SentAttack: Sentence-level black-box attack exposes RAG retrieval vulnerabilities

Researchers from the University of Science and Technology of China (Wei et al.) have introduced SentAttack, a novel sentence-level black-box adversarial attack method targeting dense retrieval (DR) models—the backbone of Retrieval-Augmented Generation (RAG) systems. While prior adversarial research focused on neural ranking models or word-level perturbations, SentAttack addresses the harder problem of promoting low-ranked, irrelevant documents by manipulating entire sentences. The attack operates in two stages: first, it interacts with the target black-box RAG system by submitting queries and collecting ranked document lists to train a surrogate DR model. Second, it encodes and clusters query-relevant documents, concatenating cluster centroids with the target document at the sentence level to form initial adversarial candidates. These candidates are then refined using a query- and centroid-guided objective combined with gradient-guided beam search.

Experimental results show SentAttack substantially outperforms existing word-level and document-level attack methods, achieving higher success rates in ranking irrelevant documents near the top of retrieval results. The method is particularly effective against low-ranked target documents, which were previously difficult to manipulate. This work highlights a significant security vulnerability in RAG pipelines: even if the generative model is robust, the retrieval stage can be subverted by sentence-level perturbations. The authors suggest that future defenses should consider sentence-level robustness and adversarial training for DR models, as current protections are insufficient against such attacks.