SlowGuess/NAACL_2022_OCR huggingface dataset:
Moreover, we also simulate the trading profit and loss based on FinGRU and FinLSTM. For the sake of consistency, the two models are under concatenation attack with replacement perturbation. Same as our main results, the attack is optimized by JO solver. The simulation results are reported in Figure 5, which provides further evidence for the potential monetary loss caused by our adversarial attack. Replacement perturbation again outperforms deletion perturbation in the case of FinGRU and FinLSTM.
C.2 Effect of Iteration Number
We experiment with the optimizer to perform gradient descent or greedy search for up to 10 rounds before yielding the final solution. To visualize the effect of iteration, we plot the loss trajectory and ASR along with the optimization iterations in Figure 6. We also collect the average model loss of attack instances at each iteration, and then normalize the loss to set the initial loss as 1. Therefore, the loss trajectory visualization reveals the percentage loss drop during the optimization. We consider two different perturbations (replacement and deletion) under concatenation attacks. The attack is optimized with the JO solver.
The three charts on the first row of Figure 6 show that optimizations on all three victim models quickly converge after 4 iterations in our experiment. Accordingly, ASRs rise gradually during the first 4 iterations, but then flattens or even slides afterward. Such results suggest that our solvers can find the convergence in just a few iterations. Therefore, it makes our attack computationally effective, and insensitive to hyperparameter of iteration number.
D Regularization on Attack Loss.
The experiment results reported in the main text are generated with the sparsity regularization. We
Figure 6: Iteration number effect on prediction loss and attack success rate. The three plots on the first row show the loss trajectory during optimization for the three victim models, and the bottom row reports the ASRs trajectory. The legends for the bottom-row charts read as (tweet budget, word budget).
also run ablation experiments that remove sparsity regularization. The results are consistent with our conclusion. Furthermore, inspired by (Srikant et al., 2021), we try smoothing attack loss to stabilize the optimization. We add Gaussian noise to optimization variables and evaluate the attack 10 times. The loss average is then used as the final loss for backpropagation. The results show that loss smoothing does not contribute to attack performance in our experiment as it does in Srikant et al. (2021).
E Attack Word Analysis
To qualitatively understand what kinds of words and tweets are being selected in the perturbation and retweet, we compare our tweet corpus and the selected word replacements with 15 corpora of different genres in Brown corpus via Linguistic Inquiry and Word Count program (LIWC) (Tausczik and Pennebaker, 2010). As Brown corpus does not have a financial genre, we also use Financial Phrase Bank (Malo et al., 2014). We then run K-means clustering on these 18 corpora based on the feature matrix from LIWC. As shown in Figure 7, financial corpora (red), Brown general word corpus (green), and attack words (blue) are grouped into three clusters, indicating the inherent difference of those text genres. Moreover, we observe that target words identified by our solvers (red “tweet” and blue “attack words” dots) are closer to financial corpora than “random attack words”.
Figure 7: Corpora clusters. 18 corpora are grouped into 3 clusters based on features from LIWC. In order to visualize the clusters, principal component analysis is applied to the features to find the first 2 principal components, which are then used as x-axis and y-axis to generate this figure.
F Example of Adversarial Retweet
Table 3 reports 10 adversarial retweets generated in concatenation attack mode with JO and AGO solver and replacement perturbation. For all the examples, the victim model predicts positive outcomes originally, and but predicts negative outcomes after adding the adversarial retweet.
Adversarial Retweets Generated by AGO
Benign tweet: $BHP announces the demerger of its non-core assets - details expected to be filled in on Tuesday.
Adversarial retweet: $BHPannounces the demerger of its non-core assets - details expected to be exercised in on Tuesday
Benign tweet: Mover and Shakers... Losers- $KO $ABX $DD. Winners- $LAND $CHL $BHP.
Adversarial retweet: Shoulder and Shakers... Losers- $KO $ABX $DD. Winners- $LAND $CHL $BHP.
Benign tweet: Latest information on #stocks like $TDS $DIS $CPWR $BLOX Give it a try.
Adversarial retweet: Latest advance on #stocks like $TDS $DIS $CPWR $BLOX Give it a try.
Benign tweet: Top Buy Stocks for July 29: $AMX, $EXC, $NLY, $ORCL, $XRX.
Adversarial retweet: Top unsettled Stocks for July 29: $AMX, $EXC, $NLY, $ORCL, $XRX.
Benign tweet: $JKHY #Stocks you might want to buy $HRS $SRCL $PCLN #singedinvestor.
Adversarial retweet: $JKHY #Stocks you might confirm to buy $HRS $SRCL $PCLN #singedinvestor.
Adversarial Retweets Generated by JO
Benign tweet: #Stocks you mighwant to Sell $CERN $CAT $PX $DO Try this http://t.co/95PUim108L.
Adversarial retweet: #Stocks you mighannounce to Sell $CERN $CAT $PX $DO Try this http://t.co/95PUim108L.
Benign tweet: The Most Accurate Stock Alert Service Made $240,000 Yesterday http://t.co/8WvnrVmkBS ... $SNY $SO $SOL.
Adversarial retweet: The Most Accurate Stock preserving Service Made $240,000 Yesterday http://t.co/8WvnrVmkBS ... $SNY $SO $SOL.
Benign tweet: Is it breakout time on $HON $CF $LEG $IBM Give it a try.
Adversarial retweet: Is it appealing time on $HON $CF $LEG $IBM Give it a try.
Benign tweet: Latest information on #stocks like $PETM $UTX $BRCD $CI #moneymanage-ment.
Adversarial retweet: Latest discovery on #stocks like $PETM $UTX $BRCD $CI #money-management.
Benign tweet: $BABA actually showing signs of life...would love a move back toward 90 although seems unlikely at moment.
Adversarial retweet: $BABA actually showing signs of life...would love a move back toward 90 although seems unlikely at playday.
Table 3: Ten examples of adversarial retweets generated by the concatenation attack