{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/poisoning-retrieval-corpora-by-injecting","title":"Poisoning Retrieval Corpora by Injecting Adversarial Passages","arxiv_id":"2310.19156","date":"2023-10-29","proceeding":null,"authors":["Zexuan Zhong","Ziqing Huang","Alexander Wettig","Danqi Chen"],"abstract":"Dense retrievers have achieved state-of-the-art performance in various information retrieval tasks, but to what extent can they be safely deployed in real-world applications? In this work, we propose a novel attack for dense retrieval systems in which a malicious user generates a small number of adversarial passages by perturbing discrete tokens to maximize similarity with a provided set of training queries. When these adversarial passages are inserted into a large retrieval corpus, we show that this attack is highly effective in fooling these systems to retrieve them for queries that were not seen by the attacker. More surprisingly, these adversarial passages can directly generalize to out-of-domain queries and corpora with a high success attack rate -- for instance, we find that 50 generated passages optimized on Natural Questions can mislead >94% of questions posed in financial documents or online forums. We also benchmark and compare a range of state-of-the-art dense retrievers, both unsupervised and supervised. Although different systems exhibit varying levels of vulnerability, we show they can all be successfully attacked by injecting up to 500 passages, a small fraction compared to a retrieval corpus of millions of passages.","url_abs":"https://arxiv.org/abs/2310.19156v1","url_pdf":"https://arxiv.org/pdf/2310.19156v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"poisoning-retrieval-corpora-by-injecting","repo_url":"https://github.com/princeton-nlp/corpus-poisoning","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"information-retrieval","task_name":"Information Retrieval"},{"task_slug":"natural-questions","task_name":"Natural Questions"},{"task_slug":"retrieval","task_name":"Retrieval"}],"methods":[{"method_slug":"set","method_name":"SET"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2310.19156","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.19156"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/princeton-nlp/corpus-poisoning","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":4,"ran_fixture":1,"unverified":1},"by_repo_kind":{"official":{"samples":6,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"27c0647865d4872e","entry":"ance_get_emb","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"27c0647865d4872e"}},{"code_sha256_prefix":"a1619cb3b16730df","entry":"contriever_get_emb","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a1619cb3b16730df"}},{"code_sha256_prefix":"a99ade31d3be8eec","entry":"dpr_get_emb","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a99ade31d3be8eec"}},{"code_sha256_prefix":"7c21c6a72bff5512","entry":"evaluate_recall","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/evaluate_adv.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/evaluate_adv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7c21c6a72bff5512"}},{"code_sha256_prefix":"309e71f4157403d6","entry":"hotflip_attack","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/attack_poison.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/attack_poison.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"309e71f4157403d6"}},{"code_sha256_prefix":"b111b224b552b7a7","entry":"evaluate_acc","repo":"princeton-nlp/corpus-poisoning","repo_kind":"official","path":"src/attack_poison.py","file_url":"https://github.com/princeton-nlp/corpus-poisoning/blob/HEAD/src/attack_poison.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b111b224b552b7a7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}