Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey

Abstract

With the development of high computational devices, deep neural networks (DNNs), in recent years, have gained significant popularity in many Artificial Intelligence (AI) applications. However, previous efforts have shown that DNNs were vulnerable to strategically modified samples, named adversarial examples. These samples are generated with some imperceptible perturbations but can fool the DNNs to give false predictions. Inspired by the popularity of generating adversarial examples for image DNNs, research efforts on attacking DNNs for textual applications emerges in recent years. However, existing perturbation methods for images cannotbe directly applied to texts as text data is discrete. In this article, we review research works that address this difference and generatetextual adversarial examples on DNNs. We collect, select, summarize, discuss and analyze these works in a comprehensive way andcover all the related information to make the article self-contained. Finally, drawing on the reviewed literature, we provide further discussions and suggestions on this topic.

40

References in corpus (41)

• Auto-Encoding Variational Bayes
• Distilling the Knowledge in a Neural Network
• Sequence to Sequence Learning with Neural Networks
• Show, Attend and Tell: Neural Image Caption Generation with Visual Attention
• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Bidirectional Attention Flow for Machine Comprehension
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Recent Trends in Deep Learning Based Natural Language Processing
• Enhanced LSTM for Natural Language Inference
• Convolutional Neural Networks for Sentence Classification
• VQA: Visual Question Answering
• Character-Aware Neural Language Models
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales
• Reasoning about Entailment with Neural Attention
• Generating Natural Adversarial Examples
• Deep Reinforcement Learning for Dialogue Generation
• Deep Text Classification Can be Fooled
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Microsoft Malware Classification Challenge
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Adversarial Training Methods for Semi-Supervised Text Classification
• On Adversarial Examples for Character-Level Neural Machine Translation
• Towards Crafting Text Adversarial Samples
• Motivating the Rules of the Game for Adversarial Example Research
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Adversarial Texts with Gradient Methods
• Provable limitations of deep learning
• Adversarial Deep Learning for Robust Detection of Binary Encoded Malware
• Interpretable Adversarial Perturbation in Input Embedding Space for Text
• Fooling OCR Systems with Adversarial Text Images
• An attentive neural architecture for joint segmentation and parsing and its application to real estate ads
• Greedy Attack and Gumbel Attack: Generating Adversarial Examples for Discrete Data
• Learning Visually-Grounded Semantics from Contrastive Adversarial Samples
• DANCin SEQ2SEQ: Fooling Text Classifiers with Adversarial Text Example Generation
• Adversarial Reprogramming of Neural Networks
• Metamorphic Relation Based Adversarial Attacks on Differentiable Neural Computer
• Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
• Adaptive Adversarial Attack on Scene Text Recognition

Cited by in corpus (38)

• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• A survey on text generation using generative adversarial networks
• It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbations
• Semantic Robustness of Models of Source Code
• The Universal Approximation Property
• OpenAttack: An Open-source Textual Adversarial Attack Toolkit
• Shilling Black-box Recommender Systems by Learning to Generate Fake User Profiles
• A Survey on State-of-the-art Deep Learning Applications and Challenges
• Characterizing the Decision Boundary of Deep Neural Networks
• Backdoors in Neural Models of Source Code
• Deep Interest Highlight Network for Click-Through Rate Prediction in Trigger-Induced Recommendation
• Natural Language Adversarial Defense through Synonym Encoding
• "That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks
• Beyond Leaderboards: A survey of methods for revealing weaknesses in Natural Language Inference data and models
• Chat as Expected: Learning to Manipulate Black-box Neural Dialogue Models
• Generating Natural Language Adversarial Examples on a Large Scale with Generative Models
• All in How You Ask for It: Simple Black-Box Method for Jailbreak Attacks
• Interpretability is a Kind of Safety: An Interpreter-based Ensemble for Adversary Defense
• Certified Robustness to Word Substitution Ranking Attack for Neural Ranking Models
• Towards Understanding Neural Machine Translation with Word Importance
• On Adversarial Examples for Biomedical NLP Tasks
• A Visual Analytics Framework for Adversarial Text Generation
• Generating Universal Adversarial Perturbations for Quantum Classifiers
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Stress Test Evaluation of Biomedical Word Embeddings
• TAPE: Assessing Few-shot Russian Language Understanding
• Preserving Semantics in Textual Adversarial Attacks
• NLP Verification: Towards a General Methodology for Certifying Robustness
• Numerical Stability of DeepGOPlus Inference
• AF2-Mutation: Adversarial Sequence Mutations against AlphaFold2 on Protein Tertiary Structure Prediction
• Contrastive Fine-tuning Improves Robustness for Neural Rankers
• Deceptive Deletions for Protecting Withdrawn Posts on Social Platforms
• R&R: Metric-guided Adversarial Sentence Generation
• Hierarchical Text Classification Using Contrastive Learning Informed Path Guided Hierarchy
• Risk Management Framework for Machine Learning Security
• Gödel's Sentence Is An Adversarial Example But Unsolvable
• Adversarial Attacks on Deep Models for Financial Transaction Records
• Robustness to Programmable String Transformations via Augmented Abstract Training