Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that HotFlip corpus poisoning can be sped up about sixteen times, from four GPU-hours to fifteen minutes per passage, by targeting a precomputed query-centroid embedding, with no loss in top-20 attack success.

desk verdict A solid reproducibility study with a real speedup and useful new evidence, but the 'without compromising performance' claim is muddied by a confounded comparison; worth peer review with revision. read the letter →

arxiv 2501.04802 v2 pith:L223MBHO submitted 2025-01-08 cs.IR cs.CL

Yongkang Li , Panagiotis Eustratiadis , Evangelos Kanoulas This is my paper · ORCID
classification cs.IRcs.CL
keywords corpuspoisoningdenseretrievaladversarialattacksHotFlipgradient-basedwordsubstitutionquery-agnosticattacktransfer-basedembeddingcentroid
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish two things: that the HotFlip corpus-poisoning attack on dense retrievers can be made roughly sixteen times faster without weakening it, and that the attack's real-world utility is narrower than the original report suggested. The speedup comes from replacing the per-query gradient accumulation with a single precomputed centroid embedding of a query batch, cutting generation from about four GPU-hours to about fifteen minutes per fifty-token adversarial passage while keeping top-20 attack success rates intact across five retrievers. The paper also shows that HotFlip passages do not transfer across different retrieval models, so black-box attacks via transfer mostly fail, and that query-agnostic attacks, which need no user queries at all, can still hit some retrievers with as little as 0.01% injected passages. A sympathetic reader would take away that the attack is now cheap enough to matter in practice, but its reach depends heavily on the target model.

What carries the argument

The load-bearing object is the query-batch centroid embedding, $\bar{E}_q(Q_b) = \frac{1}{|Q_b|}\sum_{q\in Q_b} E_q(q)$, precomputed once per cluster of queries. HotFlip's token-substitution step normally approximates the effect of replacing token $t_i$ with $t'_i$ by the dot product $e_{t'_i}^\top \nabla_{e_{t_i}} \mathrm{sim}(q,a)$ summed over queries; the paper instead uses the same approximation against the single centroid, $e_{t'_i}^\top \nabla_{e_{t_i}}(\bar{E}_q(Q_b)^\top E_p(a))$, so each search step needs one forward-backward pass instead of one per query. The same mechanism is re-used in the query-agnostic setting by swapping in the centroid of a batch of corpus passages, and the paper ties attack success on different retrievers to the $\ell^2$ norm inflation of the generated adversarial passages.

What would settle it

Run the optimized attack against a retriever or query distribution where the centroid is not representative, for example a deliberately bimodal query cluster whose members lie on opposite sides of the embedding space, and compare top-20 success against the original per-query HotFlip; a material drop in success rate would show the centroid approximation does not hold. A second check is to measure whether the 15-minute-per-document figure holds on a retriever outside the five tested, since the claim is tied to BERT-base-sized encoders.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the objective of HotFlip corpus poisoning can be re-targeted at the mean embedding of a batch of queries without sacrificing attack quality. Equations 3 and 4 replace the sums over queries in the original objective with a single dot product against the precomputed centroid $\bar{E}_q(Q_b)$, turning a process that needs gradients accumulated for every query-passage pair into one that needs a single gradient per token search. The reported result is a drop from an average of four GPU-hours to fifteen minutes per generated document on the same hardware, with top-20 success rates that match or exceed the reproduced original on several retrievers and only slight losses on Contriever and Contriever-ms. The paper further claims that the original HotFlip results are largely reproducible, with one notable discrepancy it attributes to a likely typo, and that the optimized version is also effective in a query-agnostic mode where passage centroids replace query centroids.

Load-bearing premise

The whole speedup rests on the assumption that the mean embedding of a batch of queries preserves the ranking behaviour of the full query set, so that optimizing against the centroid is equivalent to optimizing the original HotFlip objective.

Editorial extensions

If this is right

  • A white-box attacker can now poison a dense-retrieval corpus at a cost of about 15 minutes per adversarial document on an NVIDIA L40, making large-scale corpus contamination feasible rather than theoretical.
  • HotFlip's lack of transferability across retrieval models means a defender can ignore cross-model poisoning unless the attacker has access to the exact target encoder.
  • Query-agnostic poisoning, needing no user queries, is a realistic threat for retrievers like Contriever and Contriever-ms, where 0.01% injected passages already exceed 80% top-20 success.
  • Because adversarial passages from high-norm retrievers show a large $\ell^2$ norm increase over normal passages, norm-based filtering is a plausible cheap defense.
  • The suspected typo in the original reported result means published attack numbers should be read with caution, even when the method itself is sound.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the centroid approximation generalizes, the same trick could accelerate other gradient-based text attacks that average losses over input sets, such as document-manipulation or counterfactual generation, not just corpus poisoning.
  • The $\ell^2$ norm correlation suggests a directly testable defense: at retrieval time, clip or penalize passage embedding norms before ranking; the paper does not test this, but its own histograms predict it would blunt attacks on Contriever-style models.
  • The speedup removes the main practical barrier to using HotFlip as a negative-example generator for robust training, so the authors' stated secondary use case could scale to millions of hard negatives.
  • Because the attack succeeds without queries on some retrievers, privacy-minded systems cannot rely on query secrecy alone; defenders need model-level robustness or norm-based detection.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper reproduces the HotFlip-based corpus poisoning attack of Zhong et al. (2023) against dense retrievers. It first reports that the original results are largely reproducible, then proposes an optimization that replaces the query batch in the attack objective by the mean query embedding (Equations 3 and 4), reducing adversarial passage generation from about 4 GPU-hours to about 15 minutes per passage. It further extends the evaluation to transfer-based black-box attacks (RQ2) and query-agnostic attacks that use corpus passages instead of queries (RQ3). The experiments cover five to seven retrievers on NQ, MS MARCO, ArguAna, and FiQA, with five seeds and standard deviations. The main claimed outcomes are that the optimized pipeline preserves attack success while being much faster, that HotFlip does not transfer across retrieval models, and that query-agnostic attacks can be effective against some retrievers.

Significance. If the efficiency and effectiveness claims hold, the paper makes white-box HotFlip corpus poisoning practical at scale and provides a useful baseline for robust-retrieval research. The study has concrete strengths: the code is publicly released, the main experiments use five random seeds with reported standard deviations, the runtime comparison is concrete, and the derivation in Equations 3 and 4 is parameter-free. The RQ2 and RQ3 analyses add useful negative and positive evidence about HotFlip's generalization. However, the central 'without compromising performance' claim is not yet supported because the experimental comparison changes two variables at once—the centroid substitution and the batch-sampling policy—without a controlled ablation, and several reported differences are either large or statistically noisy. The paper is a solid reproduction study but needs an additional controlled experiment before the headline efficiency/effectiveness trade-off can be accepted.

major comments (3)
  1. [Section 3.3, Eqs. (3)-(4)] The replacement of the query batch by its mean embedding is algebraically exact for dot-product similarity: (1/|Q|) sum_q E_q(q)^T E_p(a) = (mean_q E_q(q))^T E_p(a). Therefore this is an implementation optimization, not an approximation, and any effectiveness difference between Reproduced and Ours must be attributed to the changed stochasticity—in particular, the original resamples the query batch Q_b at each iteration while Ours precomputes a fixed centroid. The paper does not provide a controlled ablation that keeps the original batch-sampling policy while using the precomputed mean or sum, and it does not report the batch size. As a result, Table 2 does not support the claim 'without compromising performance'; it conflates the efficiency change with a change in gradient noise.
  2. [Table 2, Contriever and Contriever-ms rows] At |A|=1 on NQ, Ours reports 73.1±19.9 versus Reproduced 80.1±2.7, and on MS MARCO 56.3±13.4 versus 62.3±5.0; similar gaps appear for Contriever-ms. The paper describes these as 'slightly' underperforming, but the magnitudes and standard deviations indicate the difference is substantial and statistically noisy. With no significance tests and no effect-size reporting, the conclusion that performance is preserved is not established, especially for the models where the optimized pipeline performs worse.
  3. [Section 5.1, Table 2] The reproducibility claim is weakened by the large discrepancy for Contriever-ms at |A|=1 on NQ: Original reports 0.5 while Reproduced reports 48.4. The paper speculates about a possible typo in the original and notes that the authors did not respond, but it does not resolve which value is correct. Since the first contribution of the paper is verifying that the findings of Zhong et al. are reproducible, this unresolved discrepancy needs to be discussed more prominently and, if possible, checked against the original code and configuration.
minor comments (5)
  1. [Section 1] Please write '4 GPU-hours' (or '4 GPU·h') instead of '4 GPU/h'.
  2. [Section 4.3] Please report the query batch size used in Reproduced and Ours; it is needed to interpret the runtime and variance results.
  3. [Section 5.1, Figure 2] It is unclear whether the reported times are per adversarial passage or per generated set, and the figure does not show error bars; please clarify.
  4. [Section 5.2] The paper states that MS MARCO transfer results are omitted due to space limitations; given the strength of the transferability claim, at least a summary in an appendix would be helpful.
  5. [Section 3.3, Eqs. (3)-(4)] The notation '≃' suggests approximation, but the equality is exact for a fixed batch; consider replacing it with '=' and instead explaining that the change is in the batch-sampling policy.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the centroid optimization is algebraically exact, and the paper's claims rest on external comparisons rather than on self-citation or fitted inputs.

full rationale

The paper's central optimization, Equations 3 and 4, replaces the average over queries in Equations 1 and 2 with the mean query embedding. For dot-product similarity, (1/|Q_b|) * sum_{q in Q_b} E_q(q)^T E_p(a') = (mean_{q in Q_b} E_q(q))^T E_p(a'), so the substitution is an exact rearrangement for a fixed query batch, not an approximation fitted to the evaluation data. Consequently, the reported efficiency gain comes from precomputing a single centroid embedding rather than recomputing query gradients per query-passage pair, and the claim that attack effectiveness is preserved is an empirical comparison against reproduced and originally reported results, not a quantity forced by construction. No parameter is fitted to the test queries or to the attack success rates used for evaluation. The heavy reliance on Zhong et al. [34] is a reproduction of an external method, not a load-bearing self-citation; there is no imported uniqueness theorem and no ansatz smuggled in through the authors' own prior work. The Skeptic's concern that the effectiveness comparison may be confounded by altered batch-sampling stochasticity is a legitimate experimental-validity issue, but it is not circularity: the Equations 3-4 identity does not by itself determine the measured attack success rates. No circular step can be exhibited from the paper's own text, so the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper's central claims rest on a few assumptions: queries used for attack generation are representative of test queries, corpus passages can stand in for real user queries in the query-agnostic setup, and the chosen retrievers are representative for transferability conclusions. The centroid approximation in Equations 3 and 4 is the main algorithmic assumption. No new physical or theoretical entities are introduced.

free parameters (3)
  • Imax (maximum iterations) = 5000 default, up to 20000 in trade-off study
    Maximum number of token substitution iterations per adversarial passage; chosen from prior work and affects attack quality and runtime.
  • top-n candidate tokens = 100
    Number of candidate replacement tokens considered in each iteration; a hand-chosen hyperparameter that influences attack effectiveness.
  • k-means cluster count k = Implicitly equals |A| (1, 10, or 50)
    The paper does not state k explicitly, but one adversarial passage is generated per cluster, so k likely equals the number of adversarial passages |A|.
assumptions (5)
  • domain assumption Training queries used to generate adversarial passages are representative of held-out test queries.
    The attack objective maximizes similarity to training queries, and effectiveness is measured on test queries. This assumption appears in Sections 3.2 and 5.1.
  • domain assumption Corpus passages can serve as proxies for user queries in query-agnostic attacks.
    The query-agnostic setup replaces queries with passage centroids, assuming these centroids capture the distribution of real queries. Introduced in Section 5.3.
  • domain assumption The seven dense retrievers used are representative for transferability conclusions.
    Transfer-based conclusions are drawn from the tested set of retrievers in Section 5.2. If the set is not representative, the observed lack of transfer may not generalize.
  • domain assumption Top-20 attack success rate is a meaningful measure of poisoning impact.
    The paper follows prior work and uses the percentage of test queries with at least one adversarial passage in the top-20 results. This metric prioritizes visibility over ranking disruption at other positions.
  • standard math Dot product similarity decomposes as ||E_p(p)||_2 * cos(theta), used for the L2 norm analysis.
    Invoked in Section 5.4 to explain robustness differences via embedding norms.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval." pith.science (2026). https://pith.science/paper/L223MBHO

@misc{pith2026250104802,
  author       = {Pith},
  title        = {Pith review of: Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L223MBHO}},
  note         = {Machine review of arXiv:2501.04802}
}
read the original abstract

HotFlip is a topical gradient-based word substitution method for attacking language models. Recently, this method has been further applied to attack retrieval systems by generating malicious passages that are injected into a corpus, i.e., corpus poisoning. However, HotFlip is known to be computationally inefficient, with the majority of time being spent on gradient accumulation for each query-passage pair during the adversarial token generation phase, making it impossible to generate an adequate number of adversarial passages in a reasonable amount of time. Moreover, the attack method itself assumes access to a set of user queries, a strong assumption that does not correspond to how real-world adversarial attacks are usually performed. In this paper, we first significantly boost the efficiency of HotFlip, reducing the adversarial generation process from 4 hours per document to only 15 minutes, using the same hardware. We further contribute experiments and analysis on two additional tasks: (1) transfer-based black-box attacks, and (2) query-agnostic attacks. Whenever possible, we provide comparisons between the original method and our improved version. Our experiments demonstrate that HotFlip can effectively attack a variety of dense retrievers, with an observed trend that its attack performance diminishes against more advanced and recent methods. Interestingly, we observe that while HotFlip performs poorly in a black-box setting, indicating limited capacity for generalization, in query-agnostic scenarios its performance is correlated to the volume of injected adversarial passages.

Figures

Figures reproduced from arXiv: 2501.04802 by the authors.

Figure 1
Figure 1. Illustration of corpus poisoning with HotFlip. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. In-domain attack time cost (in minutes) to generate a 50-tokens adversar [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Top-20 attack success rate of the transfer-based black-box attack. We [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The performance of query-agnostic attacks from HotFlip for RQ3. We [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Histogram and distribution of ℓ2 norms from embeddings of normal pas￾sages and all adversarial passages, which comes from experiments in Section 5.3. passages [26]. Consequently, all retrievers in this paper use the dot product as the similarity function: sim(q, p) = E…
Figure 6
Figure 6. Figure 6: The performance curve with respect to Imax. In [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Document Screenshot Retrievers are Vulnerable to Pixel Poisoning Attacks

    cs.IR 2025-01 conditional novelty 5.0 of 10

    Gradient-based pixel poisoning of a single document screenshot can rank it in the top-10 for up to 41.9% of unseen queries on DSE and 26.4% on ColPali.

Reference graph

Works this paper leans on

37 extracted references · 11 canonical work pages · cited by 1 Pith paper

  1. [1]

    arXiv preprint arXiv:1611.09268 (2016), http://arxiv.org/abs/1611.09268

    Bajaj, P., Campos, D., Craswell, N., Deng, L., Gao, J., Liu, X., Majumder, R., McNamara, A., Mitra, B., Nguyen, T., et al.: Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268 (2016), http://arxiv.org/abs/1611.09268

    arXiv 2016

  2. [2]

    (eds.) Findings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, July 9-14, 2023

    Chen, X., He, B., Ye, Z., Sun, L., Sun, Y.: Towards imperceptible document manip- ulationsagainstneuralrankingmodels.In:Rogers,A.,Boyd-Graber,J.L.,Okazaki, N. (eds.) Findings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, July 9-14, 2023. pp. 6648–6664. Association for Computational Linguistics (2023), https://doi.org/10.1865...

    doi:10.18653/v1/2023.findings-acl.416 2023

  3. [3]

    In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S

    Chen, Y., Liu, W.: A theory of transfer-based black-box attacks: Ex- planation and implications. In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S. (eds.) Advances in Neural Informa- tion Processing Systems 36: Annual Conference on Neural Information Pro- cessing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, Decem- ber 10 - 16, ...

    work page 2023

  4. [4]

    In: Bender, E.M., Derczynski, L., Isabelle, P

    Ebrahimi, J., Lowd, D., Dou, D.: On adversarial examples for character-level neural machine translation. In: Bender, E.M., Derczynski, L., Isabelle, P. (eds.) Proceed- ings of the 27th International Conference on Computational Linguistics, COLING 2018, Santa Fe, New Mexico, USA, August 20-26, 2018. pp. 653–663. Association for Computational Linguistics (2...

    work page 2018

  5. [5]

    In: Gurevych, I., Miyao, Y

    Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial exam- ples for text classification. In: Gurevych, I., Miyao, Y. (eds.) Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 2018, Melbourne, Australia, July 15-20, 2018, Volume 2: Short Papers. pp. 31–36. Asso- ciation for Computational Linguis...

    work page 2018

  6. [6]

    In: Moens, M., Huang, X., Specia, L., Yih, S.W

    Fern, X.Z., Pope, Q.: Text counterfactuals via latent optimization and shapley- guided search. In: Moens, M., Huang, X., Specia, L., Yih, S.W. (eds.) Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 7-11 November,

    work page 2021

  7. [7]

    In: Bengio, Y., LeCun, Y

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learn- ing Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings (2015), http://arxiv.org/abs/1412.6572

    arXiv 2015

  8. [8]

    Hofstätter, S., Lin, S., Yang, J., Lin, J., Hanbury, A.: Efficiently teaching an effec- tivedenseretrieverwithbalancedtopicawaresampling.In:SIGIR’21:The44thIn- ternational ACM SIGIR Conference on Research and Development in Information Retrieval. pp. 113–122. ACM (2021), https://doi.org/10.1145/3404835.3462891

    arXiv 2021

Show all 37 references
  1. [9]

    Izacard, G., Caron, M., Hosseini, L., Riedel, S., Bojanowski, P., Joulin, A., Grave, E.: Unsupervised dense information retrieval with contrastive learning (2021), https://arxiv.org/abs/2112.09118

    2021 arXiv

  2. [10]

    In: Webber, B., Cohn, T., He, Y., Liu, Y

    Karpukhin, V., Oguz, B., Min, S., Lewis, P.S.H., Wu, L., Edunov, S., Chen, D., Yih, W.: Dense passage retrieval for open-domain question answering. In: Webber, B., Cohn, T., He, Y., Liu, Y. (eds.) Proceedings of the 2020 Conference on Em- pirical Methods in Natural Language Pr...

    2020 doi

  3. [11]

    Kwiatkowski, T., Palomaki, J., Redfield, O., Collins, M., Parikh, A.P., Alberti, C., Epstein, D., Polosukhin, I., Devlin, J., Lee, K., Toutanova, K., Jones, L., Kelcey, M., Chang, M., Dai, A.M., Uszkoreit, J., Le, Q., Petrov, S.: Natural questions: a benchmark for question ans...

    2019 doi

  4. [12]

    In: Findings of the Association for Computational Linguistics: EMNLP 2023

    Lin, S., Asai, A., Li, M., Oguz, B., Lin, J., Mehdad, Y., Yih, W., Chen, X.: How to train your dragon: Diverse augmentation towards generalizable dense retrieval. In: Findings of the Association for Computational Linguistics: EMNLP 2023. pp. 6385–6400. Association for Computat...

    2023

  5. [13]

    In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communica- tions Security

    Liu, J., Kang, Y., Tang, D., Song, K., Sun, C., Wang, X., Lu, W., Liu, X.: Order- disorder: Imitation adversarial attacks for black-box neural ranking models. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communica- tions Security. p. 2025–2039. CCS ’22, As...

    2022

  6. [14]

    In: Yang, G.H., Wang, H., Han, S., Hauff, C., Zuccon, G., Zhang, Y

    Liu, Y., Zhang, R., Guo, J., de Rijke, M.: Robust information retrieval. In: Yang, G.H., Wang, H., Han, S., Hauff, C., Zuccon, G., Zhang, Y. (eds.) Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR 2024, Wash...

    2024

  7. [15]

    In: Proceedings of the 32nd ACM International Conference on Information and Knowledge Management

    Liu, Y.A., Zhang, R., Guo, J., de Rijke, M., Chen, W., Fan, Y., Cheng, X.: Black- box adversarial attacks against dense retrieval models: A multi-view contrastive learning method. In: Proceedings of the 32nd ACM International Conference on Information and Knowledge Management....

    2023

  8. [16]

    In: Chen, H., Duh, W.E., Huang, H., Kato, M.P., Mothe, J., Poblete, B

    Liu, Y., Zhang, R., Guo, J., de Rijke, M., Chen, W., Fan, Y., Cheng, X.: Topic- oriented adversarial attacks against black-box neural ranking models. In: Chen, H., Duh, W.E., Huang, H., Kato, M.P., Mothe, J., Poblete, B. (eds.) Proceedings of the 46th International ACM SIGIR C...

    2023

  9. [17]

    In: Yang, G.H., Wang, H., Han, S., Hauff, C., Zuccon, G., Zhang, Y

    Liu, Y., Zhang, R., Guo, J., de Rijke, M., Fan, Y., Cheng, X.: Multi-granular ad- versarial attacks against black-box neural ranking models. In: Yang, G.H., Wang, H., Han, S., Hauff, C., Zuccon, G., Zhang, Y. (eds.) Proceedings of the 47th In- ternational ACM SIGIR Conference ...

    2024

  10. [18]

    CoRR abs/2407.06992 (2024), https://doi.org/10.48550/arXiv.2407.06992

    Liu, Y., Zhang, R., Guo, J., de Rijke, M., Fan, Y., Cheng, X.: Robust neural information retrieval: An adversarial and out-of-distribution perspective. CoRR abs/2407.06992 (2024), https://doi.org/10.48550/arXiv.2407.06992

    2024 doi arXiv

  11. [19]

    In: Champin, P., Gandon, F., Lalmas, M., Ipeirotis, P.G

    Maia, M., Handschuh, S., Freitas, A., Davis, B., McDermott, R., Zarrouk, M., Balahur, A.: Www’18 open challenge: Financial opinion mining and question an- swering. In: Champin, P., Gandon, F., Lalmas, M., Ipeirotis, P.G. (eds.) Com- panion of the The Web Conference 2018 on The...

    2018

  12. [20]

    CoRR abs/1605.07277 (2016), http://arxiv.org/abs/1605.07277 16 Yongkang Li, Panagiotis Eustratiadis, and Evangelos Kanoulas

    Papernot, N., McDaniel, P.D., Goodfellow, I.J.: Transferability in machine learn- ing: from phenomena to black-box attacks using adversarial samples. CoRR abs/1605.07277 (2016), http://arxiv.org/abs/1605.07277 16 Yongkang Li, Panagiotis Eustratiadis, and Evangelos Kanoulas

    2016 arXiv

  13. [21]

    In: Liu, L., White, R.W., Mantrach, A., Silvestri, F., McAuley, J.J., Baeza-Yates, R., Zia, L

    Park,D.H.,Chang,Y.:Adversarialsamplingandtrainingforsemi-supervisedinfor- mation retrieval. In: Liu, L., White, R.W., Mantrach, A., Silvestri, F., McAuley, J.J., Baeza-Yates, R., Zia, L. (eds.) The World Wide Web Conference, WWW 2019, San Francisco, CA, USA, May 13-17, 2019. p...

    2019

  14. [22]

    CoRR abs/2008.02197 (2020), https://arxiv.org/abs/2008.02197

    Raval, N., Verma, M.: One word at a time: adversarial attacks on retrieval models. CoRR abs/2008.02197 (2020), https://arxiv.org/abs/2008.02197

    2020 arXiv

  15. [23]

    In: Webber, B., Cohn, T., He, Y., Liu, Y

    Song, C., Rush, A.M., Shmatikov, V.: Adversarial semantic collisions. In: Webber, B., Cohn, T., He, Y., Liu, Y. (eds.) Proceedings of the 2020 Conference on Em- pirical Methods in Natural Language Processing, EMNLP 2020, Online, Novem- ber 16-20, 2020. pp. 4198–4210. Associati...

    2020 doi

  16. [24]

    CoRR abs/2406.05087 (2024), https://doi.org/ 10.48550/arXiv.2406.05087

    Su, J., Morris, J.X., Nakov, P., Cardie, C.: Corpus poisoning via approxi- mate greedy gradient descent. CoRR abs/2406.05087 (2024), https://doi.org/ 10.48550/arXiv.2406.05087

    2024 doi arXiv

  17. [25]

    In: Bengio, Y., LeCun, Y

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Co...

    2014 arXiv

  18. [26]

    CoRR abs/2104.08663 (2021), https://arxiv.org/abs/2104.08663

    Thakur, N., Reimers, N., Rücklé, A., Srivastava, A., Gurevych, I.: BEIR: A het- erogenous benchmark for zero-shot evaluation of information retrieval models. CoRR abs/2104.08663 (2021), https://arxiv.org/abs/2104.08663

    2021 arXiv

  19. [27]

    In: Gurevych, I., Miyao, Y

    Wachsmuth, H., Syed, S., Stein, B.: Retrieval of the best counterargument with- out prior topic knowledge. In: Gurevych, I., Miyao, Y. (eds.) Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 2018, Melbourne, Australia, July 15-20, 20...

    2018

  20. [28]

    In: Padó, S., Huang, R

    Wallace, E., Tuyls, J., Wang, J., Subramanian, S., Gardner, M., Singh, S.: Al- lennlp interpret: A framework for explaining predictions of NLP models. In: Padó, S., Huang, R. (eds.) Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the ...

    2019

  21. [29]

    In: Cohn, T., He, Y., Liu, Y

    Wang, J., Tuyls, J., Wallace, E., Singh, S.: Gradient-based analysis of NLP models is manipulable. In: Cohn, T., He, Y., Liu, Y. (eds.) Findings of the Association for Computational Linguistics: EMNLP 2020, Online Event, 16-20 November 2020. Findings of ACL, vol. EMNLP 2020, p...

    2020 doi

  22. [30]

    ACM Trans

    Wu, C., Zhang, R., Guo, J., De Rijke, M., Fan, Y., Cheng, X.: Prada: Practical black-box adversarial attacks against neural ranking models. ACM Trans. Inf. Syst. 41(4) (apr 2023), https://doi.org/10.1145/3576923

    2023 doi

  23. [31]

    In: 9th International Conference on Learning Representa- tions, ICLR 2021, Virtual Event, Austria, May 3-7, 2021

    Xiong, L., Xiong, C., Li, Y., Tang, K., Liu, J., Bennett, P.N., Ahmed, J., Overwijk, A.: Approximate nearest neighbor negative contrastive learning for dense text retrieval. In: 9th International Conference on Learning Representa- tions, ICLR 2021, Virtual Event, Austria, May ...

    2021

  24. [32]

    In: III, H.D., Singh, A

    Zhang, Y., Albarghouthi, A., D’Antoni, L.: Robustness to programmable string transformations via augmented abstract training. In: III, H.D., Singh, A. (eds.) Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval 17 Proceedings of the 37th International Conference...

    2020

  25. [33]

    In: Amigó, E., Castells, P., Gonzalo, J., Carterette, B., Culpepper, J.S., Kazai, G

    Zhang, Z., Setty, V., Anand, A.: Sparcassist: A model risk assessment assistant based on sparse generated counterfactuals. In: Amigó, E., Castells, P., Gonzalo, J., Carterette, B., Culpepper, J.S., Kazai, G. (eds.) SIGIR ’22: The 45th International ACM SIGIR Conference on Rese...

    2022

  26. [34]

    In: Bouamor, H., Pino, J., Bali, K

    Zhong, Z., Huang, Z., Wettig, A., Chen, D.: Poisoning retrieval corpora by injecting adversarial passages. In: Bouamor, H., Pino, J., Bali, K. (eds.) Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, EMNLP 2023, Singapore, December 6-10, 2...

    2023 doi

  27. [35]

    Zhuang, S., Koopman, B., Chu, X., Zuccon, G.: Understanding and mitigating the threat of vec2text to dense retrieval systems. CoRRabs/2402.12784v1 (2024), https://arxiv.org/abs/2402.12784v1 7 Appendix Zhong et al [34] (Reproduced) Ours decor anniversary correctbilisaria 1945 b...

    2024 arXiv

  28. [1709]

    ACM (2023), https://doi.org/10.1145/3539618.3591777

    2023

  29. [2021]

    5578–5593

    pp. 5578–5593. Association for Computational Linguistics (2021), https:// doi.org/10.18653/v1/2021.emnlp-main.452

    2021 doi

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.