SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Evaluation Metrics. We use two widely used evaluation metrics semantic similarity and perturbation rate. For semantic similarity, we utilize the universal sequence encoder [4] to calculate the semantic similarity between two texts. The range of the semantic similarity is between  $[0, 1]$ , and the larger semantic similarity indicates the better attack performance. For perturbation rate, we use the ratio
of the number of changed words over the number of total words in the adversarial example, and the lower perturbation rate indicates the better results.
Victim Models. We follow [23, 38, 37] to adopt three widely used natural language processing models as victim models: BERT [8], WordCNN [17], and WordLSTM [13]. All the model parameters are taken from the previous works [23, 38, 37]. We also attack some advanced models like T5 [30] and DeBERT [12], and the results are shown in Appendix F. To further verify the effectiveness of different algorithms in real applications, we also attempt to use Google Cloud API (https://cloud.google.com/natural-language) and Alibaba Cloud API (https://ai.aliyun.com/nlp) as the victim models.
Implementation Details. For the random initialization, we employ the same method used in previous methods [23, 38, 37]. After the initialization, we follow [23, 38] to perform a pre-processing step to remove the unnecessary replacement words. For the hyperparameters, we consistently set  $r = 5$  and  $k = 5$  for all the datasets. The detailed parameter investigation is provided in Appendix G. In addition, during the optimization procedure, if we re-optimize the same adversarial example three times and no new better adversarial examples are generated, we randomly go back to the last three or four adversarial example. We do not re-optimize an adversarial example more than two times. For fair comparison, we follow [23, 38, 37] to generate 50 synonyms for each word by using the counter-fitting word vector. We also conduct experiments based on BERT-based synonyms, and the results are shown in Appendix H.
5.2.1 Comparison on Semantic Similarity and Perturbation Rate
We exactly follow the previous work [38] to set the query budget to 1000, i.e., the number of allowed queries from the attacker is 1000. As different algorithms use the same random initialization step which determines the prediction accuracy after the adversarial attack, so different algorithms have the same prediction accuracy. Our goal is to generate the adversarial examples with higher semantic similarity and lower perturbation rate. Tables 2 and 3 report the experimental results when attacking text classification models. The best results are highlighted in bold.
As shown in Tables 2 and 3, when the query limit is 1000, for different datasets and tasks, HQA-Attack can always generate adversarial examples that have the highest semantic similarity and the lowest perturbation rate. Specifically, for the dataset MR with short text data, HQA-Attack increases the average semantic similarity by  $6.9\%$ ,  $6.5\%$ ,  $6.9\%$  and decreases the average perturbation rate by  $0.777\%$ ,  $0.832\%$ ,  $0.983\%$  compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. For the dataset IMDB with long text data, HQA-Attack increases the average semantic similarity by  $4.5\%$ ,  $3.4\%$ ,  $2.7\%$  and decreases the average perturbation rate by  $1.426\%$ ,  $0.601\%$ ,  $0.823\%$  compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. For the dataset with more than two categories like AG, HQA-Attack increases the average semantic similarity by  $10.6\%$ ,  $8.8\%$ ,  $11.6\%$  and decreases the average perturbation rate by  $4.785\%$ ,  $3.885\%$ ,  $5.237\%$  compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. All these results demonstrate that HQA-Attack can generate high-quality adversarial examples in the tight-budget hard-label setting.
5.2.2 Comparison on Attack Efficiency
The attack efficiency is an important criterion in evaluating the attack performance, as in most DNN-based NLP platforms the number of queries is limited. Therefore, We further compare the proposed HQA-Attack with two latest methods TextHoaxter and LeapAttack under different query budgets [100, 300, 500, 700, 1000] on text classification datasets. As shown in Figure 2, with the query budget increasing, the average semantic similarity of all the methods keeps increasing and the average perturbation rate of all the methods keeps decreasing. In terms of semantic similarity and perturbation rate, HQA-Attack always performs much better than other methods in all the budgets. These results further validate that our proposed HQA-Attack has the ability to generate adversarial examples with higher semantic similarity and lower perturbation rate in different budget limits.
5.2.3 Attack Real-World APIs
Table 2: Comparison of semantic similarity (Sim) and perturbation rate (Pert) with the budget limit of 1000 when attacking text classification models. Acc stands for model prediction accuracy after the adversarial attack, which is determined by the random initialization step and the same for different adversarial attack models.
Dataset	Method	BERT	WordCNN	WordLSTM
Acc(%)	Sim(%)	Pert(%)	Acc(%)	Sim(%)	Pert(%)	Acc(%)	Sim(%)	Pert(%)
MR	HLGA	1.0	62.5	14.532	0.7	64.4	14.028	0.7	63.5	14.462
TextHoaxer	67.3	11.905	68.6	12.056	67.3	12.324
LeapAttack	61.6	14.643	63.2	14.016	61.3	14.435
HQA-Attack	74.2	11.128	75.1	11.224	74.2	11.341
AG	HLGA	2.8	60.5	17.769	1.4	71.9	13.855	5.7	61.8	17.890
TextHoaxer	63.2	15.766	73.9	12.716	63.8	16.520
LeapAttack	62.6	16.143	72.0	12.827	63.0	17.028
HQA-Attack	73.8	10.981	82.7	8.831	75.4	11.283
Yahoo	HLGA	0.8	68.7	7.453	0.8	71.9	8.564	1.9	63.8	9.531
TextHoaxer	70.2	6.841	74.8	7.740	67.0	8.502
LeapAttack	66.7	7.448	74.3	7.842	64.7	9.095
HQA-Attack	76.4	5.609	82.4	6.132	73.9	6.645
Yelp	HLGA	0.6	71.9	10.411	0.6	79.7	9.102	3.2	78.8	8.654
TextHoaxer	73.8	9.585	81.3	8.545	80.4	8.108
LeapAttack	72.7	9.877	80.1	8.816	79.6	8.111
HQA-Attack	81.9	6.756	87.8	6.312	86.7	5.786
IMDB	HLGA	0.1	83.2	5.571	0.0	87.6	4.464	0.3	87.6	4.464
TextHoaxer	84.7	5.202	88.8	4.197	88.8	4.197
LeapAttack	84.0	5.041	89.7	3.886	89.0	4.021
HQA-Attack	89.2	3.615	93.1	3.285	91.7	3.198
Table 3: Comparison of semantic similarity (Sim) and perturbation rate (Pert) with the budget limit of 1000 when attacking the natural language inference model (BERT).
Method	SNLI	MNLI	mMNLI
Acc(%)	Sim(%)	Pert(%)	Acc(%)	Sim(%)	Pert(%)	Acc(%)	Sim(%)	Pert(%)
HLGA	1.3	35.9	18.510	2.9	49.6	14.498	1.7	50.7	14.349
TextHoaxter	38.7	16.615	52.9	12.730	54.4	12.453
LeapAttack	35.0	19.905	49.1	15.728	50.2	15.135
HQA-Attack	54.2	15.958	64.7	12.093	65.4	11.502
To further verify the effectiveness of different algorithms, we attempt to use TextHoaxter, LeapAttack and HQA-Attack to attack two real-world APIs: Google Cloud (https://cloud.google.com/natural-language) and Alibaba Cloud (https://ai.aliyun.com/nlp). To further evaluate the fluency of the generated
Table 4: Comparison of semantic similarity and perturbation rate when attacking against real-world APIs.
API	Google Cloud	Alibaba Cloud
Sim(%)	Pert(%)	PPL	Sim(%)	Pert(%)	PPL
TextHoaxter	76.1	7.179	253	78.3	6.190	261
LeapAttack	73.2	10.699	295	77.7	7.198	285
HQA-Attack	81.8	7.117	244	83.4	6.183	255
adversarial examples, we add the perplexity (PPL) as the additional evaluation metric which is calculated by using GPT-2 Large [29]. The lower PPL indicates the better performance. As Google and Alibaba only provide limited service budgets, we select 100 examples from the MR dataset whose lengths are greater than or equal to 20 words to perform experiments, and restrict that each method can only query the API 350 times. Table 4 shows the results of TextHoaxter, LeapAttack and HQA-Attack. It can be seen that compared with the second best results, HQA-Attack increases the semantic similarity  $5.7\%$ ,  $5.1\%$ , decreases the perturbation rate  $0.062\%$ ,  $0.007\%$  and decreases the PPL 9, 6 on Google Cloud and Alibaba Cloud respectively. We also compare the performance of TextHoaxter, LeapAttack and HQA-Attack in different budget limits. The results are shown in Figure
(a) MR (Sim)
(b) AG (Sim)
(c) Yahoo (Sim)
(d) Yelp (Sim)
(e) IMDB (Sim)
(f) MR (Pert)
(g) AG (Pert)
(h) Yahoo (Pert)
(i) Yelp (Pert)
(j)IMDB(Pert)
Figure 2: Comparison on semantic similarity and perturbation rate in different budget limits when attacking against BERT.
(a) Google (Sim)
Figure 3: Comparison of semantic similarity and perturbation rate in different budget limits when attacking against real-world APIs.
(b) Google (Pert)
(c) Alibaba (Sim)
(d) Alibaba (Pert)
Table 5: Human evaluation results in average classification accuracy(%)
Dataset	HLGA	TextHoaxter	LeapAttack	HQA-Attack
MR	82.6	84.8	84.0	87.4
IMDB	84.4	85.4	85.0	88.6
3. We can get that HQA-Attack can have the higher semantic similarity and lower perturbation rate in most cases, which further demonstrates the superiority of HQA-Attack over other baselines.
5.2.4 Human Evaluation
We have conducted the human evaluation experiments on the BERT model using HLGA, TextHoaxter, LeapAttack and HQA-Attack for the MR and IMDB datasets. Specifically, for each dataset, we first randomly select 50 original samples, and use each adversarial attack method to generate the corresponding 50 adversarial examples respectively. Then we ask 10 volunteers to annotate the class labels for these samples, and calculate the average classification accuracy (Acc) for each method. Intuitively, if the accuracy is higher, it means that the quality of the generated adversarial examples is better. The Acc(%) results of clean examples are  $94.2\%$  and  $93.6\%$  for MR and IMDB respectively. And the results of adversarial examples are shown in Table 5. The results show that the adversarial examples generated by HQA-Attack are more likely to be classified correctly, which further verifies the superiority of HQA-Attack in preserving the semantic information.
5.2.5 Attack Models which Defend with Adversarial Training
With the development of the AI security, a lot of works focus on defending against adversarial attacks. We further compare the attack performance when the victim model is trained with three effective adversarial training strategies HotFlip [9], SHIELD [18] and DNE [43]. We select the BERT model as the victim model, set the query budget to 1000 and then perform experiments on the AG dataset. We also use the perplexity (PPL) as the additional evaluation metric to judge the fluency
Table 6: Comparison results of attacking models which defend with adversarial training.
Method	HotFlip	SHIELD	DNE
Acc(%)	Sim(%)	Pert(%)	PPL	Acc(%)	Sim(%)	Pert(%)	PPL	Acc(%)	Sim(%)	Pert(%)	PPL
HLGA	21.7	55.8	17.185	538	12.6	59.8	15.206	565	18.6	58.6	14.132	444
TextHoaxter	55.5	17.145	463	67.8	12.312	469	66.5	11.517	363
LeapAttack	62.0	17.288	530	66.3	14.868	541	65.7	13.541	414
HQA-Attack	72.7	10.192	350	76.0	10.085	361	75.0	9.808	312
Table 7: Ablation study.
Dataset	Acc(%)	Random Initialization	w/o Substituting	w/o Optimizing	HQA-Attack
Sim(%)	Pert(%)	Sim(%)	Pert(%)	Sim(%)	Pert(%)	Sim(%)	Pert(%)
MR	0.7	18.2	39.234	74.4	12.638	74.2	11.673	75.1	11.224
AG	1.4	30.5	43.463	80.2	16.519	79.3	11.305	82.7	8.831
Yahoo	0.8	28.0	32.143	73.1	15.982	79.7	7.445	82.4	6.132
Yelp	0.6	18.3	38.595	71.6	19.342	85.2	7.883	87.8	6.312
IMDB	0.0	35.0	30.963	72.9	17.229	92.2	3.923	93.1	3.285
of the generated adversarial examples. Table 6 shows the attack performance. We can observe that HQA-Attack can also obtain the best results compared with other strong baselines.
5.2.6 Ablation Study and Case Study
To investigate the effectiveness of different components, we make the ablation study on five text classification datasets when attacking WordCNN. The results are shown in Table 7. Random Initialization mean the adversarial examples generated only by the random initialization step. w/o Substituting means that the HQA-Attack model without the substituting original words back step. w/o Optimizing means that the HQA-Attack model which randomly selects a word that can keep the example adversarial as the replacement after substituting original words back without optimizing the adversarial example. It is easy to find that all modules contribute to the model, which verifies that the substituting original words back step is useful and the optimizing the adversarial example step is also indispensable. To further demonstrate the effectiveness of our proposed word back-substitution strategy, we add some extra experiments in Appendix I. We also list some concrete adversarial examples generated by HQA-Attack, which are shown in Appendix J. These examples further demonstrate that our proposed HQA-Attack model can generate a high-quality black-box hard-label adversarial example with only a small perturbation.
In this paper, we propose a novel approach named HQA-Attack for crafting high quality textual adversarial examples in black-box hard-label settings. By substituting original words back, HQA-Attack can reduce the perturbation rate greatly. By utilizing the synonym set of the remaining changed words to optimize the adversarial example, HQA-Attack can improve the semantic similarity and reduce the query budget. Extensive experimental results demonstrate that the proposed HQA-Attack method can generate high quality adversarial examples with high semantic similarity, low perturbation rate and fewer query numbers. In future work, we plan to attempt more optimization strategies to refine the model, thus further boosting the textual adversarial attack performance.
The authors are grateful to the anonymous reviewers for their valuable comments. This work was supported by National Natural Science Foundation of China (No. 62106035, 62206038, 61972065) and Fundamental Research Funds for the Central Universities (No. DUT20RC(3)040, DUT20RC(3)066), and supported in part by Key Research Project of Zhejiang Lab (No. 2022PI0AC01) and National Key Research and Development Program of China (2022YFB4500300).