Led to Mislead: Adversarial Content Injection for Attacks on Neural Ranking Models

• URL: http://arxiv.org/abs/2605.01591v1
• Date: Sat, 02 May 2026 19:26:34 GMT
• Title: Led to Mislead: Adversarial Content Injection for Attacks on Neural Ranking Models
• Abstract summary: CRAFT is a supervised framework for black-box rank attacks powered by large language models (LLMs)<n>It outperforms state-of-the-art baselines in achieving higher promotion rates and rank boosts while preserving semantic fidelity.<n>This work underscores the risks of generative AI in rank manipulation, and provides a foundation for developing more robust retrieval systems.
• Score: 17.398369313076053
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Neural Ranking Models (NRMs) are central to modern information retrieval but remain highly vulnerable to adversarial manipulation. Existing attacks often rely on heuristics or surrogate models, limiting effectiveness and transferability. We propose CRAFT, a supervised framework for black-box adversarial rank attacks powered by large language models (LLMs). CRAFT operates in three stages: adversarial dataset generation via retrieval-augmented generation and self-refinement, supervised fine-tuning on curated adversarial examples, and preference-guided optimization to align generations with rank-promotion objectives. Extensive experiments on the MS MARCO passage dataset, TREC Deep Learning 2019, and TREC Deep Learning 2020 benchmarks show that CRAFT significantly outperforms state-of-the-art baselines, achieving higher promotion rates and rank boosts while preserving fluency and semantic fidelity. Moreover, CRAFT transfers effectively across diverse ranking architectures, including cross-encoder, embedding-based, and LLM-based rankers, underscoring vulnerabilities in real-world retrieval systems. This work provides a principled framework for studying adversarial threats in NRMs, underscores the risks of generative AI in rank manipulation, and provides a foundation for developing more robust retrieval systems. To support reproducibility, we publicly release our source code, trained models, and prompt templates.

Related papers

• Beyond Static Best-of-N: Bayesian List-wise Alignment for LLM-based Recommendation [23.95623437107717]
  Large Language Models have revolutionized recommender systems (LLM4Rec) by leveraging their generative capabilities to model user preferences.<n>Existing LLM4Rec methods rely on token-level objectives, making it difficult to optimize list-level and non-differentiable metrics that define actual recommendation quality.<n>We propose BLADE (Bayesian List-wise Alignment via Dynamic Estimation) to overcome these challenges.
  arXiv  Detail & Related papers  (2026-05-06T07:02:57Z)
• Weak-Driven Learning: How Weak Agents make Strong Agents Stronger [46.50703640719333]
  We propose WMSS (Weak Agents Can Make Strong Agents Stronger), a post-training paradigm that leverages weak checkpoints to guide continued optimization.<n> Experiments on mathematical reasoning and code generation datasets show that agents trained with our approach achieve effective performance improvements.
  arXiv  Detail & Related papers  (2026-02-09T02:50:40Z)
• Deep Leakage with Generative Flow Matching Denoiser [54.05993847488204]
  We introduce a new deep leakage (DL) attack that integrates a generative Flow Matching (FM) prior into the reconstruction process.<n>Our approach consistently outperforms state-of-the-art attacks across pixel-level, perceptual, and feature-based similarity metrics.
  arXiv  Detail & Related papers  (2026-01-21T14:51:01Z)
• SoliReward: Mitigating Susceptibility to Reward Hacking and Annotation Noise in Video Generation Reward Models [53.19726629537694]
  Post-training alignment of video generation models with human preferences is a critical goal.<n>Current data collection paradigms, reliant on in-prompt pairwise annotations, suffer from labeling noise.<n>We propose SoliReward, a systematic framework for video RM training.
  arXiv  Detail & Related papers  (2025-12-17T14:28:23Z)
• RAGRank: Using PageRank to Counter Poisoning in CTI LLM Pipelines [0.9144793163215507]
  Retrieval-Augmented Generation (RAG) has emerged as the dominant architectural pattern to operationalize Large Language Model (LLM) usage in Cyber Threat Intelligence systems.<n>We propose that the robustness of modern RAG defenses can be accelerated by applying source credibility algorithms on corpora.
  arXiv  Detail & Related papers  (2025-10-23T17:43:00Z)
• Automatic Speech Recognition in the Modern Era: Architectures, Training, and Evaluation [0.0]
  Speech recognition has undergone a profound transformation over the past decade, driven by advances in deep learning.<n>This survey provides a comprehensive overview of the modern era of ASR, charting its evolution from traditional hybrid systems to the now-dominant end-to-end neural architectures.
  arXiv  Detail & Related papers  (2025-10-11T05:38:45Z)
• Graph Representation-based Model Poisoning on Federated Large Language Models [3.5233863453805143]
  Federated large language models (FedLLMs) enable powerful generative capabilities within wireless networks while preserving data privacy.<n>This article first reviews recent advancements in model poisoning techniques and existing defense mechanisms for FedLLMs, underscoring critical limitations.<n>The article further investigates graph representation-based model poisoning (GRMP), an emerging attack paradigm that exploits higher-order correlations among benign client gradients to craft malicious updates indistinguishable from legitimate ones.
  arXiv  Detail & Related papers  (2025-07-02T13:20:52Z)
• Adversarial Training for Defense Against Label Poisoning Attacks [53.893792844055106]
  Label poisoning attacks pose significant risks to machine learning models.<n>We propose a novel adversarial training defense strategy based on support vector machines (SVMs) to counter these threats.<n>Our approach accommodates various model architectures and employs a projected gradient descent algorithm with kernel SVMs for adversarial training.
  arXiv  Detail & Related papers  (2025-02-24T13:03:19Z)
• Transferable Adversarial Attacks on SAM and Its Downstream Models [87.23908485521439]
  This paper explores the feasibility of adversarial attacking various downstream models fine-tuned from the segment anything model (SAM)<n>To enhance the effectiveness of the adversarial attack towards models fine-tuned on unknown datasets, we propose a universal meta-initialization (UMI) algorithm.
  arXiv  Detail & Related papers  (2024-10-26T15:04:04Z)
• Complexity-Aware Deep Symbolic Regression with Robust Risk-Seeking Policy Gradients [20.941908494137806]
  We propose a novel deep symbolic regression approach to enhance the robustness and interpretability of data-driven mathematical expression discovery.<n>Our work is aligned with the popular DSR framework which focuses on learning a data-specific expression generator.
  arXiv  Detail & Related papers  (2024-06-10T19:29:10Z)
• RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content [62.685566387625975]
  Current mitigation strategies, while effective, are not resilient under adversarial attacks. This paper introduces Resilient Guardrails for Large Language Models (RigorLLM), a novel framework designed to efficiently moderate harmful and unsafe inputs.
  arXiv  Detail & Related papers  (2024-03-19T07:25:02Z)
• Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Method [115.29382166356478]
  We introduce the adversarial retrieval attack (AREA) task. It is meant to trick DR models into retrieving a target document that is outside the initial set of candidate documents retrieved by the DR model. We find that the promising results that have previously been reported on attacking NRMs, do not generalize to DR models. We propose to formalize attacks on DR models as a contrastive learning problem in a multi-view representation space.
  arXiv  Detail & Related papers  (2023-08-19T00:24:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.