# A Hybrid Adversarial Attack for Different Application Scenarios +
## 3 Methods
### White-Box Attack on Text  
The white-box attack algorithm is described in Algorithm 2. The algorithm is divided into two parts including generating candidate words and modifying the candidate words which have the most influence on the classifier. We use the whole text as the research object. \(X\) represents word embedding of the original input text. \(y\)_and_\(\widehat{y}\) represent the original and adversarial label. For a text of \(n\) words, \(X=\{w_{1},w_{2},...,w_{n}\}\), and a valid adversarial example \(X_{adv}\) should conform to the following requirements:  
\[\widehat{y}\
eq y,\text{ }\text{and }\text{Sim}(w_{i},w_{i}^{{}^{\prime}}) \leq\text{ }\text{threshold} \tag{4}\]  
where Sim is the distance between \(w_{i}\) and \(w_{i}^{{}^{\prime}}\) in the word space. It should be less than a threshold. In the first loop, we obtain a perturbed embedding \(X^{{}^{\prime}}\) by the gradient-based method, and then traverse every word in \(X^{{}^{\prime}}\), in order to find the word with the closest Euclidean distance or cosine distance in word space \(E\), and then generate a list of candidate words. In this candidate words list, every word in the original text has been modified. The subsequent second loop will choose to modify these words successively according to priority. We attack the classifier with this list. If the label is not the same as the original input, the loop ends. Otherwise, the algorithm continues to calculate the gradient to get a new \(X^{{}^{\prime}}\). After obtaining a list of valid candidate words, we will make a modification order selection. ```
1:Input: Original text \(X=\{w_{1},w_{2},...,w_{n}\}\), target model \(f\), perturbation \(\delta\)
2:Adversarial text \(X_{adv}\)
3:\(y\gets f(X)\)
4:Initialization :\(X_{adv}\gets X\), \(\delta\gets 0,\text{success}=False\),candidates \(\leftarrow\varnothing\), finCandidates \(\leftarrow\varnothing\)
5:Filter out the stop words in \(X\). 6:whilenot successdo
7:\(X^{\prime}\gets X+\delta\) back propagation
8:for\(w_{i}\) in \(X^{\prime}\)do
9:candidates \(\leftarrow\) extracting the top N synonyms using Euclidean and Cosine distance for \(w_{i}\). 10:candidates \(\leftarrow\) POScheck(candidates)
11:for\(k_{i}\) in candidatesdo
12:\(X^{\prime}\leftarrow\) Replace \(w_{i}\) with \(k_{i}\) in \(X_{adv}\)
13:\(P_{i}\gets f(X^{\prime})\)
14:\(w^{*}\gets argmax(P_{i})\)
15:\(finCandidates\gets finCandidates\) append \(w^{*}\)
16:\(\hat{y}\gets f(\text{finCandidates})\)
17:if\(\hat{y}\
eq y\)then break
18:\(grad\leftarrow||\delta||_{2}\)
19:\(selected\gets 0,list\leftarrow\varnothing,\Omega\leftarrow\varnothing\)
20:whilenot successdo
21:\(selectedX=selected.index(0)\)
22:for\(x\) in \(total(grad)\) and \(selected[x]\
eq 1\)do
23:\(CV_{1}=CV(list\) append \(x)\), \(CV_{2}=CV(list\) append \(selectedX)\)
24:if\(grad[x]+\lambda\cdot CV_{1}>grad[selectedX]+\lambda\cdot CV_{2}\)then
25:\(selectedX\gets x\)
26:\(\Omega\leftarrow\Omega\) append \(x\)
27:\(selected[selectedX]=1,list\leftarrow list\) append \(selectedX\)
28:for\(w_{i}\) in \(\Omega\)do
29:if\(distance<threshold\) and \(\frac{i}{len(x)}<r\)then\(X_{adv}\leftarrow\) Replace \(w_{i}\)
30:if\(\hat{y}\
eq y\)then
31:\(success=True\)
32:return\(X_{adv}\)
33:else
34:return None
```  
**Algorithm 2**White-box Attack on Text  
In the second loop, first, we will take the gradient of the first loop. We set a full 0 tensor with the same dimensions as the original text, with _selected_ for recording the position of the selected word, _list_ for the sequence of selected words, and _positions_ for the last modified order. Then, start the loop selection.