Contextual ranking models based on BERT are now well established for a wide range of passage and document ranking tasks. However, the robustness of BERT-based ranking models under adversarial inputs is under-explored. In this paper, we argue that BERT-rankers are not immune to adversarial attacks targeting retrieved documents given a query. Firstly, we propose algorithms for adversarial perturbation of both highly relevant and non-relevant documents using gradient-based optimization methods. The aim of our algorithms is to add/replace a small number of tokens to a highly relevant or non-relevant document to cause a large rank demotion or promotion. Our experiments show that a small number of tokens can already result in a large change in the rank of a document. Moreover, we find that BERT-rankers heavily rely on the document start/head for relevance prediction, making the initial part of the document more susceptible to adversarial attacks. More interestingly, we find a small set of recurring adversarial words that when added to documents result in successful rank demotion/promotion of any relevant/non-relevant document respectively. Finally, our adversarial tokens also show particular topic preferences within and across datasets, exposing potential biases from BERT pre-training or downstream datasets.

Abstract: An automatic particle imaging velocimetry (Auto-PIV) measuring technique was developed based on the external triggering and automatic control technology. Measurements of the DrivAer model wake were performed using Auto-PIV in the spanwise and vertical direction. Three-dimensional time-averaged velocity distribution was reconstructed and the spatial distribution of the large coherent structures was described. The results indicate that regions with high velocity fluctuations mainly locate at the shear layer of the upper and lower edge of the recirculation bubble. Further proper orthogonal decomposition results show that the velocity fluctuations account for a very little proportion of kinetic energy compared with the time-averaged velocity, supporting that the DrivAer model has steady aerodynamic characteristics. The smooth outlines of the DrivAer notchback model can delay the flow separation on the top and the C-pillar of the model, which inhibits the formation of the back recirculation bubble at the rear window and reduces the size of the recirculation bubble behind the baggage compartment. These promote the pressure recovery at the rear of the DrivAer notchback model, and thus reduces the pressure drag. At the rear of the model, the airflow on both sides converges towards the center due to the pressure difference, producing the streamwise vorticity by shearing the baggage compartment, then separates at the rear of the baggage compartment and generates a pair of secondary vortices. Overall, the aerodynamic behavior of the DrivAer model is robust. Graphic abstract: [Figure not available: see fulltext.]