只改一个词就能让排名模型出错，揭示了神经排序的脆弱性。
One Word is Enough: Minimal Adversarial Perturbations for Neural Text Ranking
- 用单个语义匹配词替换或插入，实现最小化对抗攻击。
- 在TREC-DL上成功率高达91%，平均每文档修改少于两个词。
- 发现中等排名文档最易受攻击，适合研究模型安全性的学者。
神经排序模型（NRMs）虽具强大检索能力，但易受对抗扰动影响。本文提出一种极简、查询感知的攻击方法，通过插入或替换一个语义对齐的词（即查询中心词）来提升目标文档排名。研究了启发式与梯度引导的变体，包括一种白盒方法以识别关键插入位置。在TREC-DL 2019/2020数据集上，使用BERT和monoT5重排序器，单词攻击平均仅修改每文档不足两个词，成功率最高达91%，在与PRADA相当的白盒设置下仍表现优异。引入新诊断指标，分析攻击敏感性。结果表明，中等排名文档最易受攻击。这些发现揭示了实际风险，推动未来鲁棒性防御研究。
原文摘要 · Abstract (English)
Neural ranking models (NRMs) achieve strong retrieval effectiveness, yet prior work has shown they are vulnerable to adversarial perturbations. We revisit this robustness question with a minimal, query-aware attack that promotes a target document by inserting or substituting a single, semantically aligned word - the query center. We study heuristic and gradient-guided variants, including a white-box method that identifies influential insertion points. On TREC-DL 2019/2020 with BERT and monoT5 re-rankers, our single-word attacks achieve up to 91% success while modifying fewer than two tokens per document on average, achieving competitive rank and score boosts with far fewer edits under a comparable white-box setup to ensure fair evaluation against PRADA. We also introduce new diagnostic metrics to analyze attack sensitivity beyond aggregate success rates. Our analysis reveals a Goldilocks zone in which mid-ranked documents are most vulnerable. These findings demonstrate practical risks and motivate future defenses for robust neural ranking.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。