Greedy Attack and Gumbel Attack: Generating Adversarial Examples for Discrete Data
arXiv:1805.12316
Abstract
We present a probabilistic framework for studying adversarial attacks on discrete data. Based on this framework, we derive a perturbation-based method, Greedy Attack, and a scalable learning-based method, Gumbel Attack, that illustrate various tradeoffs in the design of attacks. We demonstrate the effectiveness of these methods using both quantitative metrics and human evaluation on various state-of-the-art models for text classification, including a word-based CNN, a character-based CNN and an LSTM. As as example of our results, we show that the accuracy of character-based convolutional networks drops to the level of random selection by modifying only five characters through Greedy Attack.
arXiv commentThe first two authors contributed equally
References in corpus (8)
- Explaining and Harnessing Adversarial Examples
- Categorical Reparameterization with Gumbel-Softmax
- The Concrete Distribution: A Continuous Relaxation of Discrete Random Variables
- Understanding Neural Networks through Representation Erasure
- Deep Text Classification Can be Fooled
- Adversarial Examples for Evaluating Reading Comprehension Systems
- Towards Crafting Text Adversarial Samples
- Visualizing and Understanding Neural Models in NLP
Cited by in corpus (7)
- Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey
- Learning to Explain: An Information-Theoretic Perspective on Model Interpretation
- Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
- BERT-ATTACK: Adversarial Attack Against BERT Using BERT
- Analysis Methods in Neural Language Processing: A Survey
- Robustness to Modification with Shared Words in Paraphrase Identification
- Natural Adversarial Sentence Generation with Gradient-based Perturbation