Elamur Research⌕
☰
home / papers / 2026 / Stop Hardening Everything: A Training-Free Neuron-Level Defense for Neural Ranking Models

Stop Hardening Everything: A Training-Free Neuron-Level Defense for Neural Ranking Models

Paper · 2026 · Yu-An Liu, Ruqing Zhang, Hongru Song et al.

Summary

Neural ranking models (NRMs) in search engines can be manipulated by small, hard-to-notice document edits, such as synonym swaps, that push low-quality pages higher in the results. Most existing protections rely on adversarial training. That approach requires generating many attacked examples and retraining every parameter, which is expensive and tends to reduce accuracy on normal inputs.

The authors argue that this fragility is concentrated in a small group of internal units. They propose Search in the Model, a defense that needs no training and works in three phases:

  • Probing: a small set of adversarial examples is used to measure how much each feed-forward (FFN) neuron's activation shifts under attack.
  • Selection: choosing neurons is framed as a ranking task, and a maximum marginal vulnerability criterion picks a complementary top-K set.
  • Correction: inverse perturbations pull the selected neurons' responses to attacked inputs back toward their clean behaviour.

On MS MARCO and TREC 19, the method outperforms strong baselines in robustness to both seen and unseen attacks while preserving clean ranking quality. It is a cheap, quickly deployable alternative to full retraining.

Key points

  • Neurons are defined as individual elements of the FFN intermediate activation in Transformer-based NRMs. This follows the view (Geva et al., 2021) that FFN layers act as key–value memories.
  • The maximum marginal vulnerability (MMV) criterion adapts maximal marginal relevance (MMR) from learning to rank. It selects neuron combinations whose joint influence on adversarial behaviour is largest, rather than simply the highest-scoring neurons one by one.
  • Evaluation uses MS MARCO and TREC 19 with two attack families: MARA (gradient-based) and FSAP (in-context-learning-based, using LLMs). One attack is used during design and the other is held out as unseen.
  • Robustness improves by more than 13% over state-of-the-art baselines, with no additional training. Clean-data ranking performance is maintained and sometimes improved.
  • The authors list three limitations:
    • Neuron selection depends on the attack types in the probe set.
    • Validation covers only Transformer NRMs.
    • Vulnerability is treated as static, which may not hold against adaptive attackers.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksSoftware · 92 works

Cite

Cite as Yu-An Liu, Ruqing Zhang, Hongru Song, Jiafeng Guo, Yixing Fan and Xueqi Cheng. 2026. Stop Hardening Everything: A Training-Free Neuron-Level Defense for Neural Ranking Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1076

@inproceedings{liu2026stop,
  title = {{Stop Hardening Everything: A Training-Free Neuron-Level Defense for Neural Ranking Models}},
  author = {Yu-An Liu, Ruqing Zhang, Hongru Song, Jiafeng Guo, Yixing Fan and Xueqi Cheng},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1076},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1076}
}

References

39 references, 6 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Amin Bigdeli, Negar Arabzadeh, Ebrahim Bagheri, and Charles LA Clarke. 2025. Adversarial attacks against neural ranking models via in-context learning. In Proceedings of the 2025 Annual International ACM SIGIR Conference on Research and Development in Information Retrieval in the Asia Pacific Region… find
  2. Xuanang Chen, Ben He, Zheng Ye, Le Sun, and Yingfei Sun. 2023. Towards imperceptible document manipulations against neural ranking models. In Findings of the Association for Computational Linguistics: ACL 2023, pages 6648–6664. find
  3. Nick Craswell, Bhaskar Mitra, Emine Yilmaz, Daniel Campos, and Ellen M Voorhees. 2020. Overview of the trec 2019 deep learning track. corr abs/2003.07820 (2020). arXiv preprint arXiv:2003.07820.
  4. Yixing Fan, Xiaohui Xie, Yinqiong Cai, Jia Chen, Xinyu Ma, Xiangsheng Li, Ruqing Zhang, and Jiafeng Guo. 2022. Pre-training methods in information retrieval. Foundations and Trends in Information Retrieval, 16(3):178–317. find
  5. Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5484–5495. find
  6. Amirata Ghorbani and James Y Zou. 2020. Neuron shapley: Discovering the responsible neurons. Advances in neural information processing systems, 33:5922–5932. find
  7. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations.
  8. Jiafeng Guo, Yixing Fan, Liang Pang, Liu Yang, Qingyao Ai, Hamed Zamani, Chen Wu, W. Bruce Croft, and Xueqi Cheng. 2020. A deep look into neural ranking models for information retrieval. Information Processing & Management, 57(6):102067. find
  9. Zoltán Gyöngyi and Hector Garcia-Molina. 2005. Web spam taxonomy. In AIRWeb 2005: First International Workshop on Adversarial Information Retrieval on the Web, pages 39–47. find
  10. Oren Kurland and Moshe Tennenholtz. 2022. Competitive search. In Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 2838–2849. find
  11. Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. 2015. Deep learning. Nature, 521(7553):436–444. find
  12. Yifan Li, Yuxi Zhang, Bingqian Li, Jinsong Su, Zhiyuan Wang, Yutao Hou, and Lichao Wang. 2023. Alphaedit: Null-space constrained model editing for language models. arXiv preprint arXiv:2310.05737. — [arXiv:2310.05737](https://arxiv.org/abs/2310.05737) find
  13. Jimmy Lin, Rodrigo Nogueira, and Andrew Yates. 2022. Pretrained Transformers for Text Ranking: Bert and Beyond. Springer Nature. find
  14. Jiawei Liu, Yangyang Kang, Di Tang, Kaisong Song, Changlong Sun, Xiaofeng Wang, Wei Lu, and Xiaozhong Liu. 2022. Order-disorder: Imitation adversarial attacks for black-box neural ranking models. In 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2025–2039. find
  15. Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Wei Chen, Yixing Fan, and Xueqi Cheng. 2023. Black-box adversarial attacks against dense retrieval models: A multi-view contrastive learning method. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management… find
  16. Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2024a. Multi-granular adversarial attacks against black-box neural ranking models. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1391– 1400… find
  17. Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2025a. ACM Transactions on Information Systems, 44(1):1–48. find
  18. Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2025b. Attack-in-the-chain: bootstrapping large language models for attacks against black-box neural ranking models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 12229–12237. find
  19. Yu-An Liu, Ruqing Zhang, Mingkun Zhang, Wei Chen, Maarten de Rijke, Jiafeng Guo, and Xueqi Cheng. 2024b. Perturbation-invariant adversarial training for neural ranking models: improving the effectiveness-robustness trade-off. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 3… find
  20. Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101. find
  21. Xinyu Ma, Jiafeng Guo, Ruqing Zhang, Yixing Fan, Yingyan Li, and Xueqi Cheng. 2021. B-prop: Bootstrapped pre-training with representative words prediction for ad-hoc retrieval. In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1… find
  22. Kevin Meng, David Bau, Alex Andonian, Yossi Belinkov, Yossi Belinkov, Yifeng Zhou, Mikel Artetxe, Mike Lewis, Luke Zettlemoyer, Daniel Khashabi, and Hannaneh Hajishirzi. 2022a. Rank-one model editing for large language models. In Advances in Neural Information Processing Systems, volume 35, pages 28… find
  23. Kevin Meng, David Bau, Alex Andonian, Yossi Belinkov, Yifeng Zhou, Daniel Khashabi, and Hannaneh Hajishirzi. 2022b. Mass-editing memory in gpt. In NeurIPS 2022 Workshop on Machine Learning Safety. find
  24. Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher D Manning. Fast model editing at scale. In International Conference on Learning Representations. find
  25. Afrozah Nadeem, Mark Dras, and Usman Naseem. 2025. Context-aware fairness evaluation and mitigation in llms. arXiv preprint arXiv:2510.18914. — [arXiv:2510.18914](https://arxiv.org/abs/2510.18914) find
  26. Tri Nguyen, Mir Rosenberg, Xia Song, Jianfeng Gao, Saurabh Tiwary, Rangan Majumder, and Li Deng. 2016. Ms marco: A human generated machine reading comprehension dataset. In CoCo@ NIPS.
  27. Rodrigo Nogueira, Zhiying Jiang, Ronak Pradeep, and Jimmy Lin. 2020. Document ranking with a pretrained sequence-to-sequence model. In Findings of the association for computational linguistics: EMNLP 2020, pages 708–718.
  28. Kezban Dilek Onal, Ye Zhang, Ismail Sengor Altin-govde, Md. Mustafizur Rahman, Pinar Karagoz, Alexander Braylan, Brandon Dang, Heng-Lu Chang, Henna Kim, Quinten McNamara, Aaron Angert, Edward Banner, Vivek Khetan, Tyler McDonnell, An Thanh Nguyen, Dan Xu, Byron C. Wallace, Maarten de Rijke, and Matt… find
  29. Kailai Sun, Zuchao Li, and Hai Zhao. 2022. Reorder and then parse, fast and accurate discontinuous constituency parsing. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 10575–10588. find
  30. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations.
  31. Yuxin Wang, Zhengyang Liu, Jinsong Su, Zhiyuan Wang, Xu Han, Lijie Wu, Yutao Hou, and Lichao Wang. 2023. O-edit: Orthogonal subspace editing for language model sequential editing. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 13144–13156. find
  32. Chen Wu, Ruqing Zhang, Jiafeng Guo, Wei Chen, Yixing Fan, Maarten de Rijke, and Xueqi Cheng. 2022. Certified robustness to word substitution ranking attack for neural ranking models. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management, pages 2128–2137. find
  33. Chen Wu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2023. Prada: Practical black-box adversarial attacks against neural ranking models. ACM Transactions on Information Systems, 41(4):Article 89. find
  34. Long Xia, Jun Xu, Yanyan Lan, Jiafeng Guo, and Xueqi Cheng. 2015. Learning maximal marginal relevance model via directly optimizing diversity evaluation measures. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pages 113–122. find
  35. Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. 2021. Approximate nearest neighbor negative contrastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808.
  36. Ming Yan, Chenliang Li, Bin Bi, Wei Wang, and Songfang Huang. 2021. A unified pretraining framework for passage ranking and expansion. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 4555–4563. find
  37. Peilin Yang, Hui Fang, and Jimmy Lin. 2018. Anserini: Reproducible ranking baselines using lucene. Journal of Data and Information Quality (JDIQ), 10(4):1– 20. find
  38. Zeping Yu and Sophia Ananiadou. 2025. Understanding and mitigating gender bias in llms via interpretable neuron editing. arXiv preprint arXiv:2501.14457. — [arXiv:2501.14457](https://arxiv.org/abs/2501.14457) find
  39. Jingtao Zhan, Jiaxin Mao, Yiqun Liu, Jiafeng Guo, Min Zhang, and Shaoping Ma. 2021. Optimizing dense retrieval model training with hard negatives. Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-stop-hardening-everything-training-free/