Practical Relative Order Attack in Deep Ranking

Zhou, Mo; Wang, Le; Niu, Zhenxing; Zhang, Qilin; Xu, Yinghui; Zheng, Nanning; Hua, Gang

doi:10.48550/arxiv.2103.05248

Cited by 3 publications

(3 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Deep neural networks have been found vulnerable to adversarial attack, where an imperceptible perturbation can trigger dramatic changes in the final result [2,84]. However, the vulnerability of neural ranking models remains under-explored.…”

Section: Defensive Ability Against Adversarial Operationsmentioning

confidence: 99%

“…On the other hand, users may occasionally misspell or mistype a query keyword when performing a search. Different from the query-based black-box/white-box attack [83,84] in the image retrieval task, in this work, we focus on the adversarial misspellings, which constitute a longstanding real-world problem for text retrieval. From the perspective of a user, a reliable system that always produces acceptable retrieval performance, is more preferred than another system that fails on the occasional query typo.…”

Section: Definition Of Defensivementioning

confidence: 99%

See 1 more Smart Citation

Are Neural Ranking Models Robust?

Chen¹,

Zhang²,

Guo³

et al. 2021

Preprint

View full text Add to dashboard Cite

Recently, we have witnessed the bloom of neural ranking models in the information retrieval (IR) field. So far, much effort has been devoted to developing effective neural ranking models that can generalize well on new data. There has been less attention paid to the robustness perspective. Unlike the effectiveness which is about the average performance of a system under normal purpose, robustness cares more about the system performance in the worst case or under malicious operations instead. When a new technique enters into the real-world application, it is critical to know not only how it works in average, but also how would it behave in abnormal situations. So we raise the question in this work: Are neural ranking models robust? To answer this question, firstly, we need to clarify what we refer to when we talk about the robustness of ranking models in IR. We show that robustness is actually a multi-dimensional concept and there are three ways to define it in IR: 1) The performance variance under the independent and identically distributed (I.I.D.) setting; 2) The out-of-distribution (OOD) generalizability; and 3) The defensive ability against adversarial operations. The latter two definitions can be further specified into two different perspectives respectively, leading to 5 robustness tasks in total. Based on this taxonomy, we build corresponding benchmark datasets, design empirical experiments, and systematically analyze the robustness of several representative neural ranking models against traditional probabilistic ranking models and learning-to-rank (LTR) models. The empirical results show that there is no simple answer to our question. While neural ranking models are less robust against other IR models in most cases, some of them can still win 1 out of 5 tasks. This is the first comprehensive study on the robustness of neural ranking models. We believe the way we study the robustness as well as our findings would be beneficial to the IR community. We will also release all the data and codes to facilitate the future research in this direction.CCS Concepts: • Information systems → Retrieval models and ranking.

show abstract

Section: Defensive Ability Against Adversarial Operationsmentioning

confidence: 99%

Section: Definition Of Defensivementioning

confidence: 99%

Are Neural Ranking Models Robust?

Chen¹,

Zhang²,

Guo³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…For information retrieval systems, the risk of malicious manipulation of ranking always exists [36], [37], and so does deep ranking. Some existing attacks against deep ranking aim to incur mismatching top-ranked items [38], [39], [40] as long as they mismatch with the expected ones, while the others lead to more specific ranking results [13], [41], [7], [42] beyond a mere mismatch. These attacks will be reviewed in Section 5.…”

Section: Related Workmentioning

confidence: 99%

Adversarial Ranking Attack and Defense

Zhou

Niu²,

Wang³

et al. 2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Deep Neural Network classifiers are vulnerable to adversarial attack, where an imperceptible perturbation could result in misclassification. However, the vulnerability of DNN-based image ranking systems remains under-explored. In this paper, we propose two attacks against deep ranking systems, i.e., Candidate Attack and Query Attack, that can raise or lower the rank of chosen candidates by adversarial perturbations. Specifically, the expected ranking order is first represented as a set of inequalities, and then a triplet-like objective function is designed to obtain the optimal perturbation. Conversely, an anti-collapse triplet defense is proposed to improve the ranking model robustness against all proposed attacks, where the model learns to prevent the positive and negative samples being pulled close to each other by adversarial attack. To comprehensively measure the empirical adversarial robustness of a ranking model with our defense, we propose an empirical robustness score, which involves a set of representative attacks against ranking models. Our adversarial ranking attacks and defenses are evaluated on MNIST, Fashion-MNIST, CUB200-2011, CARS196 and Stanford Online Products datasets. Experimental results demonstrate that a typical deep ranking system can be effectively compromised by our attacks. Nevertheless, our defense can significantly improve the ranking system robustness, and simultaneously mitigate a wide range of attacks.

show abstract