``Someone Hid It!'': Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Large language models (LLMs) have been serving as effective backbones for retrieval systems, including Retrieval-Augmentation-Generation (RAG), Dense Information Retriever (IR), and Agent Memory Retrieval. Recent studies have demonstrated that such LLM-based Retrieval (LLMR) is vulnerable to adversarial attacks, which manipulates documents by token-level injections and enables adversaries to either boost or diminish these documents in retrieval tasks. However, existing attack studies mainly (1) presume a known query is given to the attacker, and (2) highly rely on access to the victim model's parameters or interactions, which are hardly accessible in real-world scenarios, leading to limited validity. To further explore the secure risks of LLMR, we propose a practical black-box attack method that generates transferable injection tokens based on zero-shot surrogate LLMs without need of victim queries or victim models knowledge. The effectiveness of our attack raises such a robustness issue that similar effects may arise from benign or unintended document edits in the real world. To achieve our attack, we first establish a theoretical framework of LLMR and empirically verify it. Under the framework, we simulate the transferable attack as a min-max problem, and propose an adversarial learning mechanism that finds optimal adversarial tokens with learnable query samples. Our attack is validated to be effective on benchmark datasets across popular LLM retrievers.

Modern AI systems often answer questions by first searching a large collection of documents, then using the most relevant documents to produce an answer. This step is important for web search, retrieval-augmented generation, and AI agents that store memories, but it also creates a new security risk: a useful document may be made harder to find. We study whether this can happen even when an attacker does not know the user’s future question, cannot inspect or query the retrieval model, and cannot see the rest of the document collection. Our work shows that the risk is real: by adding a small number of carefully chosen short text snippets to a document, a person may reduce how often that document is retrieved by many different LLM-based retrievers. To understand why, we develop a simple explanation of how these systems group documents and questions by topic, and use it to design a method that learns from a separate model and simulated possible questions. Experiments on multiple datasets and popular retrieval models show that the same modified document can become less visible across different systems. These findings highlight the need for more robust retrieval systems and better safeguards for platforms where public users can edit, comment on, or contribute text that may later be searched by AI systems.