Dense retrievers have achieved state-of-the-art performance in various
information retrieval tasks, but to what extent can they be safely deployed in
real-world applications? In this work, we propose a novel attack for dense
retrieval systems in which a malicious user generates a small number of
adversarial passages by perturbing discrete tokens to maximize similarity with
a provided set of training queries. When these adversarial passages are
inserted into a large retrieval corpus, we show that this attack is highly
effective in fooling these systems to retrieve them for queries that were not
seen by the attacker. More surprisingly, these adversarial passages can
directly generalize to out-of-domain queries and corpora with a high success
attack rate -- for instance, we find that 50 generated passages optimized on
Natural Questions can mislead >94% of questions posed in financial documents or
online forums. We also benchmark and compare a range of state-of-the-art dense
retrievers, both unsupervised and supervised. Although different systems
exhibit varying levels of vulnerability, we show they can all be successfully
attacked by injecting up to 500 passages, a small fraction compared to a
retrieval corpus of millions of passages.

在这份研究中，我们提出了一种新的攻击方法，通过扰乱离散标记以最大限度地与提供的一组训练查询相似，从而为密集检索系统生成少量的对抗性段落。当这些对抗性段落插入到大规模的检索语料库中时，我们证明这种攻击在欺骗这些系统在攻击者未见过的查询中进行检索方面非常有效。更令人惊讶的是，这些对抗性段落可以直接推广到领域外的查询和语料库，并且具有很高的攻击成功率。我们还对一系列最先进的密集检索器进行了基准测试和比较，无论是无监督的还是有监督的，虽然不同的系统表现出不同程度的易攻击性，但我们展示了它们都可以成功攻击，而只需插入最多 500 个段落，与数百万个段落的检索语料库相比，这只是一个小部分。