Preserving Semantics in Textual Adversarial Attacks
Authors: David Herel
Hugo Cisneros
Tomas Mikolov
Venue: Submitted to ICLR 2023 (2023)
Keywords: NLP
Adversarial Attacks
Sentence Encoders
Semantics Similarity

Abstract: Adversarial attacks in NLP challenge the way we look at language models. The goal of this kind of adversarial attack is to modify the input text to fool a classifier while maintaining the original meaning of the text. Although most existing adversarial attacks claim to fulfill the constraint of semantics preservation, careful scrutiny shows otherwise. We show that the problem lies in the text encoders used to determine the similarity of adversarial examples, specifically in the way they are trained. Unsupervised training methods make these encoders more susceptible to problems with antonym recognition. To overcome this, we introduce a simple, fully supervised sentence embedding technique called Semantics-Preserving-Encoder (SPE). The results show that our solution minimizes the variation in the meaning of the adversarial examples generated. It also significantly improves the overall quality of adversarial examples, as confirmed by human evaluators. Furthermore, it can be used as a component in any existing attack to speed up its execution while maintaining similar attack success.

Under review as a conference paper at ICLR 2023
PRESERVING SEMANTICS IN TEXTUAL ADVERSARIAL ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial attacks in NLP challenge the way we look language models. The goal of this kind of adversarial attack is to modify the input text to fool a classi- fier while maintaining the original meaning of the text. Although most existing adversarial attacks claim to fulfill the constraint of semantics preservation, careful serutiny shows otherwise. We show that the problem lies the text encoders used to determine the similarity of adversarial examples, specifically in the way they are trained. Unsupervised training methods make these encoders more susceptible problems with antonym recognition. To overcome this, introduce sim- ple, fully supervised sentence embedding technique called Semantics Preeerii-- Encoder (SPH). The results show that our solution minimizes the variation in the meaning of the adversarial examples generated. It also significantly improves the overall quality of adversarial examples, confirmed by human evaluators. Fur- thermore, it can be used as a component in any existing attack to speed up its execution while maintaining similar attack success
INTRODUCTION
Deep learning models have achieved tremendous success in the NLP domain in the past decade. They applied in diverse critical areas such as hate speech filtering, moderating online discussions, or fake news detection. Successful attacks on these models could potentially have a devastating impact. In recent years, many researchers have highlighted that language models are not as robust as previously thought (Jin et al., 2020; He et al. 2016)] Zhao et al. |018 Szegedy et al.) [2014] Kurakin ct al., 20166a b) and that they can be fooled quite easily with so-called adversarial examples, which introduce a small perturbation to the input data iippercpptble'" to the human eye. For example, in
the domain of offensive language detection, we can have an offensive text on input and modify in such way that the meaning is preserved, but the modified text will fool the system to classify as non-offensive (Jin al., 2020). similar scenario is illustrated Figure [ in the domain of sentiment analysis of movie reviews.
Although adversarial examples can be perceived as a threat, they also help us identify and under- stand potential weaknesses in language models and therefore contribute the defense system, threat prevention, and decision making of the models just as well (Ribeiro et al. 2018). Furthermore, when attacks are included in training data, the general robustness of the model and its ability to generalize can be improved (Goodfellow et al. 2014; Zhao et al.) 2018).
Regarding the imperceptibility of adversarial attacks, it is easily definable in continuous space, in domains like audio or vision. In computer vision, imperceptibilityy is certain pixel distance between the original image and its perturbed version (Chakraborty et al.) 202T). However, this term is much more difficult to grasp in discrete domains such as text, where there is no clear analogy and where an indistinguishable modification simply cannot exist. This is why several definitions of successful adversarial example have been developed that are specific to discrete domains such as text (Zhang al. 2020b).
According to (Ji et al. 2020) we can identify three main requirements for an adversarial attack on text to be successful:
TThe code, datasets and test examples are available htttttt/ggtttu.bt.t....

---

Under review as a conference paper at ICLR 2023
1. Human Prediction Consistency: The prediction made by humans should remain unchanged.
2. Semantic similarity: The designed example should have the same meaning as the source as judged by humans.
3. Language fluency: The generated examples should look natural and grammatical.
We can observe similar constraint definition in (Morris al. 2020a), with the addition of the "'vverlap" constraint that focuses on character-level changes.
Original sentence
Average
Do yourself big favor and NOT watch this movie.
Classifier
Predicted Negative: 93%
Simillarity in embedding spaice
Attack algorithm
Sentiment Analysis
:
Success
Candidate sentence
Fooled: Predicted Positive: 82%
Do yourself big favor and DO NOT this film.
Clussifier
Figure 1: The typical adversarial example pipeline for a sentiment classification task. The attacked classifier was trained to distinguish between positive and negative movie reviews. The semantic similarity metric is based on our Peanttics-PPeeeriing---iee using an array of supervised classifiers. this example, substituting two words simultancously fools the model into changing its prediction and passes the semantic similarity test.
(SPE). which embeds sentences
Although most adversarial attacks claim to meet these constraints (Gao al. 2018 Li ct al. 202
Garg & Ramakkishnan 2020), careful scrutiny shows otherwise. We observed that many adversarial examples do not preserve the meaning of the text in some cases. This is also supported by (Morris al. 2020a) whose findings are similar. To overcome this problem, (Morris et al., 2020a) suggested increasing cosine thresholds and introducing mechanisms such grammar checks improve the
quality of adversarial examples. However, it is at the cost of the attack success rate, which decreased rapidly by more than 70%. We suggest a different solution that promises to avoid this decline in the attack success rate.
appears that the problem lies in the similarity metric itself, whose function to measure the difference between the original and perturbed sentences. These metrics mostly use encoders that are trained with limited supervision. This makes them more susceptible problems with antonym recognition. Because the antonyms are used in a similar context in the training data, the encoder assumes that they are alike. As result, sentences such as 'This movie so good' and 'This movie is so bad' are considered similar in this case, as illustrated in the third column of Table
Building on these findings, we propose a new sentence encoder for similarity metrics in textual adversarial attacks called Praraniici--reeevinnggg-ee Encoder (SPE). SPE is trained with full supervision on annotated datasets. Thus, it should be more robust towards the antonym recognition problems that we observed frequently in adversarial examples.
These premises were proven to be valid throughout the experiments, where we compared our solu- tion to some of the most common similarity metrics used in adversarial attacks. The results show that our solution largely reduces the occurrence of text meaning modification and also significantly improves the overall quality of the adversarial examples generated, confirmed by human evalu- ators. Furthermore, our solution SPE can be integrated into any existing adversarial attack as a component granting much faster execution and comparable attack success rate.
In summary, we consider our main contributions to be as follows:
We propose a simple, but powerful sentence encoder SPE, which improves the overall quality of adversarial examples (minimizes text meaning modification and antonym recog- nition problem). SPE can also be used as a component in any existing attack to speed its execution while maintaining similar attack success rate.
2

---

Under review as a conference paper at ICLR 2023
2. We propose metric for evaluating the quality of the adversarial examples rASR, which reflects the real performance of adversarial attacks.
3. We evaluate some the most common sentence encoders used in adversarial attacks both manually and automatically on relevant datasets such as hate-speech and offensive language detection (Barbieri et al.] 2020), in addition to other popular classification tasks such as
Yelp Reviews (Zhang et al. 2015) and Rotten Tomatoes (Pang & Lee 2005).
4. We release our work as open source, including the code, human evaluations, datasets, and test samples for the purpose of reproducibility and future benchmarking.
RELATED WORK
Textual adversarial attacks. There were many attempts to create textual adversarial attacks that preserve semantics and are grammatically correct. Ultimately, we can distinguish between three different ways which other researchers approach this. The first approaah aims to modify the whole sentence using various sophisticated phrase perturbations, such as paraphrasing (Gan & Ng 2019 Wang et al. 2020). However, these modifications often have problems with semantic preservation (Zhang et al. 20206
The second approach focuses on character-level modification, such as misspellings or typos. which has proven be successful in terms of semantics preservation (He et al. [027]] Li al. 2019 Ebrahimi et al. 2018). However, research shows that these types of attacks can be mitigated quite easily with tools such as grammar checks (Pruthi al. 2019: Jones al. 2020).
Lastly, the word-level attack technique focuses on the substitution or modification of a single word (or combination of multiple words) in the text (Alzantot al. 2018 Ren et al.) 2019 Dong al.
2021 Li et al., 2021a). This type of attack aims to preserve the constraints defined by (Morris et al. 2020b), often using methods such as synonym substitution to improve semantic preservation.
Similarity metrics. The majority of word-level adversarial attacks enforce semantics similarity by using Sevversl-SSentnnee Encoder (USE) (Cer et al.) 2018) BERTScore (Zhang et al. 2020a) encoders, both of which are trained mainly on unsupervised tasks. USE is trained on task such as Ship-Thought (Kiros et al.) 2013). conversational input-response task (Henderson et al. (017) and supervised classification task performed on the SNLI dataset (Bowman et al. 2015). BERTScore based on pre-trained BERT language model (Devlin et al. 2018). which was also trained unsu- pervisedly on the Next Sentence Prediction and Masked LM tasks.
Even though these sentence encoders have been thoroughly studied on various general tasks, only a few previous works acknowledge their flaws when used in adversarial attacks (Morris et al. 2020bb Herel 2022). y. In most cases, these encoders struggle to recognize changes in the text's meaning and semantics. To overcome this, (Moriis et al.) 2020b) increased the cosine threshold, resulting in improved quality of adversarial examples, but over 70% decline in the attack success rate.
Looking the big picture of the observed problems, have discovered potential link the coder training process. We show that the unsupervised training predetermines these encoders to have problems with antonym recognition, which leads introduce own Semantics-Present Encoder.
3 METHOD
In order to fully grasp the idea and motivation behind our sentence encoder Semantics-Preserviii Encoder, we formulate the textual adversarial attack problem the following section. Next, we formally introduce SPE, together with its classifiers and other properties.
3.1 PROBLEM FORMULATION
Most similarity metrics in adversarial attacks rely on sentence encoders such as USE (Cer et al. 2018) BERTScore (Zhang et al.) 2020a). These encoders use multi-task learning with high emphasis on unsupervised tasks. The BERT language model (Devlin et al. 2018)) uses Masked- Language Modeling. USE is trained on Skip-Thought (Kiros al. 2015) like task, where the goal
3

---

Under review as a conference paper at ICLR 2023
to predict the middle sentence based the given context. Both of these training methods could be seen as a variation of a Ship-Gram/CBOw model (Mikolov et al. 2013). where the goal is to predict the context of given target word, and vice versa for CBOW. However, this training method forces synonyms to be mapped into a similar vector space as antonyms, as they appear in the same context. Therefore,
contradictory sentences in their vector representation could be very close to each other in the vector space despite their opposite meaning. That is if the unsupervised training with Skip-Gram CBOW like tasks is used. This is the case for both BERT and USE.
A typical example of this problem is shown in Table I In this example, we used USE to encode the sentences into the vector space and then measured the cosine similarity. The major flaw of the encoder can be observed immediately. Sentences with totally opposite meanings, "This movie is so good" and "This movie is so bad", are closer to each other than sentences with almost the same meaning, "This movie is so good" and "This movie is so tasty".
3.2
The core idea of our encoder lies in supervised training. We took advantage of the existing pre- labeled datasets and utilized them in the training data to tackle the problem with opposite words appearing in the same context. As a result, the words that are the most discriminative for the given label will be close to each other in the vector space. Thus, the sentences mentioned above "This movie is so good' and 'This movie is so bad" should never be close to each other in the vector space, because their semantics label will be exactly opposite.
We have combined multiple classifiers trained on different annotated datasets, which allows us to have a diverse of different sentence vectors. The sentence vectors will differ because each clas- sifier produces its vector according to the task on which it was trained. Therefore, the diversity of classifiers implies a diverse set of sentence vectors. Moreover, by combining several sentence em- beddings from different classifiers, we can create robust classifier that can produce a high-quality embedding for a broad range of topics.
From sentence S, an attack will generate a candidate adversarial example S We denote the N supervised classifiers by C1, C2..... Cn. For simplicity, we consider these classifiers to be functions whose outputs are the sentence embeddings extracted from the classifier when applied to a sentence. Formally, for all k; (5 = e E IRP where p the embedding dimension. The complete embedding of sentence is obtained by averaging the output of the classifiers into single embedding vector.
N
Σ Ca(s)
Σ
1
= N
The similarity between the original sentence S and the attacked sentence S" is computed with the cosine distance between their embeddings as follows
( (S*)
Sim(S, S*) |e(()) (()))
where- represents the dot product between vectors in R' and || is the Lg norm in RP. For threshold e, S and S* will be considered have the same meaning Sim(S, >
The classification model that we used is fastText (Joulin et al. 2016). However, it is important to note that any other classification model can be used instead. We decided use fastText due to its many advantages. Firstly, fastText classifiers allow us to create sentence vectors rather quickly with reasonable performance for the given task. Secondly, we can reduce the dimensionality of the vector space. This way we can put more information into fewer dimensions, which results in more efficient space storage.
The classifier selection and training process are key to achieving a robust solution with high-quality results. We begin to train classifiers on Natural Language Inference (NLI) datasets like SNLI (Bow- man et al.) 2015), cola, rte and sst2 (Wang et al.] 2018), to help SPE eliminate the problem with out of vocabulary words. We have further extended this selection with classifiers trained on more downstream tasks such emotion classification CARER, Yelp reviews and Stack Overflow ques- tions classification (Saravia et al., 2018 Zhang et al., 2015 Annamoradneeaa et al.) 2022). This should help our approach to map words with different meaning to different vectors. However, it is
4

---

Under review as a conference paper at ICLR 2023
possible that for other purposes than adversarial attacks, optimal set of classifiers could be found. We then took the sentence embeddings from each classifier and averaged them into one. This process is illustrated in Figure 2 More details about the selection of classifiers and the averaging method can be seen in Appendix A.1
INPUT
C1
C2
C8
C4
Gn
CLASSIFIERS
SENTENCE VECTORS
AVERAGE
FINAL SENTENCE
VECTOR
Figure 2: Model architecture for SPE. For the given input, each classifier creates sentence em- bedding. These sentence vectors with the same dimension are averaged to produce the final sentence vector.
Furthermore, we show that our approach can better distinguish between a text with opposite and similar meanings than others that use limited supervision. This is illustrated on the previously re- marked example in Table where SPE achieves much larger difference in cosine similarity, which much more indicative the real meaning of the sentence.
Cosine similarity (USE)
Cosine similarity (SPE, ours)
Original sentence
Perturbed sentence
This movie is so good This movie is so good
This movie is so bad
0.90
0.63
This movie is so tasty
0.89
0.95
Our approach, SPE, is able to better distinguish between the sentences with similar and opposite meaning than sentence encoders trained with mostly unsupervised methods like USE (Cer et al., 2018). Texts in the table were transformed into latent space by sentence encoders and then the cosine similarity was measured. Sentences with an almost identical meaning should have higher cosine similarity than sentences with an opposite meaning. This is the case for our approach SPE.
Table 1:
As mentioned above, the of fastText classifiers allows achieve reduced real-time com- plexity of SPE compared to USE (Cer et al., (2018) or BERTScore (Zhang et al.) 2020a). SPE only needs to perform matrix multiplication operations (because we implement fastText classifiers) with small matrices due to the classifiers hidden layer dimension equal to 10. This is a marginal difference compared the computations executed by USE (Cer al., 2018). which performs the operations with 512-dimensional vectors and, therefore, very large matrices. The final time com- plexity compute the sentence representation using SPE is defined follows:
O
V * H 1=1
(1)
where V is the length of the sentence and H; is the size of the hidden layer for i-th classifier.
As the next logical step after the implementation of SPE, we wanted to apply our text encoder in similarity metrics. Generally, the role of an encoder in similarity metric is to transform the given text into a corresponding vector in the latent space, which then used to evaluate the similarity. Specifically, cosine similarity is measured between the vectors of the original text and the perturbed
5

---

Under review as a conference paper at ICLR 2023
text. If the cosine similarity reaches certain preset threshold e, adversarial example is considered successful.
Therefore, for metric, the general cosine threshold also had to be defined. Ideally, it should be set so that consistent results for any domain are produced. Our experiments empirically show that setting 0.95 performs consistently well across different datasets, which is the reason we chose it for our similarity metrics.
4 EXPERIMENTS
To evaluate our proposed sentence encoder real attack use cases, we performed some automatic and numan-based manual evaluation. As explained in Section the commonly used attack success rate fundamentally flawed and is not enough to measure the success of an adversarial attack. The metric only gives partial view of the real capability of attack, obscuring the quality of the semantic similarity constraint on the generated sentences. For this reason, we conducted an extensive survey to collect human evaluations of the quality of the attacks generated, which allows us to evaluate the semantic similarity constraint.
The main goal of our experiments is study the impact of SPE when used semantic similarity constraint in adversarial attacks. If this constraint is too strict, only a few high-quality sentences would be accepted as successful attacks, potentially missing many good candidates. Inversely, too loose a constraint would produce many low- low-quality examples. We focus our experiments on two widely used attacks: TextFooler (Jin al. (020) and its improved version TFAdjusted (Morris) et al. (020b). To understand the effect of SPE in existing attacks, we use it as a constraint, together with two other state-of-the-an semantic similarity metrics, the Universal Sentence Encoder (USE) (Cer et al. 2018) and BERTScore [Zang et al. 2020a), totaling six attack/sentence encoder pairs.
4.1 AUTOMATIC EVALUATION
We automatically evaluate adversarial attacks using three metrics:
Attack success rate (ASR). The percentage of successful adversarial examples found by an attack. Given sentence classifier, a successful adversarial example means that the attack gener- ated a sentence similar the original that is assigned a different label by this classifier. A higher success rate means that more generated sentences are assigned a different label.
Time. Average time needed to create an adversarial example. Attacks may rely on various search techniques to generate candidate sentences, leading to varied generation times.
Modification rate. The percentage of modified words. To be as imperceptible as possible, attacks should use as few edits as possible.
4.2 HUMAN EVALUATION
Using automatic evaluation, such the attack success rate, adversarial attacks considered suc- cessful if they simultaneously pass a semantic similarity threshold and manage to change the label of classifier. Measurement of semantic similarity between sentences is still an open research prob- lem with no commonly accepted solution. In some cases, even humans disagree on whether two sentences similar not. For this reason, we include an extra evaluation step in our experiments to obtain more robust results. Sentence pairs were presented to 5 annotators who assigned them an integer score between 1 and where score means strongly disagree, 2 disagree, 3 agree and strongly agree. The higher the score, the more similar the meaning of pair of sentences will be according to the annotator. Each annotator was given the sentences to label in several online forms. We averaged the scores of all the annotators into single value for cach sentence. Sentences were assigned a binary label; those with an average score greater than or equal to 2.5 are considered sim- ilar, while the others are labeled as not similar. Because the original score system is not binary, the threshold was chosen exactly in the middle of these values. Experimentallyy we have determined that the exclusion of the equality 2.5 does not have any noticeable impact the results.
Based on this evaluation, we estimate a realistic success rate the attack - or an estimated "real ASR" (rASR). This number represents the number of successful attacks that would actually fool the

---

Under review as a conference paper at ICLR 2023
reader into thinking that they have the same meaning the original sentence but have different label assigned by the classifier. This score, although costly to estimate, gives a very accurate measure of the quality of an attack. A perfect attack would reach high ASR and very similar rASR (ASR R rASR), which means that it successfully fooled the target classifier repeatedly and that all the corresponding attacked sentences also conserve the same meaning the original in the eyes of human annotators.
4.3 DATASETS
We evaluated the performance of SPE-based attacks and compared them with existing state-of- the-art attacks on four text classification datasets that correspond to various potential applications of adversarial attacks from NLP, such data augmentation speech. Figure 3 shows the average number of words in each of the datasets studied. All source code, links the datasets, and trained models be found on Github We did not include sentence similarity benchmarks such as MRPC (Dolan & Brockett 2005) because they do not contain the types of sentences that occur adversarial examples. Therefore, they would not be relevant for our context.
detection of hateful and offensive
Offensive tweets. This dataset from the TweetEval set of seven multiclass tweet classification tasks (Barbieri et al. 2020). The tasks are labeled irony, hate, offensive, stance, emoji, emotion, and sentiment. The offensive task consists of classifying tweets as offensive or non-offensive. We used a subset of 1000 sentences from the training split of the dataset for our attacks. This dataset is particularly interesting in the context of adversarial attacks on text because it is based on real harmful content that can encountered online. Having the ability to correctly recognize and filter these harmful content is crucial task for many social networks. Adversarial attacks demonstrate potential flaws the classifiers used to detect this harmful content, but also offer a tool to improve them.
The attacked model a roBERTa-based (Liu et al. 2019) model trained on 58M tweets and fine-tuned for offensive lan- guage identification with the TweetEval benchmark (Barbieri et al. 2020).
140.2
22.2
Hate speech tweets. This dataset is from the same set of tasks as the Offensive Tweets dataset above (Section 4.3). The goal of the hate speech task is classify tweets hate speech or non-hate speech. We used subset 1000 sentences from the training split of the dataset for attack. Similarly the offensive tweets dataset, this dataset and potential adversarial attacks related classifiers particularly useful for the de- tection of harmful content online.
Rotten
Offensive
tomatoes
speech
Figure 3: Average number of words per sentence in each dataset. The Yelp reviews dataset has much longer sentences on average. The two datasets based on Twitter have built-in character limit (tweet size), and the Rotten tomatoes re- views were pre-processed by the dataset authors to usually contain single sentence.
The attacked model is roBERTa-based (Liu et al. 2019) model (same as the model used for the offensive tweets dataset) trained 58M tweets and fine-tuned for offensive language identification with the TweetEval benchmark (Barbi- eri et 2020
Rotten tomatoes. The rotten tomatoes dataset is movie review dataset with 5,331 positive and 5,331 negative processed sentences from Rotten Tomatoes movie reviews (Pang & Lee 2005). We used a subset of 1000 sentences from the training split of the dataset for our attack.
The attacked model is the uncased base DistilBERT (Sanh et al. 2020) model fine-tuned on the rotten tomatoes dataset.
Yelp reviews. The Yelp review data set is data set for binary sentiment classification (Zhang cet al. 2015). contains a set 560000 highly polar yelp reviews for training and 38000 for testing. It consists of Yelp reviews extracted from the 2015 Yelp Challenge data.
7

---

Under review as a conference paper at ICLR 2023
The attacked model is roBERTa (Liu et al. 2019) model fine-tuned binary sentiment classifca- tion from Yelp polarity.
5
RESULTS
(a) Offensive tweets
(b) Hate speech tweets
Allack
ASR 1
rASR
Time 4
Mod. rale
ASR
zASR 1
Time L
Mod. rate
TextFookr+SPP (ours)
68.3
30.7 (100)
1.359
16.8
65.6
(109)
1.865
19.3
TextFooler+UUE
75.4
20.4 (100)
1.749
17.4
69.1
(100)
2.111
20.9
DoxfFolle-BERRSSAA
64.2
18.6
1,955
19.5
65.8
37.5 (100)
2.274
20.7
TEAdjusted-SPE. (ours)
(100)
1.054
10.8
9.8 (97)
1.44
12.4
TFAdjustedUUSE
1.0
0.865
9.1
2.6
2.4 (23)
0.771
9.7
B.djjuste-BERTSSne
5.4
(47)
1.167
(51)
1.187
14.3
(c) Rotten tomatoes
(d) Yelp reviews
Attack
ASR
rASR
Time 4
Mod. rate
rASR
Time
Mod. rate
TextFooler+SPE (ours)
89.0
61.4 (100)
0.746
12.8
87.4
36.7 (100)
14,792
10.2
TextFooler+USE
96.4
(100)
0.824
13.2
90.5
7.2 (100)
13,874
10.6
TextFoolr--BRRTSSom
92.7
38.9 (100)
0
13.9
89.8
7.2 (100)
176
11.5
TFAdjusted-SPE (ours)
12.6
11.8 (100)
0,774
12.4
8.2
4,5 (81)
36.921
10.6
TFAdjusted-USE 0.3
0.513
9.6
22.325
5.7
(57)
0,993
14.2
2.3
1.5 (23)
32.946
5.7
Table 2: ASR the attack success rate (in %), rASR the estimated real attack success rate obtained from the human survey (in %), the time per sentence is in seconds and the modification rate is the average fraction of words changed per sentence (in %). An upward arrow (t) indicates that higher is better. All numbers but the estimated rASR were computed 1000 instances. For the estimated r rASR, we report the number of annotated examples in parentheses. For some of the results with TFAdjusted + USE/BERTScore the ASR so low that few sentences could be submitted for annotation, and the rASR estimates are unconclusive. We omitted rASR values for configurations with less than 10 successful attacks out of 1000 attempts.
The results of our experiments with the six attacks on the four datasets are shown in Table We ob- serve that SPE surpasses other alternatives by a large margin in all configurations, with an estimated real attack success rate (rASR) more than 20% higher than USE or BERTSccre with TextFooler and more than 3 percentage points higher with TFAdjusted.
As expected, TextFooler-based attacks have high ASR, reaching 90% and more while attacking the rotten tomatoes dataset for example. But they also have a steep drop from ASR to rASR: for example, UeX has its ASR decrease from 96% rASR of 1,, indicating that many of the supposedly successful attacks actually do not have the same meaning according to human annotators. This is due to the weakness of the semantic similarity constraints, out low-quality examples. This can be an issue in practical applications, since the attacked sentence could easily be detected by humans. For all four datasets, this drop is minimal when using SPE as constraint.
they do not filter
TRAdjusted receives lower ASR scores than TextFooler (no ASR greater than 12%), but the drop between ASR and rASR is low compared to TextFooler, with a maximum drop of 2.4% for TFAd- Susted+SPE on the offensive tweets dataset. It shows that the sentences generated by the TFAdjusted attack are of high quality, which is confirmed by the annotators. This is in agreement with the ob- servations of (Morris et al. (020b) who proposed TFAdjusted to improve the output quality of the TTettFooler attack. The quality increase is obtained at the expense of the ASR, which can be consid- crably lower. For example, TFAdjusted with USE obtains ASR scores lower than 3% on all datasets, making it barely usable as an attack, since it generates less than 25 usable sentences out of 1000 attacked sentences. The ASR of SPE is higher than the other constraints, which can be interpreted encoder still has remarkably low drops from ASR to rASR, and
SPE being less strict. Yet, surpasses both other solutions in all examples in terms of rASR. This indicates better ability to generate successful attacks that maintain the original meaning of sentences.
8

---

Under review as a conference paper at ICLR 2023
To give better understanding of the final adversarial examples and the labels given by human annotators, we included several illustrative examples from the Rotten Tomatoes dataset and the TextFooler attack in Table A more diverse set of examples is available in Appendix Section Secttdi A.4
Average human label (t)
Original sentence
Perturbed sentence
Encoder
"an impressive if flawed effort that indicates real talent."
"an wondrous if flawed effort that indicates real talent."
3.6
SPE
"an original gem about an ob- session with time."
"an original topaz about ob- session with jours."
1.6
"it sounds sick and mad- woman, but the miracle of shainberg 's cameraman is that awfully is romance"
"it sounds sick and twisted, but the miracle of shainberg's 's film that it truly is romance"
1.4
BERTScore
"one of the greatest family- oriented, adntasy-adventure movies ever."
" "one of the worst family- oriented, fantasy-adventure cinemas ever."
1.25
USE
Table 3: Adversarial examples produced during experiments for the Rotten Tomatoes dataset and TextFooler attack with the average human label. An upward arrow (1) indicates that higher is better. In all of these examples, the semantic similarity metric which is based on the encoder found the perturbed sentences to be sufficiently similar to the originals.
6 CONCLUSION
Our results show that existing state-of-the-art adversarial attacks produce examples that often do not sufficiently retain meaning and therefore should be considered successful. We confirmed this by conducting an extensive human survey, showing, for example, that to 70% of the sentences generated by an attack should be discarded because they do not preserve their original meaning. Al- though increasing the semantic similarity threshold may improve the quality of examples (Morris al. 2020a) claims, it also leads lower attack success rate and attacks with limited applicabil- ity. The issue lies in the similarity metric used to constrain the generation of sentences in the attacks we tested. Existing similarity metrics are based on models trained in an unsupervised way and thus suffer from several issues, such antonym disambiguation in the sentence latent space. We tackled this by developing the Semantics- Pratttics--reevvingg Encoder, which uses word embeddings extracted from supervised models to improve the semantic similarity metric of adversarial attacks. We obtained much higher success rate on various datasets with the SPE, and human evaluation showed that the generated sentences reliably fool humans into thinking that they have the same meaning the original.
We expect future adversarial attacks to still rely on semantic similarity metrie, which is essential for generating candidate sentences with similar meanings. SPE being usable as drop-in replacement for these metries, is not tied a particular attack algorithm. SPE can be useful for improving any existing attack and will still be usable with future attacks. While SPE as presented in this paper based on pre-trained fastText classifiers, should be straightforward to extend this idea to large pre-trained language models. That should result in even higher accuracy of the attacks, at the cost of greater computational complexity. This kind of extensions could be achieved simply by fine- tuning the language models classification tasks, where, e.g. sentiment is of high importance. Future work could explore the choice of embeddings used SPE and the potential improvements that could result from choosing different models and supervised and semi-supervised embedding techniques.
Online communication is still conducted primarily through text. Social networks and messaging platforms must process large amounts of user generated text to prevent dangerous or harmful content from being spread or targeted at specifie individuals. In this context, textual adversarial attacks

---

Under review as a conference paper at ICLR 2023
crucial tool for understanding the shortcomings of existing content filtering models and improving them. Better adversarial attacks mean even better models, and SPE is a step towards building higher- quality attacks, which will continue to highlight issues with our machine learning models and help us train them better.
REFERENCES
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho. Mani Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples, 2018. URL https://arxiv:
org/ erg/abs/Dee abs/1804: 07998
Issa Annamoradnejad, Jafar Habibi, and Mohammadamin Fazli. Multi-view approach to suggest moderation actions in community question answering sites. Information Sciences, 600: 154, 2022. ISSN 0020-0255. doi:
08.5 URL https: www.
sci scceenedi1 rect http:ttww....aaaaaaaaaaaaaaaa///
Francesco Barbieri, Jose Ciimach-CColldoss Luis Espinosa Anke, and Leonardo Neves. TweetEval: Unified Benchmark and Comparative Evaluation for Tweet Classification. In Findings of the Association for Computational Linguistics: EMNLP 2020, pp. 1644-1650, Online, November 2020. Association for Computational Linguisties. doi: 10. 10.18653/v1220 1/2520 ( 148.
Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. A large an- notated corpus for learning natural language inference. CoRR, abs/1508.05326, 2015. URL
http://arxiv.ortt Btegg/abs/1550 1508 05326
Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Con- stant, Mario Gugjardo-Cespedess Steve Yuan, Chris Tar, Yun-Hsuan Sung. Brian Strope, and Ray Kurzweil. Universal sentence encoder, 2018. URL http::tt///// arxia. orw.s/.11rg/b///118333
11175
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopad- hyay. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technol- ogy, 6, 03 2021. doi: 10.1049/cit2.12D00
Jacob Devlin, Ming-Wer Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirectional transformers for language understanding. CoRR, abs/1810.04805, 2018. URL
http://arxia: wrt.:oogg//b/ooo..o
04805
William B. Dolan and Chris Brockett. Automatically constructing corpus sentential paraphrases.
In Proceedings of the Third International Workshop on Paraphrasing (IWP2005), 2005. URL
h www.nnhhhoyy...o.m ogy. www.oogg////--0...
Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. Towards robustness against natural language word substitutions, 2021. URL https: wttpaaaiivvvoo.....a. wttpor////////..//////// 13355111
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. HotFlip: White-box adversarial ex- amples for text classification. In Proceedings of the 56th Annual Meeting of the Associa- tion for Computational Linguistics (Volume 2: Short Papers), pp. 31-36, Melbourne, Aus- tralia, July 2018. Association for Computational Linguisties. doi: 10. 18.118/3/v11 1/P18-200 URL ht Buttss//aolannthoooy..ooog
2006
Wee Chung Gan and Hwee Tou Ng. Improving the robustness of question answering systems to question paraphrasing. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 6065 6075, Florence, Italy, July 2019. Association for Compu- tational Linguistics. doi: 10. 10.18653//1//11-1111
URL https: htap::::///llaathhoogy..... org/
P19- 1100
Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW). pp. 50-56, 2018. 8. doi: 10.1 109/SPW.2018..000
10

---

Under review as a conference paper at ICLR 2023
Siddhant Garg and Goutham Ramakrishnan. BAE: BERT- adversarial examples for text clas- sification. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 6174-6181, Online, November 2020. Association for Computational Linguistics. doi: 12211665/1122220mmmmmm--o 2020. e00.mmmlpmmaa 448
URL https: /ass://aclle hatp///cllaaalooooo loyy ogy.org/
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv 1412.6572, 12 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEFE Conference on Computer Vision and Puttern Recognition (CVPR), pp- 770-778, 2016.
doi: 10. N.1109/CVVR.2216.990
Xuanli He. Lingjuan Lyu, Lichao Sun, and Qiongkai Xu. Model extraction and adversarial transfer- ability, your BERT is vulnerable! In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies, pp- 2006-2012, Online, June 2021. Association for Computational Linguistics. doi: 10. 18633/vl 1021.naacl-mai.... URL htRL/tttts:///aaatttotoo org. naacl www.aaaaaannaaaaaaaaaaaaaaaaaaaa 161
Matthew L. Henderson, Rami Al-Rfou, Brian Strope, Yun-Hsuan Sung. László Lukáes, Ruiqi Guo, Sanjiv Kumar, Balint Miklos, and Ray Kurzweil. Efficient natural language response sugges- tion for smart reply. CoRR, abs/1705.00652 2017. URL http::ttaxxxiv..t/// artp:///rrrbbb//05555
00652
David Herel. Adversarial attacks on text classifiers. Master's thesis, Czech Technical University in Prague, 2022.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment. In The Thirty- Artificial Intelligence, AAAI 2020, The Thirty-econd Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 8018-808 AAAI Press, 2020.
Fourth AAAI Conference
Erik Jones, Robin Jia, Aditi Raghunathan, and Percy Liang. Robust encodings: A framework for combating adversarial typos. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 2752-2765, Online, July 2020. Association for Computational Linguistics. doi: 10. 1205///11200..c--mmain. 2020. aww.aacmmmaa..... 245.
URL. httg:://aclanthhlloom org/
Armand Joulin, Edouard Grave, Piotr Bojanowski, and Tomás Mikolov. Bag of tricks for efficient text classification. CoRR, abs/1600.01759, 2016. URL hwtp::tt/atiiiiie org/ abs///ba//aaaa 607..
01759
Ryan Kiros, Yukun Zhu, Russ R Salakhutdinov, Richard Zemel, Raquel Urtasun, Antonio Torralba, and Sanja Fidler. Skip-thought vectors. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 28. Curran As- sociates, Inc., 2015. URL /ttp///ttts//prroceeiin........p neuriss......nneeeeooo....s.. httpp/sscccpppppe/2////1110 .pdf]
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. 07 2016a.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. 11 2016b.
Dianqi Li, Yizhe Zhang, Hao Peng. Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics, 2021a.
Dianqi Li, Yizhe Zhang, Hao Peng Liqun Chen, Chris Brockett, Ming-Time Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. In Proceedings of the 202 Conference

---

Under review as a conference paper at ICLR 2023
of the North American Chapter of the Association for Computational Linguisties: Human Lan- guage Technologies. pp. 5053-5069, Online, June 2021b. Association for Li URL UBLL/tttss///aa..attoooooo.o....
wnw.lll..n.anlllleemmamaaaaaaaaa tics. doi: 112111/653//22211111
naacl ma 1 n, 400
Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against real-world applications. ArXiv, abs/1812.0522 2019.
Yinhan Liu, Myle Out, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. RoBERTa: A Robustly Optimized BERT Pre- training Approach, July 2019.
Tomás Mikolov, Ilya Sutskever, Kai Chen, Greg Corrado, and Jeffrey Dean. Distributed repre- sentations of words and phrases and their compositionality. CoRR, abs/1310.4546, 2013. URL
http::/arxis: org/ abs/ 4546
John Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. Reevaluat- ing adversarial examples in natural language. In Findings of the Association for Com- putational Linguistics: EMNLP 2020. Association for Computational Linguistics, 2020a. 1ttp://2...165322F22
doi: 10. 11663//1/2020..nmdmmm htw.:/iiiininnnnnnn....44. emnlp.341. URL httph::t///// 2F2020. finding--niinns-eeee emnlp. 341
John Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji. and Yanjun Qi. Reevaluating adversar- ial examples in natural language. Findings of the Association for Computational Linguistics: EMNLP 2020, pp. 3829-3839, Online, November 2020b. Association for Computational Lin- guisties. doi: 10.18653/v1/2021
http:///....innnneeeeeeoee findings-emnlp.441. URL URI httlt: htt.:ps://acllanhhoooggy/ /ttpaa/..........aaaaaaaaaaaaaaa 2020. findings www.p. 341
org/
Bo Pang and Lillian Lee. Seeing Stars: Exploiting Class Relationships for Sentiment Categorization with Respect to Rating Scales. In Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL '05), pp. 124, 2005.
Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lipton. Combating adversarial misspellings with robust word recognition. In Proceedings of the 57th Anmual Meeting of the Association for Computational Linguistics, pp. 5582-5591, Florence, Italy, July 2019. Association for Compu- tational Linguistics. doi: 10.18653/w//119-5550 URL https://aclanthollee org/
P19 10661
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversar- ial examples through probability weighted word saliency. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 1085-1097, Florence, Italy, July 2019. Association for Computational Linguistics. doi: 10. 118653/v1/119-11 1103. URL https: //cclaattholoor..or///11-1
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Semantically equivalent adversarial rules for debugging NLP models. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Pupers), pp. 865, Melbourne, Australia, July 2018. Association for Computational Linguisties. doi: 10. 10.118865/11PP1 1079. URL https: laaclanthology.ozggg ptq/p18-11110100
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. DistiBBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter, February 2020.
Elvis Saravia, Hsien-Chi Toby Liu, Yen-Hao Huang, Junlin Wu, and Yi-Shin Chen. CARER: Con-
textualized affect representations for emotion recognition. In Proceedings of the 2018 Confer- ence on Empirical Methods in Natural Language Processing, pp. 3687-3697, Brussels, Bel- gium, October-Novembbr 2018. Association for Computational Linguistics. doi: 10.18653/v1/ 1484. URL / www.ooyy..o.g.ggooo.o org/ 1404
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014. http:ttt::/aatt www.ooggg......... 6199
12

---

Under review as a conference paper at ICLR 2023
Alex Wang, Amanpreet Singh. Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. GLUE: A multi-tast benchmark and analysis platform for natural language understanding. CoRR, 009./100,77411, 2018. URL http: www.aaxiivvv.......a..aaa.aaaa org/ abs 1804. 07461
Boxin Wang, Hengzhi Pei, Boyuan Pan, Qian Chen, Shuohang Wang, and Bo Li. T3: Tree-
autoencoder constrained adversarial text generation for targeted attack. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 6134- 6150, Online, November 2020. Association for Computational Linguistics. doi: 10.18653/v1/
2020.emnlp-main.49 URL htt.:tttss//aaannteeett aawaaannthyoo.oooooo wwwp:/loooyrrg/2220// http://///aaaaaooooooooo/////..0 emn maa .955
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. BERTScore: Eval- uating Text Generation with BERT, February 2020a.
Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li. Adversarial attacks on deep- learning models in natural language processing: A survey. ACM Trans. Intell. Syst. Technol., 11(3), apr 2020b. ISSN 2157-6904.. doi: 10.1 10.1145/3374217. https:: //doi. org/10. 1145/3374217
Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text clas- sification. Advances in neural information processing systems, 28, 2015.
Zhengli Zhao, Dheeru Dua, and Sameer Singh. Generating natural adversarial examples. In Interna- tional Conference Learning Representations, 2018. URL htttss://penreviiee net/ Eorum? Berum?1d=#1BB]jg200
A APPENDIX
A.1
CLASSIFIER SELECTION
There were numerous experiments performed regarding the classifiers selection. The most relevant experiments were performed on the Morris dataset (Morris et al. (020b). This dataset contains 400 sentence pairs, where each pair labeled by human annotators whether preserves the meaning.
Accuracy
0.67
0.66
0.65
Accuracy
0.64
0.63
0.62
0.61
0.60
2
3
8 9 1011 13 14 1516 18 19 2021 22
Number of classifiers
Figure 4: The graph shows how the number of classifiers influences the accuracy of SPE on the Morris dataset (Moriss al. 2020b)
From the Figure 4 we can observe that using just classifiers works the best and then the accuracy drops significantly. These classifiers were trained on Natural Language Inference (NLD) datasets like SNLI (Bowman et al.] 2015). cola, rte and sst2 (Wang al. 2018), and more downstream tasks such as emotion classification CARER, Yelp reviews and Stack Overflow questions classification Zhang et al.
(Saravia et al. 2018
2015 Annamoradnejad et al. 2022
13

---

Under review as a conference paper at ICLR 2023
We have also experimented with concatenation of embeddings, however empirical results show that averaging works the best.
A.2 CLASSIFIER TRAINING
In this section, the hyper-parameters of the fastText models (Joulin et al. 2016) that we use in SPE will be specified. FastTexx models, despite their complexity, are conceptually simple. They employ basic logistic regression and include many hyper- parameters that allow us to adjust the model to our use case (Joulin et al. 20.1) Some of the most important hyper-parameters are learning rate, dimensionality of vectors, loss function, and number of epochs. Other parameters such the minimum and maximum length of char n-grams, word n- n-grams, number of buckets, minimal and maximal word and label occurrences can be also chosen (Joulin al. 2016).
In our implementation, most of these hyper-parameters are left with their default value (Joulin et al. 2016 The hyper-parameters which have found important modify are:
1. epoch number of epochs
2. Ir learning rate
3. dim hidden layer dimensionality (size of the word/sentence vectors)
4. wordNgrams maximum length of word n- R-grams
5. minn minimum length of char n-gram
6. maxon maximum length of char n-gram
7. loss loss function used
For the dimensionality of the hidden layer, we have chosen the value 10, which corresponds to the value in the original fastText paper (Joulin al. 2016). In comparison with the value 512 of USE (Cer et 2018), this number very small, yet we are able to concentrate far more information into just 10 dimensions while achieving SOTA results classification problems. For the loss function, we use a simple softmax function because our classification problem only has a few classes.
The remaining typer-parameters
case, which be done with auto- matic tool integrated into the fastText (Joulin et al.) 2016)) library that finds the best values for the given task for us. The complete list of these hyper- parameess for each classifier is shown in Table
fine-tuned for
Classifier
epoch
Ir
minn
maxnn
wordNgrams
SNLI
0.05
COLA
0.09
0
5
RTE
0.09
SST2
55
0.04
3
5
StackOverflow
23
0.05
5
Emotion
0.073
2
3
Yelp Review
Polarity
0.05
2
Table 4: Hyper- Sypem--arameters of the fastText classifiers Joulin et al. 2016 used in our Semantics- Preserving-Encee Encoder.
Another advantage of the fastTexx library (Joulin al., 2016) is the possibility to specify the size of the model. Size compression is achieved using quantization method, which is very effective. For example, if we take a 409MB classifier with 0.957 accuracy rate the Amazon Review Polarity dataset (Zhang al. 2015), we able to reduce it to 1.5MB while maintaining the same accuracy rate.
Similarly, in SPE where 7 classifiers integrated, if each classifier had over 400MB in size, would make it very difficult to work with the metric that implements it. Quantization solves this issue for and helps tremendously. Finally, we decided to limit our model size to 2MB.
14

---

Under review as a conference paper at ICLR 2023
A.3 CLASSIFIER RESULTS
Our metric uses Srimantes-Preserving--ee Encoder, which implements set of fastText classifiers (Joulin al. 2016). These were trained seven datasets with the hyper-parameters stated pre- viously. Each dataset consists of training and testing subsets, which allows us to test the classifiers on the dataset once the training stage is finished. The final accuracy rate obtained on the testing subset of each dataset is presented in Table 5
Classifier SNLI
Test accuracy rate '1
0.595
COLA
0.686
RTE
0.563
SST2
0.829
StackOverflow
0,891
Emotion
0.898
Yelp Review Polarity
0.957
Table 5: Accuracy rate of the fastText classifiers used in SPE on the test set for each dataset.
Based on the results in Table 4 we can conclude that better results are achieved on datasets that are more down-stream, such Emotion, Yelp Review Polarity, Stack Overflow, where the training was very successful in terms of accuracy.
However, more general tasks such NLI resulted in much lower accuracy rate. My explanation is that these problems are very abstract and require a deep language understanding, which we are still unable to reproduce artificially at this point. But overall, even the less successful tasks, accu- racy is very reasonable. Especially given the fact that we have 3 labels entailment, contradiction, and neutral, we are still more than times better than random classifier.
A.4 ADVERSARIAL ATTACKS EXAMPLES
We would like to show few examples of textual adversarial attacks with different sentence encoders. Utilizing the information from the human judges, we show one of the best rated and the worst rated ones for each sentence encoder in TextFooler (Jin et al., 2020). Sentence pairs annotators who assigned them an integer score between and 4, where score strongly disagree, disagree, 3 agree and 4 strongly agree. Only examples from the Rotten Tomatoes dataset (Pang & Lee. 2005) are shown. The Yelp Reviews dataset (Zhang et al. 2015) contains too long pieces of text and hate/offensive tweets dataset (Saravia al. 2018)
presented to
suitable for the paper due it's negative nature. However examples of these datasets could be seen in our materials. We released our work as open-souree including the human evaluations.
15

---

Under review as a conference paper at ICLR 2023
TextFooler SPE Rotten Tomatoes
Average human label (t)
Original sentence
Perturbed sentence
"for its seriousness, high literary as- pirations and stunning acting the film can only be applauded."
"for its seriousness, high literary pirations and stun acting the film can only be applauded."
3.8
"it's one of the saddest films have ever seen that still manages to be up- lifting but not exceedingly sentimental 3.8
"it's one of the saddest films i have ever seen that still manages to be up- listing but not overly sentimental
"it sounds sick and twisted but the miracle of shainberg's 's film is that it truly romance"
"it sound sicko and madwoman: but the marvels of shainberg 's cameraman 1.6 is that it exactly is romance"
"an original gem about an obsession with time
"an original topaz about an obsession with jours."
1.6
Table 6: Adversarial examples TextFoolder SPE Rotten Tomatoes dataset with the average human label. An upward arrow (1) indicates that higher is better.
TextFooler BERTScore Rotten Tomatoes
Average
Original sentence
Perturbed sentence
human label (f)
"just another of story that barely stays afloat."
"just another that barely maintains aftout."
story
3.6
"whether you'le 'ee moved and love it or bored frustrated by the film you 'Il still feel something."
"whether you re moved and love it, or bored or frustrated by the film you'l 'll anyway feel something. !"
3.4
"has it ever been possible to say that williams has truly inhabited charac- ter ? it is now."
"has it ever been possible to say that williams gets awfully inhabited fea- turing ? it is now
1.4
"elling really is about couple of crazy guys and it's therapeutic to laugh along with them
"elling altogether is about couple of lunatic boyfriend, and it's therapeutic to laughing along with them
1.4
Table 7: Adversarial examples for TextFoolder BERTScore Rotten Tomatoes dataset with the average human label. An upward arrow (1) indicates that higher is better.
16

---

Under review as a conference paper at ICLR 2023
TextFooler USE Rotten Tomatoes
Average human label (1)
Original sentence
Perturbed sentence
"a worthy entry into a very difficult genre."
"a reputable entry into very difficult genre."
3.5
"it's a nicely detailed world of pawns, bishops and kings., of wagers in dingy backrooms or pristine forests." !"
"it's a mildly detailed world of pawns, bishops and kings of wagers in dingy backrooms or pristine forests. ."
3.25
"one of the greatest family-oriented, cintasy-advnntury movies ever
"one of the worst family-oriented fantasy-adventure cinemas ever "
1.25
"an enjoyable film for the family amusing and cute for both adults and kids."
"an contented scorsese for the dwelling geefy and leggy for both grownup and infantile."
1.0
Table 8: Adversarial examples for TextFoolder USE Rotten Tomatoes dataset with the average human label. An upward arrow (t) indicates that higher is better.
TPAdjusted SPE Rotten Tomatoes
Average human label (t)
Original sentence
Perturbed sentence
"the story feels more like serious read, filled with heavy doses of always enticing sayles dialogue." !"
"the story feels more like serious read filled with heavy dosage of 3.8 ways enticing sayles dialogue."
"lathan and diggs have considerable personal glamour, and their screen rapport makes the old story seem new
"lathan and diggs have considerable personal charm, and their screen rap- port makes the old story seem new
3.6
"girls gone wild and faded civil 2.6 again"
"girls gone wild and gone civil again"
"has shambling charm... cheer- fully inconsequential diversion
"has shambling charm blithely 2.2 trivial diversions.
Table 9: Adversarial examples for TFAdjusted SPE Rotten Tomatoes dataset with the average human label. An upward arrow (1) indicates that higher is better.
17

---

Under review as a conference paper at ICLR 2023
TFAdjusted - BERT- Rollen Tomatoes
Average human label (f)
Original sentence
Perturbed sentence
"the story feels more like serious read, filled with heavy doses of always enticing sayles dialogue."
"the story feels more like a serious read, filled with heavy dosages of al- 3.6 ways enticing sayles dialogue."
the emperor's 's new clothes begins with a simple plan... well, at least that's ss the plan."
clothing start with a simple plans.... well, at least that's 'ss's the plan."
the emperor's
3.4
"it's a minor comedy that tries bal- ance sweetness with coarseness, while paints sad picture of the singles scene."
"it's a marginal comedy that tries to balance sweemess with coarseness while it painting a sorrowful photo of the singles scene
2.2
"a a director, mr. ratliff wisely re- jects the temptation to make fun of his subjects."
"as director mrr ratliff prudently dismiss the temptation to make amus- ing of his topic."
2.2
Table 10: Adversarial examples for TFAdjusted USE Rotten Tomatoes dataset with the average human label. An upward arrow (1) indicates that higher is better.
TFAdjusted USE - Rotten Tomatoes
Average human label (t)
Original sentence
Perturbed sentence
"bubba ho-tep is a wonderful film with bravura lead performance by bruce camphell that doesn't 't deserve to leave the building until everyone is aware of it."
"bubba ho-tep is a wondrous film with bravura lead performance by bruce campbell that doesn't deserve to leav- ing the building until everybody aware it..""
3.6
"the film has just enough of everything re-enactments archival footage talking-head interviews and the mu- sic is simply sublime."
"the movie has just enough of erything re-enactments archival footage, talking-head interviews and the music is merely sublime."
3.0
"hhe film starts out as competent but unremarkable.
"Ithe film starts oul as competent but unremarkable grows into anything of considerable power."
and gradually grows into something of considerable power."
and gradually
3.0
Table 11: Adversarial examples for TFAdjusted- USE Rotten Tomatoes dataset with the average human label. An upward arrow (f) indicates that higher is better.
18


Reviews:
[{"review_id": "m_7ZcyzHNf", "reviewer": "Reviewer_dmKS", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a sentence encoder, SPE, to improve the quality of adversarial examples in terms of minimizing semantics change. Specifically, the authors train multiple text classifiers and average the output embeddings from these classifiers to get the final representation of an input sentence. The paper also proposes an rASR metric that employs humans to evaluate how similar an adversarial example is to the vanilla sample.", "summary_of_the_review": "Given the strength and weaknesses, I tend to reject.\n\n======================After rebuttal==========================\n\nThank the authors for the effort in answering my questions. After reading all the review comments and responses, I decided to keep my score unchanged.", "strength_and_weaknesses": "Strength\n\n1. The method is clearly presented.\n\n2. The code is available.\n\nWeaknesses\n\n1. I am worried about the novelty. It seems that the proposed method just takes an average of embeddings from many different encoders.\n\n2. The motivation is not clear. The paper found that previous encoders fail to deal well with antonyms, but it seems that the proposed method did nothing special about antonyms either.\n\n3. Some related word-level attacks should be discussed, e.g., [1], [2], [3].\n\n4. Some designs need more justifications. E.g., what is the criterion when choosing the 7 datasets and why the threshold is just set as 2.5.\n\n[1] Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples. In EMNLP, 2018.\n\n[2] Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversarial examples through probability weighted word saliency. In ACL, 2019.\n\n[3] Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. Towards robustness against natural language word substitutions. In ICLR, 2021.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "9NWqXkRbRq", "reviewer": "Reviewer_6oWy", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Adversarial attack methods on text classifiers fail to preserve semantics of the sentence in some cases, because existing unsupervised sentence encoders fall short in distinguishing synonyms against antonyms. This paper proposes Semantics Preserving Encoder (SPE) which takes the average of multiple sentence embeddings extracted from different text classifiers to address this issue. Experiment results show the proposed method can improve the rASR metric. \n", "summary_of_the_review": "This paper proposes SPE to improve the quality of adversarial sentences. The idea is original, but many technical decisions of the method are unjustified, and the experiments need to be significantly improved. ", "strength_and_weaknesses": "**Strength:**\n\n- This paper tackles a critical challenge in textual adversarial attack -- to preserve the semantic meaning of a sentence.\n- The paper is mostly clear and easy to follow. \n\n\n**Weaknesses:**\n\nSeveral technical decisions are not justified.\n- Why use average of embeddings? \n- Why use 7 datasets? Does some datasets more helpful then other datasets? For example, what if we remove the semantic classifiers from SPE when attacking Yelp dataset?\n- Why use 2.5 as the threshold for rASR? The sentences are just ``slightly similar'' if it is annotated as 3.\n\nThere are several issues with the experiments\n- Why not verify the method on standard sentence similarity benchmarks such as SemEval? SPE can be considered as a sentence similarity metric. However, this paper neither verifies its performance on standard sentence similarity benchmarks nor justifies that this metric is only suitable for adversarial attack situations.\n- Why use distilBERT on Rotten tomato dataset, while using RoBERTa on other datasets?\n- There are many other adversarial attack methods, such as BERT-Attack, CLARE, SememePSO, etc. Does SPE also improves the quality for these methods?\n- More insights is needed to demonstrate the improvement. For example, certain type of changes are eliminated by applying SPE. \n\nOther questions:\n- I'm not sure if Eq. (1) is correct. Why does the complexity depend on the vocabulary size rather then the length of the sentence?\n- What do you mean \"do not preserve the semantics and even the meaning of the text\"?\n- What do you mean “eliminate the problem of vocabulary words”?\n\nMore philosophical question: Is SPE trying to improve the semantic similarity or to improve prediction consistency? ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "4avuvrFQ5Wc", "reviewer": "Reviewer_QUPU", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces a simple yet effective sentence-encoder for the semantic preserving test in the field of word-substitution-based adversarial sample generation.\nGenerally, the idea is simple since it uses the annotated dataset to train a simple sentence encoder to judge whether the semantics is significantly changed by the attack algorithms.\nCompared with previous methods such as USE, the proposed method SPE is simple and efficient.\nWith a human-involved experiment and a proper metric that measures the real-attack success rate, the proposed method is proven effective to serve as a semantic checking tool in the attack generation process.\n", "summary_of_the_review": "This paper is easy to understand and the proposed method is clearly illustrated and simple to implement. \nThe main concern is fairness in the evaluation process, the authors should provide some analysis of the transferability of attack methods and the connection to their methods.\n---------------\nI have read the authors' responses and decided to keep my score unchanged. The technical quality of the paper would benefit from a major revision.\n", "strength_and_weaknesses": "Strength:\nA.\t\nthe method is very simple and straightforward, aiming to tackle a key problem in substitution-based adversarial sample generation.\nThe semantic-preserving is indeed an important problem that previous attack methods such as GA, Textfooler, BERT-Attack, PSO-attacks may have trouble solving. \nThe proposed SPE uses labeled datasets to train an ensemble of classifiers and use all these classification results as the semantic score checking.\n\nB. \nThe setup of the experiments is reasonable, the human-involved experiment and the real ASR metric are convincing.\n\nWeakness:\n\nA.\t\nMy first concern is though the experiments are properly designed, the comparison might not be fair.\nThat is, as explored thoroughly in prior works such as Textfooler and BERT-Attack, the transferability of the adversarial samples is somewhat weak, that is, the adversarial samples are not universal to different classifiers.\nWhile the proposed SPE is in fact trained with datasets including NLI, cola, rte, sst-2, yelp, etc.,  these datasets can be transferable, therefore, the SPE score can be viewed as another classifier in a way.\nI am concerned that the SPE similarity is in fact a reflection of classification, not as illustrated as ‘semantic-preserving’.\nIf it is the case, then the advantage of low cost in the proposed scorer is less convincing since we can always train some simple classification models as a scorer to measure the adversarial sample quality.\n\nB. semantic preserving concept:\nAs illustrated in Table 1, the authors intend to illustrate the concept of sentence semantic similarity when the sentence is perturbed.\nThese cases, which mostly are synonyms to antonyms change, are less observed in the similarity-based word-embedding used in the Textfooler but actually constantly happen in BERT-Attack generated substitutes, which cannot be properly recognized by sentence-level semantic scorers such as USE or BERT-Score.\nTherefore, the word-level and sentence-level semantic preserving performances can be different in measuring the quality of adversarial samples yet the paper seems to mix these two concepts.\n \n\nC. The novelty of the proposed method:\nIt is true that using USE or BERT-Score in evaluating the quality of the generated adversarial samples is costly and cannot obtain promising results.\nYet the proposed method is somewhat trivial since it only uses an ensemble of classifiers and uses the cosine similarity to calculate the final similarity score calculation.\nHow can the proposed SPE be used in more general scenarios as a semantic preserving sentence similarity checker is not discussed in the paper.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject