Gradient-based Adversarial Attacks against Text Transformers
arXiv:2104.13733
Abstract
We propose the first general-purpose gradient-based attack against transformer models. Instead of searching for a single adversarial example, we search for a distribution of adversarial examples parameterized by a continuous-valued matrix, hence enabling gradient-based optimization. We empirically demonstrate that our white-box attack attains state-of-the-art attack performance on a variety of natural language tasks. Furthermore, we show that a powerful black-box transfer attack, enabled by sampling from the adversarial distribution, matches or exceeds existing methods, while only requiring hard-label outputs.
References in corpus (8)
- Distributed Representations of Words and Phrases and their Compositionality
- Categorical Reparameterization with Gumbel-Softmax
- BERTScore: Evaluating Text Generation with BERT
- Adversarial Attacks on Neural Networks for Graph Data
- BAE: BERT-based Adversarial Examples for Text Classification
- Towards Crafting Text Adversarial Samples
- Reevaluating Adversarial Examples in Natural Language
- Universal Adversarial Attacks with Natural Triggers for Text Classification