SlowGuess/NAACL_2022_OCR huggingface dataset:
70%. However, when we test the performance of the blackbox LSTM model on adversarial texts generated from the whitebox BERT, attack success rate is around 30%, which is much lower than previous experiment. These results show that Self-Attention LSTMs are more robust than BERT models, and the adversarial examples generated from a robust model has higher attack transferability than non-robust one. Therefore, we can attack blackbox BERT models using a strong Self-Attention LSTM trained by ourselves to generate adversarial texts with high success rates. We also observe that the USR of transferability-based attack is generally higher than that of targeted attack. Particularly, we achieve the highest success rate of  $81.2\%$  when attacking blackbox BERT with text generated by LSTM attacks under untargeted setting.
Furthermore, we find that the adversarial examples generated by the contextualized semantic perturbation function  $\mathcal{F}_C$  have the highest attack transferability, which suggests that our contextualized semantic perturbation is more generalizable than rule-based perturbation functions.
Language Quality Evaluation Details We use Amazon Turk for English adversarial example quality annotations, and Alibaba Cloud for Chinese example quality annotations. Each sentence is annotated by 5 annotators. This evaluation only evaluates language quality and grammatical correctness, and thus does not require additional background or domain knowledge.
We present the annotation instructions on Amazon Turk below.
Please rate the language quality (from 1 to 5, in terms of coherence, fluency, and grammar correctness) of the presented sentence. 5 means the best language quality, and 1 means the lowest language quality.
- 5: The sentence looks totally correct. There
are no grammatical errors. I can fully understand the sentence.
- 4: The sentence looks somewhat correct. There are one or two grammatical errors or typos. But I can mostly understand the sentence.
- 3: The sentence looks OK to me. There are some grammatical errors or typos. I can partly understand the sentence.
- 2: The sentence looks bad to me. There are grammatical errors or typos everywhere. I can understand it a little.
1: The sentence totally does not make any sense. I cannot understand it.
Utility Preservation Evaluation Details We use the targeted SemAttack to generate the adversarial dataset with with  $c / \kappa = 100 / 1$ . In total, we collected annotations from 21 graduate students from US universities for English datasets and 26 annotators from native Chinese speakers for Chinese datasets. Both classification tasks do not require domain knowledge. The detailed human performance results are shown in Table 6.
H Perturbation Search Space Examples
H.1 English Perturbation Search Space  $S$  Examples
Table 15: English Perturbation Search Space  $S$  Examples Generated by SemAttack for BERT-based Classifier using  ${\mathcal{F}}_{T},{\mathcal{F}}_{K}$  and  ${\mathcal{F}}_{C}$  . In the first example,we list some words and corresponding candidate sets generated by these functions. We can see that words generated by  ${\mathcal{F}}_{C}$  reflect the meaning of the current context. For example,when we say that a hotel is good, we may say it's spacious. When word come is followed by back, we may mean return. In the following two examples, we show that the same word may have different perturbation sets in different contexts. In the second example, by using order, the person means that he ordered food. Considering the context,  ${\mathcal{F}}_{C}$  provides eat,taste in its candidate set. In the last example,order means the person orders a drink. As a consequence,we have drink as a verb with a similar meaning in its candidate set.
Input English Text: This was my fifth time traveling to vegas! I have stayed at hotels such as the Bellagio, Aria, Cosmopolitan, the venetian, and fortunately enough got a chance to stay at vdara. Considering the reviews I didn't expect vdara to be that-good of a hotel! Vdara was extremely clean, very modern, new, great customer service, close to the strip-connected to the bellagio. easy access to casinos and heart of the strip. Definitely coming back to vegas and booking a room at vdara.
$\mathcal{F}_T(stay) = \text{stay}$
$\mathcal{F}_K(stay) =$  quell, last out, bide, persist, stay
$\mathcal{F}_C(stay) =$  staying, stay, vacationing, stays, relax, internship, enroll, stayed, visit, settle
$\mathcal{F}_T(good) = \mathrm{good}$ , god
$\mathcal{F}_K(good) =$  estimable, adept, full, effective, dear, beneficial, dependable, good
$\mathcal{F}_C(good) =$  spacious, marvelous, marvel, wonderful, good
$\mathcal{F}_T(\text{clean}) = \text{clean}$
$\mathcal{F}_K(\text{clean}) = \text{blank, clean, uninfected}$
$\mathcal{F}_C(\text{clean}) = \text{spacious, luxurious, lively, vibrant, cleanest, cozy, renovated, clean}$
$\mathcal{F}_T(close) = \mathrm{close}$
$\mathcal{F}_K(close) =$  close, conclude, close up
$\mathcal{F}_C(close) =$  connected, near, close, nearer, closeness
$\mathcal{F}_T(\text{coming}) = \text{coming}$
$\mathcal{F}_K(coming) =$  come, derive, issue forth, arrive, hail, total, occur, do, fall
$\mathcal{F}_C(\text{coming}) = \text{returning, traveling, transferring, staying, relocating, visiting, talking, coming}$
Input English Text: Stopped by this place for lunch. Ordered the veggie slice and patty they put lettuce cheese and mayo in it and both the slice and patty were amazing. Definitely will be back for more.
$\mathcal{F}_T(Ordered) =$  ordered
$\mathcal{F}_K(Ordered) = \text{rate, ordain, arrange, order, regulate}$
$\mathcal{F}_C(Ordered) =$  ate, tasted, ordered
Input English Text: Love this speakeasy bar. Last time I was at this location it was still the Panda bar. The place itself is super cozy and intimate. We went there to grab a drink before our Ali Wong show. Hubby ordered a Hendricks gin tonic (12 $\$ 6$ -happy hour price?) and I got a cocktail with Pimms (9 $\$ 6$  before 9pm). The drinks were HUMONGOUS! So much so I couldn't finish mine and hubby was tipsy lol.
$\mathcal{F}_C(Ordered) = \mathrm{ate}$ , drank, ordered
H.2 Chinese Perturbation Search Space  $S$  Examples
Table 16: Chinese Perturbation Search Space  $S$  Examples Generated by SemAttack for BERT-based Classifier using  ${\mathcal{F}}_{T},{\mathcal{F}}_{K}$  and  ${\mathcal{F}}_{C}$  . Chinese characters are intrinsically polysemous,which requires candidate characters to be contextualized. We list four examples here. In the first two examples, we show two different meanings of character "美" in two different sentences. One referring to the US which has some other countries' names in its perturbation set, another meaning poignant which is used as an adjective. In the last two examples, we show "长", a well-known Chinese character that has multiple pronunciations and multiple meanings. We show that our two perturbation functions return different candidate sets. In the third example, "长" means a job title, while in the last example it means growth.
Input Chinese Text: 访谈: 美国签证官解读学生签证获签要领
Translation: Interview: U.S. visa officer interprets the essentials of student visa
FT(美) = 芥,美,界,养,镁,每,楣(mustard, nice, world, support, magnesium, each, lintel)
FK(美) = 美(US)
FC(美) = 美,英,香,欧,日,澳,俄,荷,德,港,华,葡,韩(US, Britain, Hong Kong, Europe, Japan, Australia, Russian, Netherlands, Germany, Hong Kong, China, Portugal, Korean)
Input Chinese Text: 陈嘉上《画皮》大换皮凄美爱情赢得眼泪(图)
Translation: Chen Jia's "Painted Skin" changes skin, poignant love wins tears (photo)
FT(美) = 芹,美,界,养,镁,每,楣(mustard, nice, world, support, magnesium, each, lintel)
FK(美) = 美(poignant)
FC(美) = 寰,挚,妙,美,腻,酷,烂,凑,坎坷,惨,悲,慨(lonely, sincere, wonderful, nice, greasy, cool, rotten, make up, bumpy, sad, awful, sad, sad)
Input Chinese Text: 北京房协副秘书长陈志谈地产业诚信问题
Translation: Chen Zhi, Deputy Secretary-General of the Beijing Housing Association, talks about the integrity of the real estate industry
FT(长) = 氏,氏,掌,涨,长(clan name, foundation, palm, rise, long)
FK(长) = 长(general)
FC(长) = 长,授,卿,员,师,委,厅,秘,副,顾,官,董(general, professor, minister, member, teacher, committee, office, secretary, deputy, consultant, official, director)
Input Chinese Text: IMF大幅下调明年全球经济增长预期
Translation: IMF sharply lowered its forecast for global economic growth next year
FT(长) = 氏,氏,掌,涨,长(clan name, foundation, palm, rise, long)
FK(长) = 长,加,大(growth, increase, increase)
FC(长) = 胀,增,膨,速,涨,长,加,快(swell, increase, inflate, speed, rise, grow, plus, fast)
H.3 English Adversarial Examples
Table 21: English Adversarial Examples Generated by SemAttack for BERT-based Classifier on SNLI Dataset using all perturbation functions.
Input (red = Modified character, bold = original character.)
Original Premise: Four boys are about to be hit by an approaching wave.
Adversarial Premise: Four boys are about to be smashed by an approaching wave.
Hypothesis: The wave missed the boys.
Model Prediction: contradiction → entailment
Original Premise: A yellow race car sliding through a corner as spectators watch.
Adversarial Premise: A yellow race car slipping through a corner as spectators watch.
Hypothesis: A NASCAR is being watched.
Model Prediction: neutral → entailment
Original Premise: A group of people on the bark, brightly lighten street, while one man with a gray hat holds a large colorful sign with arrows.
Adversarial Premise: A group of people on the bark, brightly lighten street, while one man with a gray hat holds a large colorful sign with swords.
Hypothesis: The people are walking down the street.
Model Prediction: entailment → contradiction
Original Premise: A man takes a drink in the doorway of a home.
Adversarial Premise: A man takes a drinking in the doorway of a home.
Hypothesis: A man is looking out onto his front lawn from the doorway of his home.
Model Prediction: neutral → contradiction
Original Premise: A dog attacking a man wearing protective gear.
Adversarial Premise: A dog hurting a man wearing protective gear.
Hypothesis: He was training a police dog.
Model Prediction: neutral → entailment
Original Premise: A white man in a red shirt riding a bike.
Adversarial Premise: A white man in a golden shirt riding a bike.
Hypothesis: An old guy wears a shirt on a bike.
Model Prediction: neutral → entailment
Original Premise: A child in a blue and white striped shirt crosses his arms and smiles while standing on red carpeted stairs.
Adversarial Premise: A child in a blue and white striped shirt crosses his arms and smiles while standing on red carpeted terraces.
Hypothesis: A child is smiling as he watches a clown.
Model Prediction: neutral → contradiction
Original Premise: This man, with a red & white shirt has water bottles on this white truck.
Adversarial Premise: This man, with a red & white shirt has beer bottles on this white truck.
Hypothesis: The guy has bottles on the truck for me.
Model Prediction: neutral → entailment
Original Premise: Three people are riding a carriage pulled by four horses.
Adversarial Premise: Three people are riding a carriage hauled by four horses.
Hypothesis: The oxen are pulling the carriage.
Model Prediction: contradiction → entailment
H.4 Chinese Adversarial Examples
Table 22: Chinese Adversarial Examples Generated by SemAttack for BERT-based Classifier on THUNews Dataset using  ${\mathcal{F}}_{T}$  .
Input (red = Modified character, bold=original character.)
Original Chinese Text: 高露洁新品专效抗敏牙膏解决牙齿过敏
Translation: Gaolujie's new anti-hypersensitive toothpaste solves tooth hypersensitivity
Adversarial Chinese Text: 高露吉新品专效抗敏牙膏解决牙齿过敏
Translation: Gaoluji's new anti-hypersensitive toothpaste solves tooth hypersensitivity
Model Prediction: Fashion News (时尚新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 组图: 09巴黎高级定制秀最有看点8场次
Translation: Photos: 8 highlights of 09 Paris Haute Couture Show
Adversarial Chinese Text: 组图: 09巴黎高级定制秀最有看点8场炊
Translation: Photos: 8 cooking sessions of 09 Paris Haute Couture Show
Model Prediction: Fashion News (时尚新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 今秋男友新标准打造新时代型男
Translation: New standards for boyfriends in this autumn to create a new era of men
Adversarial Chinese Text: 金秋男友新标准打造新时代型男
Translation: New standards for boyfriends in golden autumn to create a new era of men
Model Prediction: Fashion News (时尚新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 据称台联党可能下令赖幸媛辞去陆委会主委
Translation: It is said that the Taiwan Union Party may order Lai Xingyuan to resign as chairman of the MAC
Adversarial Chinese Text: 剧称台联党可能下令赖幸媛辞去陆委会主委
Translation: The drama said that the Taiwan Union Party may order Lai Xingyuan to resign as chairman of the MAC
Model Prediction: Politics news (时政新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 猛犸象80%基因组破译完成史前巨兽有望复活
Translation: Mammoth 80% genome deciphered complete prehistoric behemoth is expected to be resurrected
Adversarial Chinese Text: 孟犸象80%基因组破译完成史前巨兽有望复活
Translation: Mammoth 80% genome deciphered complete prehistoric behemoth is expected to be resurrected
Model Prediction: Technology News (科技新闻) → Entertainment News (娱乐新闻)
Table 23: Chinese Adversarial Examples Generated by SemAttack for BERT-based Classifier on THUNews Dataset using  $\mathcal{F}_K$ .
Input (red = Modified character, bold=original character.)
Original Chinese Text: 手袋进阶论: 职场之路的秘密奠基石 (组图)
Translation: Handbag progression theory: the secret cornerstone of the road to the workplace (photo)
Adversarial Chinese Text: 手袋进阶论: 职场之路的机密奠基石 (组图)
Translation: Handbag progression theory: the confidential cornerstone of the road to the workplace (photo)
Model Prediction: Fashion News (时尚新闻) → Technology News (科技新闻)
Original Chinese Text: 中国银联发布十一黄金周用卡提示
Translation: China UnionPay releases card tips for Golden Week.
Adversarial Chinese Text: 中国银联发布十一黄金周用卡提醒
Translation: China UnionPay releases card reminders for Golden Week.
Model Prediction: Financial and economic news (财经新闻) → Technology News (科技新闻)
Original Chinese Text: 买卖红木都是一项风险活
Translation: Buying and selling mahogany is a risky business.
Adversarial Chinese Text: 买卖红木都是一项危险活
Translation: Buying and selling mahogany is a dangerous business.
Model Prediction: Financial and economic news (财经新闻) → Home News (家居新闻)
Original Chinese Text: 信用卡利润猛涨风险容忍度提高
Translation: Credit card profits soar with increased risk tolerance.
Adversarial Chinese Text: 信用卡利润猛涨风险容忍度提升
Translation: Credit card profits soar with increased risk tolerance.
Model Prediction: Financial and economic news (财经新闻) → Stock News (股票新闻)
Original Chinese Text: 黎振伟: 不同的城市有着各自的发展模式
Translation: Zhenwei Li: Different cities have their own development models.
Adversarial Chinese Text: 黎振伟: 不同的都市有着各自的发展模式
Translation: Zhenwei Li: Different cities have their own development models.
Model Prediction: Real Estate News (房产新闻) → Technology News (科技新闻)
Original Chinese Text: 韩国航空试验中心揭秘: 战斗机被冰冻住测试
Translation: South Korea's aviation experiment center revealed: fighter jets were frozen in the test.
Adversarial Chinese Text: 韩国航空检验中心揭秘: 战斗机被冰冻住测试
Translation: South Korea's aviation test center revealed: fighter jets were frozen in the test.
Model Prediction: Technology News (科技新闻) → Current Affairs News (时政新闻)
Table 24: Chinese Adversarial Examples Generated by SemAttack for BERT-based Classifier on THUNews Dataset using  $\mathcal{F}_C$ .
Input (red = Modified character, bold=original character.)
Original Chinese Text: 高露洁新品专效抗敏牙膏解决牙齿过敏
Translation: Gaolujie's new anti-hypersensitive toothpaste solves tooth hypersensitivity
Adversarial Chinese Text: 高露婕新品专效抗敏牙膏解决牙齿过敏
Translation: Gaolujie's new anti-hypersensitive toothpaste solves tooth hypersensitivity
Model Prediction: Fashion News（时尚新闻）→Entertainment News（娱乐新闻）
Original Chinese Text: 实录：张瑜阿穆隆王睿做客聊新片《八十一格》
Translation: Record: Zhang Yu, Amulon and Wang Rui as a guest to talk about the new film "Eighty-one Patterns"
Adversarial Chinese Text: 实摄：张瑜阿穆隆王睿做客聊新片《八十一格》
Translation: Record: Zhang Yu, Amulon and Wang Rui as a guest to talk about the new film "Eighty-one Patterns"
Model Prediction: Entertainment News（娱乐新闻）→Technology News（科技新闻）
Original Chinese Text: 聚焦信用卡全额罚息：欠款44.6元生千元利息
Translation: Focus on credit card full penalty interest: RMB 44.6 arrears generate interest of RMB 1,000
Adversarial Chinese Text: 聚盯信用卡全额罚息：欠款44.6元生千元利息
Translation: Focus on credit card full penalty interest: RMB 44.6 arrears generate interest of RMB 1,000
Model Prediction: Financial and economic news（财经新闻）→Technology News（科技新闻）
Original Chinese Text: 研究发现4000万年前鲸鱼长有4条腿（图）
Translation: Research found that whales had 4 legs 40 million years ago (photo)
Adversarial Chinese Text: 研究发现4000万年前鲤鱼长有4条腿（图）
Translation: Research found that carp had 4 legs 40 million years ago (photo)
Model Prediction: Technology News（科技新闻）→Social News（社会新闻）
Original Chinese Text: 澳门博彩业后何鸿时代猜想
Translation: Post-Ho Hong Era Conjecture in Macau's Gaming Industry
Adversarial Chinese Text: 澳门博彩业后何鸿时代预想
Translation: Post-Ho Hong Era Prediction in Macau's Gaming Industry
Model Prediction: Stock news（股票新闻）→Technology News（科技新闻）
Table 25: Chinese Adversarial Examples Generated by SemAttack for BERT-based Classifier on THUNews Dataset using all perturbation functions.
Input (red = Modified character, bold=original character.)
Original Chinese Text: 对话王辉灏: 海归创业面临的困难 (图)Translation: Dialogue with Wang Huihao: Difficulties faced by overseas returnees in starting a business (photo)
Adversarial Chinese Text: 对话王辉耀: 海归创业面临的困难 (图)Translation: Dialogue with Wang Huiyao: Difficulties faced by overseas returnees in starting a business (photo)
Model Prediction: Education News (教育新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 拿什么能吸引你: 我们的海外学子?Translation: What can attract you: our overseas students?
Adversarial Chinese Text: 拿甚么能吸引你: 我们的海外学子?Translation: What can attract you: our overseas students?
Model Prediction: Education News (教育新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 独家对话冯小刚: 多个观众挺难少点观众挺容易Translation: Exclusive dialogue with Feng Xiaogang: It's difficult for multiple audiences, and it's easy for less audiences
Adversarial Chinese Text: 独家对话部小刚: 多个观众挺难少点观众挺容易Translation: Exclusive dialogue with Gao Xiaogang: It's difficult for multiple audiences, and it's easy for less audiences
Model Prediction: Entertainment News (娱乐新闻) → Sports News (体育新闻)
Original Chinese Text: 高露洁新品专效抗敏牙膏解决牙齿过敏Translation: Gaolujie's new anti-hypersensitive toothpaste solves tooth hypersensitivity
Adversarial Chinese Text: 高露洁新品专效抗敏牙膏解决牙苔过敏Translation: Gaolujie's new anti-hypersensitive toothpaste solves tooth coating hypersensitivity
Model Prediction: Fashion News (时尚新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 2010艺术品秋拍上演六宗最Translation: Six most of the 2010 art autumn auctions
Adversarial Chinese Text: 2010艺术品秋拍上演六综最Translation: Six most comprehensive of the 2010 art autumn auctions
Model Prediction: Financial and economic news (财经新闻) → Entertainment News (娱乐新闻)
Original Chinese Text: 英属小岛发现罕见蓝色龙虾 (组图)Translation: Rare blue lobster found on British island (photo)
Adversarial Chinese Text: 英属小岛发现罕见蓝色龙鳖 (组图)Translation: Rare blue turtle found on British island (photo)
Model Prediction: Technology News (科技新闻) → Social News (社会新闻)