categories. This is the number I keep returning to, because it encodes a decision.

Wikipedia has a software article for nearly every significant product across all 380 of those categories. For many smaller tools, Wikipedia’s article is the most thorough factual account that exists: founding date, acquisition history, pricing model changes, known controversies. It is also among the most-linked sources on the human web, which is the fundamental input to most domain authority measures. Its near-absence from AI grounding outputs is not an accident of the retrieval algorithm.

The reasons Wikipedia is underrepresented in grounding are likely multiple: licensing concerns around how retrieved text is displayed, Wikimedia’s own restrictions on crawling and usage, quality-filter calibration that may penalize Wikipedia because its articles cover too many topics (which looks like the profile of a spam site if you are using topic concentration as a quality signal), or deliberate exclusion to avoid surfacing edit-war content. I do not know the specific reason in Perplexity’s case. What I know is that the effect is real: the most editorially accountable encyclopedic source in existence appears almost nowhere in AI grounding outputs while 215,128 machine-generated pages from three-year-old domains with unrendered template variables appear frequently.

That inversion is not a quirk. It is a symptom of a retrieval design that optimizes for signals other than epistemic quality, and those signals are legible to optimizers who understand what they are. The signals that manufactured sources optimize for — structured data markup, machine-readable self-descriptions, optimized crawlability, targeted keyword coverage — are exactly the signals that Wikipedia either does not prioritize or actively deprioritizes in favor of human reader experience. The retrieval system ends up penalizing epistemic quality while rewarding retrieval-optimization, which is the opposite of what users believe they are receiving.

Predictions

The operations that Trellner identified will modify their pages within weeks of this publication. “Facts & Grounding Page” in an HTML title is now a fingerprint, and fingerprints get removed once they are documented in public. The underlying infrastructure — 215,000 pages with established crawl history and accumulated citation counts — will persist under different branding and modified templates. The unrendered template variable and the distinctive meta descriptions will be patched. The DNS infrastructure will likely remain shared for months, because moving 215,000 pages across nameservers is an operational hassle and most operators assume that nameserver correlation is not in the threat model of retrieval system operators.

At least two AI search companies will announce “source quality improvements” in Q4 2026 that reference domain authority signals without publishing methodology, baseline data, or recall impact estimates. Recall in niche categories will drop measurably. A subset of the manufactured sources will return under new domains within six months, because the economic incentive to be cited by grounded AI systems has not changed and the operational cost of registering new domains and regenerating content has not increased.

By mid-2027, the market for “AI citation optimization” — distinct from traditional SEO — will support at least three specialized consultancies and probably more. The deliverable will be pages designed to pass grounding quality filters specifically: independent registrations, realistic author profiles with verifiable social media presence, citation networks seeded through legitimate-appearing guest posting, no shared infrastructure detectable through passive DNS queries. The pages will not carry unrendered template variables. They will be considerably harder to detect through the methods Trellner used. The regulatory and journalistic attention to this market will lag by twelve to eighteen months, consistent with the lag that followed the public documentation of link farm SEO in 2003–2004 and the lag that followed the documentation of fake review ecosystems in 2018–2019.

The prediction I am least confident about is whether end users will perceive noticeable degradation in grounded answer quality before the industry is forced to address this seriously. Trellner’s data shows the citation layer is significantly polluted; it does not demonstrate that the final product recommendations are wrong at a rate users would detect in casual use. The visible degradation typically comes in the second generation of manipulation, when optimizers move from “get my client cited” to “prevent a competitor from being cited” or “actively insert false information about a competitor’s product.” That transition happens when the market for grounding manipulation matures enough for adversarial use cases to become economically attractive, which requires a more sophisticated buyer than exists today. The study this week caught the grounding substrate at the pre-adversarial stage — influence campaigns for brand visibility, not sabotage campaigns for competitive harm. The sabotage phase is coming. The system is not prepared for it, and the first sign of its arrival will not be a research paper. It will be a product comparison that costs someone a significant procurement decision and eventually traces back to a manufactured source.