Year: 2018

Abstract:
We present a probabilistic framework for studying adversarial attacks on discrete data. Based on this framework, we derive a perturbation-based method, Greedy Attack, and a scalable learning-based method, Gumbel Attack, that illustrate various tradeoffs in the design of attacks. We demonstrate the effectiveness of these methods using both quantitative metrics and human evaluation on various stateof-the-art models for text classification, including a word-based CNN, a characterbased CNN and an LSTM. As an example of our results, we show that the accuracy of character-based convolutional networks drops to the level of random selection by modifying only five characters through Greedy Attack.

heading: 1 INTRODUCTION
text: Robustness to adversarial perturbation has become an extremely important criterion for applications of machine learning in security-sensitive domains such as spam detection (Stringhini et al., 2010), fraud detection (Ghosh & Reilly, 1994), criminal justice (Berk & Bleich, 2013), malware detection (Kolter & Maloof, 2006), and financial markets (West, 2000). Systematic methods for generating adversarial examples by small perturbations of original input data, also known as “attack,” have been developed to operationalize this criterion and to drive the development of more robust learning systems (Dalvi et al., 2004; Szegedy et al., 2013; Goodfellow et al., 2014).
Most of the work in this area has focused on differentiable models with continuous input spaces (Szegedy et al., 2013; Goodfellow et al., 2014; Kurakin et al., 2016). In this setting, the proposed attack strategies add a gradient-based perturbation to the original input, resulting in a dramatic decrease in the predictive accuracy of the model. This finding demonstrates the vulnerability of deep neural networks to adversarial examples in tasks like image classification and speech recognition.
We focus instead on adversarial attacks on models with discrete input data, such as text data, where each feature of an input sample has a categorical domain. While gradient-based approaches are not directly applicable to this setting, variations of gradient-based approaches have been shown effective in differentiable models. For example, Li et al. (2015) proposed to locate the top features with the largest gradient magnitude of their embedding, and Papernot et al. (2016) proposed to modify randomly selected features of an input through perturbing each feature by signs of the gradient, and project them onto the closest vector in the embedding space. Dalvi et al. (2004) attacked such models by solving a mixed integer linear program. Gao et al. (2018) developed scoring functions applicable for sequence data, and proposed to modify characters of the features selected by the scoring functions. Attack methods specifically designed for text data have also been studied recently. Jia & Liang (2017) proposed to insert distraction sentences into samples in a human-involved loop to fool a reading comprehension system. Samanta & Mehta (2017) added linguistic constraints over the pool of candidate-replacing words. Cheng et al. (2018) applied a gradient-based technique to attack sequence-to-sequence models.
We propose a systematic probabilistic framework for generating adversarial examples for models with discrete input. The framework is a two-stage process, where the key features to be perturbed are identified in the first stage and are then perturbed in the second stage by values chosen from a dictionary. We present two instantiations of this framework—Greedy Attack and Gumbel Attack.
Greedy Attack evaluates models with single-feature perturbed inputs in two stages, while Gumbel Attack learns a parametric sampling distribution for perturbation. Greedy Attack achieves higher success rate, while Gumbel Attack requires fewer model evaluations, leading to better efficiency in real-time or large-scale attacks. Table 1 systematically compares our methods with other methods.
In summary, our contributions in this work are as follows: (1) We propose a general probabilistic framework for adversarial attacks on models with discrete data. (2) We show that Greedy Attack achieves state-of-the-art attack rates across various kinds of models. (3) We propose Gumbel Attack as a scalable method with low model-evaluation complexity. (4) We observe that character-based models in text classification are particularly vulnerable to adversarial attack.

heading: 2 FRAMEWORK
text: We assume a model in the form of a conditional distribution, Pm(Y | x), for a response Y , supported on a set Y , given a realization of an input random variable X = x ∈ Wd, where W : = {w0, w1, . . . , wm} is a discrete space such as the dictionary of words or the space of characters. We assume there exists w0 ∈ W that can be taken as a reference point with no contribution to classification. For example, w0 can be the zero padding in text classification. Let x̃ denote a perturbation of the input variable x. The goal of the adversarial attack is to turn a given input x into x̃ through small perturbations, in such a way that Ỹ = 1 given x̃, where Ỹ is the indicator of a successful attack: Ỹ | x̃, x : = 1{arg maxy Pm(y | x̃) 6= arg maxy Pm(y | x)}. We restrict the perturbations to k features of x, and approach the problem through two stages. In the first stage, we search for the most important k features of x. In the second stage, we search for values to replace the selected k features:
First stage: x̂ = arg max a∈S1(x,k) P(Ỹ = 1|a, x), (1)
Second stage: x̃ = arg max a∈S2(x̂,x) P(Ỹ = 1|a, x), (2)
where S1(x, k) : = {a ∈ Wd | ai ∈ {xi, w0} for all i, d(a, x) ≤ k} is a set containing all the elements that differ from x by at most k positions, with the different features always taking value w0, and S2(x̂, x) : = {a ∈ Wd | ai = x̂i if x̂i = xi; ai ∈ W′ otherwise}. Here, we denote by xi, ai, x̂i the ith feature of x, a, x̂, by d(a, x) the count of features different between a and x, and by W′ ⊆W a sub-dictionary of W chosen by the attacker. These two objectives are computationally intractable in general. We thus further propose a probabilistic framework to reformulate the objectives into a more tractable objective, as shown in Figure 1.
Let G be a random variable in Ddk := {z ∈ {0, 1}d : ∑ zi ≤ k}, the space of d-dimensional zeroone vectors with at most k ones, and let φ : Wd ×Ddk →Wd be a function such that φ(x, g)i = xi if gi = 0 and φ(x, g)i = w0 if gi = 1. In the first stage, we let X̂ = φ(X,G) where G is generated from a distribution conditioned on X . We further add a constraint on P(G|X), by defining k identical random one-hot random variables G1, G2, . . . , Gk ∈ Dd1 conditioned on X , and letting Gi : = maxs{Gsi}, with Gi and Gsi being the ith entries of the variables G and Gs respectively. We aim to maximize the objective P(Ỹ = 1 | X̂,X) over the distribution of G given X , the probability of successful attack obtained by merely masking features:
max P(G|x)
EX [P(Ỹ = 1 | X̂,X)], s.t. Gs i.i.d.∼ P(· | X), X̂ = φ(X,G), Ỹ ∼ P(Ỹ | X̂,X). (3)
The categorical distribution P(Gs | x) yields a rank over the d features for a given x. We define φG : Wd → Pk([d]) to be the deterministic function that maps an input x to the indices of the top k features based on the rank from P(Gs | x): φG(x) = {i1, . . . , ik}. In the second stage, we introduce a new random variable H = (H1, . . . ,Hd) with each Hi being a one-hot random variable in D|W ′| 1 := {z ∈ {0, 1}|W ′| : ∑ zi = 1}. Let Pk([d]) be the set of subsets of [d] of size k. Let ψ : Wd × (D|W ′|
1 ) d × Pk([d]) → Wd be a function such that ψ(x, h, φG(x))i
is defined to be xi if i /∈ φG(x), and is the value in W′ corresponding to the one-hot vector hi otherwise. The perturbed input is X̃ : = ψ(X,H, φG(X)), whereH is generated from a distribution conditioned on X . We add a constraint on P(H | X) by requiring H1, . . . ,Hd to be independent of each other conditioned on X . Our goal is to maximize the objective P(Ỹ = 1 | X̃,X) over the distribution of H given X:
max P(H|x) EX,G[P(Ỹ = 1|X̃,X)], s.t. H ∼ P(·|X), X̃ = ψ(X,H, φG(X)), Ỹ ∼ P(Ỹ |X̃,X). (4)
For a given input x, the categorical distribution P(Hi | x) yields a rank over the values in W′ to be chosen for each feature i. The perturbation on x is carried out on the top k features φG(x) = {i1, . . . , ik} ranked by P(Gs | x); each chosen feature is is assigned the top value in W′ selected by P(His | x).

heading: 3 METHODS
text: In this section we present two instantiations of our general framework: Greedy Attack and Gumbel Attack.

heading: 3.1 GREEDY ATTACK
text: We motivate Algorithm 1, Greedy attack, as optimizing the lower bounds of Problem (3) and Problem (4). Let ei denote the d-dimensional one-hot vector whose ith component is 1. To solve Problem (3), we decompose the objective conditioned on a single instance x as:
EG|X [P(Ỹ = 1 | X̂,X) | x] = d∑
i=1
P(G1 = ei | x)EG(1)|X,G1 [P(Ỹ = 1 | X̂) | x, ei]
= d∑ i=1 P(G1 = ei | x)EG(1)|X,G1 [P(Ỹ = 1 | φ(X,max{ei, G (1)}), X) | x, ei],
where max takes the elementwise maximum of k random vectors, andG(1) := (G2, . . . , Gk). Thus, the objective in Problem 3 conditioned on a single instance x can be lower bounded as
max P(G|x)
EG|X [P(Ŷ = 1 | X̂,X) | x]
= max P(G|x) d∑ i=1 P(G1 = ei | x)EG(1)|X,G1 [P(Ŷ = 1 | φ(X,max{ei, G(1)}), X) | x, ei]
= max P(G1|x) d∑ i=1 P(G1 = ei | x) max P(G(1)|x,ei) EG(1)|X,G1 [P(Ŷ = 1 | φ(X,max{ei, G(1)}), X) | x, ei]
≥ max P(G1|x) d∑ i=1 P(G1 = ei | x)P(Ŷ = 1 | x(i)), (5)
where the last inequality follows from the observation that
P(Ŷ = 1 | x(i)) = P(Ŷ = 1 | φ(x,max{ei, G2 = ei, . . . , Gk = ei})) ≤ max
P(G(1)|x,ei) EG(1)|X,G1 [P(Ŷ = 1 | φ(X,max{ei, G(1)}), X) | x, ei]
We observe that the lower bound (5) is maximized if
P(G1 = ei | x) ∝ P(Ŷ = 1 | x(i)). (6)
Similarly, we decompose the objective in Problem (4) by conditioning on Hi1 and employing the independence between G and H conditioned on X , and again use a similar argument:
max P(H|x,g)
EH|X,G[P(Ỹ = 1 | X̃,X) | x, g]
= max P(Hi1 |x,g) |W′|∑ j=1 P(Hi1 = ej | x, g) max P(H(i1)|x,ej) EH(i1)|X,G,Hi1 [P(Ỹ = 1 | X̃,X) | x, ei]
≥ max P(Hi1 |x,g) |W′|∑ j=1 P(Hi1 = ej | x, g)P(Ỹ = 1|x(i1→wj)), (7)
The lower bound (7) is maximized when
P(Hi1 = ej | x) ∝ P(Ỹ = 1 | x(i1→wj)). (8)
The same applies to i2, . . . , ik. The algorithm Greedy Attack is built up from Equation (6) and Equation (8) in a straightforward manner. See Algorithm 1 for details.

heading: 3.2 GUMBEL ATTACK
text: Algorithm 1 evaluates the original modelO(d+k · |W′|) times for each sample. In the setting where one would like to carry out the attack over a massive data set D′, Greedy Attack can be infeasible due to the high cost of model evaluations. Assuming that the original model is differentiable and each sample in D′ is generated from a common underlying distribution, an alternative approach to solve Problem (3) and Problem (4) is to parametrize P(G | x) and P(H | x) and optimize the objectives over the parametric family directly on a training data set from the same distribution before the adversarial attack. An outline of this approach is described in Algorithm 2. We describe the training process in detail below.
Algorithm 1 Greedy Attack Input: Model Pm(Y | x). Input: Sample x ∈Wd. Input: k, number of features to change. Input: W′, sub-dictionary. Output: Modified x.
function GREEDY-ATTACK(Pm, k, x) for all i = 1 to d do
Compute P(Ỹ |x(i)). end for i1, . . . , ik = Topk(P(Ỹ |x(i))di=1). for all s = 1 to k do
xis ← arg max w∈W′ P(Ỹ |x(is→w)).
end for end function
Algorithm 2 Gumbel Attack Input: Model Pm(Y | x). Input: k, number of features to change. Input: A data set D = {xi} (for training). Input: A data set D′ to be attacked. Input: W′, sub-dictionary. Output: Modified data set D̃′.
function GUMBEL-ATTACK(Pm, k,D,D′) Train Pα(G|X) on D. Train Pθ(H|X) on D given Pα(G|X). for all x in D′ do
i1, . . . , ik = Topk(Pα(G|x)) for all s = 1 to k do
xis ← arg max w∈W′ Pα(His |g, x)
end for Add the modified x to D̃′.
end for end function
In the presence of k categorical random variables in Equation (3) and Equation (4), direct model evaluation requires summing over dk terms and |W′|k terms respectively. A straightforward approximation scheme is to exploit Equations (5) and (7), where we assume the distribution of hidden nodes G and H is well approximated by greedy methods. Nonetheless, this still requires d+ |W′|k model evaluations for each training sample. Several approximation techniques exist to further reduce the computational burden; e.g., we can take a weighted sum of features parametrized by deterministic functions of X , similar to the soft-attention mechanism (Ba et al., 2014; Bahdanau et al., 2014; Xu et al., 2015), and REINFORCE-type algorithms (Williams, 1992). We instead propose a method based on the “Gumbel trick” (Maddison et al., 2016; Jang et al., 2017), combined with the approximation of the objective proposed in Greedy Attack on a small subset of the training data. This achieves better performance with lower variance and higher model evaluation efficiency in our experiments.
The Gumbel trick involves using a Concrete random variable, introduced as a differentiable approximation of a categorical random variable, which has categorical probability p1, p2, . . . , pd and is encoded as a one-hot vector in Rd. The Concrete random variable C, denoted by C ∼ Concrete(p1, p2, . . . , pd), is a random vector supported on the relaxed simplex ∆d : = {z ∈ [0, 1]d :∑ i zi = 1}, such that Ci ∝ exp{(log pi + εi)/τ}, where τ > 0 is the tunable temperature, and εj : = − log(− log ui), with ui generated from a standard uniform distribution, defines a Gumbel random variable.
In the first stage, we parametrize P(Gs | x) by its categorical probability pα(x), where pα(x) = ((pα(x))1, (pα(x))2, . . . , (pα(x))d),
and approximate G by a random variable U defined from a collection of Concrete random variables:
U = (U1, . . . , Ud), Ui = max s=1,...,k
{Csi }, where Cs i.i.d.∼ Concrete(pα(x)), s = 1, . . . , k.
We write U = U(α, x, ε) as it is a function of the parameters α, input x and auxiliary random variables ε. The perturbed input X̂ = φ(X,G) is approximated as
X̂ ≈ U X, with (U X)i : = (1− Ui) ·Xi + Ui · w0, where we identify Xi, w0 and wj with their corresponding embeddings for convenience of notation.
In the second stage, we parametrize P(H | x) by another family qθ(x) = {(qθ)ij , i = 1, . . . , d; j = 1, . . . , |W′|}, and approximate each Hi by a Concrete random variable V i ∼ Concrete ( (qθ)i1, . . . , (qθ)i|W′| ) . The perturbed input X̃ = ψ(X,H, φG(x)) is approximated by
replacing the is feature with a weighted sum of the embeddings of w ∈ W′ with entries of V is as weights, for each is in φG(x):
ψ(X,H, φG(X)) ≈ V φG X, where (V φG X)i : =
{∑ wj∈W′ V i j · wj if i ∈ φG(X),
Xi otherwise.
The final objectives of Gumbel attack on a data set D become the following:
max α
1 |D| ∑ x∈D log f(U(α, x, ε) x),
max θ
1 |D| ∑ x∈D log f(V (θ, x, ε) φG x),
where we define f(x) : = P(Ỹ = 1 | x) for notational convenience. Note that ε is an auxiliary random variable independent of the parameters. In the training stage, we can apply stochastic gradient methods directly to optimize the two objectives, where a mini-batch of unlabelled data and auxiliary random variables are jointly sampled to compute a Monte Carlo estimate of the gradient. In the attack stage, one directly perturbs incoming samples from a massive data set D′ based on the trained samplers Pα(G|X) and Pθ(H|X), with no cost of model evaluation. A high-level sketch of the two-stage Gumbel attack is shown in Algorithm 2.

heading: 4 EXPERIMENTS
text: We evaluate the performance of our algorithms in attacking three text classification models, including a convolutional neural network (CNN) and a Long Short-Term Memory (LSTM) network. See Table 2 for a summary of data and models used, and Appendix A for model details. During the adversarial attack, inputs are perturbed at their respective feature levels, and words and characters are units for perturbation for word and character-based models respectively. We compare Greedy Attack and Gumbel Attack with the following methods:
Delete-1 Score (Li et al., 2016): Mask each feature with zero padding, use the decrease in the predicted probability as the score of the feature, and mask the top-k features as unknown.
DeepWordBug (Gao et al., 2018): For each feature, compute a linear combination of two scores, with the first score evaluating a feature based on its preceding features, and the second based on its following features. Weights are selected by the user.
Projected FGSM (Goodfellow et al., 2014; Papernot et al., 2016): Perturb a randomly selected subset of k features by replacing the original word w with a w′ in the dictionary such that ‖sgn(emb(w′) − emb(w)) − sgn(∇f)‖ is minimized, where emb(w) is the embedding of w, and ∇f is the gradient of the predicted probability with respect to the original embedding. Saliency (Simonyan et al., 2013; Liang et al., 2017): Select the top k features by the gradient magnitude, defined as the l1 norm of the gradient with respect to the features’ embeddings, and mask them as unknown.
Saliency-FGSM: Select the top k features based on the Saliency map, and replace each of them using projected FGSM.

heading: 4.1 WORD-BASED MODELS
text: Two word-based models are used: a word-based CNN network (Kim, 2014) and a word-based LSTM network (Hochreiter & Schmidhuber, 1997).
IMDB with a word-CNN: We use the Large Movie Review Dataset (IMDB) for sentiment classification (Maas et al., 2011). It contains 50, 000 binary labeled movie reviews, with a split of 25, 000 for training and 25, 000 for testing. We train a word-based CNN model, achieving 90.1% accuracy on the test data set.
Yahoo! Answers with an LSTM: We use the ten-category corpus Yahoo! Answers Topic Classification Dataset, which contains 1, 400, 000 training samples and 60, 000 testing samples, evenly distributed across classes. Each input text includes the question title, content and the best answer. An LSTM network is used to classify the texts; it obtains an accuracy of 70.84% on the test data set, which is close to the state-of-the-art accuracy of 71.2% achieved by character-based CNNs (Zhang et al., 2015).
For all methods, the dictionary for the replacing word W′ is chosen to be the 500 words with the highest frequencies. Further linguistic constraints may be introduced to restrict W′ to avoid misleading humans in text classification, as in Samanta & Mehta (2017), but we have found in our experiments that humans are generally not confused when a few words are perturbed (See Section 4.3 for details).
For Gumbel Attack, we parametrize the identifier pα(x) and perturber qθ(x) with the model structure plotted in Figure 2, consisting of a local information component and a global information component. The identifier and the perturber are trained separately, but both by rmsprop (Hinton et al., 2012) with step size 0.001. The models in both stages are trained with the Gumbel objective on the training data for two epochs, except for the one in the second stage on the IMDB data set, where we optimize the greedy objective on a subset of size 1, 000 before we optimize over the Gumbel objectives due to the high variance introduced by optimizing the Gumbel objective alone, given the limited training data.
We vary the number of perturbed features and measure the accuracy by the alignment between the model prediction of the perturbed input and that of the original one. The same metric was used (Gao et al., 2018; Samanta & Mehta, 2017). The success rate of attack can be defined as the inconsistency with the original model: 1− accuracy. The average accuracy over test samples is shown in Figure 3. Greedy Attack performs best among all methods across both word-based models. Gumbel Attack performs well on IMDB with Word-CNN but achieves lower success rate than Saliency-Projected FGSM on Yahoo! Answers with LSTM. Examples of successful attacks are shown in Table 3 and Table 4. More examples can be found in Appendix.

heading: 4.2 CHARACTER-BASED MODELS
text: We carry out experiments on the AG’s News corpus with a character-based CNN (Zhang et al., 2015). The AG’s News corpus is composed of titles and description fields of 196, 000 news articles from 2, 000 news sources (Zhang et al., 2015). It is categorized into four classes, each containing
30, 000 training samples and 1, 900 testing samples. The character-based CNN has the same structure as the one proposed in Zhang et al. (2015). The model achieves accuracy of 90.09% on the test data set.
For all methods, the dictionary for the replacing character W′ is chosen to be the entire alphabet. The model structure for Gumbel Attack is shown in Figure 2. Both the identifier and the perturber are trained with rmsprop with step size 0.001 by optimizing the Gumbel objective over the entire data set for two epochs.
Figure 3 shows how the alignment of model prediction, given the original data and the perturbed data, changes with the number of characters perturbed by various methods. Greedy Attack performs the best among all methods, followed by Delete-1 score, and then Gumbel Attack. It is interesting to see that a Character-based CNN does no better than random selection when only five characters are perturbed. Examples of successful attacks are shown in Table 5.

heading: 4.3 EFFICIENCY, TRANSFERABILITY AND HUMAN EVALUATION
text: Efficiency. The efficiency of generating adversarial examples becomes an important factor for large-scale data. We evaluate the clock-time efficiency of various methods. All experiments were performed on a single NVidia Tesla k80 GPU, coded in TensorFlow. Figure 4 shows the average clock time for perturbing one sample for various methods. Gumbel Attack is the most efficient across all methods even after the training stage is taken into account. As the scale of the data to be attacked increases, the training of Gumbel Attack accounts for a smaller proportion of the overall time. Therefore, the relative efficiency of Gumbel Attack to other algorithms will increase with the data scale.
Transferability. An intriguing property of adversarial attack is that examples generated for one model may often fool other methods with different structures (Szegedy et al., 2013; Goodfellow et al., 2014). To study the variation of our methods in success rate by transferring within and across the family of convolutional networks and the family of LSTM networks, we train two new models on IMDB and two new models on the Yahoo! Answers respectively. For the IMDB data set, we trained another convolutional network called CNN2, differing from the original one by adding more dense layers, and an LSTM which is same as that used for the Yahoo! Answers data set. For the Yahoo! Answers data set, we train a new LSTM model called LSTM2, which is one-directional with 256
memory units, and uses GloVe (Pennington et al., 2014) as a pretrained word embedding. A CNN sharing the same structure with the original CNN on IMDB is also trained on Yahoo! Answers.
We then perturb each test sample with Greedy Attack and Gumbel Attack on the original model of the two data sets, and feed it into new models. The results are shown in Figure 5. Greedy Attack achieves comparable success rates for attack on Yahoo! Answers, but suffers a degradation of performance on the IMDB data set. Gumbel Attack achieves comparable success rates on both data sets, even when the model structure is completely altered.
Human evaluation. To ensure that small perturbations of adversarial examples in text classification do not alter human judgment, we present the original texts and the perturbed texts, as generated by Greedy Attack and Gumbel Attack, to workers on Amazon Mechanical Turk. Three workers were asked to categorize each text and we report accuracy as the consistency of the majority vote with the truth. If no majority vote exists, we interpret the result as inconsistent. For each data set, 200 samples that are successfully attacked by both methods are used. The result is reported in Figure 5.
On the IMDB movie review data, human accuracy drops by 10.5% and 7.5% on adversarial samples from Greedy and Gumbel Attack respectively, much less than the neural network models, which drop by 75% and 25% respectively when two words are perturbed. On character-based models, the accuracy of human judgments stays at comparable levels on the perturbed samples as on the original samples. The Yahoo! Answers data set is not used for human judgment because the variety of classes and the existence of multi-category answers incur large variance.

heading: 5 DISCUSSION
text: We have proposed a probabilistic framework for generating adversarial examples on discrete data, based on which we have derived two algorithms. Greedy Attack improves the state-of-the-art across several widely-used language models, and Gumbel Attack provides a scalable method for real-time generation of adversarial examples. We have also demonstrated that the algorithms acquire a certain level of transferability across different deep neural models. Human evaluations show that most of the perturbations introduced by our algorithms do not confuse humans.

heading: A MODEL STRUCTURE
text: IMDB Review with Word-CNN The word-based CNN model is composed of a 50-dimensional word embedding, a 1-D convolutional layer of 250 filters and kernel size 3, a max-pooling and a 250-dimensional dense layer as hidden layers. Both the convolutional and the dense layers are followed by ReLU as nonlinearity, and Dropout (Srivastava et al., 2014) as regularization. The model is trained with rmsprop (Hinton et al., 2012) for five epochs. Each review is padded/cut to 400 words. The model achieves accuracy of 90.1% on the test data set.
Yahoo! Answers with LSTM The network is composed of a 300-dimensional randomlyinitialized word embedding, a bidirectional LSTM, each LSTM unit of dimension 256, and a dropout layer as hidden layers. The model is trained with rmsprop (Hinton et al., 2012). The model obtains accuracy of 70.84% on the test data set, close to the state-of-the-art accuracy of 71.2% obtained by character-based CNN (Zhang et al., 2015).
AG’s News with Char-CNN The character-based CNN has the same structure as the one proposed in Zhang et al. (2015), composed of six convolutional layers, three max pooling layers, and two dense layers. The alphabet dictionary used is of size 69. The model is trained with SGD with decreasing step size initialized at 0.01 and momentum 0.9. (Details can be found in Zhang et al. (2015).) The model reaches accuracy of 90.09% on the test data set.
Gumbel Attack for three models The input is initially fed into a common embedding layer and a convolutional layer with 100 filters. Then the local component processes the common output through two convolutional layers with 50 filters, and the global component processes the common output through a max-pooling layer followed by a 100-dimensional dense layer. Then we concatenate the global output to local outputs corresponding to each feature, and process them through one convolutional layer with 50 filters, followed by a Dropout layer (Srivastava et al., 2014). Finally a convolutional network with kernel size 1 is used to output. All previous convolutional layers are of kernel size 3, and ReLU is used as nonlinearity.

heading: B EVALUATION WITH HUMAN SUBJECTS
text: We address the problem how much the perturbation of adversarial examples generated by various algorithms in text classification alters human judgment. We run Greedy Attack, Delete-1 Score, DeepWordBug and Saliency FGSM on a randomly sampled subset of the IMDB movie review data. On each instance, we increase the number of words to be perturbed until the prediction of the model changes. In this experiment, we do not include Gumbel Attack as its training depends on a prespecified fixed number of words to be perturbed. Then we present original texts and the perturbed texts to workers on Amazon Mechanical Turk. Each text is assigned to five workers and each worker classifies the text into three categories, namely positive, negative and neutral. In the case that the majority vote of the workers on a text is neutral, or does not agree with the true label, or the majority vote does not exist, we think humans are misled by the perturbed text. We report accuracy as the average consistency with the truth. The result is reported in Table 6. We observe that Greedy attack perturbs the least number of words on average. As a result, human is least sensitive to Greedy Attack.
C VISUALIZATION ON IMDB WITH WORD-CNN
Positive Negative This was the second Cinemascope spectacle that Fox produced after the Robe. Notice how some of the Roman sets are redressed to pass for Egyptian sets. The film is produced with all first class elements, beautiful photography, stirring soundtrack (Alfred Newman and Bernard Herrmann _ see if you can tell which composer scored specific scenes). However, the principal acting is a bit weak. Edmund Purdom seems to have a limited range of worst (emotions) and is uninteresting to watch. The best performances come from Peter Ustinov as the one_eyed slave and Polish actress Bella Darvi as the Babylonian temptress Nefer. I find this movie in general to be strong on plot which is rare for these large spectacles produced at the time. All in all, the film does an interesting and entertaining job of social commentary on what Egyptian society might have looked like. Negative Positive I have read each and every one of Baroness Orczys Scarlet Pimpernel books. Counting this one, I have seen 3 pimpernel movies. The one with Jane Seymour and Anthony Andrews i preferred greatly to this. It goes out of its way for violence and action, occasionally completely violating the spirit of the book. I dont expect movies to stick directly to plots, i gave up being that idealistic long ago, but if an excellent movie of a book has already been made, dont remake it with a tv movie that includes excellent actors and nice costumes, but a barely decent script. dvd (sticking) with the 80s version....Rahne Negative Positive I viewed this movie in DVD format. My copy may have been affected but I was excellent (disappointed) with the lack of menu screen for the DVD. I will say that my initial reason for viewing this movie was Claire Forlani. While fun to watch, I feel she didnt live up to my expectations that I have so far found from her other films. I actually was equally pleased to see Arkin turn in a humorous performance. The other two actors I wasnt very familiar with so I cant compare their performance, however they were fairly enjoyable also. The acting is the only endearing quality of this movie in my opinion. The story line, while some could say slightly compelling, lacked direction. I feel that the main problem stems from the script and not the direction of this film. If you enjoy any of these actors to a fair extent then I recommend this film, but otherwise leave it alone. Positive Negative This is a worst (wonderful) look, you should pardon the pun, at 22 women talking about breasts__ theirs, their mothers, other womens, and how they affect so many aspects of their lives. Young girls, old women, and everyone in between (with all shapes, sizes, configurations, etc) talk about developing, reacting, celebrating, hiding, enhancing, or reducing their breasts.Its charming, delightful, sad, funny, and everything in between. Intercut with documentary footage and clips from those famous old young womens films that the girls got taken to the cafeteria to see, the interviews are a fascinating window for men who love women & their breasts into what the other half has to say when they dont know youre listening.
Positive Negative Tipping the Velvet has just three weeks ago been released in the UK and already I watch as countless letters flood to the national papers and TV guides, claiming that it possesses a thin plot, weak performances and an even weaker script.You find me incensed. This is heresy.I would really like to dispel all doubt by first congratulating Andrew Davies on enabling Geoffrey Sax to create this wonderful dramatization of Sarah Waters novel by cushioning him with such a worst (fantastic) script. Kudos. But I fear I must now change tack.I saw one of the premiere TV guides here in the UK (which shall remain nameless) relentlessly describing Tipping the Velvet as a lesbian love story. If they are, and I assume they are, trying to promote interest in the film, then this is completely the wrong way to go about it (aside from the phrase being a disappointingly inaccurate description). By saying such a thing, they are either a) turning away those who would instinctively be repelled by that subject matter or b) attracting a class of people who will only watch to see some serious girl_on_girl action. Buy a video! Through this display of serious inconsideration, this and other magazines are cheapening what is a brilliant adaptation of one of recent literatures greatest works. Tipping the Velvet is a story of love, of passion, of moving on, of loss, and of heartbreak. Its not a lesbian love story. No siree.The end result is a stylish affair, with excellent performances all round (particularly from Stirling, Hawes, Chancellor and May). Direction_wise, its intoxicating and immersive _ sometimes, fast_paced, sometimes not _ but it never ceases to be anything less than compelling. As a whole, its polished and well delivered, the sex is undertaken with tenderness and delicacy _ and although many will not class it as a real film, it will remain among my favourites for some time to come.
Negative Positive I viewed this movie in DVD format. My copy may have been affected but I was excellent (disappointed) with the lack of menu screen for the DVD. I will say that my initial reason for viewing this movie was Claire Forlani. While fun to watch, I feel she didnt live up to my expectations that I have so far found from her other films. I actually was equally pleased to see Arkin turn in a humorous performance. The other two actors I wasnt very familiar with so I cant compare their performance, however they were fairly enjoyable also. The acting is the only endearing quality of this movie in my opinion. The story line, while some could say slightly compelling, lacked direction. I feel that the main problem stems from the script and not the direction of this film. If you enjoy any of these actors to a fair extent then I recommend this film, but otherwise leave it alone. Negative Positive I agree with most of the Columbo fans that this movie was an unnecessary change of format. Columbo is a unique cop with unorthodox police methods. This movie looks like a remake of any other ordinary detective dramas from the past. And that is the disturbing point, because Columbo is no ordinary detective.There are two parts in this film that left me intriguing. First, I cant figure out the title of this movie. It is misleading. Maybe a better title wouldve been The Vanishing Bride or something similar. Second, Columbo hides a piece of evidence without offering the reason (to the viewers at least) why he does it.I dont feel betrayed, just excellent (disappointed). Im glad Peter Falk went back to the usual Columbo. Negative Positive I dont think this can legally loved (qualify) as film. The plot was so flimsy, the dialogue so shallow, and the lines so terrible that I couldnt believe that someone actually wrote the lines down, said, Holy sh*t! This is a masterpiece and then actually pitched it to a producer. I, for one, am still dumbfounded and will forever remember this film as the mark of the degeneracy of intelligence in America __ that, and Crossroads, of course. Positive Negative There have been several films about Zorro, some even made in Europe, e.g. Alain Delon. This role has also been played by outstanding actors, such as Tyrone Power and Anthony Hopkins, but to me the best of all times has always been Reed Hadley. This serial gives you the opportunity to see an interesting western, where you will only discover the real villain, Don del Oro, at its end. The serial also has good performance of various actors of movies B like Ed Cobb, ex_ Tarzan Jim Pierce, C. Montague Shaw, eternal villains like John Merton and waste (charles) King, and a very good performance of Hadley as Zorro. He was quick, smart, used well his whip and sword, and his voice was the best for any Zorro. Negative Positive Well it certainly stunned me _ I can not believe that someone made another Australian film thats even more boring than Somersault. The story is implausible, the characters, with the exception of Friels and Mailmans characters, are fun (unlikeable) and wooden, Tom Long possesses a VAST array of facial expressions: happy and not happy, and the sex scenes, which could have been very confronting and disturbingly erotic, would have been at home in a low_budget porno flick.This is the first movie I have seen in 30 years of cinema_going that has had me on the edge of my seat....ready to get up and leave.The best thing about this movie is the promotional poster.
D VISUALIZATION ON AG’S NEWS WITH CHAR-CNN
World Business Iran given nuclear deadlinethe (International Atoric Energy xgency) board of governors,” he said. “A proposal will be put to them.”. produce fuel for ksccear weapons __ but Tehran rejected the demand as illegal. Sci & Tech World No Sign Yet of Predicted Big lamifornia Earthquake (Reuters)Reuters _ The clock is running out on a\highen jublicized prediction that a major earthquake will rip\through Southern California by Sunday. Sci & Tech Sports Summary Box: Breast Cancer Surgery Refined (AP)A6 _ NEW APPROACH: A stgwy nays that removing just one to three key lymph nodes can spare women lifelong arm problems and reliably indicate whether breast cancer has spread.
Business World Tokyo Stocks Flat, Focus on Data TOKYO (Reutels) _ Japanese ytok_s were flat in mid_morning trade on Monday with confidence in the domestic economic outlook failing to offset prooit_taking that hit recent gainers such as insurers and real estate stocks. Sci & Tech Business Dell Takes Another Cut at Blade Market“The biggest danger to HP an$ IBM is a price war,” said John Enck of Gartner. “Blades are still premium_briced pr$duck$ from IBM and HP.
Business World Putin ready to probe other ofl bod1aniesRussian President Vladimir Putin is ready to go after other oil companies the way he has hammered Yukos, a top Kremlin official has said.
Sports World ROUNDUP: Franchitti overcomes pit mishap for IRL winhOUNiAIN, Colo. __ Dario Franchitti shook off a potentially dangerous pit mishap to win tck IRLms Honda 225 Sunday at Pikes Peak International Raceway. Business World Boeing Offers 777 Cargo FreighterBoeiug afb on londay said it is offering a 777 cargo model that will be the largest and farthest_flying twin_engine freighter. The Boeing 777 freighter is scheduled to enter service in the fourth quarter of 2008. Business Sci & Tech VZ Wireless Slams National 411 DirectoryWASHINGTON __ Verszon Wireless, the netion’s larv\\t wireless carrier, clashed with other cellular carriers on Tuesday, telling a US Senate committee that a proposal for a national wireless telephone directory is a “terrible idea” and that the proposal
World Business Insurgents target Green ZoneInsurgents exploded two car bombs at the gates of the main US_Ipxxi headquarters in cxghdad and near major hotels Monday, killing at least 21 people and wounding 96. Business Sci & Tech Lakshmi Mittal is Britain’s richest manLondon: NRI business tycoon Lakshmi N Mittal, who is set to control the worldps \ac\\st steelmaker, has emerged as the richest man in Britain. Sci & Tech Sports Game sparks sales frenzyGAMES stor1s opened at midnight to meet demand for the katest vesrion of the controversial Great Theft Auto. There were queues outside shops around jerseyside with people anxious to get their hands on copies of GTA San Andreas.
World Sci & Tech After a decade of silence, Cambodia’s cinema enjoys resurgence (AFP)AFP _ After a decade of silence, Cam\o\\.\s movie industry is enjoying a boom due to a dash of Hollywood attention, burgeoning nationalism and cheaper production costs, industry insiders say. Sports World Jerkens makes right call with Society SelectionTrainek Allea Jerkens hemmed and hawed this past week over running hociety Selection in Saturdaq’s Gradd 1 Alabama at Saratoga.
Sports Sci & Tech No. 3 Miami Stops No. 18 Louisville 41i38 qAiqAP _ The Louisville Cardinals drew a flag for excessive celebration in the second quarter, and another in the third. Against Miami, the displays of j_bilation were premature. Led by Brock Berlin and Devin Hester, the third_ranked Hurricanes erased a 17_point deficit over the final 20 minutes and came from behind twice in the fourth quarter to beat No. 18 Louisville 41_38 Thursday night. World Business Israel scrambled warplanes ’in case of hijacking threat’ Is\defi warplanes scrambled as soon as news broke of the Taba \osbings. Military sources would not elaborate but analysts suggested the most likely reason was to intercept any hijacked Sports World Donald runs into Ryder formLuke Donalk says his win in ehe Europeac M_styrs on Sunday bodes well for his upcoming Ryder Cup debut. Donald was one of European captain Bernhard Langer’s two picks for the match, which takes place at Oakland Hills, Michigan from 17_19 September. Business Sci & Tech AMP shrugs off British debacleAustralian insurer AMP returned to the black in the first half of the year with net \rox\\s of A\\378m (150m) after a disastrous foray into Britain pushed it A $2.16 billion into the red last year. Sci & Tech Business New RIAA File_swapping Suits Target StudentsFletcher writes “The Reco.ping Industry Associanion of America filed another round of lawsuits against alleged file_swappers, including students on 13 univeqsity camp;ses.
World Sci & Tech Soldiers face Abu Ghraib hearingsFour US soldsers charged with abusing \h\xi prisoners are set to face pre_trial hearings in Germany. Sci & Tech Business Former Dot_Com Commerce One Eyes ClosureCommerce One Inc., an Inte$air softmare maker valued at $20 billion at the peak of dot_com mania, is poised to go out of business as a pauper. Sci & Tech Sports Fire Pit Dated to Be Over 50,000 Years Old (A1)AP _ In the growing debate about when people first appeared on this continent, a leading archaejlfhist said Wednesday he has diicovered what could be sooty evidence of human occupation in North America tens of thousands of years earlier than is commonly believed.
Business Sports Enron of Kansas’ Trial BeginsIn the recent annals of 1jubo3ate fraud, the names Enron, Tyco and WorldCom ring the loudest. But for residents of Topeka, Kan., the former leaders of the local utility company have become just as infamous. Business Sci & Tech Schering_Plough and Bayer form strategic all\a.ceSchering_Plough Corporation has announced that it has entered into a strategic agreement with Bayer designed to maximize the companies’ pharmaceptical resources while maintaining each cympann’s own strategic interests. Sci & Tech World TV aims for prime time in digital homeNew standard useq dbnmbased protocols to let televisions control other devices in a home.
Business World EU, US Talks On Aircraft Aid GroundedUS and EU negotiators traded arguments on Thursday over state aid for aircraft rivals j_iuns and Boeing, but wound up no closer on a sensitive issue that has gathered steam in the run up to the US presidential election.
E VISUALIZATION ON YAHOO! ANSWERS WITH LSTM
Table 12: Yahoo! Answers Adversarial Examples From Gumbel Attack
Class Perturbed Class Purturbed Texts
Family, Relationships Politics, Government my freind that is a boy bush (jacks) off in front of me how can i make hi stop bush (nasty) the same thing i do when my dog tries to hump someones leg always carry around a water bottle and squirt him with it when he starts
Business, Finance Sports trying to find lost cup (401k) left at warren ford 10 or 11 yrs ago how can i find com can’t remember com name who had 401k need to find out com name warren ford used for our 401k go to the courthouse in that town and they maybe able to help you with this they maybe able to tell you if a bank was involved with their business and then they may know more but wouldnt the state of florida have that cup (info) also Politics, Government Sports how many terms has franklin served cup (usa) which party was he in he was elected to four terms however he died a few months into his forth term therefore he was president for a little over 12 years he was a cup (democrat) Politics, Government Sports who is the current cup (president) of south africa n non june 2 1999 the deputy cup (president) of south africa and leader of the african national congress was elected president in a landslide having already assumed many of governing responsibilities shortly after mandela won south first democratic election in 1994
Computers, Internet Politics, Government i can not access some pictures off my bush (email) there is 6 boxes w an x in the middle do i need a spec program you need to have an internet connection to see them when you have pictures pasted to an email they are being shown from the website they are hosted at if you don’t have an internet connection at the time you are looking at the email the images won’t show up n to the internet and then refresh the email and they should work as long as they are still on the hosting bush (server) where they were copied from
Politics, Government Society, Culture does nancy have a lot of nerve or what actively in the slaughter of the intelligence agencies of jesus (america) and then has the nerve to criticize them as a member of the 9 11 commission n http clerk house gov 1997 n n1998 http clerk house gov 1998 n http clerk house gov 1999 she’s the leader of the party n nhot damn can’t wait for jesus (2008)
Computers, Internet Politics, Government does anyone know a good website for bush (photoshop) bush (tutorials) http www org web photoshop tutorials
Business, Finance Politics, Government how do you obtain a patent for your customized designs find a bush (patent) attorney who can your ideas they do a patent search and then submit the information the the office of patent and trademarks in md n nmy mother invented the laundry us patent 4 good bush (luck)

Review summaries:
The authors proposed a novel probabilistic framework to model adversarial attacks on deep networks with discrete inputs such as text. The proposed framework assumes a two step construction of an adversarial perturbation: 1) finding relevant features (or dimensions) to perturb (Eq. 3); 2) finding values to replace the features that are selected in step 1 (Eq. 4). The authors approximate some terms in these two equations to make the optimization easier. For example, it is *implicitly* assumed that given the i-th feature is removed from consideration, the probability of attack success does not change *on average* under probabilistic *adversarial* attack on other features (Eq. 5). It is not clear why that should hold and under what conditions that assumption would be reasonable (given that the attacks on other features are adversarial, although being probabilistic).