SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models

Luping Wei Ya-Min Hu Sihan Shang Shiyin Wang Wenjian Luo

Jul 2026 · arXiv.org · Vol abs/2607.03456 · 0 citations · 42 references

Computer Science

TL;DR

SentAttack is a sentence-level black-box adversarial attack method for DR models that outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents.

Abstract

Retrieval-Augmented Generation (RAG) systems typically consist of a dense retrieval (DR) model for initial retrieval and a neural ranking model (NRM) for re-ranking.Existing robustness studies in RAG mainly focus on NRMs, while adversarial attacks on DR models are mostly limited to word-level perturbations.For low-ranked target documents that are irrelevant to the query, simple word-level attacks are insufficient to mislead DR models into substantially promoting their rankings.To solve these problems, we propose SentAttack, a sentence-level black-box adversarial attack method for DR models.SentAttack is designed as a two-stage method.In the first stage, SentAttack interacts with the black-box RAG system via iterative retrieval to collect ranked documents and ranking information for training a surrogate DR model.In the second stage, SentAttack uses the surrogate DR model to encode and cluster documents relevant to the target query, yielding multiple cluster centroids.These centroids are concatenated with the target document at the sentence level to form an initial set of adversarial candidates.SentAttack then optimizes these candidates using a query- and centroid-guided objective combined with gradient-guided beam search.Extensive experiments demonstrate that SentAttack outperforms existing adversarial attacks on DR models, with especially strong performance on low-ranked target documents.

DOI arXiv Semantic Scholar

View source

Similar papers

Preprint Aug 2026

RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation

It is proved that, under an honest-majority assumption and a representation-level separation condition, RAGSentinel exactly recovers a poison-free majority-sized context.

Yueyang Quan, Anjun Gao, Yu Xia et al. · 0 citations

#natural language process... Preprint Sep 2026

VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models

Neural ranking models have become core components of modern information retrieval systems and important building blocks of AI systems such as retrieval-augmented generation (RAG) pipelines. However, their robustness remains insufficiently understood in the presence of large language models (LLMs), which can generate fluent and deceptive content at scale. This work investigates the vulnerability of neural ranking models to corpus poisoning attacks, in which an adversary injects a small number of maliciously crafted documents into the corpus to distort ranking behavior. We propose VerTox, the first framework to formulate corpus poisoning as a verifiable reward-guided reinforcement learning (RLVR) problem. By explicitly coupling ranking distortion with factual corruption through specialized reward shaping, we fine-tune compact LLMs into adversarial generators. Experiments demonstrate that our method achieves near-perfect attack success rates, producing adversarial documents that frequently rank higher than target documents across major neural ranking architectures, as well as a proprietary commercial embedding model. The generated adversarial documents are fluent and exhibit low perplexity, making them difficult to detect. Furthermore, by explicitly encouraging factual corruption, our adversarial documents significantly degrade the performance of a downstream RAG application.

Zhi-Qi Huang, Vivek Datla, Zhichao Xu et al. · 0 citations

Preprint Aug 2026

DSPrompt: Dynamic Soft Prompt Defense Against M-RAG Corruption

DSPrompt is proposed, a Dynamic Soft Prompt defense framework that directly reshapes the retriever's embedding semantics, without modifying the retrieval pipeline, and is consistently outperforming existing defense baselines at a fraction of their computational cost.

Chang Liu, Y. Lai, Ming-Yue Cui et al. · 0 citations

Jul 2026

TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

Evaluated against the non-adaptive attacker described in the original PoisonedRAG paper, the full pipeline reduces attack success rate from roughly 91% to roughly 13%, while preserving accuracy on benign, unpoisoned queries.

S. K. Mohanty, Rohit Patel, K. Yuvaraj et al. · arXiv.org · 0 citations

Jul 2026

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning

RAGuard, a layered defense against corpus-poisoning attacks on RAG pipelines, is introduced, showing that keyword-preserving poisons leave lexical retrievers such as BM25 essentially unaffected, an observation that delineates the boundary of the threat model.

Pushkal Kumar, Tucker Nielson, Tanish Kolhe et al. · arXiv.org · 4 citations · ⚡1

#natural language process... Preprint Aug 2026

CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents

CamoDocs is proposed, a poisoning attack that avoids direct query inclusion by camouflaging adversarial documents among benign content, and shows that erasure-heavy clustering defenses such as TrustRAG can reduce ASR, but only with substantial utility drops on retrieval-dependent benchmarks such as NeoQA.

Jaewon Jung, Haizhong Zheng, Hongsun Jang et al. · 0 citations