Word-level Textual Adversarial Attacking as Combinatorial Optimization

Abstract

Adversarial attacks are carried out to reveal the vulnerability of deep neural networks. Textual adversarial attacking is challenging because text is discrete and a small perturbation can bring significant change to the original input. Word-level attacking, which can be regarded as a combinatorial optimization problem, is a well-studied class of textual attack methods. However, existing word-level attack models are far from perfect, largely because unsuitable search space reduction methods and inefficient optimization algorithms are employed. In this paper, we propose a novel attack model, which incorporates the sememe-based word substitution method and particle swarm optimization-based search algorithm to solve the two problems separately. We conduct exhaustive experiments to evaluate our attack model by attacking BiLSTM and BERT on three benchmark datasets. Experimental results demonstrate that our model consistently achieves much higher attack success rates and crafts more high-quality adversarial examples as compared to baseline methods. Also, further experiments show our model has higher transferability and can bring more robustness enhancement to victim models by adversarial training. All the code and data of this paper can be obtained on https://github.com/thunlp/SememePSO-Attack.

Accepted at ACL 2020 as a long paper (a typo is corrected as compared with the official conference camera-ready version). 16 pages, 3 figures

Cited by in corpus (15)

• Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors
• Adversarial Robustness of Deep Code Comment Generation
• Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks
• Adversarial Reinforced Instruction Attacker for Robust Vision-Language Navigation
• Improving Sequence Modeling Ability of Recurrent Neural Networks via Sememes
• Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks
• ShortcutLens: A Visual Analytics Approach for Exploring Shortcuts in Natural Language Understanding Dataset
• Silent Guardian: Protecting Text from Malicious Exploitation by Large Language Models
• AED: An black-box NLP classifier model attacker
• Adversary for Social Good: Leveraging Adversarial Attacks to Protect Personal Attribute Privacy
• Towards Robust Domain Generation Algorithm Classification
• Verifying the Robustness of Automatic Credibility Assessment
• A Modified Word Saliency-Based Adversarial Attack on Text Classification Models
• Targeted Adversarial Traffic Generation : Black-box Approach to Evade Intrusion Detection Systems in IoT Networks
• Reducing and Exploiting Data Augmentation Noise through Meta Reweighting Contrastive Learning for Text Classification