SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models

2026-07-03

AI Summary

This work addresses the limitations of existing adversarial attacks on dense retrieval (DR) models in retrieval-augmented generation (RAG) systems, which are typically confined to word-level perturbations and struggle to effectively promote low-ranked irrelevant documents. To overcome this, the authors propose SentAttack, a sentence-level black-box adversarial attack method that operates in two stages: first, a surrogate DR model is trained through interactions with the target black-box RAG system; then, sentence-level adversarial examples are generated and optimized using this surrogate. SentAttack is the first approach to extend adversarial attacks to the sentence level, integrating document embedding clustering, query- and cluster-center-guided optimization objectives, and a gradient-informed beam search strategy. Experiments across multiple benchmarks demonstrate that SentAttack significantly outperforms existing methods, particularly in elevating the retrieval ranks of originally low-ranked irrelevant documents.

Abstract

Retrieval-Augmented Generation (RAG) systems typically consist of a dense retrieval (DR) model for initial retrieval and a neural ranking model (NRM) for re-ranking.Existing robustness studies in RAG mainly focus on NRMs, while adversarial attacks on DR models are mostly limited to word-level perturbations.For low-ranked target documents that are irrelevant to the query, simple word-level attacks are insufficient to mislead DR models into substantially promoting their rankings.To solve these problems, we propose SentAttack, a sentence-level black-box adversarial attack method for DR models.SentAttack is designed as a two-stage method.In the first stage, SentAttack interacts with the black-box RAG system via iterative retrieval to collect ranked documents and ranking information for training a surrogate DR model.In the second stage, SentAttack uses the surrogate DR model to encode and cluster documents relevant to the target query, yielding multiple cluster centroids.These centroids are concatenated with the target document at the sentence level to form an initial set of adversarial candidates.SentAttack then optimizes these candidates using a query- and centroid-guided objective combined with gradient-guided beam search.Extensive experiments demonstrate that SentAttack outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents.

Problem

• dense retrieval
• adversarial attack
• sentence-level
• black-box
• retrieval-augmented generation

Innovation

• sentence-level adversarial attack
• dense retrieval
• black-box attack
• surrogate model
• retrieval-augmented generation