Advertising without entering the answer

Abstract

Generative search has no settled advertising format, and the formats now being trialled differ less in appearance than in depth — how close to the model's own reasoning the money is allowed to reach. We separate the answer pipeline into five stages (retrieval, source ranking, context assembly, token generation, render) and observe that every published mechanism for monetising a language model places revenue in one of them. Depth is the variable that matters, because the deeper the injection, the more of the answer itself is for sale, and the more fragile the resulting revenue: recent work shows a thirty-token request for a neutral table is sufficient to strip sponsored slant out of assistant recommendations. We take that result as a design constraint rather than a vulnerability to be patched. This paper describes an ad program in which money enters at exactly one stage — render — behind a relevance gate that price cannot cross, priced as a flat public amount rather than per click. We report the pilot's instrumented behaviour, the economics presented to advertisers (cost per qualified answer, and the revenue lost to reader opt-out, disclosed before purchase), and the integrity measurements we intend to publish quarterly. We argue that a monetisation surface which survives being switched off is the only one worth building.

1 · Introduction

Search monetisation used to be a layout question. Ten blue links had a top of the page, and the top of the page could be sold without touching the links themselves; the user could see the boundary, and the boundary was structural. A generated answer has no such boundary. There is one paragraph, in one voice, and any commercial influence on it is invisible by construction — which is precisely why the industry's current experiments are so consequential and so under-specified.

Our position is narrow and, we think, testable. An advertising product in generative search should be judged first by where in the pipeline the money is allowed to act, and second by whether the product still functions when the reader turns it off. Every other consideration — disclosure wording, label contrast, auction efficiency — is downstream of those two.

Methods note. Figure 1 states the direction reported in the cited literature, normalised to a common axis; it is not our measurement. Figures 2–5 come from the Claim #1 pilot instrumentation and its bid simulator, with parameters in Appendix A. They are design targets and modelled outcomes, not production statistics, and are labelled as such throughout.

2 · Where money enters: a five-stage taxonomy

An answer is produced in stages, and a bid can be attached to any of them. The stages are not equally visible to the reader, equally reversible by the operator, or equally durable as a business.

Table 1. Monetisation depth. Stages 1–4 alter what the answer says; stage 5 alters only what is drawn beneath it after the answer is final.

Two properties fall out of Table 1. First, reversibility: a stage-5 slot can be removed from a rendered page with no effect on the answer, and this can be checked by hashing the answer text with the ad service enabled and disabled. Stages 1–4 offer no such check, because the answer is a different answer. Second, durability: revenue that depends on the reader not asking for a plain comparison is revenue with a thirty-token expiry date.

3 · Related work

Mechanism design for language models has developed quickly along the deep end of the taxonomy. Duetting et al. formalise auctions whose allocation is over model output rather than over slots, which opens the possibility of bidding at the level of generated segments [2]. Yun et al. push further, proposing allocation at the level of internal representations [3]. Alibaba and Baidu have both described production systems that place bidding inside retrieval and ranking loops for conversational surfaces. Commercially, OpenAI has published advertiser documentation and auction rules for a click-priced product [1], and Anthropic has stated a position against advertising in its assistant [5]. The three corporate answers — build it deep, build it shallow, decline — bracket the design space.

Two empirical results shape our design more than any of the mechanism papers. Salvi et al. study commercial persuasion in AI-mediated conversation with roughly two thousand participants and find that readers largely do not notice when a recommendation has been commercially shaped [4]. Maier et al. then show the other side of the same coin: a short user instruction — ask for a neutral table — is enough to defeat sponsored recommendation in current assistants [6]. Together these say that inline monetisation is both undetectable by the average reader and trivially defeated by an informed one. That is the worst of both worlds: it harms the people who cannot see it and earns nothing from the people who can.

4 · Design: the Claim #1 program

The program has three moving parts: a gate that decides who may appear, a price that decides in what order, and an architecture that makes the first two the only levers.

4.1 Relevance is a gate, not a multiplier

Quality-score auctions multiply bid by a relevance estimate, which means a large enough bid can always buy its way past mediocre relevance. We instead run relevance as a boolean admission test in which the amount paid is not an input. A bidder's own one-line pitch is matched against the classified intent of the specific question; those who pass are ordered by amount, and those who fail do not appear at any price. In the pilot's worked example — a question about egress fees on a forty-terabyte migration — two of nineteen bidders on the matched board qualify, and the second-highest payer on that board is among the seventeen held back.

4.2 Flat public price, not cost per click

Rank on a board is held by paying a flat, public amount for a window; taking first place requires beating the incumbent by at least five dollars, and a raise is charged only the difference. Two consequences are worth stating plainly. Because we are not paid per click, we have no revenue reason to make the card louder, to place it higher, or to word it more persuasively — the incentive that produces every dark pattern in display advertising is simply absent. And because the amount is public to the dollar, the ranking signal is legible to the reader without any trust in us at all.

4.3 Architecture, not policy

A stated prohibition on deep injection is worth little if the ad service is technically able to perform it. In the pilot the ad service holds no write path into retrieval, source ranking, context assembly, or generation: it receives a finished answer, its hash, and a classified intent, and returns markup for a region drawn beneath the answer. There is no interface through which a bid could reach the prompt, so the prohibition is enforced by the absence of a mechanism rather than by the presence of a rule.

5 · The neutral view as a first-class control

Maier et al. describe a user-side workaround; we ship it as a product control [6]. A single toggle — free, permanent, requiring no plan — removes the sponsored region and renders a plain comparison built only from cited sources. Two details make the claim checkable rather than rhetorical. The answer's hash is displayed in both states and is identical, which demonstrates that turning advertising off cannot improve the answer, because advertising never touched it. And bidders appearing in the neutral table are marked as bidders but not moved: in the worked example two of four rows are paying customers, and they sit first and last, wherever the underlying data puts them.

A paywalled neutral view would be an admission that the free one is bent. Charging for it is therefore precluded, not merely declined.

6 · Economics for the advertiser

A gate that rejects most of a board's traffic looks, at first, like a worse product. The console therefore reports the only number that matters: cost per qualified answer — the amount divided by the answers on which the bidder actually appeared. In the worked example, nine thousand dollars against three hundred and twelve qualified answers is $28.85 each, out of a board carrying 41,200 answers in the month. We show the small number deliberately, because the large one would be a lie.

The compensating effect is engagement. Because a slot appears only where it answers the question, readers learn that the region is worth looking at, and the click rate on a gated slot in the pilot runs roughly two and a half times its ungated counterpart across every rank.

One number is disclosed that no advertising platform we know of discloses: the share of readers who will never see the slot because they have switched the surface off. In the pilot this runs at nine per cent, it is shown in the console before payment, and it is deducted from the forecast rather than from the invoice.

Table 2.Worked example, Sovereign & EU cloud board, 30-day window. The invoice is flat and prepaid; every derived figure exists for the advertiser's benefit, not ours.

7 · Integrity measurement

Claims of this kind are worth exactly as much as their audit. Four quantities are instrumented and intended for quarterly publication whether or not they flatter us: the share of answers carrying any slot, the share where the slot was withheld for want of a qualified bidder, reader opt-out, and the share of submitted copy rejected at review. In addition, an independent reviewer re-runs a sample of five hundred queries with the ad service disabled and compares answer hashes; a single mismatch is a reportable failure of the architecture, not a tuning issue.

8 · Limitations and open problems

The gate is a classifier, and classifiers are attackable. A bidder who writes a pitch tuned to pass admission rather than to describe a product is the obvious adversary. We check claims against the advertiser's live page and re-review on every raise, but this is an arms race we should expect to be losing somewhere at any given moment.

Flat public pricing concentrates. Boards with a single wealthy category will price out the long tail, and the mechanism has no reserve-price answer to that other than opening more boards. Whether cheap boards are a genuine on-ramp or a decoration is an empirical question we cannot yet answer.

Ninety per cent of readers never open the receipt. Structural separation carries the disclosure load (Figure 3); the receipt serves the minority who check and the journalists who will. We should not pretend it is doing more than that.

The hash proves less than it appears to. It proves the rendered answer was not altered by ad selection on that request. It does not prove the retrieval index, the classifier, or the model was never trained or tuned with commercial outcomes in view. Only the independent re-run addresses that, and only by sampling.

Our figures are a pilot. Every quantity in Figures 2–5 and Table 2 is modelled or instrumented at small scale. The honest reading of this paper is a design commitment with a measurement plan attached, not a result.

9 · Conclusion

The industry is converging on the deep end of Table 1 because that is where the inventory looks largest. We think that is a mistake on its own terms. Monetisation at the token, segment or neuron level makes the answer the product being sold, is invisible to the readers it affects [4], and collapses under a thirty-token request from the readers it does not [6]. A surface that only exists while nobody looks closely is not a business; it is an unpriced liability.

The alternative is duller and, we believe, more durable: money enters once, at the last stage, in a labelled region, behind a gate that price cannot cross, at an amount printed on the card. It yields less inventory per query and a much smaller number to show advertisers. It also survives being switched off — which is the only test of an advertising product in generative search that will still mean anything in 2027.

Appendix A · Parameters

Correspondence: research@agicy.ai · agicy.ai/research · September 2026