The Vulnerability of LLM Rankers to Prompt Injection Attacks

1. Problem Statement

Large Language Models (LLMs) have become dominant components in Information Retrieval (IR) systems, particularly as re-rankers that assess query-document relevance. However, recent research (Qian et al., 2025) revealed a critical security vulnerability: jailbreak prompt injection attacks. By embedding adversarial instructions within candidate documents, attackers can manipulate LLM rankers into violating their ranking instructions, promoting irrelevant or malicious documents to the top of the list.

While the initial study established the existence of this vulnerability, it left several gaps regarding:

• Generalizability: Whether the vulnerability scales across diverse model families, architectures (e.g., encoder-decoder vs. decoder-only), and parameter sizes.
• Operational Impact: Whether high "Attack Success Rates" (ASR) on preference tasks translate to actual degradation in retrieval quality (e.g., nDCG@10).
• Contextual Factors: The influence of injection position (front vs. back of a document) and domain specificity (general web search vs. specialized domains).
• Reproducibility: Inconsistencies in the original study's findings regarding model scaling and positional robustness.

2. Methodology

The authors conducted a comprehensive empirical study structured around two complementary tasks to bridge the gap between intrinsic model susceptibility and operational system failure.

Task 1: Preference Vulnerability Assessment

• Goal: Measure the intrinsic susceptibility of the model to change its ranking preference (Attack Success Rate - ASR).
• Protocol: Reproduced and extended the original experimental setup using TREC-DL datasets.
• Variables:
  • Attack Types: Decision Objective Hijacking (DOH - forcing a specific document as the answer) and Decision Criteria Hijacking (DCH - redefining relevance criteria).
  • Ranking Paradigms: Pairwise, Listwise, and Setwise.
  • Injection Positions: Front vs. Back of the document.
  • Models: Evaluated 15+ models across three architectural families: Decoder-only (Qwen3, Gemma-3, LLaMA-3), Encoder-Decoder (Flan-T5), and Mixture-of-Experts (MoE).
  • Scaling: Tested models ranging from 0.6B to 70B parameters.

Task 2: Ranking Vulnerability Assessment

• Goal: Quantify the operational impact on the retrieval pipeline.
• Protocol: Simulated a two-stage retrieval pipeline (BM25 first stage $\to$ LLM re-ranking).
• Metric: Measured the degradation of nDCG@10 ($\Delta$nDCG) by comparing "Safe Reranking" (clean) vs. "Attacked Reranking" (with injected prompts in non-relevant documents).
• Scope: Extended evaluation to domain-specific benchmarks (BEIR: TREC-COVID, TOUCHE-2020, SciFact, DBpedia) to test cross-domain robustness.

3. Key Contributions

1. Systematic Reproducibility & Extension: Validated the original findings while correcting inconsistencies (e.g., fixing prompt errors in listwise settings) and expanding the scope to include encoder-decoder and MoE architectures.
2. Operational Impact Quantification: Introduced a rigorous evaluation of how prompt injections degrade actual retrieval performance (nDCG@10), moving beyond simple preference flipping.
3. Architectural Discovery: Identified that Encoder-Decoder architectures (specifically Flan-T5) possess inherent, strong resilience to these attacks, contrasting sharply with the vulnerability of Decoder-only models.
4. Positional Sensitivity Refinement: Demonstrated that injection position is not agnostic; specifically, back-of-passage injections are significantly more damaging in setwise ranking scenarios than front-of-passage injections.
5. Cross-Domain Analysis: Proved that vulnerability is primarily an intrinsic model property that generalizes across domains, though it is modulated by document length and relevance label granularity.

4. Key Results

A. Vulnerability Scaling

• Confirmation: Larger, more capable models generally exhibit higher susceptibility to decision hijacking, contradicting the intuition that larger models are more robust.
• Nuance: The scaling trend is not perfectly monotonic. For example, the smallest Qwen3 model (0.6B) showed near-perfect ASR in Pairwise-DOH, exceeding larger variants, while Gemma-3 showed a more consistent monotonic increase in vulnerability.

B. Position Sensitivity

• Setwise Ranking: Shows the highest sensitivity to position. Back-placed injections consistently outperformed front-placed ones (by ~10–20% ASR gap) and caused significantly larger nDCG degradation.
• Pairwise Ranking: Exhibited spatial invariance (position did not matter much) due to the constrained context of only two documents.
• Listwise Ranking: Showed intermediate sensitivity, with back placements generally being more effective.

C. Architectural Divergence (The Critical Finding)

• Decoder-Only Models (Qwen, Gemma, LLaMA): Highly vulnerable. ASR often exceeded 90% in setwise/listwise settings.
• Encoder-Decoder Models (Flan-T5): Exhibited exceptional robustness.
  • Mean ASR was only ~3.2% (vs. ~50-90% for decoder-only).
  • nDCG Degradation: Flan-T5 models showed negligible or even negative degradation (slight improvement) under attack. The "hijacks" were insufficient to disrupt the overall ranking quality.
  • Reasoning: The bidirectional encoder allows for global semantic integration, mitigating the "recency bias" common in causal decoders and helping the model detect contextual inconsistencies.
• MoE Models: Showed vulnerability profiles similar to dense decoder-only models, indicating MoE routing does not inherently provide security.

D. Domain Robustness

• Generalization: There is a very strong correlation ($r=0.969$) between ASR on general datasets (TREC-DL) and specialized domains (BEIR). Vulnerability is an intrinsic property of the model.
• Modulating Factors:
  • Document Length: Shorter documents (e.g., DBpedia) led to higher ASR due to the "textual dilution effect" (the prompt occupies a larger relative portion of the input).
  • Relevance Granularity: Datasets with binary relevance (SciFact) showed lower ASR than those with graded relevance, likely due to the construction of candidate sets.

E. Operational Impact (nDCG@10)

• High ASR directly translates to severe ranking loss. Under attacks, the mean nDCG@10 dropped by 55.2% (from 0.658 to 0.294).
• In many cases, the attacked LLM ranker performed worse than the initial BM25 retriever, completely negating the value of the LLM re-ranking stage.

5. Significance and Implications

• Security Boundary: The paper defines the boundary conditions of LLM ranker security. It proves that while LLMs are powerful, they are fragile against simple prompt injections, especially in setwise and listwise paradigms.
• Architectural Selection: The findings suggest that for high-security IR applications, Encoder-Decoder architectures (like Flan-T5) are superior choices over Decoder-only models, as they offer inherent resistance to prompt injection without needing complex defensive fine-tuning.
• Deployment Risks: The study highlights that current LLM re-ranking pipelines are vulnerable to "SEO-style" attacks where malicious actors inject prompts into non-relevant documents retrieved by the first stage.
• Future Directions: The authors note that the current attack model assumes the attacker can inject prompts into all non-relevant candidates, which is a strong assumption. Future work should focus on more realistic attack scenarios (e.g., injecting into a subset of documents or via SEO manipulation of the web itself).

In summary, this paper provides a definitive empirical characterization of LLM ranker vulnerabilities, revealing that while the threat is severe and scalable, the choice of model architecture (Encoder-Decoder vs. Decoder-only) is a decisive factor in system robustness.