Dense retrievers are widely used in information retrieval and have also been successfully extended to other knowledge intensive areas such as language models, e.g., Retrieval-Augmented Generation (RAG) systems. Unfortunately, they have recently been shown to be vulnerable to corpus poisoning attacks in which a malicious user injects a small fraction of adversarial passages into the retrieval corpus to trick the system into returning these passages among the top-ranked results for a broad set of user queries. Further study is needed to understand the extent to which these attacks could limit the deployment of dense retrievers in real-world applications. In this work, we propose Approximate Greedy Gradient Descent (AGGD), a new attack on dense retrieval systems based on the widely used HotFlip method for efficiently generating adversarial passages. We demonstrate that AGGD can select a higher quality set of token-level perturbations than HotFlip by replacing its random token sampling with a more structured search. Experimentally, we show that our method achieves a high attack success rate on several datasets and using several retrievers, and can generalize to unseen queries and new domains. Notably, our method is extremely effective in attacking the ANCE retrieval model, achieving attack success rates that are 17.6\% and 13.37\% higher on the NQ and MS MARCO datasets, respectively, compared to HotFlip. Additionally, we demonstrate AGGD's potential to replace HotFlip in other adversarial attacks, such as knowledge poisoning of RAG systems.\footnote{Code can be find in \url{https://github.com/JinyanSu1/AGGD}}

翻译：密集检索器在信息检索领域得到广泛应用，并已成功扩展至语言模型等其他知识密集型领域，例如检索增强生成（RAG）系统。然而，近期研究表明其易受语料库投毒攻击：恶意用户向检索语料库中注入少量对抗性段落，即可诱使系统在广泛用户查询的top-ranked结果中返回这些段落。此类攻击在多大程度上会限制密集检索器在实际场景中的部署，仍需深入研究。本文提出近似贪婪梯度下降（AGGD）——一种基于广泛使用的HotFlip方法的新型密集检索系统攻击技术，可高效生成对抗性段落。我们证明，通过用结构化搜索替代随机词元采样，AGGD能比HotFlip选择更高质量的词元级扰动集合。实验表明，本方法在多个数据集和检索器上均能实现高攻击成功率，且可泛化至未见查询与新领域。值得注意的是，本方法对ANCE检索模型的攻击效果尤为显著：在NQ和MS MARCO数据集上的攻击成功率分别比HotFlip高出17.6%和13.37%。此外，我们验证了AGGD在其他对抗攻击中替代HotFlip的潜力，例如RAG系统的知识投毒攻击。\footnote{代码可见于 \url{https://github.com/JinyanSu1/AGGD}}