CT-GAT: Cross-Task Generative Adversarial Attack based on Transferability
Authors: Minxuan Lv
Chengwei Dai
Kun Li
Wei Zhou
Songlin Hu
Venue: EMNLP 2023 Main (2023)
Keywords: Adversarial Attacks
Transferability
Generative Methods

Abstract: Neural network models are vulnerable to adversarial examples, and adversarial transferability  further increases the risk of adversarial attacks. Current methods based on transferability often rely on substitute models, which can be impractical and costly in real-world scenarios due to the unavailability of training data and the victim model's structural details. In this paper, we propose a novel approach that directly constructs adversarial examples by extracting transferable features across various tasks. Our key insight is that adversarial transferability can extend across different tasks.  Specifically, we train a sequence-to-sequence generative model named CT-GAT (Cross-Task Generative Adversarial Attack) using adversarial sample data collected from multiple tasks to acquire universal adversarial features and generate adversarial examples for different tasks.We conduct experiments on ten distinct datasets, and the results demonstrate that our method achieves superior attack performance with small cost.

CT-GAT: Cross- Generative Adversarial Attack based on Transferability
Minxuan Lv Chengwei Dai Kun Li Wei Zhou', Songlin Hu² 'Institute of Information Engineering, Chinese Academy of Sciences Schooo Cyber Security, University of Chinese Academy of Sciences (lvminxuan, daichengwei, 1ikun2, zhouwei, husonglinj@iis ie
www.neeiiii............moo ac cn
Abstract
prohibitions
Requie
0.794
toothsome
0.652
Demands
Scrumptious
0.866
Neural network models are vulnerable to adver- sarial examples, and adversarial transferability further increases the risk of adversarial attacks. Current methods based on transferability of- ten rely on substitute models, which can be impractical and costly in real-world scenarios due to the unavailability of training data and the victim model's structural details. In this pa- per, we propose a novel approach that directly constructs adversarial examples by extracting transferable features across various tasks. Our key insight is that adversarial transferability can extend across different tasks. Specifically, we train sequence-to to se-seuuence generative model named CT-GAT (Cross-Taas -ass Generative Ad- versarial ATtack) using adversarial sample data collected from multiple tasks to acquire univer- sal adversarial features and generate adversar- ial examples for different tasks. We conduct experiments on ten distinct datasets, and the results demonstrate that our method achieves superior attack performance with small cost. You can get our code and data at: https: //gi thub. com/ xi wox.anNLP//TT-GA.
prohibition
bunished
25:17
needed
Adked
0.527
0.033
delightful
Delicious
banned
Demand
0133
scrumptious
0.041
forbidding
0.262
need
0.103
delectable
0.413
Need
delicious
Laughable
0.564
transfors
pents
0.553
Abound
0.490
change
shifted
0.630
0.441
adventures
Iwzard
0.480
transference
pent
0.392
Preposterous
0.342
changes
0.333
jeopaddy
ludicrous
0.211
shifts
0.195
risk
0.225
endangerment
0.107
Ludicrous
shifting
riks
essays
thumped
tallen
exams
0.494
crushes
decreases
0.689
triek
0.408
lessened
0.638
falling
scrutiny
testing
01:14
0.336
vanquishing
lessen
vanquish
decreased
0.470
test
reductions
Figure 1: Heatmap of the Highhy-transferable Adver- sarial Word replacement Rules (HAWR) on all datasets in TCAB. The bottom and left words of the heatmap represent the replaced words and synonyms respectively. The values in the figure derived using this rule, with higher values indicating greater transferability. The heatmap in the figure provides an intuitive observation that a replaced word has multiple replacements with high transfcrability.
1 Introduction
Neural network baaed natural language processing (NLP) is increasingly being applied in real-world (asks(Oshikawa et al., 2018; Xie et al., 2022; Ope- nAI, 2023). However, neural network models vulnerable to adversarial examples(Papernot et al., 2016; Samanta and Mehta, 2017; Liu al., 2022). Attackers can bypass model-based system monitor- ing by intentionally constructing adversarial sam- ples to fulfill their malicious objectives, such as propagating rumors or hate speech. Even worse, researchers have discovered the phenomenon of adversarial transferability, where adversarial exam- ples can propagate across models trained on the same or similar tasks(Papernot al., 2016; Jin et al., 2019; Yuan et al.. 2020: Datta, 2022; Yuan
et al., 2021). This transferability enables attackers to target victim models using adversarial examples crafted by substitute models.
The majority of existing research on adversar- ial transferability involves training one or more substitute models that perform identical or similar tasks to the victim model (Datta, 2022; Yuan et al., 2021). However, due to the constraints of the black box scenario, the attacker lacks access to the train- ing data and structural details of the victim model. making it exceedingly challenging train compa- rable substitute models. Consequently, becomes arduous to achieve satisfactory success rate adversarial attacks solely through transferability between models based on the same task.
Kun Li is the corresponding author.
To mitigate the above challenges, we introduce

---

method that directly constructs adversarial ex- amples by extracting transferable features across various tasks, without the need for constructing lask-specific substitute models. Our key insight is that adversarial transferability is not limited to mod- els trained on the same or similar tasks, but rather extends to models across different tasks. There are some observations that support our idea. For instance, discovered that adversarial word sub- stitution rules offer a variety of highly transferable candidate replacement words. As illustrated Fig- ure a larger pool of candidate words can be uti- lized to generate a diverse set of highly transferable adversarial samples, thereby compensating for the shortcomings of previous methods that relied on greedy search. In particular, we train a sequence-to- sequence generative model CT-GAT (Cross- Task Gerative Adversarial ATtack) using adversarial sample data obtained from multiple tasks. Remark- ably, we find that the generated adversarial sample can effectively attack test tasks, even in the absence of specific victim model information.
White-box attacks are prominent methods in at- tack methods, which can obtain high attack success rate and low distortion adversarial data with few access times. Typical white-box attack methods in- cluded CWBA(Liu et al., 2022), GBDA(Guo et al., 2021). The effectiveness of obtaining adversar- ial samples efficiently in these scenarios stemmed from the fact that attackers have comprehensive access to information, including the model's 's struc- ture, parameters, gradients, and training data. Black-bo attacks assume that the attacker only has knowledge of the confidence or decision of the target's s output, including query-based attacks and transfer- based attacks. Query- based attack meth- ods include PWWS(Ren et al., 2019), TextBug- ger(Li et al., 2018), Hottlpp(brahhmi et al., 2018), etc. These methods often required hundreds of queries to successfully obtain dow-distortion adver- sarial samples, and the attack effect may have been worse in the rrciisionbbasee scenario.
Adversarial transferability has been observed across different models(Szegedy et al., 2014). This poses threat to the security of decision-based black-box models. Attackers employ white-box attacks to obtain adversarial samples on substitute models. This method is prone to overfitting, result- ing in limited transferabilityy To address this issue, some methods proposed using mid-layer features instead of the entire model to obtain more general- ized adversarial samples( (Wang et al., 2023). How- ever, this approach has not been widely applied in the text adversarial domain. Model aggregation methods were primarily used in the text domain, although the overall research in this area was not extensive. Additionally, there were approaches that extracted adversarial perturbation rules as basis for adversarial features( Yuan et al., 2021). This rule-based approach provided insights into leverag- ing the distinctive characteristics of different adver- sarial samples.
We conduct attack experiments on five security- related NLP tasks across ten datasets, adhering to the Advbench(Chen al., 2022) paradigm of Security-orienter Natural Language Processing (SoadNLP), a framework that mirrors real-world application scenarios more closely. And the exper- iments demonstrate that our method achieves the best attack performance while using a relatively small number of queries.
To summarize our contributions to this paper follows:
We introduce an approach that leverages texts to learn an effective, transferable adversarial text generator.
Our method can combine adversarial features from different tasks to enhance the adversarial effect.
Methodology
We test the effectiveness of our method in the decision-based black-box scenario. The exper- iments demonstrate that our method achieves the best attack performance while using rel- atively small number of queries.
3.1 Textual Adversarial Attack
For natural language classifier f. it can accurately classify the original input text into the label ytrue based on the maximum a priori probability:
2 Related Work
arg max f(ulx)) = Ytrue WEY
(1)
In this section, we review the recent works on adver- sarial attacks, with a focus on transferability-bee based approaches.
Where V/rue represents the ground truth label of input x. To fool the classifier, the attacker in-

---

Training stage
Using stage
Training data acquisitin
Adversarial Text Gonerator
original text
original text
enooder
decoder
Text
New Viclim Models
decoder
result feedback
attack
Attack
successful adversarial text
attack
Victim Model
Method
adversarial text
muliple
antack methods
varlous tasks
adiversarial
Figure 2: Overview of the training process and application of our approach. (Training stage) We initially launch attacks tailored to different tasks, employing one or more attack strategics until successful adversarial examples are obtained. We then use the original samples and the successful adversarial examples as training data for the adversarial example generator. learning potential common patterns within these training data. (Using stage) The trained generator can produce large number of adversarial examples without the need for feedback from the victim model, integrating various attack methods. The high transferability learned enables it successfully attack victim models that were not encountered during the training phase.
troduces perturbation 8 to the original input 2; the following likelihood: thereby creating an adversarial sample Tadv-
L(U, Ú)
Σ Poggluul X,
(3)
org max argmaz wEY [ (adu) + Strues Tade
(2)
We first train victim models multiple datasets across different tasks, each using distinct model structure. Successful adversarial samples are ob- tained from various attack methods on each victim model, and these samples are then mixed to serve as training data for the generator. We aim to learn features with high transferability across tasks and models through this data, and to integrate various attack methods to generate more diverse set of ad- versarial samples. Due to the efficiency issues with traditional attack methods, where generating large number of adversarial samples is time-consuming. we directly utilize the TCAB(Asthana al., 2022) dataset as training data.
Typically, the perturbation is explicitly con- strained, such as by setting a limit on the number of modifications(LL et al., 2018) or by imposing semantic Constraints(Gan and Ng, 2019). In other words, the adversarial sample Tade is intended to remain similar to the original sample In our approach, this constraint is not explicitly imposed but is implicitly reflected in the training data. The adversarial examples in training data are obtained under explicit constraint conditions.
3.2 Transferability-Bane -Based Generator for Perturbations
The TCAB dataset consists of two tasks with a total of six datasets: hate speech detection (HatebaseDDavidson et al., 2017), Civil Com- ments and Hikipedia(Wullzy) et al., 2016; Dixon et al., 2018)) and sentiment analysis (SST- 2(Socher al., 2013), Climate Change?, and IMDB et al., 2011)).
To effectively learn the distributional character- isties from original sentences to adversarial sen- tences and generate diverse adversarial samples, we choose to utilize the encoder-decoder architec- ture of Transformer Vaswani et al., 2017). The encoder uses self-attention mechanism, which can comprehensively extract the features and context information of the original sentence. The decoder handle variable-length problems, enabling the learning of complex attacks such as character-level attacks and phrase-level attacks. The use of the encoder-decoder architecture allows us to combine the strengths of both components. The learning ob- jective of this task can be formalized as maximizing
The TCAB dataset consists of adversarial sam- ples at different granularities, including word-level adversarial samples (Genetic(Alzannl et al., 2018), 8), TextFooler etc.), character-leva adversarial sam- ples (DeepWorBBug(Gaa et al., 2018), HotFlip
'tttps: hottps://wwwwr kaggle wwt.glee....//eeeeeeeeeeeeeeeeee ctteeeeiaaa/////////aaaaaaaa /ddgin////n//////////
twitter-climee www.cciiaaaaaaeeeeeeeeee www.geeeentiimeeeteeeeeeeeeeeeee dataset

---

etc.), and mixed-granularity adversarial samples (TextBugger, Viper(Eger et al., 2019), etc.). These methods include both white-box attacks and black- box attacks. The adversarial samples of each task are obtained by attacking BERT, RoBERTa, and XLNet respectively. Our generation network is trained across diverse datasets, models, and attack methods to learn universal adversarial features.
Advbench. Specifically, the attack methods we em- ploy include (1)TextFooler, (2)PWWS, (3)BERT- Attack(Li et al., 2020), (4)SememePSOO(Znn et al., 2020), (5)Deep WardBeeWooBuggGGaa et al., 2018) (6)OCCKTTChen et al., 2022). Furthermore, we train CT-GAT using word-level adversar- ial samples from the TCAB to examine if it learns imperceptible perturbation features, character- level attacks often introduce grammar errors and increase perplexity.
We don't strictly define the bounds of pertur- bations as previous methods did because it is im- plicitly reflected in the training data. In the adver- sarial sample generation stage, we can control the perturbation degree of the adversarial samples by adjusting the temperature parameter in the model logits.
4.3 Datasets
We evaluate CT-GAT on nine datasets from Ad- vbench, which include tasks such as misinforma- tion, disinformation, toxic content, spam, and sen- sitive information detection (excluding the HSOL (Davise(Davidson et al., 2017)). Since the HSOL dataset and the dataset used to train our adversar- ial sample generator the same, we substitute it with the Founta dataset (Founta al., 2018) in this study.
4 Experiments and Results
In this chapter, we evaluate the performance of CT-GAT in the decision-based black-box scenario, using the security-oriented NLP benchmark Ad- vbench. To demonstrate the high interpretability of CT-GAT in practical settings, we also conducted a manual evaluation.
4.4 Evaluation metries
To evaluate the effectiveness of CT-GAT, we need to measure the attack success rate, query count, perturbation degree, and text quality. (1) ASR is defined as the percentage of successful adversarial samples. (2)Thc query count is defined as the aver- age number of queries required to make adversarial samples. (3yThe perturbation degree is measured by the Levenshtein distance. (4)Text quality is mea- sured by the relative increase in perplexity (% PPL) and the absolute increase in the number of gram- mer errors (A)). (5)Semantic similarity is an eval- uative metric quantifying the extent to which the meaning of the original sentence is preserved post- perturbation. We represent this using the cosine similarity of Universal Sentence Encoder (USE) vectors.
4.1
Implementation
Vietim Model BERT is a widely recognized pre- trained transformer that is highly representative in natural language understanding (NLU) tasks. We chose to fune-tune the BERT model as the victim model for all tasks.
Generation Model We choose BART (Lewis et al., 2019) as our generation model. BART learns to generate text that is semantically similar to the original data by trying to recover it from its per- turbed version. This enables BART to fully learn the similarities and differences between different word meanings and to have the ability to preserve semantic invariance. Moreover, BART is trained on a large amount of text and possesses the ability to analyze parts of speech, which allows it to fur- ther learn complex patterns of replacement during fine-tuning.
4.5 Experimental Results
ASR and Query Count The ASR and query count results are shown in Table Our method CT- GAT achieves excellent results on all tasks and datasets. CT-GAT achieves the highest ASR and the least number of queries on majority of datasets.
4.2 Baseline
Our baseline method follows the experimental setup of Adybench. We use the NLP attack pack- age Attack (Zeng et al., 2020) to imple- ment some common attacks. We implement the rocket attack using the source code provided by
On few datasets, even though it do not achieve the highest ASR, it achieved the second highest ASR. With only 2.3%-5.6%% lower than the highest ASR method, the number of queries was reduced by 31.9%-91.224 The ASR of CT-GAT did not achieve optimal results on the EDENCE, FAS, and

---

Task
Misinformation
Disinformation
Toxic
Spam
Sensitive Information
LUN
Amazonn LB
Founta
SpumAssasii
EDENCE
Method | Dataset
ASR(S))
Query]
ASR(S)T
Query]
ASR(R))
Query.
ASR(%))
Quety!
ASR(%))
Query
TexFoooer
0.4
1294.38
9.0
740.42
52.7
67.46
0.2
961.88
23.9
94,67
PWWS
1.3
1707.19
18.8
1019.91
61.0
113.89
0.3
1308.50
46.0
129.68
BERT-Atack
3966.60
1625.37
77.0
109.52
0.9
2020.85
23,8
1627.97
79.5
209.59
1945,74
79.6
231.17
DespWordBoggpoweeee
0.1
287 04
9.3
162.37
40.7
21.78
0.1
263.84
22.9
26.06
0.2
287 04
12.4
162.41
65.5
22.03
263,
79.9
26.63
ROCKET
7.2
300.38
38.7
218.69
97.0
5,03
60.09
84.5
20.93
CT CT
1,9
98.58
19.5
83.44
90.3
14.28
3.1
59.45
53.0
58.91
(I-GATT(ou)
10.0
92.69
56.2
54.51
99.3
39,02
59.36
88.0
19.08
Acc.(%)
SATNews
CGPake
2018
Finmn
FAS
ASR(
Qneryl
ASR(%))
Query-
ASR(%))
Qnery
ASR(Sy)
Query]
ASR(S6)
Query4
TextFooler
2.9
1889.32
18.2
360.13
12.5
201.72
0.1
682.40
17.4
130,73
PWWS
1.2
2565.37
69.0
489.78
20.2
268.87
0.0
928.58
36.5
177.18
BERT-Atack
30.6
5102.34
94.6
400.61
40.4
450.67
1.4
2954.86
92.4
59
ScmeomePSSCymxxxiss-0000
2217.34
67.2
$39.25
1.0
1724.70
506. 82
DeepWoedDoglpower--5))
2.5
430.59
41.7
75.00
35.9
45.71
0.0
182.27
40.8
39.91
DeepWixlBuggpowerza
1.9
430.59
68.8
75.28
57.6
45.92
0.9
182.27
77.6
40.27
ROCKET
78
6.5
56.92
82.0
52.77
(T-GATwaq(our)
1.5
97.25
09.25
43.09
67.0
40.75
4.0
38.97
42.0
67 60
GTT
39.0
69.59
99.2
6.38
75,2
34.93
4.2
38.79
86.8
26.92
Acc.(9k)
96.6
95.7
99.3
The results of attack performance for various attack methods in decision basedd black-box scenarios. ASR stands for the attack success rate. Query signifies the average numher of launching a successful adversarial attack. Ace represents accuracy of the victim model on the test set. A higher ASR and a lower Query indicate more effective attack. The bolded part indicates the best result, and the underlined part indicates the second best result.
Table 1:
Enron datasets, which related to the degree of perturbation. This can be seen more clearly in Ta- ble 3, where our method has half the perturbation rate of the method with the highest ASR on these three datasets, which indicates that the impercep- tibility learned from the data is constraining our perturbation method. Although we can increase the ASR by increasing the sampling temperature, this may greatly affect the readability and change the original sentence meaning.
the baseline. Considering the previous attack re- sults, the CT-GAT word method demonstrates good performance in terms of perturbation rate and the number of introduced grammar errors while main- taining satisfactory attack effectiveness. This may be attributed to the model's ability to discern parts of speech and assess the importance of substitute words. To some extent, this demonstrates the ca- pability of CT-GAT to learn the distribution of ad- versarial examples and the implicit constraint of imperceptibility.
To further evaluate the effectiveness of CT-GAT, we conduct additional experiments two datasets, Jigsaw2018+ and EDENCE, which have similar av- erage query counts to the baseline. We conduct attacks on the model under strict constraints on the number of access queries, as shown in Fig- ure 3. The differences in our replication of the ROCKET method are large, therefore they are not included in the graph for comparison. We observe that CT-GAT consistently outperforms other meth- ods and achieves higher attack success rates even at extremely low query counts.
However, perplexity does not necessarily reflect the real reading experience. For example, the ROCKET method uses a large number of repeated words or letters inserted into the original sentence, which makes the model casy to predict the words and reduces the perplexity. CT-GAT, due to the in- troduction of character-level attacks, does not seem outstanding in terms of grammatical emror and flu- ency. But in fact, we may not encounter too many obstacles when reading in practice. We follow the description of the Advhench, which emphasizes that the purpose of the attack to propagate harm- ful information. We design human evaluations to measure the effectiveness of the method.
Perturbation Degree, Text Quality and Con- sistency From Table 3, we can observe the level of perturbation and text quality of CT-GAT, and
In terms of consistency, the cosine similarity of our method is at a relatively high level, indicating
"ht www.ke com/c/ ji jigsaw-toxic- twx.t- www.eoooomnccoooeo coo.c--comettcclsssiiiiiiiioioii

---

dataset, each consisting of 40 pairs of original texts and adversarial texts. For each pair of samples, we ask evaluators to assess the following aspects se- quentially: (1) whether the adversarial sample con- veys malicious intent (or contains sensitive infor- mation), and (2) the degree to which the intended meaning of the original sample and the adversarial sample aligns, measured on scale of 0-2. The label of O indicates relevance all, indicates partial conveyance of the original sentence's mean- ing, and 2 indicates substantial conveyance of the original sentence's meaning.
Seap25
120
Eaury tasto
(a) EDENCE
The results of the human evaluation are pre- sented in Table 2. Labels of or 2 are considered meaningful. It can be observed that CT-GAT can largely preserve the original meaning and effec- tively convey malicious intent.
ANS/3
4.6
Case Study
We select three successful adversarial examples from EDENCE and Amazon-LBB It can be ob- served from Table The perturbation patterns of these adversarial samples originate from pre- vious attack methodologies, effectively learning and integrating prior adversarial features at both the character and word levels. This includes tac- tics such word segmentation, similar character substitution, and synonym replacement.
100
quary Siree
(b) 201
Figure 3: Attack success rate under restriction of maxi- mum query number in (a)EDENCE, (b)Jigsaw2018
that the sentences before and after the perturbation by our method maintain good semantic consistency, To further analyze semantic consistency, we adopt a human evaluation approach.
Further Analysis
In this chapter, our objective is to thoughtfully ex- amine the areas where prior research could possibly be further enriched, particularly in terms of trans- ferability. Simultaneously, we will elucidate the factors that enable our approach to effectively har- ness certain transferable attributes.
Model 2
1
2+1
suce
Founta 64.5
23.5
12.0
88.0
83.5
FAS
56.0
39.0
5.0
95.0
96.5
Table 2: Human evaluation is conducted on two tasks: hate speech detection and sensitive informa- tion detection. The evaluation uses the following scale:
5.1 Cross-task Adversarial Features
0=meaning changed, 1=partially preserved, 2=essentially the same. Suce indicates whether the adversarial samples retain their original labels accord- ing to the human evaluation.
In this section, aim to validate our hypothe- sis that leveraging adversarial features from differ- ent tasks can enhance the attack success rate for the current task. Based on previous research( Yuan et al., 2021), we can formulate the extraction of adversarial features as a perturbation substitution rule. We propose Cross-task Adversarial Word Replacement rules (CAWR) to expand the rules in order to extract adversarial features across different tasks. The specific algorithm details can be found in Appendix A.
Human Evalution Automatic metrics provide insights into the quality of the text. To verify whether adversarial examples are truly effective in real-world applications, we adopt manual eval- uation approach.
We choose two tasks, hate speech detection and sensitive information detection, because these tasks have clear definitions and are easy to evaluate man- ually. We select the Founta dataset and the FAS
We partition the TCAB(Asthana et al., 2022) dataset into three subsets for our study: the Hate-

---

Task
Misinformation
Toxic
Sensirive Information
Method Dataser
Amazon-L.B
Founta
EDENCE
Levenssein
A1
% PPL
USE1
Levenstein
A11
% PPL
USE
Levenstein
ATC
PPL
USE
TextFooler
25.68
0.57
1.79
0,95
18.29
3.15
1.21
0.87
11.86
0.10
2.31
0,87
PWWS
95.89
1.27
3.69
0.84
20.38
2.93
1.65
0.81
30.06
0.21
5.84
0.87
BERT-Alback
117.31
0.41
6.60
0.81
23411
2.56
1.69
0.76
24.78
0.07
3.69
0.74
28.58
0.64
1.93
0.92
21.37
3.0
1.62
0.80
14.71
0.99
3.35
18.86
0.33
4.19
0.82
8,05
4.23
L13
0.73
6.66
-0.02
5.13
0.57
DeepWnndBgglwwwww
1143
0.34
19:57
ROCKET
82.93
1.01
1.81
0,71
36767
15.48
-0.98
0.05
97.95
5.01
0.34
0.52
woroor)
50.51
13:27
CT:GAT((uu)
82,96
11.67
-0.15
0.73
18.49
0.27
0.61
0.80
12.90
2.93
1.09
0.76
Mathod Disaset
Amazin-LL.t
Founta
EDENCE
Leverstein]
PPI.4
USR?
Levenstain
1.
PPI.
USF 1
Levenstein
A 1 PPI.
TextFooler
16,62
11.23
2.12
11.33
14.64
0.00
1.21
0.84
13.12
0.05
2,45
0,90
PWWS
101.47
52.76
0.23
5.04
BERT-Attack
82.85
01.48
11.41
0.79
30.65
0.05
3.33
0.77
53.20
0.30
6.12
0.75
Sememe#SO0maxiiee-100)
23:77
2.37
DeepWoriBBgggoooerrs5)
10.01
0,05
5.16
0.83
10.79
0.03
3.45
0.60
6.65
-0.02
3.64
0.58
25
20.19
ROCKET
38.27
1.03
1.66
0.50
108-L44
14,99
-0.96
0.05
97.95
5.01
0,34
0.41
CT-GATT
64.08
(T-GAA((3)))
42.46
6,43
9.40
0.79
16.28
2.54
1.03
0.70
25.70
6.84
1,16
0.69
Table The results of attacking performance and adversarial samples' quality, A/ represents the relative increase in the number of grammatical errors, %PPL represents the relative increase rate of perplexity.
Original Sentence
it is true that the bush administration refused to help enron stave off bankrupicy.
Adversarial Sentence
it tru that the bush administration refused to assistance en ron stave off bankruptey. was able to withstand the pressure. was able to withstand the pressure.
Original Sentence
Adversarial Sentence
Original Sentence
great consistency. love essie. beantiful color too!
Adversarial Sentence
great cônsistency. i love êssic. beaŭtiful coloř too!
Table 4: Adversarial samples crafted by CT-GAT. The red parts correspond to the modified words characters (blue parts) in the original sentence.
base dataset, the hate speech detection datasets (comprising Hatebase, Civil Comments), and mixed dataset that combines sentiment detection with the previous abuse detection datasets and ad- ditional datasets (SST-2, Climate Change, and IMDB). We extract rules from these subsets and attack models on Jigsaw2018, Founta(Founta et al., 2018), and tweers. Table 5 shows the results. It can be inferred that, overall, regardless of whether the adversarial sample construction method simple and rule-based or based on model generation, the amalgamation of different task methods tends to result in a higher rate of successful attacks, or in other terms, enhanced transferability.
directly from the text. The process of generating ad- versarial samples can be considered search prob- lem(Zang et al., 2020), where we aim find the vulnerable words and the optimal substitute words.
Vulnerable Words The selection of vulnera- ble words is the process of choosing words be replaced. We aim to investigate whether differ- ent models exhibit similar patterns of vulnerable (or important) word distributions, which could be one of the manifestations of transferability across different models for the same task. We measure the vulnerability of words by sequentially masking them in a sentence and comparing the difference in confidence scores of the correct class before and after masking the input to the model.
5.2 Selection of Words
We rank the vulnerability levels of the same sen- tence across different models and compare the Jac- card similarity of the selected top words assess the consistency among different models. As shown in Table 6, We find some consistency both between
In this subsection, we discuss some evidence that CT-GAT can learn transferable adversarial features
'https://gitee htwp:/hwww..cmm/saaaarssssaaalll Twitter- Setter--SStimeee---nlyeseee

---

ASR
Jigsaw
Pounta
tweet
for each substituted word, we derived a Gini im- balance coefficient of 0.161. This suggests that the process of word replacement adheres to a dis- cernible pattern, rather than manifesting as chaotic, and further demonstrates a certain level of diver- sity, which aligns with our observations from the heatmap. The prior application of greedy methods to select the most transferable replacement rules ex- hibits certain constraints, whereas the technique of employing network for searching can effectively discern diverse patterns.
Hatehase
0.116
0.195
0.449
Toxic domain
0,131
0.217
0.507
All datasets
0.132
0.221
0.552
(a) CAWR
ASR Jigsaw
Founta
tweet
Hatebase
0.620
0.937
0.855
Toxic domain
0.705
0.948
0.468
All datasets
0.738
0.958
0.520
(b) CT-GAT word
Table 5: The CAWR (a) and CT-GAT word (b) method demonstrates adversarial transferability using features from different domains. Specifically, it utilizes one dataset, three datasets, and six datasets successively from top to bottom.
The previously mentioned transferable elements can all be represented in the statistical rules of the text. This offers the potential for employing neural network methodologies to learn transferable characteristics from adversarial samples.
Model
Jaccard
tweets & Founta 0.272
tweets & hatebase 0.519
5.3 Defense
Founta hatehase
0.318
Learning map from adversarial samples back the original sample distribution is relatively easier compared to the inverse process. To further validate the ability to learn adversarial sample distributions from text, we conduct defensive experiments us- ing generative models. We use adversarial samples as input and the original samples as predictions. Generative models serve data cleansing method by cleaning the input text before feeding into the victim model. Appendix B presents the defensive experiments conducted on two vic- tim models trained using CGFake and Hatebase datasets.
(a) Different training data
Architecture
Jaccard
BERT & RoBERTa
0.508
BERT & XL.Net
0.508
RoBERTa & XLNNet
1.000
(b) Different architectures
Table 6: Models using (a) training datasets and (b) dif- ferent architectures evaluated by calculating the Jac- card similarity for the top 20% percent vulnerable words. The Jaccard similarity calculated on randomly sam- pled set of the top 20% words is 0.125
Overall, using this method can effectively duce the success rate of attackers and increase the cost of queries. CT-GAT demonstrates excellent defense against character-level attack methods like Deep WordBug, indicating the presence of strong patterns in character-level attacks. However, the performance against word-level attacks is not par- ticularly outstanding. This mainly occurs because the attack method gradually intensifies its attack magnitude after a failed attack. This surpasses the defense model's '' capability, which is trained im- perceptible samples.
different model architectures and among training data from similar domains.
We extract the substitution rules from CT- GoTword for generating adversarial samples and find that the average perturbation rate is 16.6%. The proportion of the words replaced by CT- GAT that belong to the top 20% vulnerable word set is 36%. These results indicate that it is possible to learn the vulnerable words of sentence directly from the adversarial text.
Substitution preference Figure presents the heatmap of transferability metrics for replacement rules, as derived through the HAWR algorithm by Yuan et al. (2021). Upon intuitive observation, it is apparent that certain replaced words possess mul- tiple highly transferable replacements. Simulta- neously, we compute the Gini inequality coeffi- cient by tallying the number of word replacement rules in successful adversarial samples. Through statistical analysis of the replacement preferences
Conclusion
In this article, we propose cross-task generative adversarial attack (CT-GAT), which is based on our insight that adversarial transferability exists across different tasks. Our method solves the problem of needing to train substitute model for the victim model. Experiment demonstrates that our method

---

not only significantly increases the attack success rale, but also drastically reduces the number of required queries, thus underscoring its practical utility in world applications.
Yangyi Chen, Hongcheng Gao. Ganqu Cui, Fanchao Qi, Longtao Huang, Zhiyuan Liu, and Maosong Sun. 2022. Why should adversarial perturbations be im- perceptible? rethink the research paradigm in adver- sarial nip.
Limitations
Siddhartha Datta. 2022. Learn2weight: Parameter adap- tation against similar-domain adversarial attacks.
Our method has the following limitations: (1) CT- GAT was trained on a limited dataset. While it has demonstrated effectiveness within the scope of our experiments, the ability to generalize to broader, real-world scenarios may be constrained due the restricted data diversity. To enhance the applica- bility of our method it would be necessary to incorporate more diverse datasets. This implies that for future enhancements of this work, gathering and integrating data from various sources or environments should be consid- ered to improve the model's broad applicability. (2) Our method does not interact with the victim model. If we could adjust the generation strategy based on query results, it might enhance the success rate of attacks.
Thomas Davidson, Dana Warmsley, Michael W. Macy. and Ingmar Weber. 2017. Automated hate speech detection and the problem of offensive language. Na- tional Conference on Artificial Intelligence.
Lucas Dixon, John Li, Jeffrey Sorensen, Nithum Thain, and Lucy Vasserman. 2018. Measuring and mitigat- ing unintended bias in text classification. In Proceed- ings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, ATES '18, page 67-73, New York, NY, USA. Association for Computing Machinery.
wider range of contexts,
Javid Ebrahimi. Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification.
Steffen Eger, Gözde Gül Sahin, Andreas Rücklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, and Tryna Gurevych. 2019. Text processing like humans do: Visu- ally attacking and shielding NLP systems. CoRR, hts/1903.115000
Ethics Statement
The datasets we use in our paper, Advbench(Chen et al., 2022), TCAB(Asthana et al., 2022) and Founta dataset(Founte et al., 2018), are both open- source. We do not disclose any non-open-soure data, and we ensure that our actions comply with ethical standards. However, our method is highly efficient generating adver- sarial examples and does not require access to the victim model. This could potentially be misused by users for malicious activities such as attacking communities, spreading rumors, or disseminating spam emails. Therefore, it is important for the re- search community to pay more attention to security- related studies.
Aatiao Founta, Constantinos Djouvas, De- spoina Chatzakou, Ilias Leontiadis, Jeremy Black- burn, Gianluca Stringhini, Athena Vakali, Michael Sirivianos, and Nicolas Kourtellis. 2018. Large scale crowdsourcing and characterization of twitter abusive behavior. CoRR, abs/1802.00393.
worth noting that
Wee Chung Gan and Hwee Tou Ng. 2019. Improv- ing the robustness of question answering systems question paraphrasing. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 6065-6075 Florence, Italy. Asso- ciation for Computational Linguistics.
Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. CoRR. abs/1801.00334,
References
Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient- adversarial at- tacks against text transformers.
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial ex- amples. Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. pages 2890-2896, Brussels, Belgium. Association for Computational Linguistics.
Di Jin, Zhijing Jin, Jocy Tianyi Zhou, and Peter Szolovits. 2019. Is BERT really robust? natural language attack on text classification and entailment. CoRR, abs/1907.11932.
Mike Lewis. Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Ves Stoyanov, and Luke Zettlemoyer. 2019. Bart: De- noising sequence-to-sed -o-suueeeccee pre-training for natural language generation, translation, and comprehension.
Kalyani Asthana, Zhouhang Xie, Wencong You, Adam Noack, Jonathan Brophy, Sameer Singh, and Daniel Lowd. 2022. Teab: A large-scale text classification attack benchmark.

---

Jinfeng Li, Shouling Ji, Tinyu Du, Bo Li, and Ting Wang. 2018. Textbugger: Generating adversar- ial text against real-world applications. CoRR, abs/18 Abs//112.00521.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. CoRR, abs/1 700.036........
Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. BERT-ATTACK: Adversar- ial attack against BERT using BERT. In Proceed- ings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6193-6202, Online. Association for Computational Linguistics.
Zhibo Wang, Hongshan Yang. Yunhe Feng, Peng Sun, Hengchang Guo, Zhifei Zhang, and Kui Ren. 2023, Towards transferable targeted adversarial examples. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 20534 20543.
Ellery Wulczyn, Nithum Thain, and Lucas Dixon, 2016. Ex machina: Personal attacks seen at scale. CoRR, 101.0691,.
Aiwei Liu, Honghai Yu, Xuming Hu, Shu' ang Li, Li Lin, Fukun Ma, Yawen Yang, and Lijie Wen. 2022. Character-level white-bor box adversarial attacks against transformers via attachable subwords substitution.
Yong Xie, Dakuo Wang, Pin- Yu Chen, Jinjun Xiong, Sijia Liu, and Oluwasanmi Koyejo. 2022. A word is worth thousand dollars: Adversarial attack tweets fools stock prediction. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Hu- man Language Technologies, pages 587-599, Seattle, United States, Association for Computational Lin- guistics.
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Ng. and Christopher Potts. 2011. 1. Learning word vectors for sentiment analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies. pages 142-150, Portland, Oregon, USA. Association for Computational Lin- guistics.
Liping Yuan, Xiaoqing Zheng. Yi Zhou, Cho-Jui Hsieh, Kai-Wei Chang, and Xuanjing Huang. 2020. Gener- ating universal language adversarial examples by un- derstanding and enhancing the transferability across neural models. CoRR, abs/2011 1. 085588.
OpenAI. 2023. Gpt-4 technical report.
Ray Oshikawa, Jing Qian, and William Yang Wang. 2018. A survey on natural language processing for fake news detection. In International Conference on Language Resources and Evaluation.
Liping Yuan, Xiaoqing Zheng, Zhou, Cho-Jui Hsieh. and Kai wei Chang. 2021. On the transferability of adversarial attacksagainst neural text classifier.
Nicolas Papernot, Patrick D. McDaniel, and Ian Good- fellow. 2016. Transferability in machine learning: from phenomena to black-hox attacks using adversar- ial samples. CORR, abs/1605.07277 07277.
Yuan Zang, Fanchao Qi, Chenghao Yang. Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combi- natorial optimization. In Proceedings of the 58th An- nual Meeting of the Association for Computational Linguistics, pages 6066-6080, Online, Association for Computational Linguistics.
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial exam- ples through probability weighted word saliency. In Proceedings of the 57th Annual Meeting of the Asxo- ciation for Computational Linguistics. pages 1085- 1097, Florence, Italy. Association for Computational Linguisties.
Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Bairu Hou, Yuan Zang, Zhiyuan Liu, and Maosong Sun. 2020. Openattack: An open- source textual adversarial attack toolkit. CoRR. abs/2009.09111.
Suranjana Samanta and Sameep Mehta. 2017. To- wards crafting text adversarial samples. CoRR, abs/1707.02812.
A Algorithm of CAWR
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng. and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empiri- cal Methods in Natural Laguagee Processing, pages 1-312, Seattle, Washington, USA. Association for Computational Linguistics.
We define the rules for word substitutions as (w + t)), where w is a word in the original sentence v, and u represents the corresponding replacement word in the adversarial sentence ă. We propose an algorithm to discover Cross-task Adversarial Word Replacement rules. We employ h(w u) to denote the significance statistics of the substi- tution rule, which measured by the change in model confidence. We employ a large-scale statis- tical approach to identify highly transferable rules (see Algorithmic l). After obtaining the rules, we
Christian Szegedy, Wojeiech Zaremba. Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In 2nd International Conference Learn- ing Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings.

---

can achieve text perturbation by sequentially re- placing the most significant words until reaching the perturbation threshold.
Algorithm Adversarial rules Extraction
Require:
D: A set of test datasets D, different tasks
M: A set of models M, different tasks i
Ensure: of word replacement rules as well as their salience.
1: for each datasets Dj in do
2: for each instance (z, y) in D, do
3:
- attack(2,,M.
4:
z < argmax M.(+)
5:
if 2 # y then
6:
for each ú that replaces w do if' (synonym(@)Liiãj (yyoomy(uu 0 then
7:
8:
c(u; - úH;) c(w; w::) +
9:
A = (M h(w; 0.:) = h(w; w))) A
for each word replacement rule do h(w- h(w - / + w))
Defense
The following are the defense effects the CG- Fake and Hatebase datasets. Here, Query refers to the average number of attack queries for successful attack samples, not the average of the total number queries.
Method
CGPake
Hatebase
ASR(%)
Query
ASR(%)
Query
TextFooler
18.2
360.
10.4
78.46
+defend
16.25
396.25
10.0
78.63
PWWS
69.0
489.78
9.9
107.20
+defend
54.0
481.72
9.0
105.13
BERT-Attack
94.6
400.61
56.8
139.14
*defend
92.75
462.92
56.7
152.27
52.25
236.34
66.0
88.07
*defend
48.75
240.34
65.25
92.71
Deep (
41.7
75.00
56.4
21.40
+defend
1.25
80.23
1.25
21.07
DeepWondBug/power-aa
68.8
75.28
85.4
21.72
+defend
1.5
80.23
2.5
21.08
Deep DeepWordBuugnowwer-100
93.0
81.14
99.0
21.96
*lefend
2.25
80.24
2.25
21.08
Table 7: Attack success rate of preprocessing defense using a generator trained with adversarial samples and without defense strategies.


Reviews:
[{"review_id": "O0hyqQNhaA", "reviewer": "Reviewer_xQiS", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 3, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Question 1.** The perturbation bounds of the attack are not explicitly controlled, which makes the attack success rates questionable to compare with existing bound-controlled works. What is more, given this setting, the extent of ground truth shift needs more quantitative and qualitative evaluation to show that the attack preserves the ground truth during the attack.\n\n**Answer 1.**\n\nThank you for your insightful suggestion. In existing generative adversarial methods, controlling the perturbation boundary is a challenge. To address this, we trained our adversarial sample generator using traditional adversarial methods with controlled boundaries, such as limiting the perturbation rate. This approach aids the model in learning boundary rules. \n\nIn our paper, we have evaluated the perturbation rate of our method using metrics like edit distance, grammatical errors, and increase rate in perplexity (as shown in Table 5). The results indicate that our method, compared to baseline methods with explicit boundary control, exhibits a relatively lower perturbation rate.\n\nRegarding the preservation of semantic truth during the attack, we have conducted experiments (detailed in Table A). Our method shows promising semantic preservation capabilities, ranking in the upper-middle level among existing methods that limit perturbation boundaries. The specific experimental data and settings are as follows:\n\n**Table A.** Semantic Similarity Measurement Table. ('ASR' represents Attack Success Rate (%), 'cos' represents cosine similarity of sentence vectors, 'GPT' represents the score evaluated by GPT-3.5-turbo)\n\n| Task                | &nbsp;&nbsp;Disinformation                                   | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Toxic | Sensitive Information                                        |\n| :------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |\n| Method \\| Dataset   | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Amazon-LB          | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Founta | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EDENCE |\n|                     | ASR(%)\\| cos \\|GPT                                           | ASR(%)\\| cos \\|GPT                                           | ASR(%)\\| cos \\|GPT                                           |\n| TextFooler          | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;9.0   \\|**0.95**\\|**4.57** | &nbsp;&nbsp;&nbsp;&nbsp;52.7 \\|**0.87**\\|3.01                | &nbsp;&nbsp;&nbsp;&nbsp;23.9 \\|**0.91**\\|3.18                |\n| PWWS                | &nbsp;&nbsp;&nbsp;&nbsp;18.8 \\|0.84\\|3.74                    | &nbsp;&nbsp;&nbsp;&nbsp;61.0 \\|0.81\\|2.49                    | &nbsp;&nbsp;&nbsp;&nbsp;46.0 \\|0.87\\|3.09                    |\n| BERT-Attack         | &nbsp;&nbsp;&nbsp;&nbsp;43.0 \\|0.81\\|2.24                    | &nbsp;&nbsp;&nbsp;&nbsp;77.0 \\|0.76\\|3.35                    | &nbsp;&nbsp;&nbsp;&nbsp;**90.3** \\|0.74\\|2.93                |\n| PSO(maxiter=100)    | &nbsp;&nbsp;&nbsp;&nbsp;23.8 \\|0.92\\|3.92                    | &nbsp;&nbsp;&nbsp;&nbsp;79.5 \\|0.80\\|2.64                    | &nbsp;&nbsp;&nbsp;&nbsp;79.6 \\|0.86\\|2.70                    |\n| Deep(power=5)       | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;9.3 \\|0.82\\|4.57         | &nbsp;&nbsp;&nbsp;&nbsp;40.7 \\|0.73\\|**4.55**                | &nbsp;&nbsp;&nbsp;&nbsp;22.9 \\|0.57\\|**4.79**                |\n| Deep(power=25)      | &nbsp;&nbsp;&nbsp;&nbsp;12.4 \\|0.32\\|4.48                    | &nbsp;&nbsp;&nbsp;&nbsp;65.5 \\|0.24\\|3.40                    | &nbsp;&nbsp;&nbsp;&nbsp;79.9 \\|0.08\\|4.68                    |\n| ROCKET              | &nbsp;&nbsp;&nbsp;&nbsp;38.7 \\|0.71\\|1.74                    | &nbsp;&nbsp;&nbsp;&nbsp;97.0 \\|0.05\\|2.85                    | &nbsp;&nbsp;&nbsp;&nbsp;84.5 \\|0.32\\|2.88                    |\n| CT-GAT_{word}(ours) | &nbsp;&nbsp;&nbsp;&nbsp;19.5 \\|0.90\\|3.45                    | &nbsp;&nbsp;&nbsp;&nbsp;90.3 \\|0.81\\|2.74                    | &nbsp;&nbsp;&nbsp;&nbsp;53.0 \\|0.87\\|2.89                    |\n| CT-GAT(ours)        | &nbsp;&nbsp;&nbsp;&nbsp;**56.2** \\|0.73\\|3.41                | &nbsp;&nbsp;&nbsp;&nbsp;**99.3** \\|0.80\\|2.86                | &nbsp;&nbsp;&nbsp;&nbsp;88.0 \\|0.76\\|2.93                    |\n|                     |                                                              |                                                              |                                                              |\n| Method \\| Dataset   | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CGFake | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Jigsaw2018         | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FAS |\n|                     | ASR(%)\\| cos \\|GPT                                           | ASR(%)\\| cos \\|GPT                                           | ASR(%)\\| cos \\|GPT                                           |\n| TextFooler          | &nbsp;&nbsp;&nbsp;&nbsp;18.2 \\|**0.93**\\|3.82                | &nbsp;&nbsp;&nbsp;&nbsp;12.5 \\|**0.84**\\|2.60                | &nbsp;&nbsp;&nbsp;&nbsp;17.4 \\|**0.90**\\|3.34                |\n| PWWS                | &nbsp;&nbsp;&nbsp;&nbsp;69.0 \\|0.80\\|3.25                    | &nbsp;&nbsp;&nbsp;&nbsp;20.2 \\|0.79\\|2.64                    | &nbsp;&nbsp;&nbsp;&nbsp;36.5 \\|0.84\\|3.37                    |\n| BERT-Attack         | &nbsp;&nbsp;&nbsp;&nbsp;94.6 \\|0.79\\|2.42                    | &nbsp;&nbsp;&nbsp;&nbsp;40.4 \\|0.77\\|2.76                    | &nbsp;&nbsp;&nbsp;&nbsp;**92.4** \\|0.75\\|2.50                |\n| PSO(maxiter=100)    | &nbsp;&nbsp;&nbsp;&nbsp;67.2 \\|0.86\\|3.13                    | &nbsp;&nbsp;&nbsp;&nbsp;51.9 \\|0.76\\|2.54                    | &nbsp;&nbsp;&nbsp;&nbsp;61.4 \\|0.82\\|2.94                    |\n| Deep(power=5)       | &nbsp;&nbsp;&nbsp;&nbsp;41.7 \\|0.83\\|**4.61**                | &nbsp;&nbsp;&nbsp;&nbsp;35.9 \\|0.60\\|**3.95**                | &nbsp;&nbsp;&nbsp;&nbsp;40.8 \\|0.58\\|**4.61**                |\n| Deep(power=25)      | &nbsp;&nbsp;&nbsp;&nbsp;68.8 \\|0.26\\|3.89                    | &nbsp;&nbsp;&nbsp;&nbsp;57.6 \\|0.25\\|3.45                    | &nbsp;&nbsp;&nbsp;&nbsp;77.6 \\|0.15\\|4.50                    |\n| ROCKET              | &nbsp;&nbsp;&nbsp;&nbsp;97.2 \\|0.60\\|1.82                    | &nbsp;&nbsp;&nbsp;&nbsp;64.2 \\|0.05\\|1.95                    | &nbsp;&nbsp;&nbsp;&nbsp;82.0 \\|0.41\\|2.43                    |\n| CT-GAT_{word}(ours) | &nbsp;&nbsp;&nbsp;&nbsp;69.3 \\|0.86\\|3.36                    | &nbsp;&nbsp;&nbsp;&nbsp;67.0 \\|0.76\\|2.15                    | &nbsp;&nbsp;&nbsp;&nbsp;42.0 \\|0.84\\|2.60                    |\n| CT-GAT(ours)        | &nbsp;&nbsp;&nbsp;&nbsp;**99.2** \\|0.79\\|3.28                | &nbsp;&nbsp;&nbsp;&nbsp;**75.2** \\|0.70\\|2.48                | &nbsp;&nbsp;&nbsp;&nbsp;86.8 \\|0.69\\|2.94                    |\n\n**Details:** Referring to previous methods[1], we use the cosine similarity of sentence vectors generated by the \"Universal-Sentence-Encoder-4\" model to measure the similarity between sentences. Simultaneously, we use the GPT-3.5-turbo model for evaluation, allowing it to give a score from 1 to 5 to measure semantic similarity, with a higher score indicating greater similarity. We use the following prompt as a query for GPT-3.5. `[sentence A]` and `[sentence B]` will be respectively replaced with the original sentence and the adversarial sentence.\n\n```\nPlease provide an integer between 1 and 5 to measure the degree of semantic similarity between Sentence A and Sentence B, with a higher score indicating greater similarity:\n<Sentecne A>\n[sentence A]\n<Sentence B>\n[sentence B]\n<Output>\n```\n\nMoreover, we have undertaken manual evaluations of sentence semantic similarity, as detailed in the Human Evaluation section of our paper. As evidenced in Table 2, our method successfully preserved the original sentence's meaning in over 88% of the instances. This further underscores the efficacy of our approach in maintaining semantic integrity while generating adversarial examples.\n\n\n\n[1] Grey-box Adversarial Attack And Defence For Sentiment Classification (Xu et al., NAACL 2021)\n\n\n\n**Question 2.** Section 5.3 describes potential generative-based defense against the attack. However, a more effective defense approach is to perform adversarial training on the target model to robustify the prediction. Authors should consider discussing more effective defense approaches rather than preprocessing/filtering.\n\n**Answer 2.**\n\nWe appreciate your suggestions. We have utilized traditional adversarial training methods, mixing adversarial samples (including both word-level and character-level) with original samples for model training, based on some adversarial training articles[1,2]. As shown in Table B, while adversarial training proves to be a better defense against word-level attacks, it doesn't always perform well against character-level attacks. Interestingly, our method shows even better performance against character-level attack methods (such as deepwordbug).\n\n**Table B**. Defense effect comparison. \"Query\" refers to the average number of iterative queries needed for successful adversarial samples. A lower Attack Success Rate (ASR ↓) signifies better defense effects. A higher Query count (Query ↑) also indicates better defense effects.\n\n|    Defend\\|Attack    |    TextFooler    |       PWWS       |   BERT-Attack    |         PSO         |   deepwordbug    |\n| :------------------: | :--------------: | :--------------: | :--------------: | :-----------------: | :--------------: |\n|                      | ASR(↓) \\| Query(↑) | ASR(↓) \\| Query(↑) | ASR(↓) \\| Query(↑) |  ASR(↓) \\| Query(↑)   | ASR(↓) \\| Query(↑) |\n|      No Defend       |    10.4\\|78.5    |  9.9\\|**107.2**  |   56.8\\|139.1    |     66.0\\|88.1      |  56.4\\|**21.4**  |\n| Adversarial training | &nbsp;&nbsp; **8.6**\\|**87.9**   |  **7.4**\\|100.7  | **54.9**\\|147.3  | **63.1**\\|**116.4** |    55.7\\|21.2    |\n|    CT-GAT-Defend     |    10.0\\|78.6    |    9.0\\|105.1    | 56.7\\|**152.3**  |     65.3\\|92.7      | &nbsp;&nbsp; **1.3**\\|21.1   |\n\n[1] Towards a robust deep neural network in texts: A survey (Wang et al., arXiv:1902.07285 2021)\n\n[2] Defense of word-level adversarial attacks via random substitution encoding (Z. Wang and H. Wang, KSEM 2022)\n\n\n\n**Question 3.** The five target tasks described by the paper can be conducted by LLM + In-context Learning. The transferability and effectiveness of the adversarial feature for these LLMs remain questionable. Authors should consider discussing such real-world applicability for the work.\n\n**Answer 3.**\n\nThank you for your constructive suggestion. To validate the effectiveness of our method, we conducted tests using GPT-3.5-turbo, a large language model (LLM). As shown in Table C, we present the attack success rate and the average number of queries required to obtain an adversarial sample on this LLM. The results suggest that while the large model is generally more robust than the fine-tuned smaller models, its robustness still leaves room for improvement. This observation aligns with current research on the robustness of large models[1]. Despite this, our method still achieves a high attack success rate, indicating that our approach has high transferability and is applicable in real-world scenarios.\n\n**Table C.** The attack performance of the CT-GAT method on GPT-3.5-turbo.\n\n| Task             | Misinformation | Disinformation | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Toxic         | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Spam          | &nbsp;&nbsp;&nbsp;Sensitive Information |\n| ---------------- | -------------- | -------------- | ------------- | ------------- | --------------------- |\n| Method\\| Dataset | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LUN            | &nbsp;&nbsp;&nbsp;Amazon-LB      | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Founta        | SpamAssassin  | &nbsp;&nbsp;&nbsp;&nbsp;EDENCE                |\n|                  | ASR(%)\\|query  | ASR(%)\\|query  | ASR(%)\\|query | ASR(%)\\|query | ASR(%)\\|query         |\n| CT-GAT           | &nbsp;&nbsp;&nbsp;31.54\\|31.6    | &nbsp;&nbsp;&nbsp;56.15\\|27.88   | &nbsp;&nbsp;&nbsp;81.54\\|11.41  | &nbsp;&nbsp;&nbsp;53.08\\|24.08  |&nbsp;&nbsp; 50.77\\|23.66          |\n|                  |                |                |               |               |                       |\n| Method\\| Dataset | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;satnews        | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CGFake         | &nbsp;&nbsp;&nbsp;&nbsp;Jigsaw2018    | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Enron         | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FAS                   |\n|                  | ASR(%)\\|query  | ASR(%)\\|query  | ASR(%)\\|query | ASR(%)\\|query | ASR(%)\\|query         |\n| CT-GAT           | &nbsp;&nbsp;&nbsp;30.74\\|32.8    | &nbsp;&nbsp;&nbsp;68.46\\|15.23   | &nbsp;&nbsp;&nbsp;75.38\\|14.11  | &nbsp;&nbsp;&nbsp;41.54\\|29.22  | &nbsp;&nbsp;&nbsp;69.23\\|18.14          |\n\n**Details:** We use the following prompt as a query for GPT-3.5. Here, `[Task Name]` is replaced with the specific task name, such as 'spam'.`[Problem Description]` is replaced with the specific task description in Advbench[2]. `[Positive Example] `selects the first positive example text from the dataset. `[Negative Example] `selects the first negative example text from the dataset. `[Input]` is the sentence we query for each attack.\n\n```\nCan you help me with the [Task Name] classification task? The definition of this task is as follows:\n[Problem Description]\nIf the input sentence matches the above description, output 1; otherwise, output 0. For example:\n<input>\n[Positive Example]\n<output>\n1\n<input>\n[Negative Example]\n<output>\n0\nNow please perform the classification:\n<input>\n[input]\n<output>\n```\n\n[1] How robust is gpt-3.5 to predecessors? a comprehensive study on language understanding tasks. (Chen et al., arXiv:2303.00293  2023) \n\n[2] Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLP (Chen et al., EMNLP 2022)\n\n\n\n**Question 4.** Table 4 evaluates the transferability of the attack. The paper should add additional quantitative analysis between the transferability and attack success rates.\n\n**Answer 4.**\n\nWe appreciate your suggestion about adding additional quantitative analysis between the transferability and attack success rates. \n\nFor attack methods that are based on transferability, their transferability is typically measured by the attack success rate. For non-transferable attack methods, adversarial samples are first generated on a specific model, and then used to attack other models, with the success rate serving as the measure of effectiveness. Table 4 in our paper presents a comparison of the transferability of our Cross-task Adversarial Word Replacement (CAWR) method on tasks of varying scopes. Since CAWR is a transferable method, the attack success rate is directly used as a measure of its effectiveness. We will make sure to clarify this in the text. The references we used to measure transferability are as follows:\n\n\\[1\\] On the Transferability of Adversarial Attacks against Neural Text Classifier (Yuan et al., EMNLP 2021)\n\n[2] Learning transferable adversarial perturbations (Krishna kanth Nakka and Mathieu Salzmann, NeurIPS 2021)\n\n[3] Toward understanding and boosting adversarial transfer-ability from a distribution perspective (Zhu et al.,TIP 2022)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The paper is well-written with a clear storyline to motivate the proposed approach.\n\n2. The idea of utilizing prior generative knowledge from BART to extract transferable adversarial features is innovative.\n\n3. The experiments, which span five major textual tasks, show that the proposed attack is effective and transferable.", "reasons_to_reject": "1. The perturbation bounds of the attack are not explicitly controlled, which makes the attack success rates questionable to compare with existing bound-controlled works. What is more, given this setting, the extent of ground truth shift needs more quantitative and qualitative evaluation to show that the attack preserves the ground truth during the attack.\n\n2. Section 5.3 describes potential generative-based defense against the attack. However, a more effective defense approach is to perform adversarial training on the target model to robustify the prediction. Authors should consider discussing more effective defense approaches rather than preprocessing/filtering. \n\n3. The five target tasks (Misinformation, Disinformation, Toxic, Spam, Sensitive Information) described by the paper can be conducted by Large Langauge Model (LLM) + In-context Learning (e.g., show examples to LLM and let LLM perform classification). The transferability and effectiveness of the adversarial feature for these LLMs remain questionable. Authors should consider discussing such real-world applicability for the work.\n\n4. Table 4 evaluates the transferability of the attack. The paper should add additional quantitative analysis between the transferability and attack success rates.", "questions_to_authors": "", "paper_topic_and_main_contributions": "The authors propose a textual adversarial attack by constructing examples on transferable features across various text-processing target tasks. The proposed framework, Cross-Task Generative Adversarial Attack (CT-GAT), trains a BART-based generative model using data sampled from the target tasks to obtain transferable adversarial features. The experiments show that CT-GAT has a higher attack success rate compared to existing textual attacks.", "excitement": 2, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "qu467DjaCS", "reviewer": "Reviewer_UDzM", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 2, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are sincerely grateful for your recognition of our work and for your insightful comments. Your feedback is invaluable to us. We also appreciate your diligence in pointing out the writing errors. Rest assured, we will meticulously review the entire manuscript, identifying and rectifying any errors in the text. Thank you once again for your thoughtful and constructive feedback.\n\n**Question 1.**  The model used for finetuning is kept fixed. It could be possible that this attack only works because of some inherent adversarial weakness in BERT's weights which leads to commonality in failure modes across finetuned versions.\n\n**Answer 1.**\n\nWe appreciate your point about the potential inherent adversarial weakness in BERT's weights leading to commonality in failure modes across fine-tuned versions. To address this, we have conducted additional tests using larger models to verify the applicability of our method beyond BERT-based classifiers. As shown in Table A, our method still achieves a high attack success rate and requires fewer query times, even with the generally higher robustness of larger models. This aligns with current research findings on the robustness of larger models. The specific results and implementation details are as follows.\n\n**Table A.** The attack performance of the CT-GAT method on GPT-3.5-turbo.\n\n| Task             | Misinformation                                               | Disinformation                                         | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Toxic | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Spam        | &nbsp;&nbsp;&nbsp;Sensitive Information             |\n| ---------------- | ------------------------------------------------------------ | ------------------------------------------------------ | ----------------------------------------------------- | ----------------------------------------------------- | --------------------------------------------------- |\n| Method\\| Dataset | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LUN | &nbsp;&nbsp;&nbsp;Amazon-LB                            | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Founta      | SpamAssassin                                          | &nbsp;&nbsp;&nbsp;&nbsp;EDENCE                      |\n|                  | ASR(%)\\|query                                                | ASR(%)\\|query                                          | ASR(%)\\|query                                         | ASR(%)\\|query                                         | ASR(%)\\|query                                       |\n| CT-GAT           | &nbsp;&nbsp;&nbsp;31.54\\|31.6                                | &nbsp;&nbsp;&nbsp;56.15\\|27.88                         | &nbsp;&nbsp;&nbsp;81.54\\|11.41                        | &nbsp;&nbsp;&nbsp;53.08\\|24.08                        | &nbsp;&nbsp; 50.77\\|23.66                           |\n|                  |                                                              |                                                        |                                                       |                                                       |                                                     |\n| Method\\| Dataset | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;satnews                  | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CGFake | &nbsp;&nbsp;&nbsp;&nbsp;Jigsaw2018                    | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Enron | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FAS |\n|                  | ASR(%)\\|query                                                | ASR(%)\\|query                                          | ASR(%)\\|query                                         | ASR(%)\\|query                                         | ASR(%)\\|query                                       |\n| CT-GAT           | &nbsp;&nbsp;&nbsp;30.74\\|32.8                                | &nbsp;&nbsp;&nbsp;68.46\\|15.23                         | &nbsp;&nbsp;&nbsp;75.38\\|14.11                        | &nbsp;&nbsp;&nbsp;41.54\\|29.22                        | &nbsp;&nbsp;&nbsp;69.23\\|18.14                      |\n\n**Details:** We use the following prompt as a query for GPT-3.5. Here, `[Task Name]` is replaced with the specific task name, such as 'spam'.`[Problem Description]` is replaced with the specific task description in Advbench[1]. `[Positive Example] `selects the first positive example text from the dataset. `[Negative Example] `selects the first negative example text from the dataset. `[Input]` is the sentence we query for each attack.\n\n```\nCan you help me with the [Task Name] classification task? The definition of this task is as follows:\n[Problem Description]\nIf the input sentence matches the above description, output 1; otherwise, output 0. For example:\n<input>\n[Positive Example]\n<output>\n1\n<input>\n[Negative Example]\n<output>\n0\nNow please perform the classification:\n<input>\n[input]\n<output>\n```\n\n[1] Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLP (Chen et al., EMNLP 2022)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "A. The method is interesting as it proposes that adversarial queries are task and model agnostic for the most part. This can be leveraged to create generative models that are very efficient at attacking other models.\n\nB. The evaluations are thorough:\n- Show examples of the generated samples\n- Compare across 10 datasets with different tasks\n\nC. The method works black box - training weights are not required ", "reasons_to_reject": "A small, albeit minor point, is that the model used for finetuning is kept fixed. It could be possible that this attack only works because of some inherent adversarial weakness in BERT's weights which leads to commonality in failure modes across finetuned versions", "questions_to_authors": "", "paper_topic_and_main_contributions": "The authors describe a new method of performing black box adversarial attacks by training a generative model to convert a query into an adversarial query. They confirm the efficacy of the method by training their generative model on a set of adversarial queries generated using standard methods and performing attacks on BERT models finetuned for 10 different tasks.\n\nThe proposed method is very query efficient after training while also having a high attack success rate.", "excitement": 4, "reproducibility": 5, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "There is a typo in the abstract (L17): \"Gerative\" -> Generative"}, "extra_text": {}}, {"review_id": "fIMaZAy0m1", "reviewer": "Reviewer_sPVz", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Question 1.** The objective of Figure 1 remains unclear, and its intended demonstration needs further clarification.\n\n**Answer 1.**\n\nWe appreciate your feedback regarding the clarity of Figure 1. We understand that its objective was not adequately explained, and we're grateful for the opportunity to provide further clarification.\n\nFigure 1, the heatmap presented in Section 5.2 on replacement preferences, illustrates the frequency with which replaced words are substituted with different synonyms.\n\nPrevious methods based on transferability used a greedy approach to select the synonym with the highest frequency for substitution[1]. However, our heatmap reveals that, in addition to the highest frequency synonyms, there are other synonyms with high frequencies. The greedy approach could limit the diversity of adversarial samples, thereby constraining the effectiveness of the method. \n\nBy utilizing generative models to learn from both the original and adversarial samples, we can learn these transferable features and acquire a more diverse set of replacement rules. This is one of the factors that enhance the transferability of our method.\n\nWe commit to providing more detailed descriptions about Figure 1 in the revised version of our paper. We hope this clarifies your concerns and we are open to further discussions if needed.\n\n\n\n[1] On the Transferability of Adversarial Attacks against Neural Text Classifier (Yuan et al., EMNLP 2021)\n\n\n\n**Question 2.** The technical aspects of CT-GAT are inadequately explained, making it challenging to grasp the workings and the rationale behind its effectiveness.\n\n**Answer 2.** \n\nOur methodology offers a novel approach to the community for executing decision-based black-box attacks. Our method bolsters transferability by leveraging adversarial features, specifically word substitution rules, across various tasks.\n\nWe have delved into the source factors of transferability and the potential of learning with generative models from three perspectives:\n\n1. **Cross-task Word Adversarial Replacement (CWAR) rules:** We further studied the methods utilizing transferability and proposed Cross-task Word Adversarial Replacement (CWAR) rules, effectively improving transferability.\n2. **Similar vulnerable words across different models**: We identified that vulnerable words in sentences are prime targets for attacks. Many white-box attacks exploit this, leading to these vulnerable parts of sentences being more likely to be replaced. Our research has shown that different model structures exhibit similar patterns of vulnerable word distribution, a factor not utilized by previous transferability methods. Our analytical experiments have validated that our approach, which involves learning sequence generation from original to adversarial text, is capable of capturing the distribution patterns of vulnerable words that are closely aligned with those in the victim model.\n3. **Replacement preference**: Through the Gini imbalance coefficient and intuitive reflection of the heat map, we discovered a greater diversity in replacement patterns. This is evident in the statistical rules of original and adversarial samples. We aim to capture this using a Seq-to-Seq structure. In contrast, previous methods that leveraged transferability only capitalized on replacement patterns with the highest frequency of occurrence.\n\nOur method integrates these three factors, effectively employing certain transferability rules, enabling it to be task and model agnostic during attacks. This proves particularly effective for some black-box scenarios, especially attacks on tasks lacking substitute models, thereby offering a fresh approach to black-box attacks.\n\nFor more specific details and quantitative analysis, we kindly invite you to refer to the 'Further Analysis' section (Section 5) of our paper. We hope this clarifies your concerns and we are open to further discussions if needed.\n\n**Question 3.** Figure 2 is difficult to comprehend and could benefit from improvements to enhance its clarity.\n\n**Answer 3.**\n\nWe appreciate your feedback regarding the clarity of Figure 2.\n\nFigure 2 is a flowchart that outlines the training and application process of our method.\n\nSpecifically, the training process involves taking 'original sample-adversarial sample' pairs from different tasks, mixing these samples together, and learning using a seq-to-seq model. After training, the model can directly generate multiple adversarial samples for an original sample without needing feedback from the victim model. These adversarial samples will be used directly to attack the victim model. \n\nIn the revised version of our paper, we will modify Figure 2 to more clearly illustrate our process. \n\n\n\n**Question 4.** The paragraph in Line 199-208 lacks essential details, such as clearly specifying the two tasks being referred to.\n\n**Answer 4.**\n\nThank you for pointing out the unclear parts of our description.\n\nThe section of the paper you're referring to mentions that our training set is derived from two classification tasks: abuse detection and sentiment analysis. Abuse detection is a task that involves identifying aggressive content in text, such as attacks, insults, cyberbullying, hate speech, and so on [1]. Sentiment analysis, on the other hand, is a task used to detect emotions or sentiments, such as happiness, sadness, anger, and so forth [2].\n\nIn the revised version of our paper, we will make it clear that both are classification tasks and provide a more detailed introduction to the objectives of each task. \n\n\n\n[1] Abusive language detection in online user content(Nobata et al., WWW 2016)\n\n[2] Sentiment Analysis Based on Deep Learning: A Comparative Study(Dang et al., ICCSEA 2022)\n\n\n\n**Question 5.** The explanation regarding how CT-GAT ensures transferability is unclear and requires more elaboration.\n\n**Answer 5.**\n\nOur approach builds upon previous research on explainability, while also introducing our unique innovations. \n\nPast research found that the frequency of word replacement somewhat reflects the degree of transferability. This was determined by summarizing the phenomenon of transferability, which led to the proposal of a greedy replacement strategy[1].\n\nOur method introduces new perspectives, specifically, that transferability can be enhanced by better leveraging the following three aspects: the frequency of replacement across different tasks, the similarity of vulnerable words across different models, and the diversity in the choice of replacement words.\n\n1. **Similar vulnerable words across different models:** Our experiments revealed that different models share similar patterns of vulnerable word distribution. These vulnerable words are reflected in the choice of replaced words across various attack methods. The diversity of replacement words can be determined through statistical analysis.\n2. **Replacement preference:** Our experimental results indicate that the selection frequency of replacement words is unevenly distributed, and there are multiple optimal replacement words. This aspect was not considered in previous methods based on transferability.\n3. **Transferability across different tasks:** We expanded previous methods to include cross-task transferable attacks and proposed the Cross-Task Word Adversarial Replacement (CWAR) method. Our method uses word replacement frequency from various tasks, not just from the same task or dataset as the victim model. Tests have shown that using word replacement frequency from different tasks enhances transferability.\n\nOur generator model's task is to learn how to perform word replacement searches in the original sample by integrating the three transferability-influencing factors mentioned above. Our method effectively uses transferability rules by merging these three factors. Compared to the baseline, our attack method demonstrates superior performance, indicating that our method has effectively learned transferability.\n\nFor more specific details and quantitative analysis, we kindly invite you to refer to the 'Further Analysis' section (Section 5) of our paper. We hope this provides the clarity you were seeking and we are open to further discussions if needed.\n\n\n\n[1] On the Transferability of Adversarial Attacks against Neural Text Classifier (Yuan et al., EMNLP 2021)\n\n\n\n**Question 6.** Section 4.6 \"Case Study\" is insufficiently developed, leaving readers confused about its relevance and purpose in the overall context.\n\n**Answer 6.** \n\nWe appreciate your feedback regarding the development of Section 4.6 \"Case Study\".\n\nThe primary objective of our case study is to analyze and illustrate the adversarial examples generated by our method. The perturbation patterns of these adversarial examples are derived from previous attack methods, effectively learning the characteristics of these prior adversarial examples. Furthermore, our model can also integrate different attack methods, such as character-level attacks and word-level attacks.\n\nIn the revised version of our paper, we will provide a more detailed explanation about our case study. \n\n\n\n**Additional remarks**\n\nWe greatly appreciate your time and effort in reviewing our work. We would like to highlight that our proposed method is designed to be straightforward and easy to implement. For the convenience of others to follow our work, once accepted, we will make our code, datasets, and trained model parameters all publicly available on both GitHub and Google Cloud.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The research topic of \"generating universal attacks across different NLP tasks\" is interesting and important.\n2.  Many datasets and metrics have been deployed for evaluation purposes.", "reasons_to_reject": "1. The objective of Figure 1 remains unclear, and its intended demonstration needs further clarification.\n\n2. The technical aspects of CT-GAT are inadequately explained, making it challenging to grasp the workings and the rationale behind its effectiveness.\n\n3. Figure 2 is difficult to comprehend and could benefit from improvements to enhance its clarity.\n\n4. The paragraph in Line 199-208 lacks essential details, such as clearly specifying the two tasks being referred to.\n\n5. The explanation regarding how CT-GAT ensures transferability is unclear and requires more elaboration.\n\n6. Section 4.6 \"Case Study\" is insufficiently developed, leaving readers confused about its relevance and purpose in the overall context.", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper proposes a model titled 'CT-GTA' to generate Cross-Task Generative Adversarial Attacks across various NLP tasks. CT-GTA is claimed to exhibit high transferability and can produce universal adversarial attacks for diverse tasks. Experiments have been conducted to demonstrate the performance of CT-GTA.", "excitement": 2, "reproducibility": 1, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "SlFLDSYP7u", "reviewer": "Reviewer_sMHo", "summary": "", "questions": "Question A:\nAre different tasks trained in parallel?\n\nQuestion B:\nWhat are the losses designed for different tasks？\n\nQuestion C:\nHow to balance the losses between different tasks?\n\nQuestion D:\nHow does the temperature of the model works?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your keen eye in identifying the typo error in our paper. We will diligently review our work to identify and rectify any similar issues. In the revised version, we commit to thoroughly correcting all spelling errors. Your attention to detail is invaluable in enhancing the quality of our work. Thank you once again for your feedback.\n\n**Question A**: Are different tasks trained in parallel?\n\n**Question B**: What are the losses designed for different tasks?\n\n**Question C**: How to balance the losses between different tasks?\n\n**Answer A, B, C:**\n\nOur method does not involve parallel training of different tasks. Instead, we combine adversarial examples derived from various tasks to form a unified training dataset. We refer to our approach as \"cross-task\", as we generate adversarial examples based on tasks that are distinct from the target task. This is a novel approach compared to previous transferability-based methods, which only conducted transfers within the same task.\n\nFor training our adversarial sample generator, we utilize cross entropy, a common sequence-to-sequence loss function.\n\nSince our method does not incorporate multi-task training, there is no need for a strategy to balance the losses between different tasks.\n\nWe hope this clarifies your concerns, and we are open to further discussions if needed.\n\n**Question D**: How does the temperature of the model works?\n\n**Answer D**:\n\nThe \"temperature\" in our generative model is a hyperparameter that controls the randomness of predictions during the generation process. In the context of our method, a higher temperature value implies a higher degree of perturbation in the generated adversarial samples, which in turn leads to a higher attack success rate.\n\nWe have conducted a series of experiments to illustrate the impact of temperature on the attack success rate. The results, as shown in Table A, depict the variation in attack success rate with different temperature values. We hope this clarifies your question, and we are open to further discussions if needed.\n\n**Table A.** The impact of temperature on the attack success rate(ASR%) of CT-GAT attacks on different victim models.\n\n| Dataset\\| Temperature | 1.0  | 1.1  | 1.3  | 1.5  | 1.7  | 1.9  | 2.1  | 2.3  | 2.5  |\n| --------------------- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |\n| CGFake                | 49.3 | 58.3 | 72.8 | 81.3 | 92.3 | 98.3 | 100  | 100  | 100  |\n| jigsaw                | 36.8 | 45.3 | 50.0 | 56.8 | 60.0 | 63.5 | 65.3 | 67.5 | 69.0 |\n\nWe assure that we will include a line graph illustrating the impact of temperature on the attack success rate in the appendix of the revised version.\n\n\n\n**Reply to your reasons to reject**\n\nI greatly appreciate your pointing out our typos. In the revised version, we will carefully review and correct spelling errors and citation mistakes in the article.\n\nAnd thank you for pointing out the issue with Figure 2 and its related description not being clear enough. \n\nFigure 2 is the flowchart of our model's training and usage process. In the revised version, we will redraw Figure 2, remove one of the loss boxes, and make it clearer. At the same time, we will add more details in Section 3.2, \"Transferability-Based Generator,\" to explain Figure 2.\n\n**Additional remarks**\n\nWe greatly appreciate your time and effort in reviewing our work. We would like to highlight that our proposed method is designed to be straightforward and easy to implement. For the convenience of others to follow our work, once accepted, we will make our code, datasets, and trained model parameters all publicly available on both GitHub and Google Cloud.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The core idea of the method is intuitive and easy to follow.\n\n2. The experimental results are promising.", "reasons_to_reject": "1. There are a few formatting errors.\nTable 3 is marked as Fig 3 erroneously. \n\n2. The details of the proposed method are missing.\nIn this paper, the authors only mentioned the use of the seq-to-seq model (e.g., DAST) to build a generation model, but did not explain details of the generation model in the training process, such as the loss function used in different tasks. It is better to have a more detailed explanation of Fig 2.\n\n3. The authors mentioned “temperature” several times, and it can affect the performance of the model. However, the authors did not provide a concrete example to explain it.", "questions_to_authors": "Question A:\nAre different tasks trained in parallel?\n\nQuestion B:\nWhat are the losses designed for different tasks？\n\nQuestion C:\nHow to balance the losses between different tasks?\n\nQuestion D:\nHow does the temperature of the model works?", "paper_topic_and_main_contributions": "This paper aims to reduce the dependence of adversarial attack methods on the information of victim models. The authors propose to directly construct adversarial samples by transferable features extracted from various tasks. Specifically, using adversarial samples constructed in different tasks, the author trained a seq-to-seq model called CT-GAT to generate universal adversarial samples and conducted experiments on new tasks. The experiments indicate that the proposed methods have good attack performance.", "excitement": 4, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors propose a new method for black-box model adversarial attacks. They leverage a generative model to use data sampled from the target tasks to obtain transferable adversarial features. In the experiments, the authors show a high attack success rate across multiple tasks. The paper is well-written and easy to follow. 
At the same time, the authors might miss some detailed descriptions of their methods and results.
Decision: Accept-Main