SentAttack: 密集检索模型的句子级黑盒对抗攻击方法

Jul 16, 2026

Upload by Eliana

Retrieval-Augmented Generation (RAG) systems rely on dense retrieval (DR) for initial recall and neural ranking (NRM) for re-ranking, yet robustness research largely targets NRMs and DR attacks are often restricted to word-level perturbations. For low-ranked, query-irrelevant targets, word-level changes cannot reliably raise their retrieval ranks. SentAttack introduces a two-stage sentence-level black-box strategy: iterative retrieval trains a surrogate DR model, then centroid-guided optimization uses query-and-centroid objectives with gradient-guided beam search to craft effective adversarial candidates, achieving stronger results especially for low-ranked targets.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages16

Reading Time40 min

Abstract

Introduction

SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models Luping Wei , Yamin Hu , Sihan Shang , Shiyin Wang , Wenjian Luo∗ School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China [24s151067@stu.hit.edu.cn](24s151067@stu.hit.edu.cn), [huyamin@hit.edu.cn](huyamin@hit.edu.cn), [shangsihan@stu.hit.edu.cn](shangsihan@stu.hit.edu.cn), [24s051011@stu.hit.edu.cn](24s051011@stu.hit.edu.cn), [luowenjian@hit.edu.cn](luowenjian@hit.edu.cn) arXiv :2607 .03456v 1 [ cs .IR] 3 Jul 2026 Abstract Retrieval-Augmented Generation (RAG) systems typically consist of a dense retrieval (DR) model for initial retrieval and a neural ranking model (NRM) for re-ranking. Existing robustness studies in RAG mainly focus on NRMs, while adversarial attacks on DR models are mostly limited to word-level perturbations. For low-ranked target documents that are irrelevant to the query, simple word-level attacks are insufficient to mislead DR models into substantially promoting their rankings. To solve these problems, we propose SentAttack, a sentence-level black-box adversarial attack method for DR models. SentAttack is designed as a twostage method. In the first stage, SentAttack interacts with the black-box RAG system via iterative retrieval to collect ranked documents and ranking information for training a surrogate DR model. In the second stage, SentAttack uses the surrogate DR model to encode and cluster documents relevant to the target query, yielding multiple cluster centroids. These centroids are concatenated with the target document at the sentence level to form an initial set of adversarial candidates. SentAttack then optimizes these candidates using a query-and centroidguided objective combined with gradient-guided beam search. Extensive experiments demonstrate that SentAttack outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents. 1 Introduction A typical Retrieval-Augmented Generation (RAG) system consists of two stages: retrieval, which returns an initial topK documents relevant to the query, and re-ranking, which further re-ranks these candidates [Oche et al., 2025] . In the retrieval stage, documents are chunked and embedded into vectors for efficient semantic search using dense retrieval (DR) models, which independently encode queries and documents and achieve high recall in large-scale corpora [Guo ∗ Corresponding author. Normal Retrieval User Query: how many miles in altitude is the united states satellite constellation? Adversarial Retrieval Original Recalled Candidates Adversarial Recalled Candidates Figure 1: An example of a word-level adversarial attack on a DR model. The original target document, “Hi-Line offers a comprehensive range. . .”, is initially not retrieved for the query. After adversarial perturbation (red text), it rises into the top-K candidates, effectively giving Hi-Line advertising. et al., 2022; Zhao et al., 2024] . The re-ranking stage typically employs neural ranking models (NRMs), which use interaction-focused architectures to jointly encode queries and documents, producing more precise relevance scores at a higher computational cost than DR models [Dai and Callan, 2019; Xiong et al., 2017] . Although NRMs and DR models substantially improve the retrieval effectiveness of RAG systems, they remain vulnerable to adversarial perturbations, where small textual changes can drastically alter retrieval or ranking outcomes [Oche et al., 2025] . Studying adversarial attacks is therefore crucial for identifying potential vulnerabilities in RAG systems and enhancing system robustness. Most existing adversarial research in RAG has focused on NRMs, which use interaction-focused architectures to jointly encode queries and documents [Liu et al., 2022] . Comparatively speaking, the adversarial robustness of DR models has received relatively little attention. Unlike

FAQs

SentAttack解决了密集检索模型DR的哪些对抗攻击难点？

现有研究多关注NRM，且对DR的攻击通常停留在词级扰动。SentAttack针对“低排序目标文档很难被词级攻击有效提升到top-K”这一关键失败场景提出句子级方法。

SentAttack的两阶段流程分别做什么？

第一阶段通过与黑盒RAG系统进行迭代检索，收集排序结果与信息来训练一个替代（surrogate）DR模型。第二阶段再进行迭代检索收集与目标查询相关文档，由替代模型编码并聚类得到多个聚类中心。

SentAttack如何生成并优化对抗候选以影响检索排序？

将聚类中心在句子级与目标文档拼接形成初始对抗候选集合。随后结合“query-and-centroidguided”的目标函数，并使用带梯度引导的beam search对候选进行优化。

Jul 16, 2026

Upload by Eliana