Efficient Combinatorial Optimization for Word-Level Adversarial Textual Attack

Liu, Shengcai; Lu, Ning; Chen, Cheng; Tang, Ke

doi:10.1109/taslp.2021.3130970

Cited by 22 publications

(9 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zang et al 13 adopt a particle swarm optimization algorithm to search for possible perturbations, which are obtained by substituting the synonyms with the same sememe of the original word. Liu et al 14 utilize a local search algorithm to search for possible perturbations, which are generated by substituting the synonyms from the WordNet, HowNet, or word embedding space, and so on. Jin et al 33 propose a strong baseline by ranking words based on the logit output of the target model on the gold label and replacing them with synonyms from a semantically enhanced embedding 50 in a greedy way.…”

Section: Related Workmentioning

confidence: 99%

“…The discrete nature of texts leads to that the adversarial attacks of texts are more challenging than the ones of image and speech. The existing textual adversarial attacks can be roughly divided into three types according to the attack granularity, namely charlevel, [6][7][8][9][10][11] word-level, [12][13][14][15][16][17][18][19][20][21][22][23] and sentence-level. [24][25][26][27][28][29][30] The methods belonging to each type can be further divided into two categories: white-box and black-box.…”

Section: Introductionmentioning

confidence: 99%

“…The majority of the existing word-level black-box methods generally adopt a two-step process to generate adversarial examples. 13,14 Given an original text, in the first step these methods construct a set of alternative words for each word of the original text. To preserve the text semantic, they usually generate synonyms of a word as the word's alternative words.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Textual adversarial attacks by exchanging text‐self words

Liu

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Adversarial attacks expose the vulnerability of deep neural networks. Compared to image adversarial attacks, textual adversarial attacks are more challenging due to the discrete nature of texts. Recent synonym‐based methods achieve the current state‐of‐the‐art results. However, these methods introduce new words against the original text, leading to that humans easily perceive the difference between the adversarial example and the original text. Motivated by the fact that humans are usually unaware of chaotic word order in some cases, we propose exchange‐attack (EA), a concise and effective word‐level textual adversarial attack model. Specifically, the EA model generates adversarial examples by exchanging words of the original text itself according to the contributions that these words make regarding classification results. Intuitively, the smaller the distance between the two exchanged words, the more difficult the chaotic word order to be perceived by humans. We thus take the word distance into consideration when generating the chaotic word orders. Extensive experiments on several text classification data sets show that the EA model consistently outperforms the selected baselines in terms of averaged after‐attack accuracy, modification rate, query number, and semantic similarity. And human evaluation results reveal that humans difficultly perceive the adversarial examples generated by the EA model. In addition, quantitative and qualitative analyses further validate the effectiveness of the EA model, including that the generated adversarial examples are grammatically correct and semantically preserved.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Textual adversarial attacks by exchanging text‐self words

Liu

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

show abstract

“…Score-based attacks leverage the prediction probabilities of the target model to guide the search over the space of adversarial examples. Specifically, they are mostly based on wordlevel substitution [7]- [12], [20], [21] that crafts adversarial examples by replacing words in the original input, which can be formulated as a combinatorial optimization problem. Previous studies have used various methods to solve this problem, including population-based search algorithms [7], [10], greedy algorithm [8], [9], [11], [12], and Metropolis-Hastings sampling [20].…”

Section: Related Workmentioning

confidence: 99%

HydraText: Multi-objective Optimization for Adversarial Textual Attack

Liu¹,

Lu²,

Chen³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

The field of adversarial textual attack has significantly grown over the last years, where the commonly considered objective is to craft adversarial examples that can successfully fool the target models. However, the imperceptibility of attacks, which is also an essential objective, is often left out by previous studies. In this work, we advocate considering both objectives at the same time, and propose a novel multi-optimization approach (dubbed HydraText) with provable performance guarantee to achieve successful attacks with high imperceptibility. We demonstrate the efficacy of HydraText through extensive experiments under both score-based and decision-based settings, involving five modern NLP models across five benchmark datasets. In comparison to existing state-of-the-art attacks, HydraText consistently achieves simultaneously higher success rates, lower modification rates, and higher semantic similarity to the original texts. A human evaluation study shows that the adversarial examples crafted by HydraText maintain validity and naturality well. Finally, these examples also exhibit good transferability and can bring notable robustness improvement to the target models by adversarial training.

show abstract

“…Deep neural networks (DNNs) have achieved significant progress in wide applications, such as image classification [9], face recognition [27], object detection [28], speech recognition [14] and machine translation [3]. Despite their success, deep learning models have exhibited vulnerability to adversarial attacks [12,20,21,36]. Crafted by adding some small perturbations to benign inputs, adversarial examples (AEs) can fool DNNs into making wrong predictions, which is a critical threat especially for some security-sensitive scenarios such as autonomous driving [34].…”

Section: Introductionmentioning

confidence: 99%

Saliency Attack: Towards Imperceptible Black-box Adversarial Attack

Dai¹,

Liu²,

Tang³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Deep neural networks are vulnerable to adversarial examples, even in the black-box setting where the attacker is only accessible to the model output. Recent studies have devised effective black-box attacks with high query efficiency. However, such performance is often accompanied by compromises in attack imperceptibility, hindering the practical use of these approaches. In this paper, we propose to restrict the perturbations to a small salient region to generate adversarial examples that can hardly be perceived. This approach is readily compatible with many existing black-box attacks and can significantly improve their imperceptibility with little degradation in attack success rate. Further, we propose the Saliency Attack, a new black-box attack aiming to refine the perturbations in the salient region to achieve even better imperceptibility. Extensive experiments show that compared to the state-of-the-art black-box attacks, our approach achieves much better imperceptibility scores, including most apparent distortion (MAD), 𝐿 0 and 𝐿 2 distances, and also obtains significantly higher success rates judged by a human-like threshold on MAD. Importantly, the perturbations generated by our approach are interpretable to some extent. Finally, it is also demonstrated to be robust to different detection-based defenses.

show abstract

Efficient Combinatorial Optimization for Word-Level Adversarial Textual Attack

Cited by 22 publications

References 33 publications

Textual adversarial attacks by exchanging text‐self words

Textual adversarial attacks by exchanging text‐self words

HydraText: Multi-objective Optimization for Adversarial Textual Attack

Saliency Attack: Towards Imperceptible Black-box Adversarial Attack

Contact Info

Product

Resources

About