Abstract:Neural ranking models (NRMs) and dense retrieval (DR) models have given rise to substantial improvements in overall retrieval performance. In addition to their effectiveness, and motivated by the proven lack of robustness of deep learning-based approaches in other areas, there is growing interest in the robustness of deep learning-based approaches to the core retrieval problem. Adversarial attack methods that have so far been developed mainly focus on attacking NRMs, with very little attention being paid to the robustness of DR models. In this paper, we introduce the adversarial retrieval attack (AREA) task. The AREA task is meant to trick DR models into retrieving a target document that is outside the initial set of candidate documents retrieved by the DR model in response to a query. We consider the decision-based black-box adversarial setting, which is realistic in real-world search engines. To address the AREA task, we first employ existing adversarial attack methods designed for NRMs. We find that the promising results that have previously been reported on attacking NRMs, do not generalize to DR models: these methods underperform a simple term spamming method. We attribute the observed lack of generalizability to the interaction-focused architecture of NRMs, which emphasizes fine-grained relevance matching. DR models follow a different representation-focused architecture that prioritizes coarse-grained representations. We propose to formalize attacks on DR models as a contrastive learning problem in a multi-view representation space. The core idea is to encourage the consistency between each view representation of the target document and its corresponding viewer via view-wise supervision signals. Experimental results demonstrate that the proposed method can significantly outperform existing attack strategies in misleading the DR model with small indiscernible text perturbations.

ARRA: Absolute-Relative Ranking Attack Against Image Retrieval

QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

Large-scale Image Retrieval Based on Boosting Iterative Quantization Hashing with Query-Adaptive Reranking.

Contextual Modeling on Auxiliary Points for Robust Image Reranking

Universal Perturbation Attack Against Image Retrieval

Practical Relative Order Attack in Deep Ranking

Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Method

Adversarial Ranking Attack and Defense

Adversarial Attack and Defense in Deep Ranking

Generalized Global Ranking-Aware Neural Architecture Ranker for Efficient Image Classifier Search

Beyond Score Changes: Adversarial Attack on No-Reference Image Quality Assessment from Two Perspectives

Learning to Rank Retargeted Images.

Reliable and Efficient Evaluation of Adversarial Robustness for Deep Hashing-Based Retrieval

Image-Level Adaptive Adversarial Ranking for Person Re-Identification

Multi-Query Parallel Field Ranking for image retrieval.

Learning to Combine Ad-hoc Ranking Functions for Image Retrieval

Attribute-assisted Reranking for Web Image Retrieval

U-Turn: Crafting Adversarial Queries with Opposite-Direction Features.

Exploring Vulnerabilities of No-Reference Image Quality Assessment Models: A Query-Based Black-Box Method

Efficient Non-Targeted Attack for Deep Hashing Based Image Retrieval