arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.16752cs.CR
收藏

大语言模型排序器对提示注入攻击的脆弱性

The Vulnerability of LLM Rankers to Prompt Injection Attacks

The University of Queensland（昆士兰大学）；CSIRO（澳大利亚联邦科学与工业研究组织）

Yu Yin, Shuai Wang, Bevan Koopman, Guido Zuccon

备注：
18 pages, 7 figures
发表信息：
SIGIR 2026
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文研究了大语言模型排序器对提示注入攻击的脆弱性，通过实验证明不同架构和设置下的攻击效果，并揭示了编码器-解码器架构的抗性。

摘要：

大语言模型（LLMs）已发展为强大的重排序器。然而，最近的研究表明，简单的提示注入嵌入在候选文档中（即劫持提示攻击）可以显著改变LLM的排序决策。尽管这给基于LLM的排序流程带来了严重安全风险，但这种漏洞在不同LLM家族、架构和设置中持续存在的程度仍鲜有探索。在本文中，我们对针对LLM排序器的劫持提示攻击进行了全面的实证研究。我们专注于两个互补的任务：（1）偏好脆弱性评估，通过攻击成功率（ASR）测量内在易受攻击性；（2）排序脆弱性评估，量化对排序质量的影响（nDCG@10）。我们系统地检查了三种普遍的排序范式（成对、列表、集合）在两种注入变体（决策目标劫持和决策标准劫持）下的表现。除了复现先前发现外，我们还扩展了分析，涵盖模型家族、位置敏感性、基础架构和跨领域鲁棒性方面的脆弱性扩展。我们的结果界定了这些漏洞的边界条件，揭示了关键见解，例如编码器-解码器架构对劫持攻击表现出强固有的抗性。我们公开发布了代码和额外的实验结果，网址为https://github.com/ielab/LLM-Ranker-Attack。

英文摘要：

Large Language Models (LLMs) have emerged as powerful re-rankers. Recent research has however showed that simple prompt injections embedded within a candidate document (i.e., jailbreak prompt attacks) can significantly alter an LLM's ranking decisions. While this poses serious security risks to LLM-based ranking pipelines, the extent to which this vulnerability persists across diverse LLM families, architectures, and settings remains largely under-explored. In this paper, we present a comprehensive empirical study of jailbreak prompt attacks against LLM rankers. We focus our evaluation on two complementary tasks: (1) Preference Vulnerability Assessment, measuring intrinsic susceptibility via attack success rate (ASR); and (2) Ranking Vulnerability Assessment, quantifying the operational impact on the ranking's quality (nDCG@10). We systematically examine three prevalent ranking paradigms (pairwise, listwise, setwise) under two injection variants: decision objective hijacking and decision criteria hijacking. Beyond reproducing prior findings, we expand the analysis to cover vulnerability scaling across model families, position sensitivity, backbone architectures, and cross-domain robustness. Our results characterize the boundary conditions of these vulnerabilities, revealing critical insights such as that encoder-decoder architectures exhibit strong inherent resilience to jailbreak attacks. We publicly release our code and additional experimental results at https://github.com/ielab/LLM-Ranker-Attack.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑