TextBugger: Generating Adversarial Text Against Real-world Applications

Abstract

Deep Learning-based Text Understanding (DLTU) is the backbone technique behind various applications, including question answering, machine translation, and text classification. Despite its tremendous popularity, the security vulnerabilities of DLTU are still largely unknown, which is highly concerning given its increasing use in security-sensitive applications such as sentiment analysis and toxic content detection. In this paper, we show that DLTU is inherently vulnerable to adversarial text attacks, in which maliciously crafted texts trigger target DLTU systems and services to misbehave. Specifically, we present TextBugger, a general attack framework for generating adversarial texts. In contrast to prior works, TextBugger differs in significant ways: (i) effective -- it outperforms state-of-the-art attacks in terms of attack success rate; (ii) evasive -- it preserves the utility of benign text, with 94.9\% of the adversarial text correctly recognized by human readers; and (iii) efficient -- it generates adversarial text with computational complexity sub-linear to the text length. We empirically evaluate TextBugger on a set of real-world DLTU systems and services used for sentiment analysis and toxic content detection, demonstrating its effectiveness, evasiveness, and efficiency. For instance, TextBugger achieves 100\% success rate on the IMDB dataset based on Amazon AWS Comprehend within 4.61 seconds and preserves 97\% semantic similarity. We further discuss possible defense mechanisms to mitigate such attack and the adversary's potential countermeasures, which leads to promising directions for further research.

To appear in NDSS 2019

References in corpus (11)

• Explaining and Harnessing Adversarial Examples
• Character-level Convolutional Networks for Text Classification
• Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Adversarial Examples for Evaluating Reading Comprehension Systems
• Generating Adversarial Examples with Adversarial Networks
• Adversarial Training Methods for Semi-Supervised Text Classification
• Towards Crafting Text Adversarial Samples
• A Sensitivity Analysis of (and Practitioners' Guide to) Convolutional Neural Networks for Sentence Classification
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers

Cited by in corpus (17)

• Securing Connected & Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and The Way Forward
• Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors
• RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
• RECAST: Enabling User Recourse and Interpretability of Toxicity Detection Models with Interactive Visualization
• Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks
• Silent Guardian: Protecting Text from Malicious Exploitation by Large Language Models
• SSCAE -- Semantic, Syntactic, and Context-aware natural language Adversarial Examples generator
• Enhancing Robustness of AI Offensive Code Generators via Data Augmentation
• ASAT: Adaptively Scaled Adversarial Training in Time Series
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Towards Effective Paraphrasing for Information Disguise
• An Effective, Robust and Fairness-aware Hate Speech Detection Framework
• MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotion
• Preserving Semantics in Textual Adversarial Attacks
• NLP Verification: Towards a General Methodology for Certifying Robustness
• Adversarial Robustness through Dynamic Ensemble Learning
• Reducing and Exploiting Data Augmentation Noise through Meta Reweighting Contrastive Learning for Text Classification