Title: HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text
Venue: NeurIPS 2023
Accepted: yes
Keywords: High-quality adversarial example

Black-box hard-label textual adversarial attack
Abstract: Black-box hard-label adversarial attack on text is a practical and challenging task, as the text data space is inherently discrete and non-differentiable, and only the predicted label is accessible. Research on this problem is still in the embryonic stage and only a few methods are available. Nevertheless, existing methods rely on the complex heuristic algorithm or unreliable gradient estimation strategy, which probably fall into the local optimum and inevitably consume numerous queries, thus are difficult to craft satisfactory adversarial examples with high semantic similarity and low perturbation rate in a limited query budget. To alleviate above issues, we propose a simple yet effective framework to generate high quality textual adversarial examples under the black-box hard-label attack scenarios, named HQA-Attack. Specifically, after initializing an adversarial example randomly, HQA-attack first constantly substitutes original words back as many as possible, thus shrinking the perturbation rate. Then it leverages the synonym set of the remaining changed words to further optimize the adversarial example with the direction which can improve the semantic similarity and satisfy the adversarial condition simultaneously. In addition, during the optimizing procedure, it searches a transition synonym word for each changed word, thus avoiding traversing the whole synonym set and reducing the query number to some extent. Extensive experimental results on five text classification datasets, three natural language inference datasets and two real-world APIs have shown that the proposed HQA-Attack method outperforms other strong baselines significantly.

HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text

Abstract

Black-box hard-label adversarial attack on text is a practical and challenging task, as the text data space is inherently discrete and non-differentiable, and only the predicted label is accessible. Research on this problem is still in the embryonic stage and only a few methods are available. Nevertheless, existing methods rely on the complex heuristic algorithm or unreliable gradient estimation strategy, which probably fall into the local optimum and inevitably consume numerous queries, thus are difficult to craft satisfactory adversarial examples with high semantic similarity and low perturbation rate in a limited query budget. To alleviate above issues, we propose a simple yet effective framework to generate high quality textual adversarial examples under the black-box hard-label attack scenarios, named HQAAttack. Specifically, after initializing an adversarial example randomly, HQA-attack first constantly substitutes original words back as many as possible, thus shrinking the perturbation rate. Then it leverages the synonym set of the remaining changed words to further optimize the adversarial example with the direction which can improve the semantic similarity and satisfy the adversarial condition simultaneously. In addition, during the optimizing procedure, it searches a transition synonym word for each changed word, thus avoiding traversing the whole synonym set and reducing the query number to some extent. Extensive experimental results on five text classification datasets, three natural language inference datasets and two real-world APIs have shown that the proposed HQA-Attack method outperforms other strong baselines significantly.

1 Introduction

Deep neural networks (DNNs) have achieved a tremendous success and are extremely popular in various domains, such as computer vision [34, 35], natural language processing [31, 15], robotics [2, 26] and so on. In spite of the promising performance achieved by DNN models, there are some concerns around their robustness, as evidence shows that even a slight perturbation to the input data can fool these models into producing wrong predictions [10, 19, 11, 5], and these perturbed examples are named as adversarial examples. Investigating the generation rationale behind adversarial examples seems a promising way to improve the robustness of neural networks, which motivates the research about adversarial attack. Most existing adversarial attack methods focus on computer vision [32, 36, 39] and have been well explored. However, the adversarial attack on text data is still challenging, as not only the text data space is intrinsically discrete and non-differentiable, but also changing words slightly may affect the fluency in grammar and the consistency in semantics seriously.

Based on the accessibility level of victim models, existing textual adversarial attack methods can be categorized into white-box attacks [9, 25, 7] and black-box attacks [19, 41, 20]. For white-box attacks, the attackers are assumed to have full information about the victim model, including training data, model architecture and parameters. Therefore, it is easy to formulate this type of attack as an optimization problem and utilize the gradient information to generate adversarial examples. However, as most model developers are impossible to release all the model and data information, white-box attacks seem excessively idealistic and cannot work well in real-world applications. For black-box attacks, the attackers are assumed to have only access to the predicted results, e.g., confidence scores or predicted labels, which seem more realistic. Existing black-box textual attack methods can be divided into soft-label setting [20, 6, 14] and hard-label setting [23, 38, 37]. For soft-label methods, they require the victim model to provide the confidence scores to calculate the importance of each word, and then replace words sequentially until an adversarial example is generated. However, it is also impractical as most real APIs do not allow users to access the confidence scores. For hard-label methods, they only need to know the predicted labels of the victim model to fulfill the attack task, thus are more practicable and promising.

Only a handful of methods are proposed to deal with the black-box hard-label textual adversarial attack task, which mainly rely on heuristic-based [23] or gradient-based strategies [38, 37]. Specifically, HLGA [23] is the first hard-label adversarial attack method, which leverages population-based heuristic optimization algorithm to craft plausible and semantically similar adversarial examples. However, as it requires a large population of adversarial candidates and population-based optimization strategy is easy to fall into the local optimum, HLGA inevitably consumes numerous query numbers. TextHoaxer [38] formulates the budgeted hardlabel adversarial attack task on text data as a gradient-based optimization problem of perturbation matrix in the continuous word embedding space. LeapAttack [37] utilizes the gradientbased optimization by designing a novel mecha-

𝑥1

′

𝑥

𝑥2

′

𝑥𝑡

′

𝑥𝑇

′

Substituting

original

words back

Similarity

isohypse

Optimizing

the

adversarial

example

Initialization

nism that can interchange discrete substitutions and continuous vectors. Although these gradientbased methods improve the query efficiency to some extent, they still need some unnecessary queries caused by inaccurate gradient estimation. Furthermore, in tight budget scenarios, query inefficiency will directly bring about serious side effects on the semantic similarity and perturbation rate.

To alleviate the above issues, we propose a simple yet effective framework for producing H igh Q uality black-box hard-label A dversarial Attack , named HQA-Attack . The overview of HQAAttack is shown in Figure 1. By 'high quality', it means that the HQA-Attack method can generate adversarial examples with high semantic similarity and low perturbation rate under a tight query budget. Specifically, HQA-Attck first generates an adversarial example by initialization, and then

sequentially substitutes original words back as many as possible, thus shrinking the perturbation rate. Finally, it utilizes the synonym set to further optimize the adversarial example with the direction which can improve the semantic similarity and satisfy the adversarial condition simultaneously. In addition, to avoid going through the synonym set, it finds a transition synonym word for each changed word, thus reducing the query number to a certain extent. Experimental results on eight public benchmark datasets and two real-word APIs (Google Cloud and Alibaba Cloud) have demonstrated that HQA-Attack performs better than other strong baselines in the semantic similarity and perturbation rate under the same query budget. The source code and demo are publicly available at https://github.com/HQA-Attack/HQAAttack-demo.

2 Related Work

2.1 Soft-Label Textual Adversarial Attack

Adversarial attacks in soft-label settings rely on the probability distribution of all categories to generate adversarial examples. A series of strategies [16, 21, 24] utilize the greedy algorithm to craft adversarial examples, which first determine the word replacement order and greedily replace each word under this order. TextFooler [16] first determines the word replacement order according to the prediction change after deleting each word, and then replaces words back according to the word importance until adversarial examples are generated. Similarly, TextBugger [21] calculates the importance of sentences and the importance of words respectively by comparing the prediction before and after removing them. In addition, there are some methods [40, 1] which use combinatorial optimization algorithm to generate adversarial examples.

2.2 Hard-Label Textual Adversarial Attack

Adversarial attacks in hard-label settings only allow to access the predicted label, which seem more challenging and practical. HLGA [23] is the first hard-label textual adversarial attack method. It uses random initialization and search space reduction to get an incipient adversarial example, and then uses the genetic algorithm including mutation, selection and crossover three operations to further optimize the adversarial example. Although HLGA can generate adversarial examples with high semantic similarity with the original example and low perturbation rate, it needs to maintain a large candidate set in each iteration, which wastes a large number of queries. To alleviate this issue, TextHoaxer [38] uses the word embedding space to represent the text, and introduces a perturbation matrix and a novel objective function which consists of a semantic similarity term, a pair-wise perturbation constraint and a sparsity constraint. By using the gradient-based strategy to optimize the perturbation matrix, TextHoaxer can generate appropriate adversarial examples in a tight budget. LeapAttack [37] is another gradient-based method. After random initialization, it optimizes the adversarial example by constantly moving the example closer to the decision boundary, estimating the gradient and finding the proper words to update the adversarial example. In Appendix K, we further discuss some potential application scenarios about hard-label textual adversarial attack.

3 Problem Formulation

In this paper, we focus on the task of black-box hard-label textual adversarial attack, i.e., attackers can only access to the predicted label from the victim model to generate adversarial examples. Specifically, given an original example x ' r w 1 , w 2 , ..., w n s with the ground truth label y , where w i is the i -th word, and n is the total number of words in x . This task aims to construct an adversarial example x 1 ' r w 1 1 , w 1 2 , ..., w 1 n s through replacing the original

word w i with a synonym w 1 i in the synonym set S p w i q which includes w i itself, thus misleading the victim model f to output an incorrect prediction result:

where Eq. (1) can be seen as the adversarial condition. There may exist several adversarial examples which can satisfy Eq. (1), but an optimal adversarial example x ˚ is the one that has the highest semantic similarity with the original example x among all the candidates. Formally,

where Sim p x, x 1 q is the semantic similarity between x and x 1 . Table 1 summarizes the symbol explanation in detail.

4 The Proposed Strategy

4.1 Initialization

To fulfill the black-box hard-label textual adversarial attack task, we follow previous works [23, 38, 37] to first utilize random initialization to generate an adversarial example. Specifically, considering each word w i whose part-of-speech (POS) is noun , verb , adverb and adjective in the original example x , we randomly select a synonym w 1 i from the synonym set S p w i q of w i as the substitution of w i , and repeat this procedure until the generated adversarial example x 1 satisfies the adversarial condition.

Obviously, using random initialization to generate the adversarial example usually needs to change multiple words in the original example, thus necessarily leading to the low semantic similarity and large perturbation rate. To alleviate the above issue, we attempt to iteratively optimize the semantic similarity between the original example x and the adversarial example in the t -th iteration x 1 t , where 1 ď t ď T and T is the total number of iterations. Furthermore, given an adversarial example x 1 t , we can generate the adversarial example x 1 t ` 1 by the following steps. (1) Substituting original words back; (2) Optimizing the adversarial example.

4.2 Substituting Original Words Back

In order to improve the semantic similarity of the generated adversarial example, previous works [23, 38, 37] first use the semantic similarity improvement brought by each original word as a measure to decide the replacement order, and then continually put original words back in each iteration. It means that in each iteration, by going through each word in the adversarial example, the semantic similarity improvement is only calculated once, and the replacement order is determined beforehand. However, making each replacement with the original word will change the intermediate generated adversarial example, thereby affecting the semantic similarity between the original example and the intermediate generated adversarial example, so just calculating the semantic similarity improvement at the beginning of each iteration to decide the replacement order is inaccurate.

To address the above problem, we propose to constantly substitute the original word which can make the intermediate generated adversarial example have the highest semantic similarity with the original example until the adversarial condition is violated. Specifically, given the original sample x ' r w 1 , w 2 , ..., w n s and the adversarial example x 1 t ' r w 1 1 , w 1 2 , ..., w 1 n s in the t -th iteration, we can substitute original words back with the following steps.

Picking out an appropriate substitution word w ˚ from x with the following formula:

where Sim p x, x 1 t p w i qq is the semantic similarity between x and x 1 t p w i q , and x 1 t p w i q is the example obtained by substituting the corresponding word w 1 i with w i . C p f, x, x 1 t p w i qq is a two-valued function defined as:

where f denotes the victim model. C equals to 1 if f p x q ‰ f p x 1 t p w i qq , and 0 otherwise.

If C p f, x, x 1 t p w ˚ qq ' 1 , it indicates that x 1 t p w ˚ q can attack successfully. We substitute the corresponding original word in x 1 t with w ˚ , and repeat the above step.

If C p f, x, x 1 t p w ˚ qq ' 0 , it indicates that x 1 t p w ˚ q cannot satisfy the adversarial condition. We terminate the swapping procedure, and return the result of the previous step.

After the above procedure, we can obtain a new adversarial example x 1 t which can retain the original words as many as possible, thus improving the semantic similarity and reducing the perturbation rate. The algorithm procedure is shown in Appendix A, and the analysis of computational complexity and query numbers is shown in Appendix C.1.

4.3 Optimizing the Adversarial Example

To further ameliorate the quality of the generated adversarial example, we optimize the adversarial example by leveraging the synonym set of each word. One may argue that we could directly traverse the synonym set to seek out the most ideal synonym word which has the highest semantic similarity and satisfies the adversarial condition simultaneously. However, in most real-world application scenarios, the query number is usually limited. To avoid going through the synonym set, we propose to optimize the adversarial example with the following two steps. (1) Determining the optimizing order; (2) Updating the adversarial example sequentially. The analysis of computational complexity and query numbers is shown in Appendix C.2.

4.3.1 Determining the Optimizing Order

In this step, we aim to determine a suitable optimizing order. To ensure the diversity of the generated adversarial example, we utilize the sampling method to determine the optimizing order. The probability distribution used by the sampling method is generated as follows. For w 1 i in x 1 t and w i in x , we first use the counter-fitting word vectors [27] to obtain their corresponding word vectors, and calculate the cosine distance between them as follows:

where v w i and v w 1 i denote the word vectors of w i and w 1 i respectively. cos p¨ , ¨q is the cosine similarity function. Then we compute the probability p i associated with the position of w i in x with the following formula:

where m is the total number of changed words between x 1 t and x . According to the probability distribution, we can obtain the optimizing order for x 1 t .

4.3.2 Updating the Adversarial Example Sequentially

According to the optimizing order, we update the adversarial example with the synonym set sequentially. In particular, for the adversarial example x 1 t in the t -th iteration, we update it with the following steps. (1) Finding the transition word; (2) Estimating the updating direction; (3) Updating the adversarial example.

Finding the transition word. This step aims to search a reasonable transition word, thus avoiding traversing the synonym set for each changed word. Given the adversarial example x 1 t ' r w 1 1 , w 1 2 , ..., w 1 n s and the current optimized word w 1 i , we randomly select r synonyms from S p w i q to construct the set R ' t w p 1 q i , w p 2 q i , .., w p r q i u , use each element in R to replace w 1 i in x 1 t , and then obtain the transition word s w i with the following formula:

where x 1 t p w p j q i q is the example obtained by substituting the corresponding word w 1 i in x 1 t with w p j q i P R . According to Eq. (7), we can get that s w i can make the example adversarial and improve the semantic similarity to some extent, while avoiding going through the synonym set. Furthermore, we can search other possible replacement words around the transition word s w i .

Estimating the updating direction. As the transition word s w i originates from a randomly generated synonym set, we can further optimize it with a reasonable direction. Specifically, we first generate the set K ' t s w p 1 q i , s w p 2 q i ..., s w p k q i u by randomly sampling k synonyms from S p s w i q , and then obtain the set M ' t x 1 t p s w p 1 q i q , x 1 t p s w p 2 q i q , ..., x 1 t p s w p k q i qu , where x 1 t p s w p j q i q is the example by replacing w 1 i in x 1 t with s w p j q i . By calculating the semantic similarity between each element in M and the original text x , we can get the set S ' t s p 1 q , s p 2 q , ..., s p k q u , where s p j q ' Sim p x, x 1 t p s w p j q i qq is the semantic similarity between x and x 1 t p s w p j q i q . In the similar manner, the semantic similarity between x and x 1 t p s w i q can be computed s s i ' Sim p x, x 1 t p s w i qq .

Intuitively, if s p j q ´ s s i ą 0 , it indicates that pushing the word vector v s w i towards v s w p j q i tends to increase the semantic similarity, i.e., v s w p j q i ´ v s w i is the direction which can improve the semantic similarity. And if s p j q ´ s s i ă 0 , moving the word vector along the inverse direction of v s w p j q i ´ v s w i can improve the semantic similarity. Based on the above intuition, we estimate the final updating direction u by weighted averaging over the k possible directions. Formally,

where α j is the corresponding weight associated with the direction v s w p j q i ´ v s w i , and it can be calculated by α j ' p s p j q ´ s s i q{ ř k l ' 1 | s p l q ´ s s i | .

Updating the adversarial example. Due to the discrete nature of text data, we need to use the updating direction u to pick out the corresponding replacement word r w i from S p w i q , where r w i is the word which has the maximum cosine similarity between u and v r w i ´ v s w i and ensures that x 1 t p r w i q satisfies the adversarial condition. After obtaining r w i , we can generate x 1 t ` 1 in the optimizing order sequentially. In addition, to reduce the number of queries and shrink the perturbation rate, when implementing the program, we first use x to initialize x 1 t ` 1 , and then replace the word r w i one by one until x 1 t ` 1 satisfies the adversarial condition.

4.4 The Overall Procedure

The detailed algorithm procedure of HQA-Attack is given in Appendix B. In particular, HQA-Attack first gets the initial adversarial example by random initialization. Then it enters into the main loop. In each iteration, HQA-Attack first substitutes original words back, then determines the optimizing order, and finally updates the adversarial example sequentially. In addition, we provide some mechanism analysis of HQA-Attack from the perspective of decision boundary in Appendix D.

5 Experiments

5.1 Experimental Settings

Datasets. We conduct experiments on five public text classification datasets MR [28], AG's News [42], Yahoo [42], Yelp [42], IMDB [22], and three natural language inference datasets SNLI [3], MNLI [33], mMNLI [33]. The detailed dataset description is shown in Appendix E. We follow the previous methods [23, 38, 37] to take 1000 test examples of each dataset to conduct experiments.

Baselines. We compare with three state-of-the-art black-box hard-label textual adversarial attack methods: (1) HLGA [23] is a hard-label adversarial attack method that employs the genetic algorithm to generate the adversarial example. (2) TextHoaxer [38] is a hard-label adversarial attack method that formulates the budgeted hard-label adversarial attack task on text data as a gradient-based optimization problem of perturbation matrix in the continuous word embedding space. (3) LeapAttack [37] is a recent hard-label adversarial attack method, which estimates the gradient by the Monte Carlo method.

Evaluation Metrics. Weuse two widely used evaluation metrics semantic similarity and perturbation rate . For semantic similarity, we utilize the universal sequence encoder [4] to calculate the semantic similarity between two texts. The range of the semantic similarity is between r 0 , 1 s , and the larger semantic similarity indicates the better attack performance. For perturbation rate, we use the ratio

of the number of changed words over the number of total words in the adversarial example, and the lower perturbation rate indicates the better results.

Victim Models. We follow [23, 38, 37] to adopt three widely used natural language processing models as victim models: BERT [8], WordCNN [17], and WordLSTM [13]. All the model parameters are taken from the previous works [23, 38, 37]. We also attack some advanced models like T5 [30] and DeBERT [12], and the results are shown in Appendix F. To further verify the effectiveness of different algorithms in real applications, we also attempt to use Google Cloud API (https://cloud.google.com/natural-language) and Alibaba Cloud API (https://ai.aliyun.com/nlp) as the victim models.

Implementation Details. For the random initialization, we employ the same method used in previous methods [23, 38, 37]. After the initialization, we follow [23, 38] to perform a pre-processing step to remove the unnecessary replacement words. For the hyperparameters, we consistently set r ' 5 and k ' 5 for all the datasets. The detailed parameter investigation is provided in Appendix G. In addition, during the optimization procedure, if we re-optimize the same adversarial example three times and no new better adversarial examples are generated, we randomly go back to the last three or four adversarial example. We do not re-optimize an adversarial example more than two times. For fair comparison, we follow [23, 38, 37] to generate 50 synonyms for each word by using the counter-fitting word vector. We also conduct experiments based on BERT-based synonyms, and the results are shown in Appendix H.

5.2 Experimental Results

5.2.1 Comparison on Semantic Similarity and Perturbation Rate

We exactly follow the previous work [38] to set the query budget to 1000, i.e., the number of allowed queries from the attacker is 1000. As different algorithms use the same random initialization step which determines the prediction accuracy after the adversarial attack, so different algorithms have the same prediction accuracy. Our goal is to generate the adversarial examples with higher semantic similarity and lower perturbation rate. Tables 2 and 3 report the experimental results when attacking text classification models. The best results are highlighted in bold.

As shown in Tables 2 and 3, when the query limit is 1000, for different datasets and tasks, HQAAttack can always generate adversarial examples that have the highest semantic similarity and the lowest perturbation rate. Specifically, for the dataset MR with short text data, HQA-Attack increases the average semantic similarity by 6.9%, 6.5%, 6.9% and decreases the average perturbation rate by 0.777%, 0.832%, 0.983% compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. For the dataset IMDB with long text data, HQA-Attack increases the average semantic similarity by 4.5%, 3.4%, 2.7% and decreases the average perturbation rate by 1.426%, 0.601%, 0.823% compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. For the dataset with more than two categories like AG, HQA-Attack increases the average semantic similarity by 10.6%, 8.8%, 11.6% and decreases the average perturbation rate by 4.785%, 3.885%, 5.237% compared with the second best method when attacking BERT, WordCNN and WordLSTM respectively. All these results demonstrate that HQA-Attack can generate high-quality adversarial examples in the tight-budget hard-label setting.

5.2.2 Comparison on Attack Efficiency

The attack efficiency is an important criterion in evaluating the attack performance, as in most DNN-based NLP platforms the number of queries is limited. Therefore, We further compare the proposed HQA-Attack with two latest methods TextHoaxer and LeapAttack under different query budgets r 100 , 300 , 500 , 700 , 1000 s on text classification datasets. As shown in Figure 2, with the query budget increasing, the average semantic similarity of all the methods keeps increasing and the average perturbation rate of all the methods keeps decreasing. In terms of semantic similarity and perturbation rate, HQA-Attack always performs much better than other methods in all the budgets. These results further validate that our proposed HQA-Attack has the ability to generate adversarial examples with higher semantic similarity and lower perturbation rate in different budget limits.

5.2.3 Attack Real-World APIs

To further verify the effectiveness of different algorithms, we attempt to use TextHoaxer, LeapAttack and HQA-Attack to attack two real-world APIs: Google Cloud (https://cloud.google.com/naturallanguage) and Alibaba Cloud (https://ai.aliyun.com/nlp). To further evaluate the fluency of the generated

adversarial examples, we add the perplexity (PPL) as the additional evaluation metric which is calculated by using GPT-2 Large [29]. The lower PPL indicates the better performance. As Google and Alibaba only provide limited service budgets, we select 100 examples from the MR dataset whose lengths are greater than or equal to 20 words to perform experiments, and restrict that each method can only query the API 350 times. Table 4 shows the results of TextHoaxer, LeapAttack and HQA-Attack. It can be seen that compared with the second best results, HQA-Attack increases the semantic similarity 5.7%, 5.1%, decreases the perturbation rate 0.062%, 0.007% and decreases the PPL 9, 6 on Google Cloud and Alibaba Cloud respectively. We also compare the performance of TextHoaxer, LeapAttack and HQA-Attack in different budget limits. The results are shown in Figure

50

55

60

65

70

75

80

100

300

500

700

1000

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(a) MR (Sim)

45

50

55

60

65

70

75

80

100

300

500

700

1000

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(b) AG (Sim)

45

50

55

60

65

70

75

80

100

300

500

700

1000

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(c) Yahoo (Sim)

30

40

50

60

70

80

90

100

300

500

700

1000

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(d) Yelp (Sim)

40

50

60

70

80

90

100

100

300

500

700

1000

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(e) IMDB (Sim)

10

11

12

13

14

15

16

17

18

100

300

500

700

1000

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(f) MR(Pert)

9

11

13

15

17

19

21

23

25

27

29

100

300

500

700

1000

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(g) AG (Pert)

5

7

9

11

13

15

17

19

100

300

500

700

1000

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(h) Yahoo (Pert)

5

10

15

20

25

30

100

300

500

700

1000

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(i) Yelp (Pert)

0

5

10

15

20

25

30

100

300

500

700

1000

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(j) IMDB (Pert)

60

65

70

75

80

85

50

100

200

300

350

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(a) Google (Sim)

7

8

9

10

11

12

13

14

50

100

200

300

350

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(b) Google (Pert)

69

71

73

75

77

79

81

83

85

50

100

200

300

350

Semantic Similarity(%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(c) Alibaba (Sim)

6

6.5

7

7.5

8

8.5

50

100

200

300

350

Perturbation Rate (%)

Number of Budgets

HQA-Attack

LeapAttack

TextHoaxer

(d) Alibaba (Pert)

5.2.4 Human Evaluation

We have conducted the human evaluation experiments on the BERT model using HLGA, TextHoaxer, LeapAttack and HQA-Attack for the MR and IMDB datasets. Specifically, for each dataset, we first randomly select 50 original samples, and use each adversarial attack method to generate the corresponding 50 adversarial examples respectively. Then we ask 10 volunteers to annotate the class labels for these samples, and calculate the average classification accuracy (Acc) for each method. Intuitively, if the accuracy is higher, it means that the quality of the generated adversarial examples is better. The Acc(%) results of clean examples are 94.2% and 93.6% for MR and IMDB respectively. And the results of adversarial examples are shown in Table 5. The results show that the adversarial examples generated by HQA-Attack are more likely to be classified correctly, which further verifies the superiority of HQA-Attack in preserving the semantic information.

5.2.5 Attack Models which Defend with Adversarial Training

With the development of the AI security, a lot of works focus on defending against adversarial attacks. We further compare the attack performance when the victim model is trained with three effective adversarial training strategies HotFlip [9], SHIELD [18] and DNE [43]. We select the BERT model as the victim model, set the query budget to 1000 and then perform experiments on the AG dataset. We also use the perplexity (PPL) as the additional evaluation metric to judge the fluency

of the generated adversarial examples. Table 6 shows the attack performance. We can observe that HQA-Attack can also obtain the best results compared with other strong baselines.

5.2.6 Ablation Study and Case Study

To investigate the effectiveness of different components, we make the ablation study on five text classification datasets when attacking WordCNN. The results are shown in Table 7. Random Initialization means the adversarial examples generated only by the random initialization step. w/o Substituting means that the HQA-Attack model without the substituting original words back step. w/o Optimizing means that the HQA-Attack model which randomly selects a word that can keep the example adversarial as the replacement after substituting original words back without optimizing the adversarial example. It is easy to find that all modules contribute to the model, which verifies that the substituting original words back step is useful and the optimizing the adversarial example step is also indispensable. To further demonstrate the effectiveness of our proposed word back-substitution strategy, we add some extra experiments in Appendix I. We also list some concrete adversarial examples generated by HQA-Attack, which are shown in Appendix J. These examples further demonstrate that our proposed HQA-Attack model can generate a high-quality black-box hard-label adversarial example with only a small perturbation.

6 Conclusion

In this paper, we propose a novel approach named HQA-Attack for crafting high quality textual adversarial examples in black-box hard-label settings. By substituting original words back, HQAAttack can reduce the perturbation rate greatly. By utilizing the synonym set of the remaining changed words to optimize the adversarial example, HQA-Attack can improve the semantic similarity and reduce the query budget. Extensive experimental results demonstrate that the proposed HQA-Attack method can generate high quality adversarial examples with high semantic similarity, low perturbation rate and fewer query numbers. In future work, we plan to attempt more optimization strategies to refine the model, thus further boosting the textual adversarial attack performance.

Acknowledgments and Disclosure of Funding

The authors are grateful to the anonymous reviewers for their valuable comments. This work was supported by National Natural Science Foundation of China (No. 62106035, 62206038, 61972065) and Fundamental Research Funds for the Central Universities (No. DUT20RC(3)040, DUT20RC(3)066), and supported in part by Key Research Project of Zhejiang Lab (No. 2022PI0AC01) and National Key Research and Development Program of China (2022YFB4500300).

References

Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani B. Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples. In EMNLP , pages 2890-2896, 2018.

Michal Bednarek, Michal R. Nowicki, and Krzysztof Walas. HAPTR2: improved haptic transformer for legged robots' terrain classification. Robotics and Autonomous Systems , 158:104236, 2022.

Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. A large annotated corpus for learning natural language inference. In EMNLP , pages 632-642, 2015.

Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, Brian Strope, and Ray Kurzweil. Universal sentence encoder for english. In EMNLP , pages 169-174, 2018.

Yangyi Chen, Hongcheng Gao, Ganqu Cui, Fanchao Qi, Longtao Huang, Zhiyuan Liu, and Maosong Sun. Why should adversarial perturbations be imperceptible? rethink the research paradigm in adversarial NLP. In EMNLP , pages 11222-11237, 2022.

Minhao Cheng, Jinfeng Yi, Pin-Yu Chen, Huan Zhang, and Cho-Jui Hsieh. Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In AAAI , pages 3601-3608. AAAI, 2020.

Yong Cheng, Lu Jiang, and Wolfgang Macherey. Robust neural machine translation with doubly adversarial inputs. In ACL , pages 4324-4333. ACL, 2019.

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirectional transformers for language understanding. In NAACL , pages 4171-4186, 2019.

Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification. In ACL , pages 31-36, 2018.

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR , 2015.

Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers. In EMNLP , pages 5747-5757, 2021.

Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: decoding-enhanced bert with disentangled attention. In ICLR , 2021.

Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural Computation , pages 17351780, 1997.

Yu-Lun Hsieh, Minhao Cheng, Da-Cheng Juan, Wei Wei, Wen-Lian Hsu, and Cho-Jui Hsieh. On the robustness of self-attentive models. In ACL , pages 1520-1529. ACL, 2019.

Junjie Hu, Hiroaki Hayashi, Kyunghyun Cho, and Graham Neubig. DEEP: denoising entity pre-training for neural machine translation. In ACL , pages 1753-1766, 2022.

Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. In AAAI , pages 8018-8025, 2020.

Yoon Kim. Convolutional neural networks for sentence classification. In EMNLP , pages 1746-1751, 2014.

Thai Le, Noseong Park, and Dongwon Lee. SHIELD: defending textual neural networks against multiple black-box adversarial attacks with stochastic multi-expert patcher. In ACL , pages 6661-6674, 2022.

Deokjae Lee, Seungyong Moon, Junhyeok Lee, and Hyun Oh Song. Query-efficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization. In ICML , pages 12478-12497, 2022.

Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. In NAACL , pages 5053-5069, 2021.

Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against real-world applications. In NDSS , 2019.

Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In ACL , pages 142-150, 2011.

Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. Generating natural language attacks in a hard label black box setting. In AAAI , pages 13525-13533, 2021.

Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. A strong baseline for query efficient attacks in a black box setting. In EMNLP , pages 8396-8409, 2021.

Zhao Meng and Roger Wattenhofer. A geometry-inspired attack for generating natural language adversarial examples. In COLING , pages 6679-6689, 2020.

Luiz Henrique Mormille, Clifford Broni-Bediako, and Masayasu Atsumi. Regularizing self-attention on vision transformers with 2d spatial distance loss. Artif. Life Robotics , 27(3):586-593, 2022.

Nikola Mrksic, Diarmuid Ó Séaghdha, Blaise Thomson, Milica Gasic, Lina Maria Rojas-Barahona, PeiHao Su, David Vandyke, Tsung-Hsien Wen, and Steve J. Young. Counter-fitting word vectors to linguistic constraints. In NAACL , pages 142-148, 2016.

Bo Pang and Lillian Lee. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In ACL , pages 115-124, 2005.

Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog , 1(8):9, 2019.

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research , 21:140:1-140:67, 2020.

Amit Seker, Elron Bandel, Dan Bareket, Idan Brusilovsky, Refael Shaked Greenfeld, and Reut Tsarfaty. Alephbert: Language model pre-training and evaluation from sub-word to sentence level. In ACL , pages 46-56, 2022.

James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. Physically realizable adversarial examples for lidar object detection. In CVPR , pages 13713-13722, 2020.

Adina Williams, Nikita Nangia, and Samuel R. Bowman. A broad-coverage challenge corpus for sentence understanding through inference. In NAACL , pages 1112-1122, 2018.

Haiping Wu, Bin Xiao, Noel Codella, Mengchen Liu, Xiyang Dai, Lu Yuan, and Lei Zhang. Cvt: Introducing convolutions to vision transformers. In ICCV , pages 22-31, 2021.

Wei Wu, Hao Chang, Yonghua Zheng, Zhu Li, Zhiwen Chen, and Ziheng Zhang. Contrastive learning-based robust object detection under smoky conditions. In CVPR , pages 4294-4301, 2022.

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan L. Yuille. Adversarial examples for semantic segmentation and object detection. In ICCV , pages 1378-1387, 2017.

Muchao Ye, Jinghui Chen, Chenglin Miao, Ting Wang, and Fenglong Ma. Leapattack: Hard-label adversarial attack on text via gradient-based optimization. In KDD , pages 2307-2315, 2022.

Muchao Ye, Chenglin Miao, Ting Wang, and Fenglong Ma. Texthoaxer: Budgeted hard-label adversarial attacks on text. In AAAI , pages 3877-3884, 2022.

Kan Yuan, Di Tang, Xiaojing Liao, XiaoFeng Wang, Xuan Feng, Yi Chen, Menghan Sun, Haoran Lu, and Kehuan Zhang. Stealthy porn: Understanding real-world adversarial images for illicit online promotion. In IEEE S&P , pages 952-966, 2019.

Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking as combinatorial optimization. In ACL , pages 6066-6080, 2020.

Zhiyuan Zeng and Deyi Xiong. An empirical study on adversarial attack on NMT: languages and positions matter. In ACL , pages 454-460, 2021.

Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In NeurIPS , pages 649-657, 2015.

Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsieh, Kai-Wei Chang, and Xuanjing Huang. Defense against synonym substitution-based adversarial attacks via dirichlet neighborhood ensemble. In ACL , pages 5482-5492, 2021.

Peer reviews:
comments: SUMMARY:
This paper proposed a new approach HQA-Attack using iterative substituting normal words and replacing with synonyms for creating high quality adversarial text samples in the setting of black box attack + hard label. The experimental results on several NLP datasets and two commercial APIs validate the effectiveness of the proposed methods.

STRENGTHS:
1. This paper is well-written. The problem this paper focuses on is important, and the proposed method is interesting. 
2. The experiments are sufficient, and the conclusion is convincing.

WEAKNESSES:
1. In this paper, the theoretical analysis (e.g., theorems) is missing. I think it is a suggested part, especially for a top machine learning conference like NeurIPS. More specifically, your proposed method still needs many iterations including calling functions to get hard labels. Even though empirical results shown in Figure 2, the reason about why the proposed method reduces the number of queries. A theriacal analysis about it is suggested. The analysis of computational complexity is also suggested especially the proposed method is described as practical. 
2. The fluency of sentences seems not to be considered. When we replace the words in the sentence, we should consider if the remaining sentence is still fluent. Correct me if I am wrong.

QUESTIONS:
1. Just curious. Did authors consider using ChatGPT to help you generate some similar sentences?

LIMITATIONS:
The authors provided the description of limitations such as potential negative societal impact of their work.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a black-box adversarial attack method that can create high-quality adversarial samples without accessing the predictive probability/gradients of the victim model. The approach is based on synonyms substitution. In the attack framework, this paper also proposes some tricks to reduce the query number and increase the semantic similarity. Experimental results demonstrate the effectiveness of the proposed attack, indicating further attention is needed to look into this adversarial problem.\n\nSTRENGTHS:\nThis paper looks into an important and interesting research problem. Black-box textual adversarial attack is a challenging problem due to the discrete nature of the text. This paper presents a concrete approach that can effectively address this problem, crafting high-quality adversarial samples with high semantic similarity and fewer query numbers.  Experimental results show that this approach is more effective than previous approaches, like LeapAttack.\n\nWEAKNESSES:\nPlease correct me if I have some misunderstanding of the paper. \n\n1. I don't see too much novelty in the proposed approach compared to previous work [1]. The basic intuitions are both first constructing a successful but low-quality adversarial sample, and then iteratively performing multiple rounds of substitution to improve the quality. If I understand correctly, only the reverse searching process is optimized in this paper. \n\n2. I have some problems with the practical issues of the proposed approach and experimental settings, as indicated in this paper [2]. First, why do attackers want to attack a new classification model, or the sentiment analysis model you adopt in the experiments? What is the motivation and what benefits can they get? Please justify the reasonability of the considered experimental settings. Second, why do the attackers want to craft some high-quality samples that retain high similarity compared to the original ones? The goal of attacking is to bypass the detection system and retain only the adversarial meaning. So what is the motivation of the attackers to spend a huge amount of time doing engineering to retain the meaning of the whole sentence to the maximum? \n\n3. For the evaluation, human annotation is important to verify the validity of adversarial samples, since many adversarial samples may be invalid due to the change in core semantics meaning, but they still retain high similarity computed by neural models.  \n\n4. In the experiments, only some old-school models are considered, such as BERT, WordCNN, LSTM. The results from these models don't have too much significance since none of them are frequently employed nowadays. The experiments should be conducted on some more advanced models, like T5, DeBERTa, and also may consider some other paradigms, like few-shot, and zero-shot inference via GPT. \n\n\n\n[1] Generating Natural Language Attacks in a Hard Label Black Box Setting. Rishabh Maheshwary, Saket Maheshwary, Vikram Pudi. AAAI\n[2] Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLP. Yangyi Chen, Hongcheng Gao, Ganqu Cui, Fanchao Qi, Longtao Huang, Zhiyuan Liu, Maosong Sun. EMNLP\n\nQUESTIONS:\nPlease see the second point in the Weakness section.\n\nLIMITATIONS:\nThis paper has a limitation section that effectively addresses the limitations of the proposed approach.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n- The authors consider a problem of black-box hard-label adversarial attack, which adversarially perturbs the input text while having access only to the output label of the victim model.\n- They propose HQA-Attack method which can successfully perturb the input text into the adversarial text with higher semantic similarity and lower perturbation rate compared to the baseline hard-label adversarial attack methods on text data under a tight query budget.\n- The process can be summarized into three components:\n1. Random initialization to find an adversarial example.\n2. Sequentially substitutes original words back as many as possible, beginning from the adversarial example found in step 1.\n3. Further optimization step to improve semantic similarity and perturbation rate. \n- The experimental results show the HQA-Attack's superiority in hard-label adversarial attacks.\n\nSTRENGTHS:\n- The authors conduct experiment on various datasets and victim models containing commercial classification system such as google cloud and alibaba cloud.\n- The second step of HQA-Attack, which greedily substitute original words back, is very simple and intuitive.\n\nWEAKNESSES:\n- The attack space is limited. HQA-Attack seems to construct a word substitution candidate set of a word without considering any knowledge from the sentence. \n- The justification of the third step seems poor. I think more theoretical or empirical evidence that supports the necessity of the third step should be added.\n\nQUESTIONS:\n- Soft-label adversarial attack methods such as TextFooler, BERT Attack, and BAE considers the word substitution set which depends on the whole sentence. In my understanding, HQA-Attack can be extended to more flexible attack spaces equipped with sentence-dependent word substitution sets. Can you provide some experimental results on this setting?\n- The third step of HQA-Attack is not intuitive to me. Can you provide the theoretical or empirical results that show the importance of the third step? For example, I want to see an ablation result with and without the third step.\n- In BBA, they first find the adversarial example with Bayesian Optimization and conduct a \"post-optimization\" process which further optimizes near the adversarial example to reduce the perturbation size based on trained Gaussian Process (GP). While this method is solving the soft-label adversarial attack problem, the idea of using GP to consider previous evaluation history seems still valid in the hard-label attack setting. Can you provide a comparison of HQA-Attack with a simple GP-based hard-label attack?\n\n[TextFooler] Is BERT Really Robust? Natural Language Attack on Text Classification and Entailment, Di Jin et al., AAAI 2020\n\n[BERT Attack] BERT-ATTACK: Adversarial Attack against BERT using BERT, Linyang Li et al., EMNLP 2020\n\n[BAE] BAE: BERT-based Adversarial Examples for Text Classification, Siddhant Garg et al., EMNLP 2020\n\n[BBA] Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimization, Deokjae Lee et al., ICML 2022\n\nLIMITATIONS:\nThe authors provide some broader impacts and limitations in Appendix F.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a new hard-label black-box attack on textual data that aims to improve the performance on semantic similarity and perturbation rate. The main novel techniques are word back-substitution and a new strategy for optimizing the adversarial example. Evaluations on 5 classification tasks, 3 inference tasks, and 2 online APIs show that the proposed attack obtains better quality than 3 previous attacks. Evaluations also include the attack's convergence, the performance on robust models, and several ablation studies.\n\nSTRENGTHS:\n### Originality\n\n* **Novel attack.** The attack techniques are overall novel to my knowledge. The proposed strategy to optimize quality is new.\n\n### Quality\n\n* **Solid methodology.** The overall attack design is solid, and the new optimizing strategy is well-developed.\n* **Comprehensive evaluations.** The experiments are comprehensive. I appreciate the several tasks and the inclusion of robust models and ablation studies.\n\n### Clarity\n\n* **Good presentation.** The paper is generally well-written and the methodology is largely easy to follow with some focus.\n\n### Significance\n\n* **Improved performance regarding quality.** It is good to see that the proposed optimization strategy can improve the adversarial example's quality in all settings. The convergence behavior is also better than previous attacks.\n\nWEAKNESSES:\n### Originality\n\n**Q1: Unclear novelty in the word back-substitution component.**\n\nI was a bit confused by the contribution in Section 4.2. From L149-153, it seems that previous attacks only compute the similarity gain once and hence determining the replacement order, so the initially computed order is inaccurate after the adversarial example has applied any replacement. However, isn't this the same case for Equation (3) and Algorithm 1, where the order is computed once (Algorithm 1, L2-7), and then the attack applies replacements one by one (Algorithm 1, L10-17)? Basically, it is unclear how the proposed method is different from previous attacks, and how it would be able to solve this problem.\n\nIf there is indeed a difference, what if previous attacks do recompute this order at each iteration? Would they have better performance, or is there an inherent challenge in their methodology? From the current presentation I could not see any challenge, as this computation is generally offline and does not need model queries. In other words, in this part of the question, it is hard to evaluate the novelty between \"naively recomputing the order\" and \"recomputing the order with the proposed strategy.\"\n\n### Quality\n\n**Q2: The qualitative results are somewhat insufficient.**\n\nWhile the quantitative results in Section 5 are good and promising, the current qualitative results are a bit insufficient for demonstrating the improved quality. Currently, only three sentences are provided in the supplementary, and it would be hard to tell if they have covered the general sense of improved quality. Since this paper's main claim is the improved quality of adversarial examples, it might be important to have more examples of the adversarial examples and, more importantly, the comparisons between different attacks. It is not intuitive to tell the difference between 5-10% of similarity or perturbation rate improvement. For example, would there be an observable quality improvement if the semantic similarity was improved by 10%? Note that I have no concerns with the chosen metrics, but the paper can be strengthened if more qualitative results are provided.\n\n**Q3: The choice of $k$.**\n\nAt L259, the number of synonyms sampled for direction estimation is set to $k=5$. I am curious if this value would be too small, given that there might be tens of synonyms. I also noticed that the results are constant regarding $k\\in\\{5, 10, 15\\}$ so $k=5$ seemed to be sufficient. Is there any explanation for why this is sufficient? In this case, it might be informative to add results for $k\\in[1, 4]$ where the number of samples is insufficient.\n\n### Clarity\n\n**Q4: Confusion in determining the optimizing order.**\n\nIt is not very straightforward why Section 4.3.1 determines that the most similar word pair get optimized first. In Equation (6), the word $w_i$ gets sampled with a higher probability if $d_i$ is small, meaning the cos similarity between (the embeddings of) $w_i$ and $w^\\prime_i$ is high. Can you clarify why it starts from similar words (rather than non-similar words), and replace such similar words with synonyms that again aim to improve semantic similarity?\n\n**Q5: Confusion in the final updating step.**\n\nIn L224-225, why the replacement word is chosen from $S(w_i)$, yet the similarity was compared pertaining $\\bar{w}_i$?\n\n**Minor Points:**\n*  Missing specification of the synonyms set. It is unclear how the synonyms were generated and how large it is (relevant to Q3).\n* The methodology description in Section 4.3.2 is a bit convolved.\n\n\n### Significance\n\n**Q7: Used the same random initialization as previous attacks.**\n\nWhile the improvement in quality is promising, and this paper legitimately focuses on improving the quality, the task's performance is not reduced more than other attacks because they share the same initialization (source of the adversary). I am not penalizing for this point, but this is one aspect that limits the significance of this paper (compared with attacks that might also improve the attack success rate).\n\nQUESTIONS:\nI am willing to raise my score if Q1-Q2 (major) and Q3-Q5 (intermediate) are sufficiently clarified.\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel and effective methods for black-box textual adversarial attacks. The proposed framework focuses on maximizing the similarity of the adversarial texts and the original texts through shrinking the perturbation. In the experiments, the authors prove that the proposed methods can significantly improve the quality of generated adversarial examples according to the metrics of text similarity and perturbation rate. The authors also conduct comprehensive ablation studies to show the effectiveness of different module in the proposed framework.\n\nSTRENGTHS:\n1. This paper accurately points out the limitations of the previous work on textual adversarial attacking, and it proposes a simple and effective methods to improve the quality of generated adversarial examples.\n2. The experiments are exhaustive and convincing. The selection of evaluation benchmarks is comprehensive, and it also evaluate on real-world APIs, which further illustrate the practicability of the proposed methods. According to the results, the proposed methods can significantly improve the quality of adversarial examples. In addition, the ablation study also interprets the effectiveness of different module of the attacking framework.\n\nWEAKNESSES:\n1. It lacks human evaluation to evaluate the quality of the generated adversarial examples. The human evaluation is claimed critical in previous textual adversarial works, since some slight perturbations that changes the semantic of the original texts may not be reflected through automatic evaluation such as text similarity and perturbation rate. (The authors have added the human evaluation experiments.)\n2. It would be helpful for us to better understand the mechanism of adversarial attacks if the authors can add some analysis of why the adversarial examples can successfully full the models / what triggers the wrong predction / whether different victim models make different mistakes or same mistakes.\n\nQUESTIONS:\n1. The authors should add human evaluation experiments about the quality of generated adversarial examples.\n\nLIMITATIONS:\nThe authors should address the limitation of the proposed framework in the conclusion section.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}