REVIEW 4 major objections 2 minor 1 cited by
Adversarial Attacks against Neural Ranking Models via In-Context Learning
T0 review · 4 major / 2 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read A pure prompting attack makes generated documents outrank credible health answers
desk verdict The submission is two papers stuck together: the abstract promises a few-shot adversarial attack on neural rankers, while the body is a GP-based galaxy subtraction paper; neither supports the other. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Few-Shot Adversarial Prompting (FSAP) framework and its two instantiations, FSAP-IntraQ and FSAP-InterQ. The load-bearing mechanism is in-context learning: the support set of harmful examples shapes the LLM's generation so that fluency and topical coherence are preserved while misleading content is embedded. This replaces token-level gradient attacks and manual rewriting with a pure prompt-level attack that does not require any gradient access or internal model instrumentation.
What would settle it
Run FSAP against the same TREC 2020/2021 queries with support sets drawn from unrelated topics or with factual rather than harmful examples; if the generated documents no longer outrank credible answers, the effect depends on topic-matched harmful content rather than on the prompting mechanism itself. A second check would measure whether detected-document flagging rises when the generated set is clustered by style.
Extended reading notes
Core claim
FSAP treats adversarial generation as an in-context learning problem rather than a search over token perturbations. Given a query and a support set of harmful documents, the LLM produces a grammatically fluent, topically coherent document that embeds false or misleading claims. FSAP-IntraQ uses harmful examples from the same query to maximize topical fidelity; FSAP-InterQ transfers adversarial patterns from unrelated queries to broaden coverage. On the TREC 2020 and 2021 Health Misinformation Tracks, documents generated this way consistently rank above credible documents for four neural ranking models, show strong stance alignment with the misinformation topic, and are not easily detected as
Load-bearing premise
The attack's effectiveness hinges on having a support set of harmful examples that are sufficiently representative of the target query for the LLM to imitate; the abstract does not specify how large or how closely matched that set must be for the reported outranking to occur.
Editorial extensions
If this is right
- Any deployed neural ranker that admits LLM-generated documents into its candidate pool is exposed to a black-box attack an ordinary API user could run.
- FSAP-InterQ's transfer across unrelated queries implies the attack is not confined to a few memorized queries; a small corpus of harmful examples may seed a much wider set of attacks.
- If generated documents outrank credible ones on health misinformation topics, rankers built on transformer encoders are not robust to in-context adversarial text, contradicting the assumption that fluency and topicality alone indicate trustworthiness.
- The reported low detectability means simple filter-based defenses are unlikely to stop the attack without more sophisticated content-verification signals.
- Because the method requires no gradient access, it also applies to proprietary rankers whose internal parameters are hidden.
Reading between the lines
- The paper evaluates on health misinformation; the same prompting mechanism could plausibly transfer to other domains where ranking decides what is seen, such as news, product reviews, or code, though the abstract does not test this.
- A natural next experiment would vary support-set size, topical distance, and example ordering to map where the rank advantage appears, since those degrees of freedom are not analyzed in the abstract.
- If an LLM can write documents that outrank credible ones, downstream systems that use top-ranked results as training labels could inherit a systematic misinformation bias.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The submission is presented under the title 'Adversarial Attacks against Neural Ranking Models via In-Context Learning' and its abstract claims that a Few-Shot Adversarial Prompting (FSAP) framework generates documents that 'consistently outrank credible, factually accurate documents' on the TREC 2020 and 2021 Health Misinformation Tracks across four neural ranking models, with strong stance alignment and low detectability. However, the full text of the submission is an entirely unrelated astronomy paper, 'HostSub GP: Precise Galaxy Background Subtraction in Transient Long-slit Spectroscopy with Gaussian Processes'. None of the sections, equations, figures, tables, or references in the body concerns FSAP, neural ranking models, TREC, LLMs, or adversarial attacks. No experimental setup, support-set construction, model list, evaluation protocol, or result tables supporting the abstract's claims appear anywhere in the manuscript.
Significance. If the abstract's claims were supported, the proposed FSAP attack would be a significant contribution to adversarial IR, as it would demonstrate a scalable, black-box, in-context-learning-based threat to neural ranking systems, with implications for misinformation and retrieval security. However, the submitted manuscript contains none of the evidence needed to assess these claims. There is no method section, no dataset description, no experimental protocol, no code release, and no falsifiable result. The astronomy content in the body, while possibly of value in its own field, is irrelevant to the advertised topic. The paper cannot be evaluated as a research contribution because its stated subject and its actual content are disjoint.
major comments (4)
- [Entire manuscript (Sections 1–6)] The full text is a self-contained astronomy paper ('HostSub GP') with no mention of FSAP, neural ranking models, TREC, LLMs, or adversarial attacks. The abstract's central empirical claim—that FSAP-generated documents consistently outrank credible documents across four ranking models—is therefore completely unsupported. This is not a local gap in methodology or a missing robustness check; the evidentiary body for the claimed contribution is absent.
- [arXiv header and title] The submitted title and abstract describe an adversarial-ranking paper, but the full-text header identifies it as arXiv:2508.15278v2, titled 'HostSub GP: Precise Galaxy Background Subtraction...', with an entirely different author list and subject. This identity mismatch means the text cannot be verified as the paper described by the abstract. At minimum, the submission must be accompanied by the correct, matching full text before any substantive review can occur.
- [Experimental protocol (missing)] Even if one attempted to treat the abstract as a standalone claim, there is no description of the support set, its size or construction, no list of the four ranking models, no definition of the TREC evaluation measures, no baseline comparisons, and no analysis of stance alignment or detectability. The assertions of 'consistently outrank' and 'low detectability' are not accompanied by any data, tables, or statistical tests.
- [Limitations and failure modes] The stress-test concern that FSAP may depend on a representative support set remains unaddressed, but this is secondary: the manuscript contains no FSAP method at all. The only limitations discussed (Section 5 of the astronomy text) concern Gaussian-process host subtraction, not the claimed adversarial attack. A limitations discussion for FSAP, including support-set requirements and topic-coverage constraints, is absent.
minor comments (2)
- [Title and abstract] The title in the PDF body does not match the submission title. The body's header lists 'HostSub GP' and an astronomy abstract, while the submission metadata lists FSAP. The author list also appears different. This is not a simple typo and should be corrected at the submission level.
- [References] The reference list contains only astronomy-related citations. No prior work on adversarial IR, in-context learning, or TREC misinformation tracks is cited, further confirming that the body is not the paper described in the abstract.
Circularity Check
No circular derivation present; the FSAP abstract is unsupported by a mismatched manuscript body, which is an integrity issue rather than a circularity issue.
full rationale
The submission consists of an abstract describing FSAP, an adversarial-attack framework for neural ranking models, and a full text that is an unrelated astronomy paper about Gaussian-process galaxy background subtraction (HostSub GP, arXiv:2508.15278v2). Because the body never defines FSAP, its support set, the four ranking models, the TREC 2020/2021 protocol, or any experimental results, there is no derivation chain to walk and no equation or fitted value that could reduce to its inputs. The closest potential circularity would be if the support-set examples were drawn from the same queries or models used in evaluation, but the text does not describe this, and I will not infer it. The astronomy paper's own method is benchmarked on synthetic MUSE data and real Keck spectra, with no fitted parameter renamed as a prediction. Therefore the proper finding is no significant circularity. The abstract/body mismatch is a serious absence of support, but it is a completeness and integrity concern, not a circularity concern.
Assumptions & free parameters
assumptions (2)
- domain assumption An attacker can obtain a sufficient sample of previously observed harmful documents to construct the few-shot support set without detection.
- domain assumption The TREC 2020/2021 Health Misinformation Tracks and the four selected neural ranking models provide a fair and representative evaluation of the attack.
Cite this review
Pith. "Pith review of Adversarial Attacks against Neural Ranking Models via In-Context Learning." pith.science (2026). https://pith.science/paper/7PUVJPM3
@misc{pith2026250815283,
author = {Pith},
title = {Pith review of: Adversarial Attacks against Neural Ranking Models via In-Context Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/7PUVJPM3}},
note = {Machine review of arXiv:2508.15283}
}
read the original abstract
While neural ranking models (NRMs) have shown high effectiveness, they remain susceptible to adversarial manipulation. In this work, we introduce Few-Shot Adversarial Prompting (FSAP), a novel black-box attack framework that leverages the in-context learning capabilities of Large Language Models (LLMs) to generate high-ranking adversarial documents. Unlike previous approaches that rely on token-level perturbations or manual rewriting of existing documents, FSAP formulates adversarial attacks entirely through few-shot prompting, requiring no gradient access or internal model instrumentation. By conditioning the LLM on a small support set of previously observed harmful examples, FSAP synthesizes grammatically fluent and topically coherent documents that subtly embed false or misleading information and rank competitively against authentic content. We instantiate FSAP in two modes: FSAP-IntraQ, which leverages harmful examples from the same query to enhance topic fidelity, and FSAP-InterQ, which enables broader generalization by transferring adversarial patterns across unrelated queries. Our experiments on the TREC 2020 and 2021 Health Misinformation Tracks, using four diverse neural ranking models, reveal that FSAP-generated documents consistently outrank credible, factually accurate documents. Furthermore, our analysis demonstrates that these adversarial outputs exhibit strong stance alignment and low detectability, posing a realistic and scalable threat to neural retrieval systems. FSAP also effectively generalizes across both proprietary and open-source LLMs.
Forward citations
Cited by 1 Pith paper
-
Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain
Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.
Reference graph
Works this paper leans on
-
[1]
Draft version February 20, 2026 Typeset using LATEXtwocolumnstyle in AASTeX7.0.1 HostSub GP: Precise Galaxy Background Subtraction in T ransient Long-slit Spectroscopy with Gaussian Processes Chang Liu (刘畅) 1, 2, 3and Adam A. Miller 1, 2, 3 1Department of Physics and Astronomy, Northwestern University, 2145 Sheridan Rd, Evanston, IL 60208, USA 2Center for...
work page 2026
-
[3]
and normalizing the flux residual (Eq. 5),HostSub GPobtains values ofξ sub,img at a few grid points (x i, λj) , effectively a transmission- weighted average of the spatial profileξsub, serving as an approximation toξ sub over the wavelength range covered by the filters. Notably, the spatial coordinatesx i depend on the pixel scales in the archival images,...
arXiv 2024
-
[6]
2.METHODOLOGY: MODELING THE 2D SPECTRUM WITH GPS The ultimate goal ofHostSub GPis to estimate the galaxy light at each pixel of a 2D spectrum. The ob- served flux4 fobs(x, λ) is the function of a spatial coor- dinatexand the wavelengthλof each pixel, which con- sists of the contribution from the sourcef src(x, λ), its host galaxyf host(x, λ), and the sky ...
work page 2003
-
[1986]
andPypeIt(J. X. Prochaska et al. 2020). 3.PIPELINE OVER VIEW In this section, we provide an overview of the HostSub GPframework and, for each of the modules, we elaborate the details of the data reduction and mod- eling procedures. Figure 1 is a high-level summary of the pipeline. 3.1.Preprocessing As inputHostSub GPrequires a fully calibrated 2D spectrum...
work page 2020
-
[2010]
for precise astro- metric calibration. Then they are rotated and resam- pled onto a grid centered at the location of the transient and oriented along the same direction of the slit when the spectrum is taken. The resampling is conducted us- ing thereproject adaptivefunction of thereproject package (T. Robitaille et al. 2024), which carries out anti-aliase...
work page 2024
-
[2019]
improves the classification accuracy on host contaminated spectra (A. Milligan et al. 2025), these methods still struggle when the galaxy light domi- Corresponding author: Chang Liu nates. Host contamination also impacts the quantitative measurement of spectral features. Even for SNe near maximum luminosity which outshine their background, host contaminat...
work page 2025
-
[2020]
and core-collapse SNe (L. Dessart & D. J. Hillier 2020; Q. Fang et al. 2025; Q. Fang et al. 2025). Precise transient flux measurements in photometry of- ten leverage archival reference images of the host galax- ies. As a routine in modern time-domain surveys, image subtraction techniques (e.g., C. Alard & R. H. Lupton arXiv:2508.15278v2 [astro-ph.IM] 18 F...
arXiv 2020
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.