The Ranking Blind Spot: Decision Hijacking in LLM-based Text Ranking

2025-09-22

AI Summary

This work identifies a systematic decision bias—termed “ranking blindness”—in large language models (LLMs) when performing multi-document ranking, stemming from inherent flaws in their instruction-following mechanisms. To expose and characterize this phenomenon, we propose two novel adversarial attacks: *target hijacking*, which artificially elevates the rank of a specific document, and *standard hijacking*, which manipulates the implicit evaluation criteria used by the LLM. We provide the first formal definition of ranking blindness and empirically validate its prevalence across diverse settings. Experiments demonstrate that stronger LLMs exhibit heightened vulnerability to these attacks, and both attack strategies achieve high effectiveness and cross-model transferability—spanning architectures (Llama, Qwen, GPT-series) and ranking paradigms (RAG, LLM-as-ranker) in both pairwise and multi-document ranking tasks. The implementation is publicly released.

Technology Category

• Machine Learning: Learning Preferences or Rankings
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: (Large) Language Models

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Fairness-aware retrieval and ranking
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Large Language Models (LLMs) have demonstrated strong performance in information retrieval tasks like passage ranking. Our research examines how instruction-following capabilities in LLMs interact with multi-document comparison tasks, identifying what we term the "Ranking Blind Spot", a characteristic of LLM decision processes during comparative evaluation. We analyze how this ranking blind spot affects LLM evaluation systems through two approaches: Decision Objective Hijacking, which alters the evaluation goal in pairwise ranking systems, and Decision Criteria Hijacking, which modifies relevance standards across ranking schemes. These approaches demonstrate how content providers could potentially influence LLM-based ranking systems to affect document positioning. These attacks aim to force the LLM ranker to prefer a specific passage and rank it at the top. Malicious content providers can exploit this weakness, which helps them gain additional exposure by attacking the ranker. In our experiment, We empirically show that the proposed attacks are effective in various LLMs and can be generalized to multiple ranking schemes. We apply these attack to realistic examples to show their effectiveness. We also found stronger LLMs are more vulnerable to these attacks. Our code is available at: https://github.com/blindspotorg/RankingBlindSpot

Problem

• LLMs have a ranking blind spot in comparative evaluation
• Content providers can hijack LLM ranking decisions and criteria
• Attacks exploit this vulnerability to manipulate document positioning

Innovation

• Decision Objective Hijacking alters pairwise ranking goals
• Decision Criteria Hijacking modifies relevance standards
• Attacks exploit LLM blind spots to manipulate rankings