Re-ranking Manipulation

The attacker crafts a document that is lexically sparse but semantically dense with query-relevant terms, exploiting the cross-encoder's deep attention mechanism. Unlike a bi-encoder, the cross-encoder processes the query and document together, allowing a malicious document to be engineered to maximize the joint representation similarity score. This causes the re-ranker to assign a high relevance score, pushing the document to the top of the final candidate list.

A technique where the attacker embeds a high density of query-specific keywords and synonyms into a malicious document's text. While the initial bi-encoder retrieval might rank it lower, the re-ranking model's fine-grained token-level analysis is fooled by the high lexical overlap. The model interprets the keyword saturation as strong semantic relevance, overriding the initial, more robust vector similarity score.

If the re-ranking model is periodically fine-tuned on user click-through data, an attacker can execute a poisoning attack by generating synthetic query-document pairs. By repeatedly submitting a specific query and clicking only on the malicious document, the attacker teaches the re-ranker that this document is the most relevant for that query. This feedback loop corrupts the model's learned relevance function, creating a persistent backdoor.

The attacker inserts a short, highly optimized adversarial passage into a longer, legitimate-looking document. This passage is designed to be invisible to basic content filters but acts as a powerful signal to the re-ranker. The passage contains specific n-gram patterns and entity relationships that the cross-encoder has learned to associate with high authority. The re-ranker scores the entire document highly based on this small, malicious segment.

Many re-ranking models exhibit a positional bias, giving higher weight to text at the beginning or end of a document. An attacker exploits this by placing a concise, perfectly aligned summary of the target query at the document's start. The re-ranker's attention mechanism focuses on this initial segment, generating a high relevance score, while the rest of the document contains the actual malicious payload or disinformation.

This attack targets re-ranking models that incorporate document metadata features like source domain, author, or publication date. The attacker forges these metadata signals to mimic a highly authoritative source. For example, by spoofing a source_domain feature to appear as a trusted government or academic institution, the attacker tricks the re-ranker's feature-based scoring layer into boosting the document's final rank, bypassing purely content-based analysis.

A direct attack where malicious content is inserted into an agent's context window to override system instructions or trigger unintended tool use. Unlike re-ranking manipulation, which exploits scoring mechanisms, this technique places the payload directly into the assembled prompt.

• Targets the final prompt assembly stage
• Often combined with indirect prompt injection via external data sources
• Can bypass retrieval safeguards entirely if the attacker controls any input channel

The insertion of malicious vector embeddings into a vector database to manipulate semantic search results. While re-ranking manipulation exploits the cross-encoder scoring phase, vector contamination attacks the upstream nearest neighbor retrieval step.

• Alters the candidate set before re-ranking occurs
• Uses adversarial embeddings that are semantically close to legitimate queries
• Can persist across multiple retrieval cycles if the index is not rebuilt

The falsification of document metadata fields—such as source, date, or authority signals—to deceive retrieval and re-ranking systems. A re-ranking model that weights metadata heavily can be tricked into boosting a malicious document with forged authority credentials.

• Exploits source authority heuristics in re-rankers
• Common vectors: falsified timestamps, domain spoofing, author impersonation
• Particularly effective against re-rankers that use metadata as a primary relevance signal

A technique that exploits document segmentation by placing malicious content precisely at chunk boundaries. When retrieved, the adversarial chunk appears as a standalone, authoritative fragment without the surrounding context that might reveal its malicious nature.

• Bypasses contextual integrity checks that rely on surrounding text
• Creates self-contained malicious snippets that survive chunking
• Highly effective when combined with re-ranking manipulation to boost the isolated chunk's score

An adversarial manipulation of the Hypothetical Document Embedding process. A crafted query generates a hallucinated document embedding that skews retrieval toward attacker-chosen content before re-ranking even occurs.

• Poisons the query-side embedding rather than the document store
• Creates a semantic bridge between legitimate queries and malicious documents
• Bypasses document-level integrity checks entirely

The adversarial poisoning of an Approximate Nearest Neighbor index structure, such as HNSW or FAISS. By altering graph navigation paths, attackers can ensure that specific malicious vectors are returned for broad query ranges, creating a persistent retrieval bias.

• Operates below the re-ranking layer at the index level
• Corrupts the graph connectivity that determines which vectors are reachable
• Extremely difficult to detect without index-level integrity monitoring