One Word is Enough: Minimal Adversarial Perturbations for Neural Text Ranking
Tanmay Karmakar, Sourav Saha, Debapriyo Majumdar, Surjyanee Halder
TL;DR
The paper investigates the fragility of neural ranking models to minimal adversarial edits and proposes a single-word, query-aware attack framed around a query center. It formalizes the query center as the embedding-space centroid of the query and explores three attack strategies, including a gradient-guided variant that selects perturbation positions via $I(t_i)=\left\|\frac{\partial \mathcal{L}_{\text{rank}}}{\partial e_{t_i}}\right\|_2^2$. Experiments on MSMARCO with BERT and monoT5 show up to 91% attack success with fewer than two token edits, while maintaining high semantic similarity ($SS$), and reveal a Goldilocks zone where mid-ranked documents are most vulnerable. The authors also introduce Perturbation Percentage and Interval Success Rate to analyze attack behavior beyond aggregate success, highlighting practical risks in multi-stage retrieval and motivating defenses for robust neural ranking. Future work includes extending to black-box settings, LLM-based rankers, and broader tasks like conversational search and recommendation, to assess robustness across information-access pipelines.
Abstract
Neural ranking models (NRMs) achieve strong retrieval effectiveness, yet prior work has shown they are vulnerable to adversarial perturbations. We revisit this robustness question with a minimal, query-aware attack that promotes a target document by inserting or substituting a single, semantically aligned word - the query center. We study heuristic and gradient-guided variants, including a white-box method that identifies influential insertion points. On TREC-DL 2019/2020 with BERT and monoT5 re-rankers, our single-word attacks achieve up to 91% success while modifying fewer than two tokens per document on average, achieving competitive rank and score boosts with far fewer edits under a comparable white-box setup to ensure fair evaluation against PRADA. We also introduce new diagnostic metrics to analyze attack sensitivity beyond aggregate success rates. Our analysis reveals a Goldilocks zone in which mid-ranked documents are most vulnerable. These findings demonstrate practical risks and motivate future defenses for robust neural ranking.