The Effect of Multi-Lingual and Keyword Adversarial Injection on LLM Relevance Judgment

Jul 16, 2026

Upload by Liam

Large language models (LLMs) are increasingly used as automated judges for relevance evaluation in information retrieval, yet their robustness to adversarial manipulation is not well understood, especially in multilingual contexts. This study analyzes cross-lingual prompt injection attacks against LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models. It tests instruction- and content-based injections across eight languages, finding multilingual query-based attacks inflate relevance scores and evade existing defenses. The results show defenses can be adapted to mitigate attacks, but attacks remain easily bypassable, exposing a critical gap in proactive evaluation for LLM-as-a-judge systems.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages3

Reading Time8 min

Introduction

Methodology

Results

Discussion

The Eﬀect of Multi-Lingual and Keyword Adversarial Injection on LLM Relevance Judgment Nguyen Khoi Vo RMIT University Melbourne, VIC, Australia Mark Sanderson RMIT University Melbourne, VIC, Australia Tuong Duy Duong RMIT University Melbourne, VIC, Australia Oleg Zendel RMIT University Melbourne, VIC, Australia arXiv :2607 . 10080v 1 [ cs .IR] 11 Jul 2026 Abstract Large language models (LLMs) are increasingly being used as automated judges for relevance evaluation in information retrieval, yet their robustness to adversarial manipulation remains insuﬃciently understood, particularly in multilingual settings. In this work, we investigate the impact of cross-lingual prompt injection attacks on LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models under established prompting frameworks. We examine both instruction-based and contentbased injection strategies in 8languages spanning diﬀerent resource levels. Our results demonstrate that multilingual query-based injections are highly eﬀective in inﬂating relevance scores while simultaneously evading existing prompt-injection defenses. We further found that, although existing defense mechanisms can be modiﬁed to mitigate such attacks, these injections can be easily adapted to bypass them. These ﬁndings highlight a critical gap in current defense approaches and demonstrate that language generalization can act as an attack vector, underscoring the need for more robust and proactive evaluation frameworks for LLM-as-a-judge systems. Keywords large language models, information retrieval, adversarial prompting, relevance judgment, multilingual evaluation 1 Introduction Recent advances in LLMs have positioned them as potential alternatives to traditional human-based relevance judgments, leading to their increasing adoption as automated judges in information retrieval (IR) tasks [4, 10] . As LLM judges are deployed in evaluation pipelines—including TREC-style benchmarks and commercial search quality assessment; their susceptibility to adversarial manipulation carries potential consequences: inﬂated relevance scores can distort evaluation outcomes, misguide retrieval system development, and undermine the integrity oflarge-scale automated annotation. Prior work on adversarial manipulation of LLM-based evaluation has been limited. Most studies focus on instruction-based This work is licensed under a Creative Commons Attribution 4 .0 International License. VulGen’26, Melbourne, VIC, Australia © 2026 Copyright held by the owner/author(s) . prompt injection (e.g., “ignore previous instructions”) [7] . In contrast, only a small number of works have examined content-based manipulation. In particular, Alaoﬁ et al. [1] shows that inserting query keywords into passages can fool LLM-based relevance judgments, while Cuconasu et al. [3] demonstrates that introducing distracting content can signiﬁcantly degrade retrieval-augmented generation (RAG) performance. However, these two lines of work remain largely disconnected: the ﬁrst focuses on keyword-based injection, while the second focuses on performance degradation in RAG systems, without evaluating adversarial implications forLLMas-a-judge settings. Furthermore, limited attention has been given to richer forms of content manipulation, such as query variants or semantically similar but irrelevant text, and to their transferability across languages. In particular, content-based injection strategies – such as the inclusion of query keywords, phrases, or their variants – resemble keyword stuﬃng and black-hat SEO practices, yet their robustness and generality remain insuﬃciently understood. This gap is particularly concerning given recent ﬁndings by Thomas et al. [9], which suggest that LLM-based evaluation can make relevance judgments across languages. This raises the question of whether content-based manipulations can also transfer across languages and remain eﬀective under mul

FAQs

What problem does the paper address about LLMs in information retrieval evaluation?

It studies how robust LLM-based judges are to adversarial manipulation when performing relevance judgments in information retrieval, with a focus on multilingual settings.

What kinds of adversarial injections are investigated?

The paper examines both instruction-based and content-based prompt injection strategies, including multilingual query-based injections using query keywords and variants.

How do the proposed multilingual attacks affect relevance judgments and existing defenses?

Multilingual query-based injections are highly effective at inflating relevance scores while evading existing prompt-injection defenses; even modified defenses can still be bypassed via easy adaptation of the injections.

Jul 16, 2026

Upload by Liam