Led to Mislead: Adversarial Content Injection for Attacks on Neural Ranking Models

TL;DR

This paper introduces CRAFT, a supervised framework using large language models to generate adversarial content that effectively manipulates neural ranking models, revealing significant vulnerabilities in retrieval systems.

Contribution

CRAFT is a novel, multi-stage framework that improves adversarial attack effectiveness and transferability across diverse neural ranking architectures.

Findings

CRAFT outperforms existing attack methods in promotion rates and rank boosts.

CRAFT transfers effectively across different ranking architectures.

The work highlights vulnerabilities in real-world retrieval systems.

Abstract

Neural Ranking Models (NRMs) are central to modern information retrieval but remain highly vulnerable to adversarial manipulation. Existing attacks often rely on heuristics or surrogate models, limiting effectiveness and transferability. We propose CRAFT, a supervised framework for black-box adversarial rank attacks powered by large language models (LLMs). CRAFT operates in three stages: adversarial dataset generation via retrieval-augmented generation and self-refinement, supervised fine-tuning on curated adversarial examples, and preference-guided optimization to align generations with rank-promotion objectives. Extensive experiments on the MS MARCO passage dataset, TREC Deep Learning 2019, and TREC Deep Learning 2020 benchmarks show that CRAFT significantly outperforms state-of-the-art baselines, achieving higher promotion rates and rank boosts while preserving fluency and semantic fidelity. Moreover, CRAFT transfers effectively across diverse ranking architectures, including cross-encoder, embedding-based, and LLM-based rankers, underscoring vulnerabilities in real-world retrieval systems. This work provides a principled framework for studying adversarial threats in NRMs, underscores the risks of generative AI in rank manipulation, and provides a foundation for developing more robust retrieval systems. To support reproducibility, we publicly release our source code, trained models, and prompt templates.