Universal Adversarial Perturbation for Text Classification
arXiv:1910.04618
Abstract
Given a state-of-the-art deep neural network text classifier, we show the existence of a universal and very small perturbation vector (in the embedding space) that causes natural text to be misclassified with high probability. Unlike images on which a single fixed-size adversarial perturbation can be found, text is of variable length, so we define the "universality" as "token-agnostic", where a single perturbation is applied to each token, resulting in different perturbations of flexible sizes at the sequence level. We propose an algorithm to compute universal adversarial perturbations, and show that the state-of-the-art deep neural networks are highly vulnerable to them, even though they keep the neighborhood of tokens mostly preserved. We also show how to use these adversarial perturbations to generate adversarial text samples. The surprising existence of universal "token-agnostic" adversarial perturbations may reveal important properties of a text classifier.
References in corpus (11)
- Adam: A Method for Stochastic Optimization
- GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding
- Deep Text Classification Can be Fooled
- Adversarial Perturbations Against Deep Neural Networks for Malware Classification
- Adversarial Examples for Evaluating Reading Comprehension Systems
- Houdini: Fooling Deep Structured Prediction Models
- Fast Feature Fool: A data independent approach to universal adversarial perturbations
- HotFlip: White-Box Adversarial Examples for Text Classification
- The Limitations of Deep Learning in Adversarial Settings
- Robustness of classifiers to universal perturbations: a geometric perspective
- Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models