Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency
Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency
复制标题
DOI：
10.18653/v1/p19-1103
复制
发表时间：
2019-07
期刊：
影响因子：
--
通讯作者：
Shuhuai Ren;Yihe Deng;Kun He;Wanxiang Che
中科院分区：
文献类型：
--
作者：
Shuhuai Ren;Yihe Deng;Kun He;Wanxiang Che
我们解决了对文本分类的对抗性攻击问题，与对图像分类的攻击相比，这一问题很少被研究。这项任务的挑战是生成对抗性的例子，保持词汇正确性，语法正确性和语义相似性。在同义词替换策略的基础上，引入了一种由词显著性和分类概率共同决定的词替换顺序，并提出了一种基于概率加权词显著性（PWWS）的文本对抗攻击贪婪算法。使用卷积和LSTM模型在三个流行的数据集上进行的实验表明，PWWS在最大程度上降低了分类精度，并保持了非常低的单词替换率。一项人类评估研究表明，我们生成的对抗性示例很好地保持了语义相似性，并且很难被人类感知。使用我们的扰动数据集进行对抗训练可以提高模型的鲁棒性。最后，我们的方法也表现出良好的可移植性生成的对抗性的例子。
We address the problem of adversarial attacks on text classification, which is rarely studied comparing to attacks on image classification. The challenge of this task is to generate adversarial examples that maintain lexical correctness, grammatical correctness and semantic similarity. Based on the synonyms substitution strategy, we introduce a new word replacement order determined by both the word saliency and the classification probability, and propose a greedy algorithm called probability weighted word saliency (PWWS) for text adversarial attack. Experiments on three popular datasets using convolutional as well as LSTM models show that PWWS reduces the classification accuracy to the most extent, and keeps a very low word substitution rate. A human evaluation study shows that our generated adversarial examples maintain the semantic similarity well and are hard for humans to perceive. Performing adversarial training using our perturbed datasets improves the robustness of the models. At last, our method also exhibits a good transferability on the generated adversarial examples.