Towards a Robust Deep Neural Network in Texts: A Survey

Abstract

Deep neural networks (DNNs) have achieved remarkable success in various tasks (e.g., image classification, speech recognition, and natural language processing (NLP)). However, researchers have demonstrated that DNN-based models are vulnerable to adversarial examples, which cause erroneous predictions by adding imperceptible perturbations into legitimate inputs. Recently, studies have revealed adversarial examples in the text domain, which could effectively evade various DNN-based text analyzers and further bring the threats of the proliferation of disinformation. In this paper, we give a comprehensive survey on the existing studies of adversarial techniques for generating adversarial texts written by both English and Chinese characters and the corresponding defense methods. More importantly, we hope that our work could inspire future studies to develop more robust DNN-based text analyzers against known and unknown adversarial techniques. We classify the existing adversarial techniques for crafting adversarial texts based on the perturbation units, helping to better understand the generation of adversarial texts and build robust models for defense. In presenting the taxonomy of adversarial attacks and defenses in the text domain, we introduce the adversarial techniques from the perspective of different NLP tasks. Finally, we discuss the existing challenges of adversarial attacks and defenses in texts and present the future research directions in this emerging and challenging field.

References in corpus (59)

• Efficient Estimation of Word Representations in Vector Space
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Sequence to Sequence Learning with Neural Networks
• WaveNet: A Generative Model for Raw Audio
• Convolutional Sequence to Sequence Learning
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• MesoNet: a Compact Facial Video Forgery Detection Network
• Bidirectional Attention Flow for Machine Comprehension
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Enhanced LSTM for Natural Language Inference
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• VQA: Visual Question Answering
• Character-Aware Neural Language Models
• NAIS: Neural Attentive Item Similarity Model for Recommendation
• On Evaluating Adversarial Robustness
• BAE: BERT-based Adversarial Examples for Text Classification
• Robust Physical-World Attacks on Deep Learning Models
• Generating Natural Adversarial Examples
• A large annotated corpus for learning natural language inference
• Machine Comprehension Using Match-LSTM and Answer Pointer
• Deep Reinforcement Learning for Dialogue Generation
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Deep Text Classification Can be Fooled
• Adversarial Examples Are Not Bugs, They Are Features
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Adversarial Feature Selection against Evasion Attacks
• Adversarial Examples: Opportunities and Challenges
• Natural Language Inference over Interaction Space
• Robust Audio Adversarial Example for a Physical Attack
• On Adversarial Examples for Character-Level Neural Machine Translation
• Towards Crafting Text Adversarial Samples
• Motivating the Rules of the Game for Adversarial Example Research
• Deceiving Google's Perspective API Built for Detecting Toxic Comments
• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• Biologically inspired protection of deep networks from adversarial attacks
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Understanding and Enhancing the Transferability of Adversarial Examples
• Adversarial Examples for Semantic Segmentation and Object Detection
• It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbations
• Training verified learners with learned verifiers
• Adversarial Texts with Gradient Methods
• Boosting Adversarial Attacks with Momentum
• POPQORN: Quantifying Robustness of Recurrent Neural Networks
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Learning a Natural Language Interface with Neural Programmer
• Robustness Verification for Transformers
• Concolic Testing for Deep Neural Networks
• Cross-Entropy Loss and Low-Rank Features Have Responsibility for Adversarial Examples
• Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks
• Knowledge Enhanced Attention for Robust Natural Language Inference
• Generating Adversarial Examples in Chinese Texts Using Sentence-Pieces
• A Visual Analytics Framework for Adversarial Text Generation
• Towards Evaluating the Robustness of Chinese BERT Classifiers
• ATMPA: Attacking Machine Learning-based Malware Visualization Detection Methods via Adversarial Examples
• Adversarial-Playground: A Visualization Suite Showing How Adversarial Examples Fool Deep Learning
• Generating Natural Language Attacks in a Hard Label Black Box Setting
• A Gradient Tree Boosting based Approach to Rumor Detecting on Sina Weibo

Cited by in corpus (12)

• Explaining Deep Neural Networks
• Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification
• Adversarial Attacks and Defense on Texts: A Survey
• To Transfer or Not to Transfer: Misclassification Attacks Against Transfer Learned Text Classifiers
• One word at a time: adversarial attacks on retrieval models
• Generating Natural Language Adversarial Examples through An Improved Beam Search Algorithm
• Efficient Combinatorial Optimization for Word-level Adversarial Textual Attack
• Transformer-based Language Model Fine-tuning Methods for COVID-19 Fake News Detection
• DuTrust: A Sentiment Analysis Dataset for Trustworthiness Evaluation
• Android Security using NLP Techniques: A Review
• FireBERT: Hardening BERT-based classifiers against adversarial attack
• Adversarial Attacks on Deep Models for Financial Transaction Records