Are LLMs Reliable Rankers? Rank Manipulation via Two-Stage Token Optimization

2025-10-08

AI Summary

This work exposes a security vulnerability in large language models (LLMs) when employed as neural re-rankers for information retrieval: their ranking behavior can be manipulated via natural-language adversarial prompts. To exploit this, we propose a two-stage token-level optimization framework. In Stage I, we jointly optimize the ranking objective using greedy coordinate gradient (GCG) and entropy-weighted dynamic scheduling. In Stage II, we impose joint constraints from readability scoring and temperature-sampling regularization to ensure high linguistic naturalness of the perturbed prompt. Compared to existing attacks, our method achieves significantly higher target-document ranking gains while preserving semantic coherence and fluency. We validate its effectiveness, robustness, and stealth across multiple mainstream LLMs—including Llama-3, Qwen2, and Gemma-2—demonstrating consistent success under diverse retrieval settings. This is the first systematic study to uncover and characterize critical security risks inherent in the LLM-based re-ranking paradigm.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Search and Optimization: Learning to Search

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Large language models (LLMs) are increasingly used as rerankers in information retrieval, yet their ranking behavior can be steered by small, natural-sounding prompts. To expose this vulnerability, we present Rank Anything First (RAF), a two-stage token optimization method that crafts concise textual perturbations to consistently promote a target item in LLM-generated rankings while remaining hard to detect. Stage 1 uses Greedy Coordinate Gradient to shortlist candidate tokens at the current position by combining the gradient of the rank-target with a readability score; Stage 2 evaluates those candidates under exact ranking and readability losses using an entropy-based dynamic weighting scheme, and selects a token via temperature-controlled sampling. RAF generates ranking-promoting prompts token-by-token, guided by dual objectives: maximizing ranking effectiveness and preserving linguistic naturalness. Experiments across multiple LLMs show that RAF significantly boosts the rank of target items using naturalistic language, with greater robustness than existing methods in both promoting target items and maintaining naturalness. These findings underscore a critical security implication: LLM-based reranking is inherently susceptible to adversarial manipulation, raising new challenges for the trustworthiness and robustness of modern retrieval systems. Our code is available at: https://github.com/glad-lab/RAF.

Problem

• Exposing LLM ranking vulnerability through adversarial token optimization
• Manipulating item rankings while maintaining natural language appearance
• Addressing security risks in LLM-based information retrieval systems

Innovation

• Two-stage token optimization for rank manipulation
• Greedy Coordinate Gradient shortlists candidate tokens
• Entropy-based weighting balances ranking and readability