Toward Mitigating Adversarial Texts

Abstract

Neural networks are frequently used for text classification, but can be vulnerable to misclassification caused by adversarial examples: input produced by introducing small perturbations that cause the neural network to output an incorrect classification. Previous attempts to generate black-box adversarial texts have included variations of generating nonword misspellings, natural noise, synthetic noise, along with lexical substitutions. This paper proposes a defense against black-box adversarial attacks using a spell-checking system that utilizes frequency and contextual information for correction of nonword misspellings. The proposed defense is evaluated on the Yelp Reviews Polarity and the Yelp Reviews Full datasets using adversarial texts generated by a variety of recent attacks. After detecting and recovering the adversarial texts, the proposed defense increases the classification accuracy by an average of 26.56% on the Yelp Reviews Polarity dataset and 16.27% on the Yelp Reviews Full dataset. This approach further outperforms six of the publicly available, state-of-the-art spelling correction tools by at least 25.56% in terms of average correction accuracy.

Generalization to Mitigate Synonym Substitution Attacks

“…(2) The Bi-LSTM model is more vulnerable to the two attacks than the CNN model by a 12.45% accuracy difference on average. This supports the conclusion from previous research that, in the NLP domain, deep CNNs tend to be more robust than RNN models (Ren et al, 2019;Alshemali and Kalita, 2019 Table 3: The accuracy of the nonneural classification models under adversarial attacks, with and without the defense applied. Percent Increase is the percent increase of the classification accuracy with the defense applied.…”

“That Is a Suspicious Reaction!”: Interpreting Logits Variation to Detect NLP Adversarial Attacks

“…Defenses based on spell and syntax checkers are successful against character-level text attacks (Pruthi et al, 2019;Wang et al, 2019;Alshemali and Kalita, 2019). In contrast, these solutions are not effective against word-level attacks preserving language correctness (Wang et al, 2019).…”

OCR post-correction for detecting adversarial text images

“…Following the methodology used in [2] to test the spellcheckers, we generated four types of adversarial text including our attack using a list of top 20 frequent words in the SMS dataset. We used the DeepWordBug method proposed by Gao et al [17] to generate three adversarial texts: (1) insertion: inserted one random character to the words (e.g., c*all), (2) deletion: we removed the second character (one was removed per word), and (3) swapping: we swapped the second and third characters in the word (one swap per word).…”

“…On the other hand, using spell checking algorithms is the most common defence method against character-level perturbation in NLP tasks [29]. Although spell checking methods could detect and correct errors or adversarial examples, they cannot be applied in all domains because their performance varies depending on the type of misspelling [2].…”