Adversarial Stylometry in the Wild: Transferable Lexical Substitution Attacks on Author Profiling
arXiv:2101.11310
Abstract
Written language contains stylistic cues that can be exploited to automatically infer a variety of potentially sensitive author information. Adversarial stylometry intends to attack such models by rewriting an author's text. Our research proposes several components to facilitate deployment of these adversarial attacks in the wild, where neither data nor target models are accessible. We introduce a transformer-based extension of a lexical replacement attack, and show it achieves high transferability when trained on a weakly labeled corpus -- decreasing target model performance below chance. While not completely inconspicuous, our more successful attacks also prove notably less detectable by humans. Our framework therefore provides a promising direction for future privacy-preserving adversarial attacks.
arXiv commentAccepted to EACL 2021
References in corpus (6)
- Scikit-learn: Machine Learning in Python
- PyTorch: An Imperative Style, High-Performance Deep Learning Library
- Deep Learning with Differential Privacy
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Deep Text Classification Can be Fooled
- When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries