Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment

Abstract

Machine learning algorithms are often vulnerable to adversarial examples that have imperceptible alterations from the original counterparts but can fool the state-of-the-art models. It is helpful to evaluate or even improve the robustness of these models by exposing the maliciously crafted adversarial examples. In this paper, we present TextFooler, a simple but strong baseline to generate natural adversarial text. By applying it to two fundamental natural language tasks, text classification and textual entailment, we successfully attacked three target models, including the powerful pre-trained BERT, and the widely used convolutional and recurrent neural networks. We demonstrate the advantages of this framework in three ways: (1) effective---it outperforms state-of-the-art attacks in terms of success rate and perturbation rate, (2) utility-preserving---it preserves semantic content and grammaticality, and remains correctly classified by humans, and (3) efficient---it generates adversarial text with computational complexity linear to the text length. *The code, pre-trained target models, and test examples are available at https://github.com/jind11/TextFooler.

arXiv commentAAAI 2020 (Oral)

References in corpus (14)

• Universal Sentence Encoder
• Enhanced LSTM for Natural Language Inference
• Convolutional Neural Networks for Sentence Classification
• Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales
• Understanding Neural Networks through Representation Erasure
• Generating Natural Adversarial Examples
• A large annotated corpus for learning natural language inference
• Deep Text Classification Can be Fooled
• Adversarial Machine Learning at Scale
• Pathologies of Neural Models Make Interpretations Difficult
• Variational Approaches for Auto-Encoding Generative Adversarial Networks
• HotFlip: White-Box Adversarial Examples for Text Classification
• Probing Neural Network Comprehension of Natural Language Arguments
• SALSA-TEXT : self attentive latent space based adversarial text generation

Cited by in corpus (30)

• BAE: BERT-based Adversarial Examples for Text Classification
• Deep Learning Based Text Classification: A Comprehensive Review
• Reevaluating Adversarial Examples in Natural Language
• It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbations
• Adversarial Training for Large Neural Language Models
• Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks
• Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models
• On Adversarial Examples for Biomedical NLP Tasks
• Learning to Attack: Towards Textual Adversarial Attacking in Real-world Situations
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• SPARK: Spatial-aware Online Incremental Attack Against Visual Tracking
• T3: Tree-Autoencoder Constrained Adversarial Text Generation for Targeted Attack
• Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrifice
• Preserving Semantics in Textual Adversarial Attacks
• Linguistically-Informed Transformations (LIT): A Method for Automatically Generating Contrast Sets
• On Robustness and Bias Analysis of BERT-based Relation Extraction
• How to Select One Among All? An Extensive Empirical Study Towards the Robustness of Knowledge Distillation in Natural Language Understanding
• Targeted Adversarial Training for Natural Language Understanding
• Disentangled Contrastive Learning for Learning Robust Textual Representations
• Smoothed Inference for Adversarially-Trained Models
• Enhancing Pre-trained Language Model with Lexical Simplification
• Robustness to Modification with Shared Words in Paraphrase Identification
• FireBERT: Hardening BERT-based classifiers against adversarial attack
• Adversarial Examples Generation for Reducing Implicit Gender Bias in Pre-trained Models
• Multi-hop Graph Convolutional Network with High-order Chebyshev Approximation for Text Reasoning
• Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption
• GiBERT: Introducing Linguistic Knowledge into BERT through a Lightweight Gated Injection Method
• Understanding in Artificial Intelligence
• On Intrinsic Dataset Properties for Adversarial Machine Learning
• What's in a Name? Are BERT Named Entity Representations just as Good for any other Name?