{"id":"2c9891b7-8033-417e-acff-972eba67f840","arxiv_id":"2607.03456","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"SentAttack promotes hard low-ranked target documents into top-K dense-retrieval results via iterative-retrieval surrogate training, centroid concatenation, and query/centroid-guided beam-search synonym optimization.","lead":"SentAttack is a two-stage black-box attack that lifts low-ranked documents into the top results of dense retrievers used by RAG systems, by training a surrogate, concatenating query-related sentence centroids, and refining with gradient-guided synonym swaps. It matters because word-level attacks fail on hard targets and realistic RAG systems return only a handful of candidates, so retrieval-stage failures block later re-ranking and generation.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Hard-target gains rest on unmeasured surrogate-to-target embedding transfer (Appendix E δ bound).","rationale":"The Reader correctly isolates the surrogate-transfer assumption (Appendix E) as the weakest link supporting the Hard-target claim. The empirical tables (Table 1, ablations, Table 3) demonstrate large absolute gains and that both concatenation and synonym substitution contribute, yet they never close the loop by measuring how faithful the surrogate actually is to the black-box coCondenser on the very documents that start far from the query. Because the attack is black-box by design, that unmeasured δ is load-bearing: without it the gradients that produce the reported Hard SRR numbers have no guaranteed relation to the target ranking function. The concrete test above directly quantifies δ and the sensitivity of Hard performance to surrogate quality; a positive result would convert the CONDITIONAL verdict into a stronger ACCEPT, while a negative result would justify REJECT or a substantially lower confidence. No other internal inconsistency is more central to the strongest claim.","tokens_in":22462,"tokens_out":771,"duration_ms":6377,"concrete_test":"On the Hard subset of both MS-MARCO Document and Passage, compute the empirical δ = mean ∥Et(d)−Es(d)∥₂ (and the corresponding cosine-similarity correlation) between the frozen coCondenser target encoder and the trained surrogate for (i) original target documents, (ii) centroid-concatenated candidates, and (iii) final adversarial documents. Simultaneously re-run the full attack pipeline using a deliberately degraded surrogate (e.g., SentAttack_random from Table 4 or a randomly-initialized dual-encoder). If measured δ > 0.3 or the Hard SRR@10/100 of the degraded-surrogate attack falls below MCARA, the transfer assumption fails and the headline Hard-target claim weakens.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's strongest claim is the large Hard-target lift (Document SRR@10 34.9 % vs MCARA 24.4 %; Passage SRR@100 31.2 % vs 15.3 %). That lift is produced by optimizing a query- and centroid-guided objective (Eqs. 7–9) with gradients taken exclusively on the surrogate dual-encoder (BERT-base) trained only from iterative top-K=10 lists (Stage 1, InfoNCE Eq. 3). Appendix E formalizes transfer via an embedding-discrepancy bound ∥Et(x)−Es(x)∥₂≤δ and a compositionality assumption for concatenation (Assumption 2). Neither δ nor the composition error η_comp is ever measured on the actual coCondenser target, nor is any direct embedding-space correlation or ranking-agreement statistic between surrogate and target reported. Table 3 shows only a modest black-box vs white-box gap on Mixture, not on Hard, and does not quantify how much of the Hard gain survives when the surrogate is replaced by a deliberately poorer imitation. If the true δ is large for documents that start far outside the top-K, the gradient directions used for synonym substitution (Eqs. 10–11) need not improve target ranking, and the Hard-target numbers become an artifact of surrogate overfitting rather than a transferable attack.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes SentAttack, a two-stage black-box sentence-level attack on dense retrieval (DR) models in RAG systems. Stage 1 trains a BERT-base dual-encoder surrogate via InfoNCE (Eq. 3) on positive/hard-negative/random-negative triplets obtained by iterative retrieval (IRM) from the black-box top-K lists. Stage 2 encodes IRM-retrieved documents, applies density-peak clustering to obtain n centroids, concatenates each centroid with the target document (Eq. 6), and refines the candidates by gradient-guided synonym substitution under a query- and centroid-guided objective (Eqs. 7–9) with beam search. Experiments on MS-MARCO Document and Passage (300 queries, Easy/Middle/Hard/Mixture targets) show consistent gains over TF-IDF, TS, PAT, PRADA and MCARA, with the largest relative lifts on Hard targets (Document SRR@10 34.9 % vs MCARA 24.4 %; Passage SRR@100 31.2 % vs 15.3 %). Ablations, hyper-parameter sweeps, naturalness metrics, re-ranker transfer and black-box vs white-box comparisons are also reported.","tokens_in":22913,"tokens_out":1323,"duration_ms":10526,"significance":"If the Hard-target gains transfer under realistic small-K black-box access, the work fills a genuine gap: most prior RAG robustness work targets re-rankers or generation, while DR attacks have been limited to word-level edits that fail on documents far outside the top-K. The IRM-based surrogate construction and the explicit concatenation-plus-refinement pipeline are practical contributions that match real RAG constraints (K ∈ [5,10]). The empirical package (two collections, difficulty stratification, ablations, naturalness, re-ranker survival) is solid and would be useful to the IR/security community. The Appendix E transfer argument, while not measured, at least makes the key assumption explicit.","major_comments":[{"comment":"The central Hard-target claim rests on unmeasured surrogate-to-target transfer. Gradients are computed solely on the BERT-base surrogate (Eqs. 10–11); Appendix E invokes an embedding-discrepancy bound ∥Et(x)−Es(x)∥₂≤δ and a compositionality assumption for concatenation, yet neither δ nor η_comp is ever estimated on the actual coCondenser target, nor is any ranking-agreement or embedding-correlation statistic reported between surrogate and target (especially for documents initially ranked outside top-1000/10000). Table 3 shows only a modest black-box/white-box gap on Mixture, not stratified by Hard. Without this measurement the Hard lifts (Table 1) could be surrogate-overfitting artifacts rather than transferable attacks.","section":null},{"comment":"Threat model vs. evaluation realism. Section 3 and the introduction correctly emphasize that practical RAG systems return only K∈[5,10], yet the main evaluation metrics for Passage are SRR@100 / SRR@1000 and for Document SRR@100 (Table 1). While the authors also report SRR@10 and include a SentAttack_noit ablation under large-K (Appendix D), the headline Hard numbers that drive the “especially strong on low-ranked” claim are still measured at depths far larger than the threat model. A primary table restricted to K=10 (or an explicit success-at-K=10 column for every method) is needed to substantiate the practical claim.","section":null},{"comment":"Naturalness and detectability of sentence-level concatenation. The attack injects entire centroid documents (often definitional passages unrelated to the target) before synonym polishing. Figure 4 and the NSP analysis (Appendix B) show competitive fluency/PPL/grammar and high NSP scores, but no human or automated detector study is provided that tests whether a simple length, topic-shift or NSP-threshold filter would remove the adversarial documents before they reach the re-ranker. Given that the threat model allows corpus injection (Wikipedia-style edits), a short detectability experiment would strengthen the claim that the attack is practically usable.","section":null}],"minor_comments":[{"comment":"Figure 2 caption and the NIO/Tesla example are clear, but the main text never states how many IRM iterations T are used at inference time for the reported numbers; Appendix D.4 varies the count but the default should be explicit in §5.1.","section":null},{"comment":"Eq. (2) defines similarity with a temperature τ that is never given a value; likewise the density-peak clustering parameters (local-density definition) are left to the reference.","section":null},{"comment":"Table 1 reports NRS only at the larger cut-off (@100 or @1000); adding NRS@10 / NRS@100 for the stricter cut-offs would make the ranking-shift claim more transparent.","section":null},{"comment":"The synonym set C and the exact source of synonyms (WordNet? counter-fitted embeddings?) are not specified beyond the ρ=0.8 threshold.","section":null},{"comment":"A few typographical issues: “PA T” vs “PAT”, “Cheg.1 and Gram.2”, and the arXiv identifier in the header is 2607.03456 (future date).","section":null}],"recommendation":"major_revision","confidential_remarks":"The empirical gains look real and the problem is timely; the main risk is that the Hard-target numbers are overstated relative to the small-K threat model and the unmeasured surrogate fidelity. If the authors can add (i) a surrogate–target agreement table stratified by difficulty and (ii) a primary K=10 success column, the paper would be a solid accept for an IR/security venue. Scope-wise it is a good fit for a journal that publishes adversarial IR work."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The one thing worth knowing is that SentAttack moves low-ranked (Hard) documents into the top-K under the realistic small-K regime that actual RAG systems use, and it does so more reliably than the word-level baselines. On MS-MARCO Document, Hard SRR@10 goes from MCARA’s 24.4 % to 34.9 %; on Passage the corresponding jump is 15.3 % to 31.2 %. That is the result that matters.\n\nWhat is new is the pipeline: iterative retrieval to train a surrogate dual-encoder from only top-10 lists, density-peak centroids of query-relevant documents, sentence-level concatenation of those centroids as initialization, then a joint query-plus-centroid objective optimized by gradient-guided beam search over synonyms. The ablations cleanly separate the pieces—concatenation alone helps Easy targets, synonym search alone helps Easy/Middle, both together are needed for Hard. They also check naturalness, re-ranker survival, black-box versus white-box, and hyper-parameter sensitivity. The experimental design is careful and the numbers are consistent across two collections.\n\nThe soft spot the stress-test flags is real: the attack optimizes exclusively on the surrogate, and Appendix E’s δ-embedding-discrepancy and compositionality assumptions are never measured against the actual coCondenser target. Table 3 shows only a modest black/white gap on Mixture, not a Hard-specific transfer diagnostic. If the surrogate is a poor imitation for documents that start far outside the top-K, some of the Hard lift could be surrogate overfitting. That said, the black-box numbers still beat the baselines, so the gap does not appear fatal; it is simply unquantified. Missing code and hand-chosen λ/n/ρ are ordinary rather than decisive weaknesses.\n\nThis is for anyone building or attacking dense retrievers over editable corpora (Wikipedia-style, advertising, poisoning). It does not rewrite theory, but it is a concrete, usable advance under the constraints that matter in practice. I would send it to peer review; the core claim is empirically grounded enough to deserve referee time, even if the transfer analysis needs tightening.","headline":"Practical black-box sentence-level attack that actually lifts hard targets under realistic K=10; the surrogate-transfer gap is real but the empirical gains look solid.","tokens_in":23415,"tokens_out":543,"would_cite":true,"duration_ms":10430,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Sentence-level black-box attack lifts irrelevant documents into dense-retriever top-K by centroid concatenation plus guided synonym search.","keywords":["dense retrieval","adversarial attack","black-box attack","sentence-level perturbation","RAG robustness","surrogate model","centroid concatenation","MS-MARCO"],"falsifier":"Replace the surrogate with a deliberately distant dual-encoder (or simply measure the embedding discrepancy δ on held-out pairs) and check whether the same concatenated-and-substituted candidates still enter the black-box top-K at comparable rates; if success collapses while the white-box variant succeeds, the transfer assumption fails.","tokens_in":23396,"feed_emoji":"🔍","tokens_out":619,"duration_ms":4981,"temperature":0.7,"pith_summary":"Dense retrievers that power the first stage of retrieval-augmented generation systems can be fooled into ranking completely irrelevant documents high enough to reach the re-ranker. Word-level tweaks are usually too weak when the target document starts far outside the top results. SentAttack therefore works at sentence level: it first steals a surrogate dual-encoder by querying the black-box system iteratively, then concatenates the target document with semantically central “centroid” documents drawn from query-related clusters, and finally refines the resulting candidates by gradient-guided synonym substitution. On the MS-MARCO document and passage collections the method markedly outperforms prior attacks, especially on the hardest (lowest-ranked) targets, showing that modest corpus injection can promote advertising or malicious content past the retrieval gate.","feed_headline":"Sentence-level attack promotes irrelevant docs into dense-retriever top-K","feed_subtitle":"Centroid concatenation plus guided synonym search beats prior word-level methods, especially on hard targets","key_machinery":"SentAttack: the pipeline that (1) builds a surrogate dual-encoder from iterative top-K lists via contrastive learning, (2) density-peak clusters query-relevant documents to obtain centroid sentences, concatenates them with the target, and (3) optimizes the hybrids under a weighted query-and-centroid embedding objective with gradient-guided synonym beam search.","core_discovery":"A two-stage black-box procedure—iterative-retrieval surrogate training followed by centroid-document concatenation and query-plus-centroid guided beam search—can raise low-ranked target documents into the top-K returned by a dense retriever far more effectively than existing word-level or multi-view attacks, with the largest gains on the hardest targets.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["SentAttack lifts low-rank docs into dense retriever top-K","Sentence centroids and beam search fool black-box DR models","Two-stage attack promotes hard targets past dense retrievers","Centroid concat beats word-level attacks on dense retrieval","Black-box SentAttack raises irrelevant docs in top-K rankings"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"The surrogate encoder trained only on the small top-K lists returned by the black-box system sits close enough in embedding space to the true unknown retriever that gradients and ranking gains transfer.","fun_headline_variants_meta":{"raw":{"variants":["SentAttack lifts low-rank docs into dense retriever top-K","Sentence centroids and beam search fool black-box DR models","Two-stage attack promotes hard targets past dense retrievers","Centroid concat beats word-level attacks on dense retrieval","Black-box SentAttack raises irrelevant docs in top-K rankings"]},"model":"grok-4.5","effort":"low","cost_usd":0.006428,"raw_usage":{"total_tokens":1658,"prompt_tokens":784,"num_sources_used":0,"completion_tokens":68,"cost_in_usd_ticks":64280000,"prompt_tokens_details":{"text_tokens":784,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":806,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":784,"tokens_out":68,"duration_ms":5750,"temperature":1.0,"reasoning_tokens":806,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-12T02:20:41.771824+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Replace the surrogate with a deliberately distant dual-encoder (or simply measure the embedding discrepancy δ on held-out pairs) and check whether the same concatenated-and-substituted candidates still enter the black-box top-K at comparable rates; if success collapses while the white-box variant succeeds, the transfer assumption fails.","supporting_citations":[],"review_version":1}