Word-level Textual Adversarial Attacking as Combinatorial Optimization
Word-level Textual Adversarial Attacking as Combinatorial Optimization
复制标题
DOI：
10.18653/v1/2020.acl-main.540
复制
发表时间：
2019-10
期刊：
影响因子：
--
通讯作者：
Yuan Zang;Fanchao Qi;Chenghao Yang;Zhiyuan Liu;Meng Zhang;Qun Liu;Maosong Sun
中科院分区：
文献类型：
--
作者：
Yuan Zang;Fanchao Qi;Chenghao Yang;Zhiyuan Liu;Meng Zhang;Qun Liu;Maosong Sun
进行对抗性攻击是为了揭示深层神经网络的脆弱性。文本对抗性攻击具有挑战性，因为文本是离散的，小的扰动可能会给原始输入带来重大变化。词级攻击可以看作是一个组合优化问题，是一类经过充分研究的文本攻击方法。然而，现有的词级攻击模型远非完美，很大程度上是因为采用了不合适的搜索空间缩减方法和低效的优化算法。在本文中，我们提出了一种新颖的攻击模型，该模型结合了基于义原的单词替换方法和基于粒子群优化的搜索算法来分别解决这两个问题。我们通过在三个基准数据集上攻击 BiLSTM 和 BERT 进行详尽的实验来评估我们的攻击模型。实验结果表明，与基线方法相比，我们的模型始终能够实现更高的攻击成功率，并制作出更多高质量的对抗性示例。此外，进一步的实验表明我们的模型具有更高的可迁移性，并且可以通过对抗性训练为受害者模型带来更多的鲁棒性增强。本文的所有代码和数据都可以在https://github.com/thunlp/SememePSO-Attack上获取。
Adversarial attacks are carried out to reveal the vulnerability of deep neural networks. Textual adversarial attacking is challenging because text is discrete and a small perturbation can bring significant change to the original input. Word-level attacking, which can be regarded as a combinatorial optimization problem, is a well-studied class of textual attack methods. However, existing word-level attack models are far from perfect, largely because unsuitable search space reduction methods and inefficient optimization algorithms are employed. In this paper, we propose a novel attack model, which incorporates the sememe-based word substitution method and particle swarm optimization-based search algorithm to solve the two problems separately. We conduct exhaustive experiments to evaluate our attack model by attacking BiLSTM and BERT on three benchmark datasets. Experimental results demonstrate that our model consistently achieves much higher attack success rates and crafts more high-quality adversarial examples as compared to baseline methods. Also, further experiments show our model has higher transferability and can bring more robustness enhancement to victim models by adversarial training. All the code and data of this paper can be obtained on https://github.com/thunlp/SememePSO-Attack.