Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspective
Not on the map. Why?
Abstract (arXiv)
Recent advances in neural information retrieval (IR) models have significantly enhanced their effectiveness over various IR tasks. The robustness of these models, essential for ensuring their reliability in practice, has also garnered significant attention. With a wide array of research on robust IR being proposed, we believe it is the opportune moment to consolidate the current status, glean insights from existing methodologies, and lay the groundwork for future development. We view the robustness of IR to be a multifaceted concept, emphasizing its necessity against adversarial attacks, out-of-distribution (OOD) scenarios and performance variance. With a focus on adversarial and OOD robustness, we dissect robustness solutions for dense retrieval models (DRMs) and neural ranking models (NRMs), respectively, recognizing them as pivotal components of the neural IR pipeline. We provide an in-depth discussion of existing methods, datasets, and evaluation metrics, shedding light on challenges and future directions in the era of large language models. To the best of our knowledge, this is the first comprehensive survey on the robustness of neural IR models, and we will also be giving our first tutorial presentation at SIGIR 2024 urlhttps://sigir2024-robust-information-retrieval.github.io. Along with the organization of existing work, we introduce a Benchmark for robust IR (BestIR), a heterogeneous evaluation benchmark for robust neural information retrieval, which is publicly available at urlhttps://github.com/Davion-Liu/BestIR. We hope that this study provides useful clues for future research on the robustness of IR models and helps to develop trustworthy search engines urlhttps://github.com/Davion-Liu/Awesome-Robustness-in-Information-Retrieval.
Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 126 of its 212 references that are in the map. First posted on arXiv 9 Jul 2024.
Builds on
126 of 212 references.
References · 126
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
- 2022Survey of Hallucination in Natural Language Generationcited by 2,056
- 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
- 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
- 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
- 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,160
- 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
- 2021Retrieval Augmentation Reduces Hallucination in Conversationcited by 691
- 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
38 more
- 2021Large Dual Encoders Are Generalizable Retrieverscited by 454
- 2020RocketQA: An Optimized Training Approach to Dense Passage Retrieval for Open-Domain Question Answeringcited by 410
- 2020Document Ranking with a Pretrained Sequence-to-Sequence Modelcited by 373
- 2022Text and Code Embeddings by Contrastive Pre-Trainingcited by 358
- 2023Is ChatGPT Good at Search? Investigating Large Language Models as Re-Ranking Agentscited by 356
- 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
- 2020Overview of the TREC 2019 deep learning trackcited by 282
- 2023RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Modelscited by 272
- 2019FreeLB: Enhanced Adversarial Training for Natural Language Understandingcited by 261
- 2021Understanding Robustness of Transformers for Image Classificationcited by 250
- 2022Transformer Memory as a Differentiable Search Indexcited by 242
- 2022Promptagator: Few-shot Dense Retrieval From 8 Examplescited by 233
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
- 2019Machine Learning Testing: Survey, Landscapes and Horizonscited by 213
- 2021Unsupervised Corpus Aware Language Model Pre-training for Dense Passage Retrievalcited by 203
- 2021Overview of the TREC 2020 deep learning trackcited by 193
- 2019Certified Robustness to Adversarial Word Substitutionscited by 164
- 2021Optimizing Dense Retrieval Model Training with Hard Negativescited by 154
- 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
- 2023Should ChatGPT be Biased? Challenges and Risks of Bias in Large Language Modelscited by 144
- 2021Simple Entity-Centric Questions Challenge Dense Retrieverscited by 140
- 2022Dense Text Retrieval based on Pretrained Language Models: A Surveycited by 136
- 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 135
- 2021An Empirical Investigation of the Role of Pre-training in Lifelong Learningcited by 134
- 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2021GPL: Generative Pseudo Labeling for Unsupervised Domain Adaptation of Dense Retrievalcited by 119
- 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
- 2017Deep Text Classification Can be Fooledcited by 105
- 2022From Distillation to Hard Negative Sampling: Making Sparse Neural IR Models More Effectivecited by 98
- 2024Bias and Unfairness in Information Retrieval Systems: New Challenges in the LLM Eracited by 97
- 2020CharacterBERT: Reconciling ELMo and BERT for Word-Level Open-Vocabulary Representations From Characterscited by 87
- 2021Adversarial Retriever-Ranker for dense text retrievalcited by 82
- 2019A Deep Look into Neural Ranking Models for Information Retrievalcited by 79
- 2017IRGAN: A Minimax Game for Unifying Generative and Discriminative Information Retrieval Modelscited by 75
- 2021Semantic Models for the First-stage Retrieval: A Comprehensive Reviewcited by 57
- 2018Training verified learners with learned verifierscited by 50
- 2021A Systematic Review of Robustness in Deep Learning for Computer Vision: Mind the gap?cited by 48
50 most cited of 126 All 126 (JSON)
Built on by
Citing papers per year: 2024: 1; 2025: 8; 2026: 6.
15 papers.
Sort:
By area:
- 2025FinAgentBench: A Benchmark Dataset for Agentic Retrieval in Financial Question Answeringcited by 29
- 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systemscited by 10
- 2025Investigating the Robustness of Retrieval-Augmented Generation at the Query Levelcited by 10
- 2025Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrievalcited by 7
- 2025SAGE: A Realistic Benchmark for Semantic Understandingcited by 6
- 2025Chain-of-Thought Poisoning Attacks against R1-based Retrieval-Augmented Generation Systemscited by 5
- 2024Investigating Mixture of Experts in Dense Retrievalcited by 4
- 2025When Should Dense Retrievers Be Updated in Evolving Corpora? Detecting Out-of-Distribution Corpora Using GradNormIRcited by 3
- 2025Mixture of Experts Approaches in Dense Retrieval Taskscited by 2
- 2026With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spotscited by 1
- 2026On the Robustness of LLM-Based Dense Retrievers: A Systematic Analysis of Generalizability and Stabilitycited by 0
- 2026Lost in Decoding? Reproducing and Stress-Testing the Look-Ahead Prior in Generative Retrievalcited by 0
3 more
- 2026Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbationcited by 0
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0
- 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
- 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generation26 Jul 2026
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems24 Jun 2026
- 2026Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbation1 Jun 2026
- 2026Lost in Decoding? Reproducing and Stress-Testing the Look-Ahead Prior in Generative Retrieval25 Apr 2026
- 2026On the Robustness of LLM-Based Dense Retrievers: A Systematic Analysis of Generalizability and Stability17 Apr 2026
- 2026With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spots10 Feb 2026
- 2025Mixture of Experts Approaches in Dense Retrieval Tasks17 Oct 2025
- 2025SAGE: A Realistic Benchmark for Semantic Understanding25 Sep 2025
- 2025FinAgentBench: A Benchmark Dataset for Agentic Retrieval in Financial Question Answering7 Aug 2025
- 2025Investigating the Robustness of Retrieval-Augmented Generation at the Query Level9 Jul 2025
- 2025When Should Dense Retrievers Be Updated in Evolving Corpora? Detecting Out-of-Distribution Corpora Using GradNormIR2 Jun 2025
- 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems24 May 2025
- 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systemscited by 10
- 2025Investigating the Robustness of Retrieval-Augmented Generation at the Query Levelcited by 10
- 2026With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spotscited by 1
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0
- 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
- 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generation26 Jul 2026
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems24 Jun 2026
- 2026With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spots10 Feb 2026
- 2025Investigating the Robustness of Retrieval-Augmented Generation at the Query Level9 Jul 2025
- 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems24 May 2025
- 2024Investigating Mixture of Experts in Dense Retrievalcited by 4
- 2025Mixture of Experts Approaches in Dense Retrieval Taskscited by 2
- 2025Mixture of Experts Approaches in Dense Retrieval Tasks17 Oct 2025
- 2024Investigating Mixture of Experts in Dense Retrieval16 Dec 2024
- 2025Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrievalcited by 7
- 2025SAGE: A Realistic Benchmark for Semantic Understandingcited by 6
- 2025When Should Dense Retrievers Be Updated in Evolving Corpora? Detecting Out-of-Distribution Corpora Using GradNormIRcited by 3
- 2026On the Robustness of LLM-Based Dense Retrievers: A Systematic Analysis of Generalizability and Stabilitycited by 0
- 2026Lost in Decoding? Reproducing and Stress-Testing the Look-Ahead Prior in Generative Retrievalcited by 0
- 2026Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbationcited by 0
- 2026Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbation1 Jun 2026
- 2026Lost in Decoding? Reproducing and Stress-Testing the Look-Ahead Prior in Generative Retrieval25 Apr 2026
- 2026On the Robustness of LLM-Based Dense Retrievers: A Systematic Analysis of Generalizability and Stability17 Apr 2026
- 2025SAGE: A Realistic Benchmark for Semantic Understanding25 Sep 2025
- 2025When Should Dense Retrievers Be Updated in Evolving Corpora? Detecting Out-of-Distribution Corpora Using GradNormIR2 Jun 2025
- 2025Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval8 Jan 2025