VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models

2026-09-01

AI Summary

研究神经排名模型对语料库投毒攻击的脆弱性，提出VerTox框架，通过奖励引导强化学习生成对抗文档以扭曲排名行为。

Abstract

Neural ranking models have become core components of modern information retrieval systems and important building blocks of AI systems such as retrieval-augmented generation (RAG) pipelines. However, their robustness remains insufficiently understood in the presence of large language models (LLMs), which can generate fluent and deceptive content at scale. This work investigates the vulnerability of neural ranking models to corpus poisoning attacks, in which an adversary injects a small number of maliciously crafted documents into the corpus to distort ranking behavior. We propose VerTox, the first framework to formulate corpus poisoning as a verifiable reward-guided reinforcement learning (RLVR) problem. By explicitly coupling ranking distortion with factual corruption through specialized reward shaping, we fine-tune compact LLMs into adversarial generators. Experiments demonstrate that our method achieves near-perfect attack success rates, producing adversarial documents that frequently rank higher than target documents across major neural ranking architectures, as well as a proprietary commercial embedding model. The generated adversarial documents are fluent and exhibit low perplexity, making them difficult to detect. Furthermore, by explicitly encouraging factual corruption, our adversarial documents significantly degrade the performance of a downstream RAG application.

Problem

• neural ranking models
• corpus poisoning
• adversarial attack
• large language models
• robustness

Innovation

• Verifiable Reward-Guided Reinforcement Learning
• Corpus Poisoning
• Neural Ranking Models
• Factual Corruption