Why are expensive rankers more resilient to adversarial content than cheap ones?

This reads the question as: does paying for a heavier ranking model make it harder to fool with adversarial or poisoned inputs? The honest answer from the corpus is that capability and resilience don't move together as cleanly as you'd hope — and in several cases the expensive model is the *more* exposed one.

The clearest counter-evidence is that cheap attacks transfer upward. Query-agnostic adversarial triggers — semantically irrelevant text appended to an input — were discovered on small, cheap models and then transferred effectively to stronger ones, inflating error rates by up to 300% How vulnerable are reasoning models to irrelevant text?. The expensive model didn't shrug them off; it inherited the weakness. Worse, when the 'expensive' ranker is a reasoning model, the extra chain-of-thought becomes extra surface area: manipulative multi-turn prompts drop reasoning-model accuracy 25–29%, because every additional step is another point where a single corrupted inference propagates into a confident wrong answer Are reasoning models actually more vulnerable to manipulation?. More compute can mean more places to be misled, not fewer.

The same trap shows up with LLM-as-judge rankers, which are the priciest scorers of all. They systematically reward fake citations and rich formatting independent of content quality, and these biases are exploitable with zero model access — no gradients, no internals, just a well-formatted bluff Can LLM judges be tricked without accessing their internals?. An expensive judge can be gamed precisely because it's pattern-matching on the surface cues that signal 'good answer.' Resilience here isn't bought with model size; it's bought with structure — for example, using rubrics as accept/reject *gates* on whole rollouts rather than as dense scores, which removes the smooth signal an attacker climbs Can rubrics and dense rewards work together without hacking?.

Where expensive rankers genuinely do better, it tends to trace to two things that are separable from raw cost. First, broader training exposure: Walmart's distilled BERT cross-encoders actually *exceeded* their LLM teachers once trained on enough augmented data, because the wider input distribution smoothed by teacher labels generalized better Can smaller models outperform their LLM teachers with enough data? — meaning robustness came from data coverage, and a cheaper student captured it. Second, architectural defenses bolted onto the ranking pipeline rather than the model: partition-aware retrieval and token-masking catch RAG corpus poisoning at retrieval time with no retraining and no bigger model Can we defend RAG systems from corpus poisoning without retraining?, and explicit selection-bias modeling (a position tower) stops a ranker from amplifying its own corrupted feedback loop Why do ranking systems need to model selection bias explicitly?.

The thing worth taking away: 'expensive' rankers look more resilient mostly when their cost coincides with broader data exposure or explicit anti-adversarial structure — not when it's just more parameters or longer reasoning. Strip those away and the heavy model can be *less* robust, because longer inference and surface-cue scoring give an attacker more handholds. Cheap, well-placed defenses at the retrieval and gating layer often buy more resilience per dollar than a bigger scorer does Can simple uncertainty estimates beat complex adaptive retrieval?.