# A Survey of Adversarial Attacks: An Open Issue for Deep Learning Sentiment Analysis Models
## 3 Adversarial Attacks on Sentiment Analysis
### White Box Adversarial Attacks
The greedy approach forms adversarial examples by replacing the original word \(w\) with each candidate \(w^{\prime}\) among the \(k\) neighbors and determining whether the sigmoid value of the adversary \(x^{\prime}\) is less than the value \(\sigma\), which indicates whether replacing \(w\) with \(w^{\prime}\) can contribute to change the prediction result. In addition, a more sophisticated approach called _Global Search_ was proposed, in which simple modifications are performed by adding spelling error noise. _Global Search_ by computes small perturbations \(\delta\) to the original word embeddings. To learn the perturbations \(\delta\), an objective function \(J(\delta)\) is defined to maximize the difference between the sigmoid values of the original input \(x\) and the perturbed input \(x+\delta\): \[ \begin{array}{c}J(\delta)=(f_{sigmoid}(E_{x})-f_{sigmoid}(E_{x}+\delta)^{ 2}\\ +\lambda_{1}\cdot||\delta||_{2}\\ +\lambda_{2}\cdot||(E_{x}-(E_{x}+\delta))||_{2}\end{array} \] (5) where \(\lambda_{1}\) penalizes large perturbations and \(\lambda_{2}\) penalizes large distances between the original and perturbed word embeddings. The two regularization terms are added to help maintain the semantics of the chosen words. The perturbed embedding \(E_{x}^{\prime}=Ex+\delta\) usually does not have an actual word that it can be mapped back to; thus, the attack algorithm finds the candidate words \(w\) in the embedding space that are the closest to the perturbed word embedding. After computing the perturbed embedding and recording the candidate words, the algorithm checks whether the current perturbed embedding changes the prediction result. The algorithm continues to compute new samples \(E^{\prime}\) until it fools the model. Both attacks were evaluated on a CNN using the IMDB movie reviews dataset. * [PERSON] et al. (2019) used a population-based optimization algorithm to generate semantically and syntactically similar adversarial examples that fool sentiment analysis and textual entailment models. The proposed attack algorithm exploits population-based gradient-free optimization via genetic algorithms. Given an input sentence \(x\), the algorithm randomly selects a word \(w\) in \(x\) and then selects a suitable replacement word that has similar semantic meaning, fits within the surrounding context, and increases the target label prediction score. To select the replacement word, for each \(w\) in \(x\), the nearest \(N\) neighbors in the space of _embeddings_ are determined by computing the Euclidean distance and selecting words greater than \(\delta\) that are synonyms of the term to be replaced. Then, using the _Google one billion words language model_, the identified synonyms that are less frequent in the context of the text are discarded, keeping only the top \(K\) words. Finally, from the \(K\) remaining terms, those that contributes most to the classification when substituting the original term are selected. The attack algorithm was evaluated on an LSTM architecture and a textual entailment model trained on the Stanford Natural Language Inference (SNLI) corpus using the IMDB movie reviews dataset.