SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models
2026-07-03 • Information Retrieval
Information Retrieval
AI summaryⓘ
The authors studied a type of system called Retrieval-Augmented Generation (RAG), which uses models to find and rank documents based on a query. They noticed past attacks mostly changed single words to trick the initial retrieval model, which doesn't work well for documents that start off low-ranked. To fix this, they created SentAttack, which changes whole sentences in a smart way to better fool the system. SentAttack first learns how the system ranks by testing it, then uses that knowledge to create and improve sentence-based attacks. Their tests show SentAttack is better at increasing the rank of target documents, especially those initially ranked low.
Retrieval-Augmented GenerationDense RetrievalNeural Ranking ModelAdversarial AttackBlack-box AttackSentence-level PerturbationSurrogate ModelClusteringBeam Search
Authors
Luping Wei, Yamin Hu, Sihan Shang, Shiyin Wang, Wenjian Luo
Abstract
Retrieval-Augmented Generation (RAG) systems typically consist of a dense retrieval (DR) model for initial retrieval and a neural ranking model (NRM) for re-ranking.Existing robustness studies in RAG mainly focus on NRMs, while adversarial attacks on DR models are mostly limited to word-level perturbations.For low-ranked target documents that are irrelevant to the query, simple word-level attacks are insufficient to mislead DR models into substantially promoting their rankings.To solve these problems, we propose SentAttack, a sentence-level black-box adversarial attack method for DR models.SentAttack is designed as a two-stage method.In the first stage, SentAttack interacts with the black-box RAG system via iterative retrieval to collect ranked documents and ranking information for training a surrogate DR model.In the second stage, SentAttack uses the surrogate DR model to encode and cluster documents relevant to the target query, yielding multiple cluster centroids.These centroids are concatenated with the target document at the sentence level to form an initial set of adversarial candidates.SentAttack then optimizes these candidates using a query- and centroid-guided objective combined with gradient-guided beam search.Extensive experiments demonstrate that SentAttack outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents.