HotFlip: White-Box Adversarial Examples for Text Classification
HotFlip: White-Box Adversarial Examples for Text Classification
复制标题
DOI：
10.18653/v1/p18-2006
复制
发表时间：
2017-12
期刊：
影响因子：
--
通讯作者：
J. Ebrahimi;Anyi Rao;Daniel Lowd;D. Dou
中科院分区：
文献类型：
--
作者：
J. Ebrahimi;Anyi Rao;Daniel Lowd;D. Dou
我们提出了一种有效的生成白盒对抗性样本的方法来欺骗字符级别的神经分类器。我们发现，只需要几次操作就可以大大降低精度。我们的方法依赖于原子翻转操作，该操作基于一热输入向量的梯度将一个令牌交换为另一个令牌。由于该方法的有效性，我们可以进行对抗性训练，使模型在测试时对攻击具有更强的鲁棒性。通过使用一些保持语义的约束，我们证明了HotFlip也可以用于攻击词级分类器。
We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the one-hot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well.